Jump to content

Everytime I reinstall windows i got infected \HiJack. Folder Options

CaptainRos
 Share

Recommended Posts

CaptainRos

CaptainRos

Posted
Posted

Hello!

First of all, sorry if my english bad.

Last week i spent so much time in reinstalling my windows but everytime i do that i got infected in first minutes. My computer starts freezing and to act slow. Today i reinstalled it again and MWAB found PUP.Open Candy and deleted it. Now... it detectd HiJack. Folder Options deletes it but when i restart the computer it shows again.

 

FRST.txt:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 29-05-2015
Ran by RossBossBG (administrator) on ROSSBOSS on 02-06-2015 23:25:32
Running from C:\Users\RossBossBG\Desktop
Loaded Profiles: RossBossBG (Available Profiles: RossBossBG)
Platform: Windows 8.1 Pro (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PrivacyIconClient.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2673296 2015-04-09] (NVIDIA Corporation)
HKLM\...\Run: [iAStorIcon] => C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [287592 2014-04-11] (Intel Corporation)
HKLM\...\Run: [shadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13671792 2014-03-14] (Realtek Semiconductor)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iMSS] => C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe [134616 2013-09-16] (Intel Corporation)
HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM-x32\...\Run: [switchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKU\S-1-5-21-3456315844-1928112805-2880478906-1001\...\Run: [uTorrent] => "C:\Users\RossBossBG\Desktop\uTorrent.exe"  /MINIMIZED
HKU\S-1-5-21-3456315844-1928112805-2880478906-1001\...\Run: [skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [28917376 2015-05-14] (Skype Technologies S.A.)
HKU\S-1-5-21-3456315844-1928112805-2880478906-1001\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-3456315844-1928112805-2880478906-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Ribbons.scr [132608 2014-11-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3456315844-1928112805-2880478906-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-06-02] (Oracle Corporation)
BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-02] (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 62.221.132.211 85.130.60.11

FireFox:
========
FF ProfilePath: C:\Users\RossBossBG\AppData\Roaming\Mozilla\Firefox\Profiles\hox4s1di.default
FF Homepage: www.google.bg
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-02] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-02] (Oracle Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-04-08] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-04-08] (NVIDIA Corporation)
FF Extension: Adblock Plus - C:\Users\RossBossBG\AppData\Roaming\Mozilla\Firefox\Profiles\hox4s1di.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-06-02]

