alex92 Posted May 20, 2015 ID:964051 Share Posted May 20, 2015 the moment my scan gets to the rootkit part it just stops after like 4-5 seconds Link to post Share on other sites More sharing options...
kevinf80 Posted May 20, 2015 ID:964058 Share Posted May 20, 2015 Hello and welcome to Malwarebytes.org P2P/Piracy Warning: If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here. Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy. Next, Change the download folder setting in the default Browser so all tools we may use are saved to the Desktop: Google Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser. Choose Settings. at the bottom of the screen click the"Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK. Mozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser. Choose Options. In the downloads section, click the Browse button, click on the Desktop folder and the click the "Select Folder" button. Click OK to get out of the Options menu. Internet Explorer - Click the Tools menu in the upper right-corner of the browser. Select View downloads. Select the Options link in the lower left of the window. Click Browse and select the Desktop and then choose the Select Folder button. Click OK to get out of the download options screen and then click Close to get out of the View Downloads screen.NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop. Next, Follow the instructions in the following link to show hidden files: http://www.bleepingcomputer.com/tutorials/how-to-see-hidden-files-in-windows/ Next, Please open Malwarebytes Anti-Malware. On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits". Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button. A Threat Scan will begin. With some infections, you may or may not see this message box. 'Could not load DDA driver' Click 'Yes' to this message, to allow the driver to load after a restart. Allow the computer to restart. Continue with the rest of these instructions. When the scan is complete, click Apply Actions. Wait for the prompt to restart the computer to appear, then click on Yes. After the restart once you are back at your desktop, open MBAM once more. To get the log from Malwarebytes do the following: Click on the History tab > Application Logs. Double click on the scan log which shows the Date and time of the scan just performed. Click Export > From export you have three options: Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply Recommend you use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply… If Malwarebytes is not installed follow these instructions first: Download Malwarebytes Anti-Malware to your desktop.Double-click mbam-setup and follow the prompts to install the program.At the end, be sure a checkmark is placed next to the following: Launch Malwarebytes Anti-MalwareA 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.Click Finish. Follow the instructions above.... Next, Download Farbar Recovery Scan Tool and save it to your desktop. Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. If your security alerts to FRST either accept the alert or disable your security and allow FRST to run... Double-click to run it. When the tool opens click Yes to disclaimer.Press Scan button.It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply. Let me see those logs in your reply.... Thank you, Kevin.... Link to post Share on other sites More sharing options...
alex92 Posted May 20, 2015 Author ID:964073 Share Posted May 20, 2015 Malwarebytes Anti-Malwarewww.malwarebytes.orgUpdate, 5/20/2015 5:40:19 PM, SYSTEM, NEMESIS, Manual, Rootkit Database, 0.0.0.0, 2015.5.16.1,Update, 5/20/2015 5:40:19 PM, SYSTEM, NEMESIS, Manual, Remediation Database, 0.0.0.0, 2015.5.13.1,Update, 5/20/2015 5:40:25 PM, SYSTEM, NEMESIS, Manual, Malware Database, 0.0.0.0, 2015.5.20.5,Protection, 5/20/2015 5:40:25 PM, SYSTEM, NEMESIS, Protection, Refresh, Starting,(end) and the farbar scan Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-05-2015Ran by cam at 2015-05-20 17:43:45Running from e:\Users\cam\DesktopBoot Mode: Normal============================================================================== Accounts: =============================Administrator (S-1-5-21-40843148-1728485514-400720728-500 - Administrator - Disabled)cam (S-1-5-21-40843148-1728485514-400720728-1000 - Administrator - Enabled) => C:\Users\camGuest (S-1-5-21-40843148-1728485514-400720728-501 - Limited - Disabled)HomeGroupUser$ (S-1-5-21-40843148-1728485514-400720728-1002 - Limited - Enabled)==================== Security Center ========================(If an entry is included in the fixlist, it will be removed.)AV: McAfee VirusScan Enterprise (Enabled - Up to date) {ADA629C7-7F48-5689-624A-3B76997E0892}AS: McAfee VirusScan Enterprise Antispyware Module (Enabled - Up to date) {16C7C823-5972-5907-58FA-0004E2F9422F}AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}==================== Installed Programs ======================(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version: - Hidden Path Entertainment, Ensemble Studios)Block N Load (HKLM-x32\...\Steam App 299360) (Version: - Jagex)Chivalry: Medieval Warfare (HKLM-x32\...\Steam App 219640) (Version: - Torn Banner Studios)Classic Shell (HKLM\...\{840C85B7-D3D6-4143-9AF9-DAE80FD54CFC}) (Version: 4.1.0 - IvoSoft)Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve)D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) HiddenDayZ (HKLM-x32\...\Steam App 221100) (Version: - Bohemia Interactive)Deus Ex: Human Revolution (HKLM-x32\...\Steam App 28050) (Version: - Eidos Montreal)Dota 2 (HKLM-x32\...\Steam App 570) (Version: - Valve)Fallout: New Vegas (HKLM-x32\...\Steam App 22380) (Version: - Obsidian Entertainment)Heroes of Newerth (HKLM-x32\...\hon) (Version: 2.3.0 - S2 Games)HyperCam 2 (HKLM-x32\...\HyperCam 2) (Version: - )Java 8 Update 40 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation)League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games)League of Legends (x32 Version: 3.0.1 - Riot Games) HiddenLG Burning Tool (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.2.6009 - CyberLink Corp.)LG Burning Tool (x32 Version: 6.2.6009 - CyberLink Corp.) HiddenLG CyberLink BD Advisor (HKLM-x32\...\{2D2D8FE2-605C-4D3C-B706-36E981E7EEF0}) (Version: 2.0.4606 - CyberLink Corp.)LG CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.3624 - CyberLink Corp.)LG CyberLink LabelPrint (x32 Version: 2.5.3624 - CyberLink Corp.) HiddenLG CyberLink Media Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 8.0.2820 - CyberLink Corp.)LG CyberLink Media Suite (x32 Version: 8.0.2820 - CyberLink Corp.) HiddenLG CyberLink MediaEspresso (HKLM-x32\...\InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}) (Version: 6.5.1622_37397b - CyberLink Corp.)LG CyberLink MediaEspresso (x32 Version: 6.5.1622_37397b - CyberLink Corp.) HiddenLG CyberLink MediaShow (HKLM-x32\...\InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}) (Version: 4.1.3402 - CyberLink Corp.)LG CyberLink MediaShow (x32 Version: 4.1.3402 - CyberLink Corp.) HiddenLG CyberLink PowerDVD (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.3424.52 - CyberLink Corp.)LG CyberLink PowerDVD (x32 Version: 10.0.3424.52 - CyberLink Corp.) HiddenLG CyberLink PowerProducer (HKLM-x32\...\InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 5.0.2.2820a - CyberLink Corp.)LG CyberLink PowerProducer (x32 Version: 5.0.2.2820a - CyberLink Corp.) HiddenLG CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 2.0.3718 - CyberLink Corp.)LG CyberLink YouCam (x32 Version: 2.0.3718 - CyberLink Corp.) HiddenLG Tool Kit (HKLM-x32\...\{6179550A-3E7C-499E-BCC9-9E8113E0A285}) (Version: 10.01.0712.01 - )LightScribe System Software (HKLM-x32\...\{E0E55FC1-C53D-4F8D-B14B-B59C312747C8}) (Version: 1.18.22.2 - LightScribe)Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)McAfee Agent (HKLM-x32\...\{D107EA80-023A-443C-AA79-1C4B0CB2E227}) (Version: 4.6.0.2988 - McAfee, Inc.)McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)McAfee VirusScan Enterprise (HKLM-x32\...\{CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF}) (Version: 8.8.02004 - McAfee, Inc.)Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{929CE49F-1CA7-4CF3-A9A1-6D757443C63F}) (Version: 1.2.0241 - Microsoft Corporation)Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) HiddenMozilla Firefox 38.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 en-US)) (Version: 38.0.1 - Mozilla)Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)MyFreeCodec (HKU\S-1-5-21-40843148-1728485514-400720728-1000\...