Chrome:
=======
CHR Profile: C:\Users\RossBossBG\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\RossBossBG\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-06-03]
CHR Extension: (Google Docs) - C:\Users\RossBossBG\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-06-03]
CHR Extension: (Google Drive) - C:\Users\RossBossBG\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-06-03]
CHR Extension: (YouTube) - C:\Users\RossBossBG\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-06-03]
CHR Extension: (Google Search) - C:\Users\RossBossBG\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-06-03]
CHR Extension: (Google Sheets) - C:\Users\RossBossBG\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-06-03]
CHR Extension: (Bookmark Manager) - C:\Users\RossBossBG\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-06-03]
CHR Extension: (Avast Online Security) - C:\Users\RossBossBG\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-06-03]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\RossBossBG\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-03]
CHR Extension: (Google Wallet) - C:\Users\RossBossBG\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-03]
CHR Extension: (Gmail) - C:\Users\RossBossBG\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-03]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-11-21] (Microsoft Corporation)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152144 2015-04-09] (NVIDIA Corporation)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [16232 2014-04-11] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [345864 2015-03-20] (Intel Corporation)
R2 Intel® Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-28] (Intel® Corporation) [File not signed]
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-28] (Intel® Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1878672 2015-04-09] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [22995600 2015-04-09] (NVIDIA Corporation)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-11-21] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-11-21] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-06-02] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-04-09] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2015-04-09] (NVIDIA Corporation)
R2 RtNdPt630; C:\Windows\system32\DRIVERS\RtNdPt630.sys [28888 2013-09-26] (Realtek Semiconductor Corp.)
S3 RTTEAMPT; C:\Windows\system32\DRIVERS\RtTeam620.sys [58512 2012-07-03] (Realtek Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-11-21] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-03 14:50 - 2015-06-03 14:50 - 00000000 ____D () C:\Users\RossBossBG\AppData\Roaming\HD Tune Pro
2015-06-03 03:49 - 2015-06-03 03:49 - 00000118 _____ () C:\Windows\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2015-06-03 03:48 - 2015-06-03 03:48 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM
2015-06-03 03:48 - 2015-06-03 03:48 - 00000000 ____D () C:\Program Files\Realtek
2015-06-03 03:48 - 2014-02-27 15:02 - 02162992 _____ (Yamaha Corporation) C:\Windows\system32\YamahaAE.dll
2015-06-03 03:47 - 2015-06-03 03:47 - 00002077 _____ () C:\Users\Public\Desktop\3D Vision Photo Viewer.lnk
2015-06-03 03:47 - 2014-03-14 14:08 - 03896920 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys
2015-06-03 03:47 - 2014-03-14 12:14 - 00628440 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtDataProc64.dll
2015-06-03 03:47 - 2014-03-14 09:42 - 00947928 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInstII64.dll
2015-06-03 03:47 - 2014-03-12 12:19 - 57362432 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoRes64.dat
2015-06-03 03:47 - 2014-03-11 16:50 - 00853784 _____ () C:\Windows\system32\Drivers\RTAIODAT.DAT
2015-06-03 03:47 - 2014-03-11 05:06 - 01738032 _____ () C:\Windows\system32\SStudio.dll
2015-06-03 03:47 - 2014-03-07 05:57 - 02794200 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkAPO64.dll
2015-06-03 03:47 - 2014-03-06 11:35 - 01959128 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl
2015-06-03 03:47 - 2014-03-05 00:11 - 01048824 _____ (SRS Labs, Inc.) C:\Windows\system32\slcnt64.dll
2015-06-03 03:47 - 2014-03-05 00:11 - 00889592 _____ (DTS, Inc.) C:\Windows\system32\sl3apo64.dll
2015-06-03 03:47 - 2014-03-05 00:11 - 00724728 _____ (DTS, Inc.) C:\Windows\system32\sltech64.dll
2015-06-03 03:47 - 2014-03-05 00:11 - 00246008 _____ (TODO: <Company name>) C:\Windows\system32\slprp64.dll
2015-06-03 03:47 - 2014-03-04 15:27 - 02831576 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll
2015-06-03 03:47 - 2014-03-03 15:21 - 01019608 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll
2015-06-03 03:47 - 2014-02-26 03:48 - 00942384 _____ (Nahimic Inc) C:\Windows\system32\NAHIMICAPOSettingsIPC.dll
2015-06-03 03:47 - 2014-02-26 03:47 - 05751048 _____ (Nahimic Inc) C:\Windows\system32\NAHIMICAPOlfx.dll
2015-06-03 03:47 - 2014-02-18 13:12 - 01042520 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPOShell64.dll
2015-06-03 03:47 - 2014-02-18 13:12 - 00882776 _____ (Waves Audio Ltd.) C:\Windows\SysWOW64\MaxxAudioAPOShell.dll
2015-06-03 03:47 - 2014-02-18 12:04 - 02770976 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll
2015-06-03 03:47 - 2014-02-18 09:48 - 02396760 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO6064.dll
2015-06-03 03:47 - 2014-02-18 09:48 - 01424984 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO4064.dll
2015-06-03 03:47 - 2014-02-18 09:48 - 01423960 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO5064.dll
2015-06-03 03:47 - 2014-02-16 15:30 - 28314200 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioVnA64.dll
2015-06-03 03:47 - 2014-02-16 15:30 - 14742104 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek64.dll
2015-06-03 03:47 - 2014-02-16 15:30 - 12816472 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO3064.dll
2015-06-03 03:47 - 2014-02-16 15:30 - 03927640 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioVnN64.dll
2015-06-03 03:47 - 2014-02-16 15:30 - 02101848 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesGUILib64.dll
2015-06-03 03:47 - 2014-02-16 15:30 - 02040920 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ64.dll
2015-06-03 03:47 - 2014-02-16 15:30 - 01933400 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek264.dll
2015-06-03 03:47 - 2014-02-06 06:28 - 05804772 _____ () C:\Windows\system32\Drivers\rtvienna.dat
2015-06-03 03:47 - 2014-01-31 12:28 - 00938608 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO2064.dll
2015-06-03 03:47 - 2014-01-31 12:27 - 01313904 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxSpeechAPO64.dll
2015-06-03 03:47 - 2014-01-28 06:48 - 01286872 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll
2015-06-03 03:47 - 2013-10-15 22:43 - 00209096 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll
2015-06-03 03:47 - 2013-10-11 07:47 - 00113576 _____ (Real Sound Lab SIA) C:\Windows\system32\CONEQMSAPOGUILibrary.dll
2015-06-03 03:47 - 2013-10-11 06:31 - 00947760 _____ (Sony Corporation) C:\Windows\system32\SFSS_APO.dll
2015-06-03 03:47 - 2013-10-06 19:26 - 00501184 _____ (DTS) C:\Windows\system32\DTSU2PLFX64.dll
2015-06-03 03:47 - 2013-10-06 19:26 - 00487360 _____ (DTS) C:\Windows\system32\DTSU2PGFX64.dll
2015-06-03 03:47 - 2013-10-06 19:26 - 00415680 _____ (DTS) C:\Windows\system32\DTSU2PREC64.dll
2015-06-03 03:47 - 2013-09-09 23:02 - 06217904 _____ (Dolby Laboratories) C:\Windows\system32\DDPP64A.dll
2015-06-03 03:47 - 2013-09-09 23:02 - 00313520 _____ (Dolby Laboratories) C:\Windows\system32\DDPO64A.dll
2015-06-03 03:47 - 2013-09-09 23:01 - 01938608 _____ (Dolby Laboratories) C:\Windows\system32\DDPD64A.dll
2015-06-03 03:47 - 2013-09-09 23:01 - 00260272 _____ (Dolby Laboratories) C:\Windows\system32\DDPA64.dll
2015-06-03 03:47 - 2013-08-20 12:37 - 00605496 _____ () C:\Windows\system32\audioLibVc.dll
2015-06-03 03:47 - 2013-08-14 10:36 - 00662784 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVolumeSDAPO.dll
2015-06-03 03:47 - 2013-08-14 10:35 - 00663296 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO30.dll
2015-06-03 03:47 - 2013-06-25 07:47 - 00871856 _____ (TOSHIBA Corporation) C:\Windows\system32\tossaeapo64.dll
2015-06-03 03:47 - 2013-06-25 07:47 - 00162224 _____ (TOSHIBA Corporation) C:\Windows\system32\toseaeapo64.dll
2015-06-03 03:47 - 2013-06-25 07:46 - 00582056 _____ (TOSHIBA Corporation) C:\Windows\system32\tosasfapo64.dll
2015-06-03 03:47 - 2013-06-21 06:01 - 00109848 _____ () C:\Windows\system32\AcpiServiceVnA64.dll
2015-06-03 03:47 - 2013-04-03 09:13 - 00906800 _____ (Sony Corporation) C:\Windows\system32\MISS_APO.dll
2015-06-03 03:47 - 2012-08-31 14:18 - 07164176 _____ (Dolby Laboratories) C:\Windows\system32\R4EEP64A.dll
2015-06-03 03:47 - 2012-08-31 14:17 - 00434960 _____ (Dolby Laboratories) C:\Windows\system32\R4EED64A.dll
2015-06-03 03:47 - 2012-08-31 14:17 - 00141584 _____ (Dolby Laboratories) C:\Windows\system32\R4EEL64A.dll
2015-06-03 03:47 - 2012-08-31 14:17 - 00124176 _____ (Dolby Laboratories) C:\Windows\system32\R4EEA64A.dll
2015-06-03 03:47 - 2012-08-31 14:17 - 00075024 _____ (Dolby Laboratories) C:\Windows\system32\R4EEG64A.dll
2015-06-03 03:47 - 2012-03-08 06:47 - 00108640 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll
2015-06-03 03:47 - 2012-01-30 06:43 - 00836544 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo264.dll
2015-06-03 03:47 - 2012-01-10 05:20 - 00065944 _____ (TOSHIBA CORPORATION.) C:\Windows\system32\tepeqapo64.dll
2015-06-03 03:47 - 2011-12-20 10:32 - 00331880 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll
2015-06-03 03:47 - 2011-11-22 11:28 - 00014952 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoLDR64.dll
2015-06-03 03:47 - 2011-09-02 09:21 - 00221024 _____ (Synopsys, Inc.) C:\Windows\system32\SFNHK64.dll
2015-06-03 03:47 - 2011-09-02 09:21 - 00081248 _____ (Synopsys, Inc.) C:\Windows\system32\SFCOM64.dll
2015-06-03 03:47 - 2011-09-02 09:21 - 00078688 _____ (Synopsys, Inc.) C:\Windows\system32\SFAPO64.dll
2015-06-03 03:47 - 2011-08-23 12:00 - 00603984 _____ (Knowles Acoustics ) C:\Windows\system32\KAAPORT64.dll
2015-06-03 03:47 - 2011-05-31 04:42 - 01756264 _____ (DTS) C:\Windows\system32\DTSS2SpeakerDLL64.dll
2015-06-03 03:47 - 2011-05-31 04:42 - 01568360 _____ (DTS) C:\Windows\system32\DTSS2HeadphoneDLL64.dll
2015-06-03 03:47 - 2011-05-31 04:42 - 01486952 _____ (DTS) C:\Windows\system32\DTSBoostDLL64.dll
2015-06-03 03:47 - 2011-05-31 04:42 - 00728680 _____ (DTS) C:\Windows\system32\DTSBassEnhancementDLL64.dll
2015-06-03 03:47 - 2011-05-31 04:42 - 00712296 _____ (DTS) C:\Windows\system32\DTSSymmetryDLL64.dll
2015-06-03 03:47 - 2011-05-31 04:42 - 00693352 _____ (DTS) C:\Windows\system32\DTSVoiceClarityDLL64.dll
2015-06-03 03:47 - 2011-05-31 04:42 - 00491112 _____ (DTS) C:\Windows\system32\DTSNeoPCDLL64.dll
2015-06-03 03:47 - 2011-05-31 04:42 - 00432744 _____ (DTS) C:\Windows\system32\DTSLimiterDLL64.dll
2015-06-03 03:47 - 2011-05-31 04:42 - 00428648 _____ (DTS) C:\Windows\system32\DTSGainCompensatorDLL64.dll
2015-06-03 03:47 - 2011-05-31 04:42 - 00242792 _____ (DTS) C:\Windows\system32\DTSLFXAPO64.dll
2015-06-03 03:47 - 2011-05-31 04:42 - 00242792 _____ (DTS) C:\Windows\system32\DTSGFXAPO64.dll
2015-06-03 03:47 - 2011-05-31 04:42 - 00241768 _____ (DTS) C:\Windows\system32\DTSGFXAPONS64.dll
2015-06-03 03:47 - 2011-03-17 07:17 - 01361336 _____ (TOSHIBA Corporation) C:\Windows\system32\tosade.dll
2015-06-03 03:47 - 2011-03-07 12:11 - 00148416 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo.dll
2015-06-03 03:47 - 2010-11-08 02:31 - 00375128 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll
2015-06-03 03:47 - 2010-11-08 02:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll
2015-06-03 03:47 - 2010-11-08 02:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll
2015-06-03 03:47 - 2010-11-08 02:31 - 00204120 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll
2015-06-03 03:47 - 2010-11-08 02:31 - 00101208 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll
2015-06-03 03:47 - 2010-11-08 02:31 - 00078680 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll
2015-06-03 03:47 - 2010-11-03 13:30 - 00149608 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll
2015-06-03 03:47 - 2010-09-27 04:34 - 00318808 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll
2015-06-03 03:47 - 2010-07-22 11:48 - 00074064 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\SysWOW64\SFCOM.dll
2015-06-03 03:47 - 2009-11-24 04:55 - 00518896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSX64.dll
2015-06-03 03:47 - 2009-11-24 04:55 - 00211184 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSH64.dll
2015-06-03 03:47 - 2009-11-24 04:55 - 00198896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP64.dll
2015-06-03 03:47 - 2009-11-24 04:55 - 00155888 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW64.dll
2015-06-03 03:46 - 2015-06-03 03:46 - 00000401 _____ () C:\Windows\system32\{F33C3B9B-72AF-418A-B3FD-560646F7CDA2}.bat
2015-06-03 03:45 - 2015-06-03 03:45 - 00001397 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2015-06-03 03:44 - 2015-06-03 03:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-06-03 03:44 - 2015-04-09 03:58 - 01756424 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2015-06-03 03:44 - 2015-04-09 03:58 - 01570672 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2015-06-03 03:44 - 2015-04-09 03:58 - 01316000 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2015-06-03 03:44 - 2015-04-09 03:58 - 01316000 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2015-06-03 03:44 - 2015-04-08 23:32 - 00560968 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2015-06-03 03:44 - 2010-05-26 21:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2015-06-03 03:44 - 2010-05-26 21:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2015-06-03 03:44 - 2010-05-26 21:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2015-06-03 03:44 - 2010-05-26 21:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2015-06-03 03:44 - 2010-05-26 21:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2015-06-03 03:44 - 2010-05-26 21:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 31570064 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 30397072 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 25375048 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 24053576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 17176128 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 15818528 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 15716232 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 14617288 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 14006752 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 12852784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 12689592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 11380728 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 10423952 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2015-06-03 03:43 - 2015-04-09 03:58 - 03317344 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 02935416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 02896528 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 02573456 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 01895568 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6435012.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 01557648 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6435012.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 01540240 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 01086424 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 01047368 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 01037640 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 00970568 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 00962192 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 00927440 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 00849552 _____ () C:\Windows\system32\nvmcumd.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 00499344 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 00402576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 00390472 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 00346256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 00195728 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2015-06-03 03:43 - 2015-04-09 03:58 - 00175880 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 00154256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 00150648 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 00128512 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 00038032 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2015-06-03 03:43 - 2015-04-09 03:58 - 00035472 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 00032400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2015-06-03 03:43 - 2015-04-09 03:58 - 00030536 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2015-06-03 03:41 - 2015-06-03 03:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Realtek
2015-06-03 03:41 - 2014-03-17 12:57 - 00843480 _____ (Realtek ) C:\Windows\system32\Drivers\Rt630x64.sys
2015-06-03 03:41 - 2014-03-17 12:57 - 00073800 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RtNicProp64.dll
2015-06-03 03:41 - 2013-09-26 13:01 - 00028888 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RtNdPt630.sys
2015-06-03 03:41 - 2012-09-01 02:00 - 00032400 _____ (Realtek Corporation) C:\Windows\system32\Drivers\RtVlan620.sys
2015-06-03 03:41 - 2012-07-03 15:32 - 00058512 _____ (Realtek Corporation) C:\Windows\system32\Drivers\RtTeam620.sys
2015-06-03 03:40 - 2013-09-16 22:17 - 00016344 _____ (Intel Corporation) C:\Windows\system32\Drivers\IntelMEFWVer.dll
2015-06-03 03:39 - 2015-06-03 03:39 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_TeeDriverx64_01011.Wdf
2015-06-03 03:39 - 2013-09-16 22:17 - 00099288 _____ (Intel Corporation) C:\Windows\system32\Drivers\TeeDriverx64.sys
2015-06-03 03:38 - 2015-06-03 03:40 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
2015-06-03 03:38 - 2015-06-03 03:38 - 00835482 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-06-03 03:30 - 2015-06-03 03:44 - 00000000 ____D () C:\Windows\LastGood.Tmp
2015-06-03 03:24 - 2015-04-09 00:30 - 06841488 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2015-06-03 03:24 - 2015-04-09 00:30 - 03478344 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2015-06-03 03:24 - 2015-04-09 00:30 - 02558608 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2015-06-03 03:24 - 2015-04-09 00:30 - 00936264 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2015-06-03 03:24 - 2015-04-09 00:30 - 00385168 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2015-06-03 03:24 - 2015-04-09 00:30 - 00062608 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2015-06-03 03:24 - 2015-04-08 20:52 - 04336074 _____ () C:\Windows\system32\nvcoproc.bin
2015-06-03 03:23 - 2015-03-20 07:02 - 00086528 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2015-06-03 03:23 - 2015-03-20 07:02 - 00082432 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2015-06-03 00:30 - 2015-06-03 00:30 - 00000000 ____D () C:\Users\RossBossBG\Tracing
2015-06-03 00:30 - 2015-06-03 00:30 - 00000000 ____D () C:\Users\RossBossBG\AppData\Local\Skype
2015-06-03 00:29 - 2015-06-02 23:37 - 00000000 ____D () C:\Windows\Panther
2015-06-03 00:29 - 2015-06-02 23:21 - 00000000 ____D () C:\Users\RossBossBG\AppData\Roaming\Skype
2015-06-03 00:29 - 2015-06-02 18:02 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-06-03 00:26 - 2015-06-03 00:26 - 00000000 ____D () C:\Users\RossBossBG\AppData\Roaming\Mozilla
2015-06-03 00:26 - 2015-06-03 00:26 - 00000000 ____D () C:\Users\RossBossBG\AppData\Local\Mozilla
2015-06-03 00:26 - 2015-06-03 00:26 - 00000000 ____D () C:\ProgramData\Mozilla
2015-06-03 00:06 - 2015-06-03 00:06 - 00000000 ____D () C:\ProgramData\Google
2015-06-03 00:05 - 2015-06-03 00:14 - 00000000 ____D () C:\Users\RossBossBG\AppData\Local\Google
2015-06-03 00:05 - 2015-06-02 17:15 - 00000000 ____D () C:\Program Files (x86)\Google
2015-06-03 00:00 - 2015-06-03 00:02 - 00000000 ____D () C:\Users\RossBossBG\AppData\Local\NVIDIA Corporation
2015-06-03 00:00 - 2015-06-03 00:00 - 00000000 ____D () C:\Users\RossBossBG\AppData\Local\NVIDIA
2015-06-03 00:00 - 2015-06-02 23:19 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-06-02 23:59 - 2015-06-03 03:44 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2015-06-02 23:59 - 2015-06-03 03:44 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2015-06-02 23:59 - 2015-06-03 00:03 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2015-06-02 23:58 - 2015-06-02 23:58 - 00000000 ____D () C:\NVIDIA
2015-06-02 23:54 - 2015-06-03 03:40 - 00000000 ____D () C:\Program Files\Intel
2015-06-02 23:54 - 2015-06-03 03:38 - 00000000 ____D () C:\ProgramData\Intel
2015-06-02 23:54 - 2015-06-02 23:54 - 00000000 ____D () C:\Users\RossBossBG\AppData\Roaming\Intel Corporation
2015-06-02 23:54 - 2015-06-02 23:54 - 00000000 ____D () C:\Users\RossBossBG\AppData\Roaming\InstallShield
2015-06-02 23:53 - 2015-06-02 23:53 - 00000000 ____D () C:\Users\RossBossBG\Intel
2015-06-02 23:52 - 2015-06-03 03:47 - 00000000 ____D () C:\Intel
2015-06-02 23:52 - 2015-06-03 03:39 - 00000000 ____D () C:\Program Files (x86)\Intel
2015-06-02 23:52 - 2015-06-02 23:52 - 00000000 ____H () C:\ProgramData\DP45977C.lfl
2015-06-02 23:52 - 2013-08-22 01:16 - 00053248 _____ (Windows XP Bundled build C-Centric Single User) C:\Windows\SysWOW64\CSVer.dll