\MyFreeCodec) (Version: - )MyFreeCodec (HKU\S-1-5-21-40843148-1728485514-400720728-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MyFreeCodec) (Version: - )NightSky (HKLM-x32\...\Steam App 99700) (Version: - Nicalis)NVIDIA 3D Vision Controller Driver 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation)NVIDIA 3D Vision Driver 341.44 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 341.44 - NVIDIA Corporation)NVIDIA GeForce Experience 2.4.1.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.4.1.21 - NVIDIA Corporation)NVIDIA Graphics Driver 341.44 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 341.44 - NVIDIA Corporation)NVIDIA PhysX System Software 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)PerfectDisk 12.5 Professional (HKLM\...\{FD310764-B3E5-430F-980E-D6C0016B2660}) (Version: 12.05.312 - Raxco Software Inc.)Reign Of Kings (HKLM-x32\...\Steam App 344760) (Version: - Code}{atch)Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.0.13064_2 - Samsung Electronics Co., Ltd.)Samsung Kies (x32 Version: 2.6.0.13064_2 - Samsung Electronics Co., Ltd.) HiddenSamsung Story Album Viewer (HKLM-x32\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.)Samsung Story Album Viewer (x32 Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) HiddenSAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.45.0 - SAMSUNG Electronics Co., Ltd.)Shadowrun Returns (HKLM-x32\...\Steam App 234650) (Version: - Harebrained Schemes)SHIELD Streaming (Version: 4.1.1000 - NVIDIA Corporation) HiddenSHIELD Wireless Controller Driver (Version: 2.4.1.21 - NVIDIA Corporation) HiddenSteam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.11 - TeamSpeak Systems GmbH)VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)Wasteland 2 (HKLM-x32\...\Steam App 240760) (Version: - inXile Entertainment)Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)==================== Custom CLSID (selected items): ==========================(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)==================== Restore Points =========================17-05-2015 03:00:17 Windows Update18-05-2015 03:00:16 Windows Update19-05-2015 03:00:16 Windows Update20-05-2015 03:00:17 Windows Update==================== Hosts content: ==========================(If needed Hosts: directive could be included in the fixlist to reset Hosts.)2009-07-13 22:34 - 2009-06-10 17:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts==================== Scheduled Tasks (Whitelisted) =============(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)Task: {0215FA74-B8AB-4DAC-9A7E-2AAAF9A6543E} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)Task: {4097E67B-7F03-4D29-98B1-8CBEFA9D7D2E} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)Task: {65193E7B-65CA-4B95-80FC-EEF0C0B095EB} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)Task: {7A92EF4E-2BDC-4F70-8A6D-E69170DD8C1F} - System32\Tasks\{17452C46-1826-4C62-984A-20F4E0903B47} => Firefox.exe http://ui.skype.com/ui/0/6.13.0.104/en/abandoninstall?source=lightinstaller&page=tsBingTask: {8FB06518-89DE-4D4F-9129-3113F23937C3} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-24] (Microsoft Corporation)Task: {A49F4FEF-282F-4CDD-AFAF-144C55F5F324} - System32\Tasks\{B0B81569-265B-494D-9FA7-D7808A7FE984} => Firefox.exe http://ui.skype.com/ui/0/6.21.0.104/en/abandoninstall?source=lightinstaller&page=tsMainTask: {A8E49419-D80F-4613-8601-B7931632A349} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-14] (Adobe Systems Incorporated)Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe==================== Loaded Modules (Whitelisted) ==============2013-08-13 10:53 - 2009-07-02 10:02 - 00244904 ____N () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe2013-08-11 14:34 - 2015-02-03 22:21 - 00115400 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll2007-04-18 20:30 - 2007-04-18 20:30 - 00393216 _____ () C:\Program Files (x86)\McAfee\Common Framework\cryptocme2.dll2007-04-18 20:30 - 2007-04-18 20:30 - 00471040 _____ () C:\Program Files (x86)\McAfee\Common Framework\ccme_base.dll2012-08-14 20:08 - 2012-08-14 20:08 - 00150328 _____ () C:\Program Files (x86)\McAfee\VirusScan Enterprise\WscAv.dll2015-04-16 18:56 - 2015-03-27 23:45 - 00011920 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll2011-03-04 12:02 - 2011-03-04 12:02 - 02121728 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll2011-03-04 12:02 - 2011-03-04 12:02 - 07745536 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll2011-03-04 12:02 - 2011-03-04 12:02 - 00135168 _____ () C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll2009-12-15 13:46 - 2009-12-15 13:46 - 00619816 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll2009-12-15 13:49 - 2009-12-15 13:49 - 00013096 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll2015-03-31 10:09 - 2015-03-31 10:09 - 00019368 _____ () C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2native.dll2015-04-14 18:45 - 2015-04-14 18:45 - 16863920 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll2013-08-21 14:18 - 2015-04-16 13:40 - 00776192 _____ () C:\Program Files (x86)\Steam\SDL2.dll2015-01-19 19:33 - 2015-04-22 22:16 - 04962816 _____ () C:\Program Files (x86)\Steam\v8.dll2015-01-19 19:33 - 2015-04-22 22:16 - 01556992 _____ () C:\Program Files (x86)\Steam\icui18n.dll2015-01-19 19:33 - 2015-04-22 22:16 - 01187840 _____ () C:\Program Files (x86)\Steam\icuuc.dll2014-05-23 16:52 - 2015-05-14 21:58 - 02396352 _____ () C:\Program Files (x86)\Steam\video.dll2014-08-28 15:56 - 2014-12-01 17:31 - 02396672 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll2014-08-28 15:56 - 2014-12-01 17:31 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll2014-08-28 15:56 - 2014-12-01 17:31 - 00479744 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll2014-08-28 15:56 - 2014-12-01 17:31 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll2014-08-28 15:56 - 2014-12-01 17:31 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll2013-10-04 16:54 - 2015-05-14 21:57 - 00703168 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL2013-09-10 14:20 - 2015-05-11 15:01 - 36302728 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll2015-05-14 19:19 - 2015-05-11 15:01 - 08958344 _____ () C:\Program Files (x86)\Steam\bin\pdf.dll==================== Safe Mode (Whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"==================== EXE Association (Whitelisted) ===============(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)==================== Internet Explorer trusted/restricted ===============(If an entry is included in the fixlist, the associated entry will be removed from the registry.)IE trusted site: HKU\.DEFAULT\...\clonewarsadventures.com -> clonewarsadventures.comIE trusted site: HKU\.DEFAULT\...\freerealms.com -> freerealms.comIE trusted site: HKU\.DEFAULT\...\soe.com -> soe.comIE trusted site: HKU\.DEFAULT\...\sony.com -> sony.com==================== Other Areas ============================(Currently there is no automatic fix for this section.)HKU\S-1-5-21-40843148-1728485514-400720728-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\cam\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpgHKU\S-1-5-21-40843148-1728485514-400720728-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\Users\cam\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpgDNS Servers: 192.168.1.254==================== MSCONFIG/TASK MANAGER disabled items ==(Currently there is no automatic fix for this section.)==================== FirewallRules (Whitelisted) ===============(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)FirewallRules: [{42281A2A-ACA1-4E5D-857C-08CE8AF6D399}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeFirewallRules: [{3675EA0C-F54B-473B-B9BA-E78F8074F303}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeFirewallRules: [{67C167E3-DE2E-41DE-BA2F-9951A15F80E9}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exeFirewallRules: [{6BDA2C59-46D3-465F-8510-4F3FA00D6F67}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exeFirewallRules: [{A54D1D51-2CE2-45F7-9E92-2475F8BCD610}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exeFirewallRules: [{7D5C6E65-3A8D-4681-AD86-414C417A3DAE}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXEFirewallRules: [{C559176A-19E3-4ACC-8F8A-3210764094B5}] => (Allow) C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exeFirewallRules: [{7B59880F-082F-4A19-B6C1-3E5FF6C73D2A}] => (Allow) C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exeFirewallRules: [{45CB1BCE-CEB0-41A5-9090-DE997EBD39A8}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1675\Agent.exeFirewallRules: [{392EC4C4-AEC5-4426-8E87-7FD424C5BB57}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1675\Agent.exeFirewallRules: [{CB652311-E94A-49CA-8FF7-A441FECFA5AF}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2045\Agent.exeFirewallRules: [{C5538A1E-67B8-47E4-B090-98379C4AD81C}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2045\Agent.exeFirewallRules: [{23B2F665-4FC0-4DBF-9AE2-23953C3AA962}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II.exeFirewallRules: [{E9E12A6F-5FD0-4950-86DD-40E49497F31B}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II.exeFirewallRules: [{910E17B2-5D40-488C-82D1-5227B6A59DDE}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II Public Test.exeFirewallRules: [{5D618311-22C3-458D-B520-886CB6A82183}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II Public Test.exeFirewallRules: [TCP Query User{7E23C86D-0EA4-4480-B262-F8D0C7BE45AB}D:\hon\hon.exe] => (Block) D:\hon\hon.exeFirewallRules: [uDP Query User{72CAB8DE-4499-4920-BB49-24DB931D24A8}D:\hon\hon.exe] => (Block) D:\hon\hon.exeFirewallRules: [{7B35F4C6-DA94-49EB-A342-CC84E80F93E1}] => (Allow) C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exeFirewallRules: [{0B9A4250-4903-4917-B0CF-DA3CF3B9DD50}] => (Allow) C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exeFirewallRules: [{4FE9A6CE-A7C7-4FE9-B622-1C3E4B051685}] => (Allow) C:\Program Files (x86)\Steam\Steam.exeFirewallRules: [{8AB335DB-08D3-47E6-A8E9-C6C85E6AE1B6}] => (Allow) C:\Program Files (x86)\Steam\Steam.exeFirewallRules: [TCP Query User{3F874B01-5E68-470D-B1EC-FE96B232E9E0}C:\program files (x86)\infinitecrisis\infinitecrisis.exe] => (Allow) C:\program files (x86)\infinitecrisis\infinitecrisis.exeFirewallRules: [uDP Query User{BF742C9C-905A-4895-AB8C-481D05C254E3}C:\program files (x86)\infinitecrisis\infinitecrisis.exe] => (Allow) C:\program files (x86)\infinitecrisis\infinitecrisis.exeFirewallRules: [TCP Query User{18647631-4404-4591-A4EE-6D1FE230EE7D}C:\program files (x86)\steam\steamapps\common\magickawizardwars\bitsquid_win32_dev.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\magickawizardwars\bitsquid_win32_dev.exeFirewallRules: [uDP Query User{FA03CD52-28D7-4A8F-8BE2-193BF1EBBE05}C:\program files (x86)\steam\steamapps\common\magickawizardwars\bitsquid_win32_dev.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\magickawizardwars\bitsquid_win32_dev.exeFirewallRules: [TCP Query User{52923272-5B7A-42DA-B08A-B94BF80B8011}C:\program files (x86)\steam\steam.exe] => (Allow) C:\program files (x86)\steam\steam.exeFirewallRules: [uDP Query User{8A9E20E6-9EFC-463F-A81D-741CD321E61E}C:\program files (x86)\steam\steam.exe] => (Allow) C:\program files (x86)\steam\steam.exeFirewallRules: [TCP Query User{2FD5D4BC-6B37-4461-94B4-05BEC795AD63}C:\voobly\voobly.exe] => (Allow) C:\voobly\voobly.exeFirewallRules: [uDP Query User{FDC25C5B-8BAE-4524-ABE6-84364F8505D1}C:\voobly\voobly.exe] => (Allow) C:\voobly\voobly.exeFirewallRules: [{20ABB6D1-DCEC-4181-BA92-E8296604F323}] => (Block) C:\voobly\voobly.exeFirewallRules: [{22C8307A-E879-4714-8B40-509D146FB6AF}] => (Block) C:\voobly\voobly.exeFirewallRules: [TCP Query User{C9B8B813-BC9C-40EB-98B0-B8918BE08CB0}D:\aoe2\age2_x1\age2_x1.exe] => (Allow) D:\aoe2\age2_x1\age2_x1.exeFirewallRules: [uDP Query User{C526585D-AFE7-4B0E-B9A0-F850B814E3AD}D:\aoe2\age2_x1\age2_x1.exe] => (Allow) D:\aoe2\age2_x1\age2_x1.exeFirewallRules: [TCP Query User{154E71A8-D1C0-4F2F-BB8B-958A6F2548CC}C:\windows\syswow64\dplaysvr.exe] => (Allow) C:\windows\syswow64\dplaysvr.exeFirewallRules: [uDP Query User{53AB8B4F-E070-45F9-BD51-04E74D18E24D}C:\windows\syswow64\dplaysvr.exe] => (Allow) C:\windows\syswow64\dplaysvr.exeFirewallRules: [TCP Query User{DA6C547C-7F84-43CE-8B3E-3122D6CEEFDE}C:\program files (x86)\steam\steamapps\common\chivalrymedievalwarfare\binaries\win32\udk.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\chivalrymedievalwarfare\binaries\win32\udk.exeFirewallRules: [uDP Query User{F5035B77-5802-42B7-BA28-751B11A0011C}C:\program files (x86)\steam\steamapps\common\chivalrymedievalwarfare\binaries\win32\udk.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\chivalrymedievalwarfare\binaries\win32\udk.exeFirewallRules: [{DFD188D2-DF65-428C-9C48-9F443E806965}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2045\Agent.exeFirewallRules: [{C034A180-33BA-4935-A405-39DAC80A511F}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2045\Agent.exeFirewallRules: [{A909E7E4-3A13-4AA4-A7B4-ABB040BD8911}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exeFirewallRules: [{8B0DC3A1-9DA1-4383-B96C-2F11274C6038}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exeFirewallRules: [TCP Query User{22B4E3C0-2986-4854-975A-489A0223AE2A}C:\program files (x86)\java\jre7\bin\java.exe] => (Allow) C:\program files (x86)\java\jre7\bin\java.exeFirewallRules: [uDP Query User{817C166E-5F99-4F69-A8B8-35FCFD447A9F}C:\program files (x86)\java\jre7\bin\java.exe] => (Allow) C:\program files (x86)\java\jre7\bin\java.exeFirewallRules: [TCP Query User{0A10C038-E4E9-4B49-A09D-CE1809289CBC}C:\program files (x86)\steam\steamapps\common\planetside 2\planetside2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\planetside 2\planetside2.exeFirewallRules: [uDP Query User{E4914C94-098D-4936-A2ED-05376E2AC584}C:\program files (x86)\steam\steamapps\common\planetside 2\planetside2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\planetside 2\planetside2.exeFirewallRules: [{AF5BE73F-2D9A-4E72-AE0E-796820FB721C}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exeFirewallRules: [{485298D6-FFDA-44E6-A569-A9C4FBB866C9}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exeFirewallRules: [{26F6F430-5562-4BC9-81A5-224BD83BFE32}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exeFirewallRules: [{8D0FF2E6-3CDC-46A9-A0BC-77D3D9270795}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exeFirewallRules: [{A924D711-B204-4FEE-B1E7-6312813C2229}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exeFirewallRules: [{C930FBB6-CDEB-4A9B-82EE-5EC43833CB78}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exeFirewallRules: [TCP Query User{65F29E11-FE88-4C82-A796-3EEDBF3C9D56}E:\ts server\teamspeak3-server_win32-3.0.10.3\teamspeak3-server_win32\ts3server_win32.exe] => (Allow) E:\ts server\teamspeak3-server_win32-3.0.10.3\teamspeak3-server_win32\ts3server_win32.exeFirewallRules: [uDP Query User{D9A50048-416E-4735-8E97-4B980E9EB936}E:\ts server\teamspeak3-server_win32-3.0.10.3\teamspeak3-server_win32\ts3server_win32.exe] => (Allow) E:\ts server\teamspeak3-server_win32-3.0.10.3\teamspeak3-server_win32\ts3server_win32.exeFirewallRules: [TCP Query User{F26EAEEC-0DDB-4BE2-8CF4-26573421C1E6}E:\ts server\teamspeak3-server_win32-3.0.10.3\teamspeak3-server_win32\tsdns\tsdnsserver_win32.exe] => (Allow) E:\ts server\teamspeak3-server_win32-3.0.10.3\teamspeak3-server_win32\tsdns\tsdnsserver_win32.exeFirewallRules: [uDP Query User{7F6758C2-9EF0-4359-A5F0-B814302B8FF4}E:\ts server\teamspeak3-server_win32-3.0.10.3\teamspeak3-server_win32\tsdns\tsdnsserver_win32.exe] => (Allow) E:\ts server\teamspeak3-server_win32-3.0.10.3\teamspeak3-server_win32\tsdns\tsdnsserver_win32.exeFirewallRules: [TCP Query User{7839C09C-4040-4A89-A8F3-95345D0C55EB}C:\program files (x86)\steam\steamapps\common\planetside 2\planetside2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\planetside 2\planetside2.exeFirewallRules: [uDP Query User{579A6936-D1CF-4C81-B5C3-E3F40D260E3C}C:\program files (x86)\steam\steamapps\common\planetside 2\planetside2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\planetside 2\planetside2.exeFirewallRules: [TCP Query User{C687611A-5FBF-4C9A-AC3D-C90028E3A129}C:\program files (x86)\steam\steamapps\common\planetside 2\planetside2_x64.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\planetside 2\planetside2_x64.exeFirewallRules: [uDP Query User{5790B521-6D18-4AF9-8F4F-CA6731E6C38E}C:\program files (x86)\steam\steamapps\common\planetside 2\planetside2_x64.