2015-06-02 23:51 - 2015-06-03 03:48 - 00000000 ___HD () C:\Program Files (x86)\Temp
2015-06-02 23:51 - 2015-06-03 03:41 - 00000000 ____D () C:\Program Files (x86)\Realtek
2015-06-02 23:51 - 2015-06-02 18:48 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-06-02 23:51 - 2014-02-26 10:16 - 02080472 _____ (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll
2015-06-02 23:42 - 2015-06-02 23:25 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3456315844-1928112805-2880478906-1001
2015-06-02 23:37 - 2015-06-03 03:18 - 00000000 ____D () C:\Users\RossBossBG
2015-06-02 23:37 - 2015-06-02 23:38 - 00000000 ____D () C:\Users\RossBossBG\AppData\Local\Packages
2015-06-02 23:37 - 2015-06-02 23:37 - 00001446 _____ () C:\Users\RossBossBG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-06-02 23:37 - 2015-06-02 23:37 - 00000020 ___SH () C:\Users\RossBossBG\ntuser.ini
2015-06-02 23:37 - 2015-06-02 23:37 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-06-02 23:37 - 2015-06-02 23:37 - 00000000 ____D () C:\Windows\CSC
2015-06-02 23:37 - 2015-06-02 23:37 - 00000000 ____D () C:\Users\RossBossBG\AppData\Local\VirtualStore
2015-06-02 23:37 - 2015-06-02 22:49 - 01536830 _____ () C:\Windows\WindowsUpdate.log
2015-06-02 23:37 - 2015-06-02 19:37 - 00000000 ____D () C:\Users\RossBossBG\AppData\Roaming\Adobe
2015-06-02 23:37 - 2014-11-21 18:14 - 00000000 ___RD () C:\Users\RossBossBG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-06-02 23:37 - 2014-11-21 18:14 - 00000000 ___RD () C:\Users\RossBossBG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-06-02 23:37 - 2014-11-21 18:14 - 00000000 ___RD () C:\Users\RossBossBG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-06-02 23:37 - 2014-11-21 10:48 - 00000369 _____ () C:\Users\RossBossBG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2015-06-02 23:37 - 2014-11-21 10:48 - 00000369 _____ () C:\Users\RossBossBG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2015-06-02 23:37 - 2013-08-22 18:36 - 00000000 ____D () C:\Users\RossBossBG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-06-02 23:33 - 2015-06-02 23:33 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2015-06-02 23:25 - 2015-06-02 23:25 - 00012598 _____ () C:\Users\RossBossBG\Desktop\FRST.txt
2015-06-02 23:25 - 2015-06-02 23:25 - 00000000 ____D () C:\FRST
2015-06-02 23:19 - 2015-06-02 23:19 - 00000682 _____ () C:\Windows\system32\.crusader
2015-06-02 23:14 - 2015-06-02 23:21 - 00000000 ____D () C:\Program Files\HitmanPro
2015-06-02 23:14 - 2015-06-02 23:19 - 00000000 ____D () C:\ProgramData\HitmanPro
2015-06-02 23:13 - 2015-06-02 23:14 - 11024496 _____ (SurfRight B.V.) C:\Users\RossBossBG\Desktop\HitmanPro_x64.exe
2015-06-02 23:12 - 2015-06-02 23:12 - 02108928 _____ (Farbar) C:\Users\RossBossBG\Desktop\FRST64.exe
2015-06-02 23:08 - 2015-06-02 23:08 - 01124544 _____ (Adobe Systems Incorporated) C:\Users\RossBossBG\Desktop\flashplayer17_ha_install.exe
2015-06-02 22:31 - 2015-06-02 22:31 - 00000000 ____D () C:\Users\RossBossBG\AppData\Roaming\WinRAR
2015-06-02 21:16 - 2015-06-02 21:16 - 00000000 ____D () C:\Users\RossBossBG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-06-02 21:16 - 2015-06-02 21:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-06-02 21:16 - 2015-06-02 21:16 - 00000000 ____D () C:\Program Files\WinRAR
2015-06-02 21:06 - 2015-06-02 21:06 - 00004608 _____ () C:\Windows\SECOH-QAD.exe
2015-06-02 21:06 - 2015-06-02 21:06 - 00003584 _____ () C:\Windows\SECOH-QAD.dll
2015-06-02 19:05 - 2015-06-02 19:05 - 00000943 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6 (64 Bit).lnk
2015-06-02 19:05 - 2015-06-02 19:05 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe
2015-06-02 19:04 - 2015-06-02 19:04 - 00000913 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6 (64bit).lnk
2015-06-02 19:04 - 2015-06-02 19:04 - 00000888 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6.lnk
2015-06-02 19:04 - 2015-06-02 19:04 - 00000860 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6.lnk
2015-06-02 19:03 - 2015-06-02 19:03 - 00001008 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS6.lnk
2015-06-02 19:02 - 2015-06-02 19:02 - 00001543 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS6.lnk
2015-06-02 19:02 - 2015-06-02 19:02 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-06-02 19:00 - 2015-06-02 19:05 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2015-06-02 18:58 - 2015-06-02 19:05 - 00000000 ____D () C:\ProgramData\Adobe
2015-06-02 18:57 - 2015-06-02 19:36 - 00000000 ____D () C:\Users\RossBossBG\AppData\Local\Adobe
2015-06-02 18:53 - 2015-06-02 18:53 - 00000000 ____D () C:\Users\RossBossBG\AppData\Roaming\Sony
2015-06-02 18:53 - 2015-06-02 18:53 - 00000000 ____D () C:\Users\RossBossBG\AppData\Roaming\Publish Providers
2015-06-02 18:53 - 2015-06-02 18:53 - 00000000 ____D () C:\Users\RossBossBG\AppData\Roaming\NVIDIA
2015-06-02 18:52 - 2015-06-02 18:53 - 00000000 ____D () C:\Users\RossBossBG\AppData\Local\Sony
2015-06-02 18:52 - 2015-06-02 18:52 - 00000000 ____D () C:\ProgramData\Sony
2015-06-02 18:52 - 2015-06-02 18:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
2015-06-02 18:52 - 2015-06-02 18:52 - 00000000 ____D () C:\Program Files\Sony
2015-06-02 18:52 - 2015-06-02 18:52 - 00000000 ____D () C:\Program Files (x86)\Sony
2015-06-02 18:51 - 2015-06-02 18:51 - 00000080 _____ () C:\Users\RossBossBG\AppData\Local剜捯獫慴⁲慇敭屳呇⁁屖湥楴汴浥湥⹴湩潦
2015-06-02 18:51 - 2015-06-02 18:51 - 00000000 ____D () C:\Users\RossBossBG\AppData\Local\Rockstar Games
2015-06-02 18:50 - 2015-06-02 22:31 - 00000000 ____D () C:\Users\RossBossBG\Documents\Rockstar Games
2015-06-02 18:49 - 2015-06-02 18:51 - 00000000 ____D () C:\Program Files\Rockstar Games
2015-06-02 18:49 - 2015-06-02 18:51 - 00000000 ____D () C:\Program Files (x86)\Rockstar Games
2015-06-02 18:49 - 2015-06-02 18:49 - 00010123 _____ () C:\Windows\DirectX.log
2015-06-02 18:49 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2015-06-02 18:49 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2015-06-02 18:49 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2015-06-02 18:49 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2015-06-02 18:49 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2015-06-02 18:49 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2015-06-02 18:49 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2015-06-02 18:49 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2015-06-02 18:49 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2015-06-02 18:49 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2015-06-02 18:49 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2015-06-02 18:49 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2015-06-02 18:49 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2015-06-02 18:49 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2015-06-02 18:49 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2015-06-02 18:49 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2015-06-02 18:49 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2015-06-02 18:49 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2015-06-02 18:49 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll
2015-06-02 18:49 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2015-06-02 18:49 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2015-06-02 18:49 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll
2015-06-02 18:49 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll
2015-06-02 18:49 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2015-06-02 18:49 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll
2015-06-02 18:49 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2015-06-02 18:49 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll
2015-06-02 18:49 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll
2015-06-02 18:49 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll
2015-06-02 18:49 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2015-06-02 18:49 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2015-06-02 18:49 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2015-06-02 18:49 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll
2015-06-02 18:49 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll
2015-06-02 18:49 - 2009-03-16 14:18 - 00521560 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll
2015-06-02 18:49 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2015-06-02 18:49 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2015-06-02 18:49 - 2009-03-16 14:18 - 00174936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll
2015-06-02 18:49 - 2009-03-16 14:18 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll
2015-06-02 18:49 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2015-06-02 18:49 - 2009-03-09 15:27 - 05425496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll
2015-06-02 18:49 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll
2015-06-02 18:49 - 2009-03-09 15:27 - 02430312 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_41.dll
2015-06-02 18:49 - 2009-03-09 15:27 - 01846632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_41.dll
2015-06-02 18:49 - 2009-03-09 15:27 - 00520544 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll
2015-06-02 18:49 - 2009-03-09 15:27 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_41.dll
2015-06-02 18:49 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll
2015-06-02 18:49 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll
2015-06-02 18:49 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2015-06-02 18:49 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll
2015-06-02 18:49 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll
2015-06-02 18:49 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll
2015-06-02 18:49 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll
2015-06-02 18:49 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll
2015-06-02 18:49 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2015-06-02 18:49 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2015-06-02 18:49 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2015-06-02 18:49 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2015-06-02 18:49 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2015-06-02 18:49 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2015-06-02 18:49 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2015-06-02 18:49 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2015-06-02 18:49 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2015-06-02 18:49 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2015-06-02 18:49 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2015-06-02 18:49 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2015-06-02 18:49 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2015-06-02 18:49 - 2008-07-10 11:00 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2015-06-02 18:49 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2015-06-02 18:49 - 2008-07-10 11:00 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2015-06-02 18:49 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2015-06-02 18:49 - 2008-07-10 11:00 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2015-06-02 18:49 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll
2015-06-02 18:49 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2015-06-02 18:49 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2015-06-02 18:49 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll
2015-06-02 18:49 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll
2015-06-02 18:49 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2015-06-02 18:49 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2015-06-02 18:49 - 2008-05-30 14:16 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll
2015-06-02 18:49 - 2008-05-30 14:11 - 04991496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll
2015-06-02 18:49 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll
2015-06-02 18:49 - 2008-05-30 14:11 - 01941528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll
2015-06-02 18:49 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2015-06-02 18:49 - 2008-05-30 14:11 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll
2015-06-02 18:49 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2015-06-02 18:49 - 2008-03-05 16:04 - 00489480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll
2015-06-02 18:49 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll
2015-06-02 18:49 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2015-06-02 18:49 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll
2015-06-02 18:49 - 2008-03-05 16:00 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll
2015-06-02 18:49 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll
2015-06-02 18:49 - 2008-03-05 15:56 - 04910088 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll
2015-06-02 18:49 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2015-06-02 18:49 - 2008-03-05 15:56 - 01860120 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll
2015-06-02 18:49 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll
2015-06-02 18:49 - 2008-02-05 23:07 - 00529424 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll
2015-06-02 18:49 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll
2015-06-02 18:49 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll
2015-06-02 18:49 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2015-06-02 18:49 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll
2015-06-02 18:49 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
2015-06-02 18:49 - 2007-10-12 15:14 - 05081608 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_36.dll
2015-06-02 18:49 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
2015-06-02 18:49 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll
2015-06-02 18:49 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
2015-06-02 18:49 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll
2015-06-02 18:49 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
2015-06-02 18:49 - 2007-07-20 00:57 - 00411496 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_9.dll
2015-06-02 18:49 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
2015-06-02 18:49 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll
2015-06-02 18:49 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll
2015-06-02 18:49 - 2007-07-19 18:14 - 01985904 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_35.dll
2015-06-02 18:49 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2015-06-02 18:49 - 2007-07-19 18:14 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_35.dll
2015-06-02 18:49 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2015-06-02 18:49 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2015-06-02 18:49 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2015-06-02 18:49 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll
2015-06-02 18:49 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2015-06-02 18:49 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2015-06-02 18:49 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2015-06-02 18:49 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2015-06-02 18:49 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2015-06-02 18:49 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2015-06-02 18:49 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2015-06-02 18:49 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2015-06-02 18:49 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2015-06-02 18:49 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll
2015-06-02 18:49 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2015-06-02 18:49 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2015-06-02 18:49 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2015-06-02 18:49 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll
2015-06-02 18:49 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2015-06-02 18:49 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2015-06-02 18:49 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2015-06-02 18:49 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2015-06-02 18:49 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2015-06-02 18:49 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2015-06-02 18:49 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2015-06-02 18:49 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2015-06-02 18:49 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2015-06-02 18:49 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll
2015-06-02 18:49 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2015-06-02 18:49 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2015-06-02 18:49 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2015-06-02 18:49 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2015-06-02 18:49 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
2015-06-02 18:49 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2015-06-02 18:49 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2015-06-02 18:49 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2015-06-02 18:49 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2015-06-02 18:49 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2015-06-02 18:49 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2015-06-02 18:49 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2015-06-02 18:49 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
2015-06-02 18:49 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2015-06-02 18:49 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2015-06-02 18:49 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2015-06-02 18:49 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2015-06-02 18:49 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2015-06-02 18:49 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2015-06-02 18:49 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2015-06-02 18:49 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2015-06-02 18:49 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2015-06-02 18:49 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2015-06-02 18:49 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2015-06-02 18:49 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2015-06-02 18:49 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2015-06-02 18:49 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2015-06-02 18:49 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2015-06-02 18:49 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2015-06-02 18:49 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2015-06-02 18:49 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2015-06-02 18:48 - 2015-06-02 18:48 - 00000687 _____ () C:\Users\Public\Desktop\Grand Theft Auto V.lnk
2015-06-02 18:48 - 2015-06-02 18:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games
2015-06-02 18:48 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2015-06-02 18:48 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2015-06-02 18:05 - 2015-06-02 18:05 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf
2015-06-02 18:03 - 2015-06-02 18:03 - 00110688 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2015-06-02 18:03 - 2015-06-02 18:03 - 00000000 ____D () C:\ProgramData\Sun
2015-06-02 18:03 - 2015-06-02 18:03 - 00000000 ____D () C:\ProgramData\Oracle
2015-06-02 18:03 - 2015-06-02 18:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-06-02 18:02 - 2015-06-02 18:02 - 00000000 ____D () C:\ProgramData\Skype
2015-06-02 18:02 - 2015-06-02 18:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-06-02 18:00 - 2015-06-02 18:03 - 00000000 ____D () C:\Program Files\Java
2015-06-02 18:00 - 2015-06-02 18:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit
2015-06-02 17:59 - 2015-06-02 23:20 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-02 17:59 - 2015-06-02 17:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-06-02 17:59 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-06-02 17:59 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-06-02 17:59 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-06-02 17:55 - 2015-06-02 17:55 - 00000000 ____D () C:\Windows\SysWOW64\vbox
2015-06-02 17:55 - 2015-06-02 17:55 - 00000000 ____D () C:\Windows\system32\vbox
2015-06-02 17:54 - 2015-06-02 17:54 - 00001175 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-06-02 17:54 - 2015-06-02 17:54 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-06-02 17:53 - 2015-06-02 17:53 - 00003946 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{63E3F448-AF12-4B13-9FD8-EF83A9B42656}
2015-06-02 17:53 - 2015-06-02 17:53 - 00000000 __SHD () C:\Users\RossBossBG\AppData\Local\EmieUserList
2015-06-02 17:53 - 2015-06-02 17:53 - 00000000 __SHD () C:\Users\RossBossBG\AppData\Local\EmieSiteList
2015-06-02 17:53 - 2015-06-02 17:53 - 00000000 __SHD () C:\Users\RossBossBG\AppData\Local\EmieBrowserModeList
2015-06-02 17:02 - 2015-06-02 17:54 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-06-02 16:31 - 2015-06-02 17:59 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-06-02 16:31 - 2015-06-02 16:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-06-02 14:57 - 2015-06-02 23:19 - 00000000 ____D () C:\Users\RossBossBG\AppData\Roaming\uTorrent
2015-06-02 14:57 - 2015-06-02 14:57 - 00000000 ____D () C:\Users\RossBossBG\AppData\Roaming\Macromedia

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-03 14:48 - 2013-08-22 18:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-06-03 03:40 - 2013-08-22 18:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2015-06-03 03:24 - 2013-08-22 18:36 - 00000000 ____D () C:\Windows\Help
2015-06-03 00:29 - 2013-08-22 18:36 - 00262144 _____ () C:\Windows\system32\config\BCD-Template
2015-06-02 23:53 - 2013-08-22 18:36 - 00000000 ____D () C:\Windows\system32\restore
2015-06-02 23:34 - 2013-08-22 18:37 - 00002988 _____ () C:\Windows\DtcInstall.log
2015-06-02 23:34 - 2013-08-22 18:36 - 00000000 ____D () C:\Windows\system32\Recovery
2015-06-02 23:32 - 2013-08-22 16:36 - 00000000 __RHD () C:\Users\Default
2015-06-02 23:19 - 2013-08-22 17:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-06-02 23:09 - 2014-11-21 10:38 - 00820548 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-06-02 23:03 - 2013-08-22 16:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-06-02 23:02 - 2013-08-22 18:36 - 00000000 ____D () C:\Windows\system32\sru
2015-06-02 22:50 - 2013-08-22 17:44 - 04958944 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-06-02 22:49 - 2014-11-21 10:29 - 01320126 _____ () C:\Windows\PFRO.log
2015-06-02 20:05 - 2013-08-22 18:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-06-02 18:05 - 2013-08-22 17:46 - 00019022 _____ () C:\Windows\setupact.log
2015-06-02 17:15 - 2013-08-22 18:36 - 00000000 ____D () C:\Windows\SysWOW64\WinMetadata
2015-06-02 17:15 - 2013-08-22 18:36 - 00000000 ____D () C:\Windows\system32\WinMetadata
2015-06-02 17:15 - 2013-08-22 18:36 - 00000000 ____D () C:\Windows\security
2015-06-02 17:15 - 2013-08-22 18:36 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-06-02 17:15 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\Sysprep
2015-06-02 17:15 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-06-02 17:15 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\servicing
2015-06-02 17:14 - 2013-08-22 18:36 - 00000000 ____D () C:\Windows\registration

==================== Files in the root of some directories =======

2015-06-02 23:52 - 2015-06-02 23:52 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some files in TEMP:
====================
C:\Users\RossBossBG\AppData\Local\Temp\HitmanPro.exe
C:\Users\RossBossBG\AppData\Local\Temp\nvStInst.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-06-02 23:32

==================== End of log ============================

Addition.txt

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Hello and welcome to Malwarebytes.org

 

P2P/Piracy Warning:

 

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here. Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

Next,

 

Change the download folder setting in the default Browser so all tools we may use are saved to the Desktop:

 

Chrome.JPGGoogle Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser. Settings.JPG

Choose Settings. at the bottom of the screen click the

"Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK.

 

Firefox.JPGMozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser. Settings.JPG Choose Options. In the downloads section, click the Browse button, click on the Desktop folder and the click the "Select Folder" button. Click OK to get out of the Options menu.

 

IE.jpgInternet Explorer - Click the Tools menu in the upper right-corner of the browser. Tools.JPG Select View downloads. Select the Options link in the lower left of the window. Click Browse and select the Desktop and then choose the Select Folder button. Click OK to get out of the download options screen and then click Close to get out of the View Downloads screen.

NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop.

 

Next,

 

Follow the instructions in the following link to show hidden files:

 

http://www.bleepingcomputer.com/tutorials/how-to-see-hidden-files-in-windows/

 

Next,

 

Please open Malwarebytes Anti-Malware.

 


On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits".
Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware
Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
A Threat Scan will begin.
With some infections, you may or may not see this message box.
 
        'Could not load DDA driver'
 
Click 'Yes' to this message, to allow the driver to load after a restart.
Allow the computer to restart. Continue with the rest of these instructions.
When the scan is complete, click Apply Actions.
Wait for the prompt to restart the computer to appear, then click on Yes.
After the restart once you are back at your desktop, open MBAM once more.

 

To get the log from Malwarebytes do the following:

 


Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click Export > From export you have three options:
 
  Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
  Text file (*.txt)        - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
  XML file (*.xml)      - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
 
Recommend you use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…

 

 

If Malwarebytes is not installed follow these instructions first:

 

Download Malwarebytes Anti-Malware to your desktop.


Double-click mbam-setup and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:
Launch Malwarebytes Anti-Malware
A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
Click Finish. Follow the instructions above....

 

Next,

 

Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/

 


Quit all running programs.
For Windows XP, double-click to start.
For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
Read and accept the EULA (End User Licene Agreement)
Click Scan to scan the system.
When the scan completes select "Report", log will open. Close the program > Don't Fix anything!
Post back the report which should also be located here:

 

C:\Programdata\RogueKiller\Logs <-------- W7/8

C:\Documents and Settings\All Users\Application Data\RogueKiller\Logs <------XP

 

 

Let me see those logs in your reply....

 

Thank you,

 

Kevin...

Link to post
Share on other sites
CaptainRos

CaptainRos

Posted
  • Author
Posted

Hi!

Thanks for the fast reply! I removed the current software.

 

Application log:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 3.6.2015 г.
Scan Time: 0:32:42
Logfile:
Administrator: Yes

Version: 2.01.6.1022
Malware Database: v2015.06.02.06
Rootkit Database: v2015.06.02.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: RossBossBG

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 351589
Time Elapsed: 5 min, 7 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 1
PUP.Optional.OpenCandy, C:\Users\RossBossBG\AppData\Local\Temp\HYDC554.tmp.1433276428\HTA\install.1433276428.zip, Quarantined, [f0fed6dfd8b249ed80bd97c36e98a45c],

Physical Sectors: 0
(No malicious items detected)


(end)

 

 

 

Report from Rogue Killer:

RogueKiller V10.8.0.0 [Jun  1 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 8.1 (6.3.9200 ) 64 bits version
Started in : Normal mode
User : RossBossBG [Administrator]
Started from : C:\Users\RossBossBG\Desktop\RogueKiller.exe
Mode : Scan -- Date : 06/03/2015  00:44:46

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 4 ¤¤¤
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 62.221.132.211 85.130.60.11 [iTALY (IT)][bULGARIA (BG)]  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 62.221.132.211 85.130.60.11 [iTALY (IT)][bULGARIA (BG)]  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{9422E2B0-6FAD-4812-8191-F5700547D000} | DhcpNameServer : 62.221.132.211 85.130.60.11 [iTALY (IT)][bULGARIA (BG)]  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{9422E2B0-6FAD-4812-8191-F5700547D000} | DhcpNameServer : 62.221.132.211 85.130.60.11 [iTALY (IT)][bULGARIA (BG)]  -> Found

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000036b]) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: WDC WD10EZEX-00BN5A0 +++++
--- User ---
[MBR] ee0c17d46f1f44fb3816afac3fe2d5be
[bSP] be8056990cecea664b0af446b2c63d68 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 350 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 718848 | Size: 204450 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 419432448 | Size: 749066 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK
 

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Thanks for the update, continue:

 

Download AdwCleaner by Xplode onto your Desktop.


Double click on Adwcleaner.exe to run the tool.
Click on Scan
Once the scan is done, click on the Clean button. <<<--- Ensure this option is completed
You will get a prompt asking to close all programs. Click OK.
Click OK again to reboot your computer.
A text file will open after the restart. Please post the content of that logfile in your reply.
You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number

 

Next,

 

thisisujrt.gif Please download Junkware Removal Tool to your desktop.