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\planetside 2\planetside2_x64.exeFirewallRules: [{6F6EF4C8-B10E-40D6-8F79-BE2F65B93343}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exeFirewallRules: [{6575F8CF-0898-4E29-B516-1CD27485BBB2}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exeFirewallRules: [TCP Query User{908B2929-9C6B-4899-96D7-40CD7CD0BD0A}C:\users\public\sony online entertainment\installed games\planetside 2\planetside2_x64.exe] => (Allow) C:\users\public\sony online entertainment\installed games\planetside 2\planetside2_x64.exeFirewallRules: [uDP Query User{D18E0C59-7297-4895-A523-400EEFDEF9E8}C:\users\public\sony online entertainment\installed games\planetside 2\planetside2_x64.exe] => (Allow) C:\users\public\sony online entertainment\installed games\planetside 2\planetside2_x64.exeFirewallRules: [{38368967-15BA-4B7C-9241-085D232EECB9}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3147\Agent.exeFirewallRules: [{CB82FBAE-570D-4E7C-9A0B-BCD711B368EE}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3147\Agent.exeFirewallRules: [{66B00008-FF96-46E7-8948-8D64F7603251}] => (Allow) C:\Program Files (x86)\StarCraft II\Versions\Base28667\SC2.exeFirewallRules: [{0FBB2F2B-9284-4CA8-86CE-4F5219211AB2}] => (Allow) C:\Program Files (x86)\StarCraft II\Versions\Base28667\SC2.exeFirewallRules: [{BCDEE3F1-2B50-4ECF-A57B-D63667191E39}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exeFirewallRules: [{297715E8-0495-493F-A1F6-E88F554A836E}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exeFirewallRules: [{5DF4D32A-6363-436D-AD99-FD8E2A2474F5}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Firefall\system\bin\FirefallClient.exeFirewallRules: [{21DD1EEC-C285-4A52-8324-162D2BB6D7A0}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Firefall\system\bin\FirefallClient.exeFirewallRules: [TCP Query User{6CB41197-FB78-477E-A649-BF7549E94DA6}C:\users\cam\appdata\roaming\gameranger\gameranger\gameranger.exe] => (Allow) C:\users\cam\appdata\roaming\gameranger\gameranger\gameranger.exeFirewallRules: [uDP Query User{DE185AC6-F0E1-4A8E-90EE-B76CB2FCF959}C:\users\cam\appdata\roaming\gameranger\gameranger\gameranger.exe] => (Allow) C:\users\cam\appdata\roaming\gameranger\gameranger\gameranger.exeFirewallRules: [TCP Query User{E0B81E1C-D939-4D2B-B0B0-A573720B7561}E:\aoe2\age2_x1\age2_x1.icd] => (Allow) E:\aoe2\age2_x1\age2_x1.icdFirewallRules: [uDP Query User{B0F00B36-F048-4D1A-8BDD-90FAA6F70CC4}E:\aoe2\age2_x1\age2_x1.icd] => (Allow) E:\aoe2\age2_x1\age2_x1.icdFirewallRules: [{6918946D-E100-4D0A-B77F-1A0B85E84DC8}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Fallout New Vegas\FalloutNVLauncher.exeFirewallRules: [{016EFEF2-3E3E-41CF-ACCF-8EF3050EC7EF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Fallout New Vegas\FalloutNVLauncher.exeFirewallRules: [{DB867E00-B980-45CF-88EE-C7703589305B}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exeFirewallRules: [{88455E32-95D8-48F0-B6B6-0DBD61264044}] => (Allow) D:\steam folder 2\SteamApps\common\Wasteland 2\Build\WL2.exeFirewallRules: [{B8DD6D44-72C7-4A75-A6D8-85930326AF7C}] => (Allow) D:\steam folder 2\SteamApps\common\Wasteland 2\Build\WL2.exeFirewallRules: [{6E939D36-6063-4B7D-BD36-5B87B4D0A03B}] => (Allow) D:\steam folder 2\SteamApps\common\Nightsky\NightSky.exeFirewallRules: [{B28FDF14-304F-4438-B5E0-12B834E9131F}] => (Allow) D:\steam folder 2\SteamApps\common\Nightsky\NightSky.exeFirewallRules: [TCP Query User{925865B2-FE3F-466F-AE2B-9B8936E83419}C:\program files (x86)\java\jre7\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre7\bin\jp2launcher.exeFirewallRules: [uDP Query User{8C7B76E9-23CC-42D6-A0EB-55D0CD012729}C:\program files (x86)\java\jre7\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre7\bin\jp2launcher.exeFirewallRules: [TCP Query User{A23D9680-EC5F-454E-A38B-98C750A8405F}C:\program files (x86)\java\jre7\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre7\bin\jp2launcher.exeFirewallRules: [uDP Query User{97D70D14-3E05-4B69-8769-8B1D0C7131F9}C:\program files (x86)\java\jre7\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre7\bin\jp2launcher.exeFirewallRules: [{54755031-C732-4D24-83D5-32A6BF681057}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exeFirewallRules: [{6308724F-19A8-4744-A70E-DD58B378C1CB}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exeFirewallRules: [{FF51CF57-1454-4517-A5F5-B8B57827C74C}] => (Allow) D:\steam folder 2\SteamApps\common\Counter-Strike Global Offensive\csgo.exeFirewallRules: [{EA75013E-E7F4-4162-BAB7-2C377ED6F3E0}] => (Allow) D:\steam folder 2\SteamApps\common\Counter-Strike Global Offensive\csgo.exeFirewallRules: [{22C19F95-95AA-448E-BB29-65FDF253D7F8}] => (Allow) D:\steam folder 2\SteamApps\common\dota 2 beta\dota.exeFirewallRules: [{8E8ABD1F-49C1-4A2D-B38B-0089A6F77DD1}] => (Allow) D:\steam folder 2\SteamApps\common\dota 2 beta\dota.exeFirewallRules: [TCP Query User{6674F50E-00C1-4D1D-8DA0-7855B4CA4CEC}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exeFirewallRules: [uDP Query User{6AE0CB72-2A8B-41C3-9AC2-64AB9F3F1D73}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exeFirewallRules: [{F6972EC2-0D19-4DAD-8C64-DBB83D375FF1}] => (Allow) D:\steam folder 2\SteamApps\common\DayZ\DayZ_BE.exeFirewallRules: [{EC7D68BA-858A-4252-A0EC-C0A25563361C}] => (Allow) D:\steam folder 2\SteamApps\common\DayZ\DayZ_BE.exeFirewallRules: [{26281125-D078-4C86-A210-8446F050B90B}] => (Allow) D:\steam folder 2\SteamApps\common\Reign Of Kings\ROK.exeFirewallRules: [{7DD12BF1-2D6D-494E-8E60-37ED449EDD7B}] => (Allow) D:\steam folder 2\SteamApps\common\Reign Of Kings\ROK.exeFirewallRules: [{B4970DAA-9A90-4BCE-B9CC-97DCE6BB941A}] => (Allow) D:\steam folder 2\SteamApps\common\chivalrymedievalwarfare\Binaries\Win64\CMW.exeFirewallRules: [{D727A555-F84E-441F-A9AF-EC1F41FF1B8E}] => (Allow) D:\steam folder 2\SteamApps\common\chivalrymedievalwarfare\Binaries\Win64\CMW.exeFirewallRules: [{C1DB820E-935A-45A5-8841-5246EAF47789}] => (Allow) D:\steam folder 2\SteamApps\common\chivalrymedievalwarfare\Binaries\Win32\CMW.exeFirewallRules: [{D37242F7-07FE-48C9-B94B-748796D33B93}] => (Allow) D:\steam folder 2\SteamApps\common\chivalrymedievalwarfare\Binaries\Win32\CMW.exeFirewallRules: [{4A3B74A5-B773-4A6C-BA51-35FA60FD7592}] => (Allow) D:\steam folder 2\SteamApps\common\chivalrymedievalwarfare\ChivLauncher.exeFirewallRules: [{A96B04A4-1284-43EB-8677-00772E9120F1}] => (Allow) D:\steam folder 2\SteamApps\common\chivalrymedievalwarfare\ChivLauncher.exeFirewallRules: [{F5ACF34D-A2B1-46F6-A20C-AE771FF99853}] => (Allow) D:\steam folder 2\SteamApps\common\Shadowrun Returns\Shadowrun.exeFirewallRules: [{CC0C4EC1-7371-4B0C-82EF-EC65CBB4C049}] => (Allow) D:\steam folder 2\SteamApps\common\Shadowrun Returns\Shadowrun.exeFirewallRules: [{EE7A8E0D-CD3E-40DB-84C2-959EE193F8B3}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exeFirewallRules: [{381E490A-BCE6-4E69-B5C6-7F65B8F3E5D1}] => (Allow) LPort=2869FirewallRules: [{2CFA03DB-1F95-40C5-9584-444EA8CD65BC}] => (Allow) LPort=1900FirewallRules: [{3B166333-9A05-4798-AE27-8FDDC3A71F26}] => (Allow) D:\steam folder 2\SteamApps\common\Deus Ex - Human Revolution\dxhr.exeFirewallRules: [{A74D50A4-55E4-4570-B0BA-89631894F830}] => (Allow) D:\steam folder 2\SteamApps\common\Deus Ex - Human Revolution\dxhr.exeFirewallRules: [{02D75CCC-4FD7-47D2-A351-DBFC81F38C76}] => (Allow) D:\steam folder 2\SteamApps\common\Reign Of Kings\Reign of Kings.exeFirewallRules: [{E01C4D52-E1EE-4730-807E-B06A318929AF}] => (Allow) D:\steam folder 2\SteamApps\common\Reign Of Kings\Reign of Kings.exeFirewallRules: [{9F1A040A-C379-4B6A-B244-7F3EA369848E}] => (Allow) D:\steam folder 2\SteamApps\common\BlockNLoad\Win64\BlockNLoad.exeFirewallRules: [{7C1712F8-3292-4FE5-8236-194E013C6E1B}] => (Allow) D:\steam folder 2\SteamApps\common\BlockNLoad\Win64\BlockNLoad.exeFirewallRules: [{95CCC4F1-8C1E-4A52-A9EA-F4010C5C36A3}] => (Allow) D:\steam folder 2\SteamApps\common\Age2HD\Launcher.exeFirewallRules: [{F18864D0-7447-427C-BDDF-DD3B738A13FE}] => (Allow) D:\steam folder 2\SteamApps\common\Age2HD\Launcher.exe==================== Faulty Device Manager Devices =============Name: DNS-321Description: DNS-321Class Guid:Manufacturer:Service:Problem: : The drivers for this device are not installed. (Code 28)Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.==================== Event log errors: =========================Application errors:==================Error: (05/14/2015 01:39:40 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.Error: (05/14/2015 01:39:40 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.Error: (05/14/2015 01:50:26 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.Error: (05/14/2015 01:50:26 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.Error: (05/14/2015 01:10:58 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.Error: (05/14/2015 01:10:58 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.Error: (05/12/2015 08:29:46 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.Error: (05/12/2015 08:29:46 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.Error: (05/12/2015 10:50:50 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.Error: (05/12/2015 10:50:50 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.System errors:=============Error: (05/20/2015 03:04:23 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)Description: Installation Failure: Windows failed to install the following update with error 0x80070643: Internet Explorer 11 for Windows 7 for x64-based Systems.Error: (05/19/2015 03:04:36 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)Description: Installation Failure: Windows failed to install the following update with error 0x80070643: Internet Explorer 11 for Windows 7 for x64-based Systems.Error: (05/18/2015 03:04:51 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)Description: Installation Failure: Windows failed to install the following update with error 0x80070643: Internet Explorer 11 for Windows 7 for x64-based Systems.Error: (05/17/2015 03:04:49 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)Description: Installation Failure: Windows failed to install the following update with error 0x80070643: Internet Explorer 11 for Windows 7 for x64-based Systems.Error: (05/16/2015 03:05:11 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)Description: Installation Failure: Windows failed to install the following update with error 0x80070643: Internet Explorer 11 for Windows 7 for x64-based Systems.Error: (05/15/2015 03:06:02 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)Description: Installation Failure: Windows failed to install the following update with error 0x80070643: Internet Explorer 11 for Windows 7 for x64-based Systems.Error: (05/14/2015 03:06:41 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)Description: Installation Failure: Windows failed to install the following update with error 0x80070643: Internet Explorer 11 for Windows 7 for x64-based Systems.Error: (05/14/2015 01:05:15 AM) (Source: Service Control Manager) (EventID: 7023) (User: )Description: The Windows Modules Installer service terminated with the following error:%%16405Error: (05/14/2015 00:57:54 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)Description: Installation Failure: Windows failed to install the following update with error 0x80070643: Internet Explorer 11 for Windows 7 for x64-based Systems.Error: (05/13/2015 03:04:50 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)Description: Installation Failure: Windows failed to install the following update with error 0x80070643: Internet Explorer 11 for Windows 7 for x64-based Systems.Microsoft Office Sessions:=========================Error: (05/14/2015 01:39:40 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)Description: WmiApRplWmiApRpl8F20300004D070000Error: (05/14/2015 01:39:40 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)Description: Performance1637070000000000000000000009030000Error: (05/14/2015 01:50:26 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)Description: WmiApRplWmiApRpl8F20300004D070000Error: (05/14/2015 01:50:26 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)Description: Performance1637070000000000000000000009030000Error: (05/14/2015 01:10:58 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)Description: WmiApRplWmiApRpl8F20300004D070000Error: (05/14/2015 01:10:58 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)Description: Performance1637070000000000000000000009030000Error: (05/12/2015 08:29:46 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)Description: WmiApRplWmiApRpl8F20300004D070000Error: (05/12/2015 08:29:46 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)Description: Performance1637070000000000000000000009030000Error: (05/12/2015 10:50:50 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)Description: WmiApRplWmiApRpl8F20300004D070000Error: (05/12/2015 10:50:50 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)Description: Performance1637070000000000000000000009030000==================== Memory info ===========================Processor: AMD Phenom II X4 945 ProcessorPercentage of memory in use: 65%Total physical RAM: 8190.49 MBAvailable physical RAM: 2847.86 MBTotal Pagefile: 16379.19 MBAvailable Pagefile: 10413.28 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.82 MB==================== Drives ================================Drive c: (WIN_7) (Fixed) (Total:123.98 GB) (Free:58.59 GB) NTFS ==>[Drive with boot components (obtained from BCD)]Drive d: (DATA1) (Fixed) (Total:587.84 GB) (Free:499.62 GB) NTFSDrive e: (DATA2) (Fixed) (Total:685.42 GB) (Free:683.22 GB) NTFSDrive x: () (Network) (Total:1373.11 GB) (Free:1256.19 GB)Drive y: () (Network) (Total:1848.39 GB) (Free:460.67 GB)==================== MBR & Partition Table ==========================================================================Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1397.3 GB) (Disk ID: 649B0E66)Partition 1: (Active) - (Size=124 GB) - (Type=07 NTFS)Partition 2: (Not Active) - (Size=587.8 GB) - (Type=07 NTFS)Partition 3: (Not Active) - (Size=685.4 GB) - (Type=07 NTFS)==================== End Of Log ============================ Link to post Share on other sites More sharing options...
kevinf80 Posted May 20, 2015 ID:964075 Share Posted May 20, 2015 FRST produces two logs, FRST.txt and Addition.txt. You`ve only posted the secondary log, I need to see the primary log FRST.txt.... Logs are saved here: C:\FRST\Logs I also want to see the "Scan log" from Malwarebytes, you`ve posted a protection log result.... Thanks, Kevin... Link to post Share on other sites More sharing options...
alex92 Posted May 20, 2015 Author ID:964076 Share Posted May 20, 2015 the maleware bytes scan doesnt run, thats all it gives me Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 19-05-2015Ran by cam (administrator) on NEMESIS on 20-05-2015 17:42:58Running from e:\Users\cam\DesktopLoaded Profiles: cam & (Available profiles: cam)Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: English (United States)Internet Explorer Version 9 (Default browser: FF)Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/==================== Processes (Whitelisted) =================(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe(McAfee, Inc.) C:\Windows\System32\mfevtps.exe(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe(Raxco Software, Inc.) C:\Program Files\Raxco\PerfectDisk\PDAgent.exe(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\mfeann.exe() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE(Raxco Software, Inc.) C:\Program Files\Common Files\Raxco\Shared\PDEngine.exe(Microsoft Corporation) C:\Windows\System32\LogonUI.exe(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe(cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe(BitLeader) C:\Program Files (x86)\lg_fwupdate\fwupdate.exe(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\McTray.exe(Raxco Software, Inc.) C:\Program Files\Raxco\PerfectDisk\PDAgentS1.exe(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\shstat.exe(Microsoft Corporation) C:\Windows\System32\LogonUI.exe(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe==================== Registry (Whitelisted) ==================(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2673296 2015-03-27] (NVIDIA Corporation)HKLM\...\Run: [shadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStartHKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161984 2014-04-20] (IvoSoft)HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-12-15] (CyberLink)HKLM-x32\...\Run: [updateP2GoShortCut] => C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2011-03-30] (CyberLink Corp.)HKLM-x32\...\Run: [bDRegion] => C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2011-09-27] (cyberlink)HKLM-x32\...\Run: [uCam_Menu] => C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)HKLM-x32\...\Run: [LGODDFU] => C:\Program Files (x86)\lg_fwupdate\lgfw.exe [27760 2013-08-13] (Bitleader)HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2014-07-25] (Samsung Electronics Co., Ltd.)HKLM-x32\...\Run: [McAfeeUpdaterUI] => C:\Program Files (x86)\McAfee\Common Framework\udaterui.exe [333416 2012-09-05] (McAfee, Inc.)HKLM-x32\...