Shut down your protection software now to avoid potential conflicts. (re-enable when done)
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

 

Next,

 

Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop

Ensure to get the correct version for your system....

32 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

64 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en

 

Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window

In the "Scan Type" window, select Quick Scan

Perform a scan and  Click Finish when the scan is done.

Retrieve the MSRT log as follows, and post it in your next reply:

 

1) Select the Windows key and R key together to open the "Run" function

2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:

 

notepad c:\windows\debug\mrt.log

 

Let me see those logs, also give an update on any remaining issues or concerns...

 

Thanks,

 

Kevin...

Link to post
Share on other sites
CaptainRos

CaptainRos

Posted
  • Author
Posted

AdwCleaner log:

# AdwCleaner v4.206 - Logfile created 03/06/2015 at 01:49:39
# Updated 01/06/2015 by Xplode
# Database : 2015-06-01.1 [server]
# Operating system : Windows 8.1 Pro  (x64)
# Username : RossBossBG - ROSSBOSS
# Running from : C:\Users\RossBossBG\Desktop\AdwCleaner.exe
# Option : Cleaning

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Scheduled tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17416


-\\ Mozilla Firefox v38.0.5 (x86 en-US)


-\\ Google Chrome v


*************************

AdwCleaner[R0].txt - [767 bytes] - [03/06/2015 01:48:36]
AdwCleaner[s0].txt - [693 bytes] - [03/06/2015 01:49:39]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [751  bytes] ##########
 

 

JRT log:

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.8.7 (06.01.2015:1)
OS: Windows 8.1 Pro x64
Ran by RossBossBG on ба 03.06.2015 Ј. at  1:55:49,93
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values



~~~ Registry Keys



~~~ Files

Successfully deleted: [File] C:\Windows\prefetch\GOOGLETOOLBARINSTALLER_EN_SIG-9E7CD4D6.pf
Successfully deleted: [File] C:\Windows\prefetch\GOOGLETOOLBARMANAGER_BA9226F4-3D073F18.pf
Successfully deleted: [File] C:\Windows\prefetch\GOOGLETOOLBARNOTIFIER.EXE-7AE0A20E.pf
Successfully deleted: [File] C:\Windows\prefetch\GTOOLBAR_SETUP_14332791583440-28ADFB1B.pf



~~~ Folders





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on ба 03.06.2015 Ј. at  1:57:00,80
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

 

MRT Log:


---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.24, May 2015 (build 5.24.11401.0)
Started On Wed Jun 03 01:59:51 2015

Engine: 1.1.11602.0
Signatures: 1.197.1100.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Wed Jun 03 02:02:11 2015


Return code: 0 (0x0)
 

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Ok finish with ESET online scan, this will take a few hours to complete:

 

ESETOnline.png Scan with ESET Online Scanner

 

This step can only be done using Internet Explorer, Google Chrome or Mozilla Firefox.

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

Please visit ESET Online Scanner website.

 

Click there Run ESET Online Scanner.

 

If using Internet Explorer:

 


Accept the Terms of Use and click Start.
Allow the running of add-on.

If using Mozilla Firefox or Google Chrome:


Download esetsmartinstaller_enu.exe that you'll be given link to.
Double click esetsmartinstaller_enu.exe.
Allow the Terms of Use and click Start.

To perform the scan:


Make sure that Remove found threats is unchecked.
Scan archives is checked.
In Advanced Settings: Scan for potentially unwanted applications, Scan for potentially unsafe applications and Enable Anti-Stealth technology are checked.
Under “Enable Stealth Technology select “Change” select any extra drives in that window.
Click Start
The program will begin to download it's virus database. The speed may vary depending on your Internet connection.
When completed, the program will begin to scan. This may take several hours. Please, be patient.
Do not do anything on your machine as it may interrupt the scan.
When the scan is done, click Finish.
A logfile will be created at C:\Program Files (x86)\ESET\ESET Online Scanner. Open it using Notepad.

 

Please include this logfile in your next reply.

 

Don't forget to re-enable protection software!

 

If this log is clean we can clean up...

 

Thank you,

 

Kevin...

Link to post
Share on other sites
CaptainRos

CaptainRos

Posted
  • Author
Posted

Hello! The Scan is Complete. Here is the log file:

 

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=2b1943d572360f43b748cd2ce091cf74
# end=init
# utc_time=2015-06-02 11:21:22
# local_time=2015-06-03 02:21:22 (+0200, FLE Daylight Time)
# country="Bulgaria"
# osver=6.2.9200 NT
Update Init
Update Download
Update Finalize
Updated modules version: 24143
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=2b1943d572360f43b748cd2ce091cf74
# end=updated
# utc_time=2015-06-02 11:25:25
# local_time=2015-06-03 02:25:25 (+0200, FLE Daylight Time)
# country="Bulgaria"
# osver=6.2.9200 NT
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=2b1943d572360f43b748cd2ce091cf74
# engine=24143
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-06-02 11:50:50
# local_time=2015-06-03 02:50:50 (+0200, FLE Daylight Time)
# country="Bulgaria"
# lang=1033
# osver=6.2.9200 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 16706153 58170343 0 0
# scanned=139359
# found=3
# cleaned=0
# scan_time=1524
sh=1EE3CD79A1E9917B126A936CD67083988097C4DF ft=1 fh=d2bc14e7d54b4918 vn="a variant of MSIL/HackTool.IdleKMS.E potentially unsafe application" ac=I fn="C:\Users\RossBossBG\AppData\Roaming\Microsoft\Windows\Templates\KMSpico_setup.exe"
sh=6EF8310627537B1D24409574BC3C398CD97C474C ft=1 fh=8f545065e84edd76 vn="Win64/HackKMS.D potentially unsafe application" ac=I fn="C:\Windows\SECOH-QAD.dll"
sh=66C72019EAFA41BBF3E708CC3824C7C4447BDAB6 ft=1 fh=0a46a8abafa4da1b vn="Win64/HackKMS.C potentially unsafe application" ac=I fn="C:\Windows\SECOH-QAD.exe"
 

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

It would seem that you have illegal software installed and running on your system, If correct that action is a direct breach of Forum Protocol....

 

Run the following and post the requested log..

 

Select the Windows key and X key together, from the menu select "Command prompt (Admin)"

 

Copy the following command at the prompt:

 

Licensingdiag.exe -report %userprofile%\desktop\report.txt -log %userprofile%\desktop\repfiles.cab

 

put cursor at the command prompt then Right click and select paste, hit enter. Two files will be saved to your Desktop.

 

Attach the "report.txt" file to your reply. - you can ignore the repfiles.cab file, it's only backup data.

 

Thank you,

 

Kevin...

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Unfortunately the version of Windows 8.1 is cracked, the Licence is not genuine. That is a direct breach of forum protocol, as such I cannot offer any further help.

Your thread will be locked and closed shortly. If you dispute that action please contact a forum moderator and give your reasons...

 

Thank you,

 

Kevin.

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.