\Run: [shStatEXE] => C:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE [215656 2012-08-14] (McAfee, Inc.)HKLM\...\Policies\Explorer: [NoControlPanel] 0HKLM\...\Policies\Explorer: [NoFolderOptions] 0HKU\S-1-5-21-40843148-1728485514-400720728-1000\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2741616 2011-03-04] (Hewlett-Packard Company)HKU\S-1-5-21-40843148-1728485514-400720728-1000\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1562264 2014-07-25] (Samsung)HKU\S-1-5-21-40843148-1728485514-400720728-1000\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startupHKU\S-1-5-21-40843148-1728485514-400720728-1000\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845120 2014-07-25] (Samsung)HKU\S-1-5-21-40843148-1728485514-400720728-1000\...\Run: [Voobly] => "C:\Voobly\voobly.exe" --startupHKU\S-1-5-21-40843148-1728485514-400720728-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2741616 2011-03-04] (Hewlett-Packard Company)HKU\S-1-5-21-40843148-1728485514-400720728-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1562264 2014-07-25] (Samsung)HKU\S-1-5-21-40843148-1728485514-400720728-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startupHKU\S-1-5-21-40843148-1728485514-400720728-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845120 2014-07-25] (Samsung)HKU\S-1-5-21-40843148-1728485514-400720728-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Voobly] => "C:\Voobly\voobly.exe" --startupStartup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2015-03-18]ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)ShellIconOverlayIdentifiers: [shareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)ShellIconOverlayIdentifiers-x32: [shareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20] (IvoSoft)BootExecute: PDBoot.exeautocheck autochk *==================== Internet (Whitelisted) ====================(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blankHKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blankHKU\S-1-5-21-40843148-1728485514-400720728-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blankHKU\S-1-5-21-40843148-1728485514-400720728-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ca.msn.com/?rd=1&ucc=CA&dcc=CA&opt=0&ocid=iehp&tc=3HKU\S-1-5-21-40843148-1728485514-400720728-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = about:blankHKU\S-1-5-21-40843148-1728485514-400720728-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ca.msn.com/?rd=1&ucc=CA&dcc=CA&opt=0&ocid=iehp&tc=3BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)BHO: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20130901113835.dll [2013-09-01] (McAfee, Inc.)BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2014-04-20] (IvoSoft)BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll [2014-04-09] (McAfee, Inc.)BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20] (IvoSoft)BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-31] (Oracle Corporation)BHO-x32: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20130901113835.dll [2013-09-01] (McAfee, Inc.)BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-31] (Oracle Corporation)BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2014-04-20] (IvoSoft)Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20] (IvoSoft)Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - No FileTcpip\Parameters: [DhcpNameServer] 192.168.1.254Tcpip\..\Interfaces\{FDD38EBF-3ABE-4A75-9A5B-FB1ECAFB4644}: [NameServer] 8.8.8.8,8.8.4.4FireFox:========FF ProfilePath: C:\Users\cam\AppData\Roaming\Mozilla\Firefox\Profiles\n7l1bkz2.defaultFF DefaultSearchEngine: GoogleFF DefaultSearchEngine.US: GoogleFF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-14] ()FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-14] ()FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-31] (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-31] (Oracle Corporation)FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-02-03] (NVIDIA Corporation)FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-02-03] (NVIDIA Corporation)FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No FileFF Plugin-x32: @videolan.org/vlc,version=2.0.7 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-22] (VideoLAN)FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-22] (VideoLAN)FF Extension: Adblock Plus - C:\Users\cam\AppData\Roaming\Mozilla\Firefox\Profiles\n7l1bkz2.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-03-08]FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-05-14]FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-05-14]FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCoreFF Extension: IDS_SS_NAME - C:\Program Files (x86)\Common Files\McAfee\SystemCore [2013-09-01]FF HKU\S-1-5-21-40843148-1728485514-400720728-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpiFF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]FF HKU\S-1-5-21-40843148-1728485514-400720728-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpiChrome:=======CHR HKLM-x32\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - http://clients2.google.com/service/update2/crx==================== Services (Whitelisted) =================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [49152 2014-01-06] () [File not signed]S2 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [241648 2011-04-20] (CyberLink)R2 DiagTrack; C:\Windows\system32\diagtrack.dll [1254400 2015-04-27] (Microsoft Corporation)S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [237352 2015-04-10] (EasyAntiCheat Ltd)R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152144 2015-03-27] (NVIDIA Corporation)R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2011-03-04] (Hewlett-Packard Company) [File not signed]R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)R2 McAfeeFramework; C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe [132712 2012-09-05] (McAfee, Inc.)S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [201864 2013-09-01] (McAfee, Inc.)R2 McTaskManager; C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe [210056 2012-08-14] (McAfee, Inc.)R2 mfevtp; C:\Windows\system32\mfevtps.exe [170440 2013-09-01] (McAfee, Inc.)R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1878672 2015-03-27] (NVIDIA Corporation)R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [22995600 2015-03-27] (NVIDIA Corporation)R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-07-02] () [File not signed]S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)==================== Drivers (Whitelisted) ====================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-05-20] (Malwarebytes Corporation)R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [160952 2013-09-01] (McAfee, Inc.)R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [274880 2013-09-01] (McAfee, Inc.)U3 mfeavfk01; No ImagePathR0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [665768 2013-09-01] (McAfee, Inc.)S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [101200 2013-09-01] (McAfee, Inc.)R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [303464 2013-09-01] (McAfee, Inc.)R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-03-27] (NVIDIA Corporation)R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]S3 EasyAntiCheatSys; \??\C:\Windows\system32\EasyAntiCheat.sys [X]S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]S3 tsusbhub; system32\drivers\tsusbhub.sys [X]S3 VGPU; System32\drivers\rdvgkmd.sys [X]==================== NetSvcs (Whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)==================== One Month Created Files and Folders ========(If an entry is included in the fixlist, the file\folder will be moved.)2015-05-20 17:42 - 2015-05-20 17:43 - 00000000 ____D () C:\FRST2015-05-18 09:48 - 2015-05-18 09:51 - 00000000 ____D () C:\Users\cam\ikov2015-05-18 09:48 - 2015-05-18 09:48 - 00000000 ____D () C:\Windows\.ikov_cache_322015-05-18 09:48 - 2015-05-18 09:48 - 00000000 _____ () C:\Users\cam\ent_ikov_preferences.dat2015-05-14 21:54 - 2015-05-14 21:54 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox2015-05-14 00:48 - 2015-05-01 09:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll2015-05-14 00:48 - 2015-05-01 09:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll2015-05-13 06:17 - 2015-05-04 21:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll2015-05-13 06:17 - 2015-05-04 21:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll2015-05-13 06:17 - 2015-04-27 15:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe2015-05-13 06:17 - 2015-04-27 15:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys2015-05-13 06:17 - 2015-04-27 15:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys2015-05-13 06:17 - 2015-04-27 15:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll2015-05-13 06:17 - 2015-04-27 15:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll2015-05-13 06:17 - 2015-04-27 15:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll2015-05-13 06:17 - 2015-04-27 15:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll2015-05-13 06:17 - 2015-04-27 15:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll2015-05-13 06:17 - 2015-04-27 15:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll2015-05-13 06:17 - 2015-04-27 15:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll2015-05-13 06:17 - 2015-04-27 15:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll2015-05-13 06:17 - 2015-04-27 15:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll2015-05-13 06:17 - 2015-04-27 15:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll2015-05-13 06:17 - 2015-04-27 15:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll2015-05-13 06:17 - 2015-04-27 15:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll2015-05-13 06:17 - 2015-04-27 15:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll2015-05-13 06:17 - 2015-04-27 15:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll2015-05-13 06:17 - 2015-04-27 15:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll2015-05-13 06:17 - 2015-04-27 15:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll2015-05-13 06:17 - 2015-04-27 15:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll2015-05-13 06:17 - 2015-04-27 15:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll2015-05-13 06:17 - 2015-04-27 15:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll2015-05-13 06:17 - 2015-04-27 15:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll2015-05-13 06:17 - 2015-04-27 15:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll2015-05-13 06:17 - 2015-04-27 15:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll2015-05-13 06:17 - 2015-04-27 15:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll2015-05-13 06:17 - 2015-04-27 15:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll2015-05-13 06:17 - 2015-04-27 15:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll2015-05-13 06:17 - 2015-04-27 15:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe2015-05-13 06:17 - 2015-04-27 15:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe2015-05-13 06:17 - 2015-04-27 15:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe2015-05-13 06:17 - 2015-04-27 15:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe2015-05-13 06:17 - 2015-04-27 15:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe2015-05-13 06:17 - 2015-04-27 15:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe2015-05-13 06:17 - 2015-04-27 15:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe2015-05-13 06:17 - 2015-04-27 15:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe2015-05-13 06:17 - 2015-04-27 15:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe2015-05-13 06:17 - 2015-04-27 15:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe2015-05-13 06:17 - 2015-04-27 15:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll2015-05-13 06:17 - 2015-04-27 15:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 15:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe2015-05-13 06:17 - 2015-04-27 15:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe2015-05-13 06:17 - 2015-04-27 15:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll2015-05-13 06:17 - 2015-04-27 15:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll2015-05-13 06:17 - 2015-04-27 15:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll2015-05-13 06:17 - 2015-04-27 15:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll2015-05-13 06:17 - 2015-04-27 15:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll2015-05-13 06:17 - 2015-04-27 15:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll2015-05-13 06:17 - 2015-04-27 15:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll2015-05-13 06:17 - 2015-04-27 15:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll2015-05-13 06:17 - 2015-04-27 15:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll2015-05-13 06:17 - 2015-04-27 15:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll2015-05-13 06:17 - 2015-04-27 15:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll2015-05-13 06:17 - 2015-04-27 15:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll2015-05-13 06:17 - 2015-04-27 15:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe2015-05-13 06:17 - 2015-04-27 15:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe2015-05-13 06:17 - 2015-04-27 15:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe2015-05-13 06:17 - 2015-04-27 15:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe2015-05-13 06:17 - 2015-04-27 15:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe2015-05-13 06:17 - 2015-04-27 15:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll2015-05-13 06:17 - 2015-04-27 15:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll2015-05-13 06:17 - 2015-04-27 15:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll2015-05-13 06:17 - 2015-04-27 15:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll2015-05-13 06:17 - 2015-04-27 15:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe2015-05-13 06:17 - 2015-04-27 15:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe2015-05-13 06:17 - 2015-04-27 15:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll2015-05-13 06:17 - 2015-04-27 15:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll2015-05-13 06:17 - 2015-04-27 15:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 14:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll2015-05-13 06:17 - 2015-04-27 13:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe2015-05-13 06:17 - 2015-04-27 13:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe2015-05-13 06:17 - 2015-04-27 13:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 13:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 13:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll2015-05-13 06:17 - 2015-04-27 13:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll2015-05-13 06:17 - 2015-04-17 23:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll2015-05-13 06:17 - 2015-04-17 22:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll2015-05-13 06:17 - 2015-04-12 23:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe2015-05-13 06:16 - 2015-04-19 23:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll2015-05-13 06:16 - 2015-04-19 23:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll2015-05-13 06:16 - 2015-04-19 22:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll2015-05-13 06:16 - 2015-04-19 22:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys2015-05-13 06:16 - 2015-04-10 12:54 - 17881088 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll2015-05-13 06:16 - 2015-04-10 12:44 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\html.iec2015-05-13 06:16 - 2015-04-10 12:43 - 10935808 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll2015-05-13 06:16 - 2015-04-10 12:43 - 02339840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll2015-05-13 06:16 - 2015-04-10 12:39 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll2015-05-13 06:16 - 2015-04-10 12:39 - 01388032 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll2015-05-13 06:16 - 2015-04-10 12:38 - 02158080 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll2015-05-13 06:16 - 2015-04-10 12:37 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb2015-05-13 06:16 - 2015-04-10 12:37 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl2015-05-13 06:16 - 2015-04-10 12:37 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll2015-05-13 06:16 - 2015-04-10 12:37 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll2015-05-13 06:16 - 2015-04-10 12:37 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll2015-05-13 06:16 - 2015-04-10 12:37 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll2015-05-13 06:16 - 2015-04-10 12:37 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll2015-05-13 06:16 - 2015-04-10 12:37 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll2015-05-13 06:16 - 2015-04-10 12:37 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll2015-05-13 06:16 - 2015-04-10 12:37 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe2015-05-13 06:16 - 2015-04-10 12:37 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll2015-05-13 06:16 - 2015-04-10 12:37 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll2015-05-13 06:16 - 2015-04-10 12:37 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll2015-05-13 06:16 - 2015-04-10 12:37 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe2015-05-13 06:16 - 2015-04-10 12:36 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe2015-05-13 06:16 - 2015-04-10 11:30 - 12379136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2015-05-13 06:16 - 2015-04-10 11:25 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2015-05-13 06:16 - 2015-04-10 11:25 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec2015-05-13 06:16 - 2015-04-10 11:24 - 09750528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2015-05-13 06:16 - 2015-04-10 11:21 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2015-05-13 06:16 - 2015-04-10 11:20 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2015-05-13 06:16 - 2015-04-10 11:20 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2015-05-13 06:16 - 2015-04-10 11:19 - 01804288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2015-05-13 06:16 - 2015-04-10 11:19 - 00718336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll2015-05-13 06:16 - 2015-04-10 11:19 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll2015-05-13 06:16 - 2015-04-10 11:19 - 00421888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll2015-05-13 06:16 - 2015-04-10 11:19 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll2015-05-13 06:16 - 2015-04-10 11:19 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll2015-05-13 06:16 - 2015-04-10 11:19 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2015-05-13 06:16 - 2015-04-10 11:19 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2015-05-13 06:16 - 2015-04-10 11:18 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb2015-05-13 06:16 - 2015-04-10 11:18 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll2015-05-13 06:16 - 2015-04-10 11:18 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2015-05-13 06:16 - 2015-04-10 11:18 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2015-05-13 06:16 - 2015-04-10 11:18 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll2015-05-13 06:16 - 2015-04-10 11:18 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe2015-05-13 06:16 - 2015-04-10 11:18 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe2015-05-13 06:15 - 2015-04-07 23:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll2015-05-13 06:15 - 2015-04-07 23:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll2015-05-13 06:15 - 2015-04-07 23:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll2015-05-13 06:15 - 2015-03-04 00:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll2015-05-13 06:15 - 2015-03-04 00:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll2015-05-13 06:15 - 2015-03-04 00:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe2015-05-13 06:15 - 2015-03-04 00:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll2015-05-13 06:15 - 2015-03-04 00:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll2015-05-13 06:15 - 2015-03-04 00:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll2015-05-13 06:15 - 2015-03-04 00:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe2015-05-13 06:15 - 2015-02-18 03:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe2015-05-13 06:15 - 2015-02-18 03:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe2015-05-13 06:15 - 2015-01-28 23:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll2015-05-13 06:15 - 2015-01-28 23:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll==================== One Month Modified Files and Folders =======(If an entry is included in the fixlist, the file\folder will be moved.)2015-05-20 17:43 - 2013-08-11 12:52 - 00000000 ____D () C:\Temp2015-05-20 17:42 - 2014-04-16 16:29 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys2015-05-20 16:45 - 2014-10-21 08:48 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job2015-05-20 15:20 - 2014-10-21 09:22 - 00000000 ____D () C:\Users\cam\AppData\Roaming\ClassicShell2015-05-20 10:51 - 2013-08-14 16:29 - 00000024 _____ () C:\Users\cam\random.dat2015-05-20 10:51 - 2013-08-14 14:12 - 00000000 ____D () C:\Users\cam\AppData\Roaming\TS3Client2015-05-20 10:21 - 2013-08-14 16:29 - 00000042 _____ () C:\Users\cam\jagex_cl_oldschool_LIVE.dat2015-05-20 10:20 - 2013-10-09 15:41 - 00000000 ____D () C:\Program Files (x86)\Steam2015-05-20 03:02 - 2013-08-11 15:44 - 01328906 _____ () C:\Windows\WindowsUpdate.log2015-05-20 03:01 - 2013-11-26 04:00 - 02764419 _____ () C:\Windows\IE11_main.log2015-05-18 14:16 - 2013-08-13 11:21 - 00000000 ____D () C:\Users\cam\AppData\Roaming\vlc2015-05-18 09:48 - 2013-08-11 12:50 - 00000000 ____D () C:\Users\cam2015-05-17 11:08 - 2013-08-12 13:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service2015-05-16 03:10 - 2009-07-14 00:45 - 00020672 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A02015-05-16 03:10 - 2009-07-14 00:45 - 00020672 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A02015-05-14 13:39 - 2009-07-14 01:13 - 00006214 _____ () C:\Windows\system32\PerfStringBackup.INI2015-05-14 03:53 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\rescache2015-05-14 01:44 - 2013-08-13 11:01 - 00000344 _____ () C:\Windows\lgfwup.ini2015-05-14 01:44 - 2013-08-13 11:01 - 00000000 ____D () C:\Program Files (x86)\lg_fwupdate2015-05-14 01:14 - 2013-08-13 10:49 - 00000000 ____D () C:\ProgramData\Temp2015-05-14 01:04 - 2013-08-11 14:19 - 00000000 ____D () C:\ProgramData\NVIDIA2015-05-14 01:04 - 2009-07-14 01:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT2015-05-14 01:04 - 2009-07-14 00:51 - 00080822 _____ () C:\Windows\setupact.log2015-05-14 01:04 - 2009-07-14 00:45 - 00287248 _____ () C:\Windows\system32\FNTCACHE.DAT2015-05-14 01:01 - 2009-07-14 03:47 - 00000000 ____D () C:\Program Files\Windows Journal2015-05-14 01:01 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers2015-05-14 00:54 - 2013-08-12 11:26 - 00000000 ____D () C:\Windows\system32\MRT2015-05-14 00:51 - 2013-08-11 16:07 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe2015-05-14 00:48 - 2013-08-12 10:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight2015-05-14 00:47 - 2013-08-12 10:36 - 00000000 ____D () C:\Program Files\Microsoft Silverlight2015-05-14 00:47 - 2013-08-12 10:36 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight2015-05-08 15:57 - 2013-11-03 12:42 - 00000000 ____D () C:\Users\cam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games2015-05-08 15:57 - 2009-07-14 01:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games2015-05-06 17:49 - 2013-08-11 14:05 - 00000000 ____D () C:\ProgramData\McAfee2015-05-02 21:17 - 2014-03-18 20:24 - 00000000 ____D () C:\ProgramData\Package Cache2015-04-29 11:00 - 2014-04-16 16:02 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware2015-04-29 11:00 - 2013-08-12 00:08 - 00206558 _____ () C:\Windows\PFRO.log2015-04-25 10:11 - 2014-04-16 16:02 - 00001103 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk2015-04-25 10:11 - 2014-04-16 16:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware==================== Files in the root of some directories =======2015-04-12 23:04 - 2015-04-12 23:04 - 0003584 _____ () C:\Users\cam\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.iniFiles to move or delete:====================C:\Users\cam\ent_ikov_preferences.dat==================== Bamital & volsnap Check =================(There is no automatic fix for files that do not pass verification.)C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\SysWOW64\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signedLastRegBack: 2015-05-14 03:45==================== End Of Log ============================ theres the other 1 srry bout that Link to post Share on other sites More sharing options...
kevinf80 Posted May 20, 2015 ID:964079 Share Posted May 20, 2015 Follow instructions here: https://forums.malwarebytes.org/index.php?/topic/146017-mbam-clean-removal-process-2x/ make clean install of Malwarebytes, when complete run a threat scan and post its log... Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 27, 2015 Root Admin ID:965537 Share Posted May 27, 2015 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts