I think I have HKLMM.com

[JPSmith]

My browsers are completely locked up.  Whenever I try to go somewhere the page I navigate to stops responding and I get an additional page saying I have a virus and I should call a number for help removing it.  I tried MalwareBytes to no avail.

 

 

Here is my Farbar log:

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-07-2015

Ran by kuechl (administrator) on TYR on 09-07-2015 09:44:26

Running from C:\Users\kuechl\Desktop

Loaded Profiles: kuechl (Available Profiles: kuechl & kuechj & jp)

Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)

Internet Explorer Version 11 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(SafeNet Inc.) C:\Windows\System32\hasplms.exe

() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.EXE

(National Instruments Corporation) C:\Windows\SysWOW64\nipalsm.exe

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security 8 for Windows\avp.exe

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security 8 for Windows\avp.exe

(HP) C:\Windows\System32\HPSIsvc.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Symantec) C:\Program Files (x86)\Norton Ghost\Shared\Drivers\SymSnapServicex64.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Garmin Ltd. or its subsidiaries) C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\prevhost.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe

 

 

==================== Registry (Whitelisted) ==================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [sysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-01-21] (IDT, Inc.)

HKLM\...\Run: [iAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2010-01-08] (Intel Corporation)

HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2174760 2010-06-04] (Synaptics Incorporated)

HKLM\...\Run: [intelliPoint] => c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2327952 2010-07-21] (Microsoft Corporation)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)

HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2722080 2013-09-05] ()

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-07] (Apple Inc.)

HKLM-x32\...\Run: [iMSS] => C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe [111640 2009-11-04] ()

HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496 2009-11-20] (NEC Electronics Corporation)

HKLM-x32\...\Run: [QlbCtrl.exe] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [287800 2009-11-11] ( Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [Microsoft Default Manager] => C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [439568 2010-05-10] (Microsoft Corporation)

HKLM-x32\...\Run: [Norton Ghost 15.0] => C:\Program Files (x86)\Norton Ghost\Agent\VProTray.exe [2598760 2010-03-03] (Symantec Corporation)

HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2011-04-08] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [switchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41360 2015-04-29] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840592 2015-04-29] (Adobe Systems Inc.)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-03-20] (Apple Inc.)

HKLM-x32\...\Run: [AVP] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security 8 for Windows\avp.exe [515888 2013-02-07] (Kaspersky Lab ZAO)

HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1273448 2012-04-03] (CANON INC.)

HKLM-x32\...\Run: [niDevMon] => C:\Program Files (x86)\National Instruments\NI-DAQ\HWConfig\nidevmon.exe [119120 2014-02-12] (National Instruments Corporation)

Winlogon\Notify\klogon: C:\Windows\system32\klogon.dll (Kaspersky Lab ZAO)

Winlogon\Notify\ScCertProp: wlnotify.dll [X]

HKLM\...\Policies\Explorer: [HideSCAHealth] 1

HKU\S-1-5-21-1715567821-813497703-1801674531-1130\...\Run: [AdobeBridge] => [X]

HKU\S-1-5-21-1715567821-813497703-1801674531-1130\...\Run: [NIRegistrationWizard] => C:\Program Files (x86)\National Instruments\Shared\RegistrationWizard\Bin\RegistrationWizard.exe [847000 2013-04-19] ()

HKU\S-1-5-21-1715567821-813497703-1801674531-1130\...\Run: [GarminExpressTrayApp] => "C:\Program Files (x86)\Garmin\Express Tray\tray.exe"

HKU\S-1-5-21-1715567821-813497703-1801674531-1130\...\MountPoints2: K - K:\LaunchU3.exe -a

HKU\S-1-5-21-1715567821-813497703-1801674531-1130\...\MountPoints2: {d5b88fa9-63a7-11e1-9bee-e01e7314eea2} - K:\LaunchU3.exe -a

HKU\S-1-5-21-1715567821-813497703-1801674531-1130\...\MountPoints2: {df8be996-0678-11e1-8fad-d8d3852a34b2} - F:\SISetup.exe

HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1403224 2015-04-23] (Garmin Ltd. or its subsidiaries)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk [2011-02-02]

ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NI Error Reporting.lnk [2011-10-26]

ShortcutTarget: NI Error Reporting.lnk -> C:\Program Files (x86)\National Instruments\Shared\NI Error Reporting\nierserver.exe (National Instruments Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk [2011-07-11]

ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{467D5E81-8349-4892-9E81-C3674ED8E451}\Icon09DB8A851.exe ()

Startup: C:\Users\kuechl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2011-12-19] ()

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-1715567821-813497703-1801674531-1130\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-1715567821-813497703-1801674531-1130\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp

HKU\S-1-5-21-1715567821-813497703-1801674531-1130\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/

SearchScopes: HKU\S-1-5-21-1715567821-813497703-1801674531-1130 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-02] (Google Inc.)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)

BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-02] (Google Inc.)

BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-04-29] (Adobe Systems Incorporated)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-05-04] (Sun Microsystems, Inc.)

BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-04-29] (Adobe Systems Incorporated)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-02] (Google Inc.)

Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-04-29] (Adobe Systems Incorporated)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-02] (Google Inc.)

Toolbar: HKU\S-1-5-21-1715567821-813497703-1801674531-1130 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File

DPF: HKLM-x32 {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: HKLM-x32 {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://mathworksevents.webex.com/client/T27L10NSP21EP5/event/ieatgpc1.cab

DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Winsock: Catalog5 11 C:\Program Files (x86)\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll [26512 2014-06-06] (National Instruments Corporation)

Winsock: Catalog5-x64 11 C:\Program Files\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll [28560 2014-06-06] (National Instruments Corporation)

Tcpip\Parameters: [DhcpNameServer] 10.0.0.10

Tcpip\..\Interfaces\{1E0E6BFA-DA40-46DF-8583-86014A3F16B4}: [DhcpNameServer] 192.168.10.1

Tcpip\..\Interfaces\{7D2D7676-D120-40FD-A470-50863810B765}: [DhcpNameServer] 10.0.0.10

 

FireFox:

========

FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2010-09-17] (Microsoft Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2012-09-20] (Adobe Systems)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()

FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2011-11-30] (CANON INC.)

FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2012-10-29] (Google)

FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll [2011-05-04] (Sun Microsystems, Inc.)

FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2010-09-17] (Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2013-08-29] (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2013-08-29] (NVIDIA Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)

FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll [2015-04-29] (Adobe Systems Inc.)

FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2012-09-20] (Adobe Systems)

FF Plugin HKU\S-1-5-21-1715567821-813497703-1801674531-1130: @citrixonline.com/appdetectorplugin -> C:\Users\kuechl\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2015-04-17] (Citrix Online)

FF HKLM-x32\...\Firefox\Extensions: [{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension

FF Extension: Default Manager - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension [2010-10-26]

FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn

FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2011-09-11]

 

Chrome: 

=======

CHR Profile: C:\Users\kuechl\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (YouTube) - C:\Users\kuechl\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-08-22]

CHR Extension: (Google Search) - C:\Users\kuechl\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-08-22]

CHR Extension: (Chrome Hotword Shared Module) - C:\Users\kuechl\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-16]

CHR Extension: (Google Wallet) - C:\Users\kuechl\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-16]

CHR Extension: (Gmail) - C:\Users\kuechl\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-08-22]

 

==================== Services (Whitelisted) =================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [68096 2011-02-02] () [File not signed]

S2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_2223a6b19a4f4233\AESTSr64.exe [89600 2009-03-03] (Andrea Electronics Corporation)

S2 AnsoftRSMService; C:\Program Files (x86)\Ansoft\RSM\AnsoftRSMService.exe [131584 2011-10-22] (SAS IP, Inc.) [File not signed]

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)

R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security 8 for Windows\avp.exe [515888 2013-02-07] (Kaspersky Lab ZAO)

S2 Cadence License Manager; C:\Cadence\LicenseManager\lmgrd.exe [1814352 2011-08-30] (Flexera Software, Inc.)

R2 Garmin Device Interaction Service; C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe [713736 2015-04-23] (Garmin Ltd. or its subsidiaries)

S3 GenericMount Helper Service; C:\Program Files (x86)\Norton Ghost\Shared\Drivers\GenericMountHelperx64.exe [2227216 2010-02-12] (Symantec)

R2 hasplms; C:\Windows\system32\hasplms.exe [4683144 2014-07-15] (SafeNet Inc.)

R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [140456 2012-03-28] ()

S3 LiveUpdate; C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_3.EXE [3093880 2010-02-17] (Symantec Corporation)

S2 LkCitadelServer; C:\Windows\SysWOW64\lkcitdl.exe [695136 2014-12-02] (National Instruments, Inc.)

S2 lkClassAds; C:\Windows\SysWOW64\lkads.exe [53032 2014-06-09] (National Instruments Corporation)

S2 lkTimeSync; C:\Windows\SysWOW64\lktsrv.exe [63280 2014-06-09] (National Instruments Corporation)

S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)

S2 McNeelUpdate; C:\Program Files (x86)\McNeelUpdate\5.0\McNeelUpdateService.exe [67224 2014-06-09] (Robert McNeel & Associates)

S2 mxssvr; C:\Program Files (x86)\National Instruments\MAX\nimxs.exe [84792 2015-01-09] (National Instruments Corporation)

R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [50688 2011-04-13] (Hewlett-Packard) [File not signed]

R2 ni488enumsvc; C:\Windows\SysWOW64\nipalsm.exe [19280 2014-06-05] (National Instruments Corporation)

S2 NIApplicationWebServer; C:\Program Files (x86)\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe [57184 2014-11-21] (National Instruments Corporation)

S4 NIApplicationWebServer64; C:\Program Files\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe [80736 2014-11-21] (National Instruments Corporation)

S2 niauth; C:\Program Files (x86)\National Instruments\Shared\niauth\niauth_daemon.exe [569152 2014-10-23] (National Instruments Corporation)

S2 nidevldu; C:\Windows\SysWOW64\nidevldu.exe [162672 2015-04-06] (National Instruments Corporation)

S2 NIDomainService; C:\Program Files (x86)\National Instruments\Shared\Security\nidmsrv.exe [394544 2014-06-09] (National Instruments Corporation)

S4 NILM License Manager; C:\Program Files (x86)\National Instruments\Shared\License Manager\Bin\lmgrd.exe [1427688 2010-08-02] (Macrovision Corporation)

S2 niLXIDiscovery; C:\Program Files (x86)\IVI Foundation\VISA\WinNT\NIvisa\niLxiDiscovery.exe [383352 2014-06-13] (National Instruments Corporation)

S2 nimDNSResponder; C:\Program Files (x86)\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe [320368 2014-06-06] (National Instruments Corporation)

S2 NINetworkDiscovery; C:\Program Files (x86)\National Instruments\Shared\NI Network Discovery\niDiscSvc.exe [177536 2014-06-19] (National Instruments Corporation)

S2 nipxirmu; C:\Windows\SysWOW64\nipxism.exe [20816 2014-11-14] (National Instruments Corporation)

S2 NiSvcLoc; C:\Program Files (x86)\National Instruments\Shared\niSvcLoc\nisvcloc.exe [89928 2014-06-06] (National Instruments Corporation)

S2 NISystemWebServer; C:\Program Files (x86)\National Instruments\Shared\NI WebServer\SystemWebServer.exe [57168 2014-11-21] (National Instruments Corporation)

S2 NITaggerService; C:\Program Files (x86)\National Instruments\Shared\Tagger\tagsrv.exe [676016 2011-06-14] (National Instruments Corporation)

S2 Norton Ghost; C:\Program Files (x86)\Norton Ghost\Agent\VProSvc.exe [4590432 2010-03-03] (Symantec Corporation)

S2 Norton PC Checkup Application Launcher; C:\Program Files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe [132504 2013-03-17] (Symantec Corporation)

S2 NVWMI; C:\Windows\system32\nvwmi64.exe [1290016 2013-09-05] (NVIDIA Corporation)

R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [66048 2011-04-13] (Hewlett-Packard) [File not signed]

S2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_2223a6b19a4f4233\STacSV64.exe [244736 2010-01-21] (IDT, Inc.)

S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]

R3 SymSnapService; C:\Program Files (x86)\Norton Ghost\Shared\Drivers\SymSnapServicex64.exe [2963960 2009-09-21] (Symantec)

S2 wgsslvpnsrc; C:\Program Files (x86)\WatchGuard\WatchGuard Mobile VPN with SSL\wgsslvpnsrc.exe [58368 2011-06-29] () [File not signed]

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

S3 Symantec SymSnap VSS Provider; C:\Windows\system32\dllhost.exe /Processid:{BC69A640-1C64-4F07-8D2C-22403CC50C0A}

 

==================== Drivers (Whitelisted) ====================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

S3 akshasp; C:\Windows\System32\DRIVERS\akshasp.sys [60488 2014-07-15] (SafeNet Inc.)

S3 akshhl; C:\Windows\System32\DRIVERS\akshhl.sys [63944 2014-07-15] (SafeNet Inc.)

S3 aksusb; C:\Windows\System32\DRIVERS\aksusb.sys [303624 2014-07-15] (SafeNet Inc.)

S2 cvintdrv; C:\Windows\SysWow64\Drivers\cvintdrv.sys [7140 2005-01-10] ()

R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [304784 2010-03-23] ()

S3 CYUSB.NTamd64; C:\Windows\System32\Drivers\ADICYUSB64.sys [47104 2010-04-16] (Cypress Semiconductor)

R3 GenericMount; C:\Windows\System32\DRIVERS\GenericMount.sys [66608 2010-02-12] (Symantec Corporation)

R2 hardlock; C:\Windows\system32\drivers\hardlock.sys [331608 2014-07-15] (SafeNet Inc.)

R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [464176 2011-08-18] (Kaspersky Lab ZAO)

R1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [13616 2011-08-18] (Kaspersky Lab ZAO)

R1 KLFLTDEV; C:\Windows\System32\DRIVERS\klfltdev.sys [58672 2012-04-03] (Kaspersky Lab)

R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [636720 2012-05-14] (Kaspersky Lab)

R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [32048 2011-09-01] (Kaspersky Lab ZAO)

S3 lvalarmk; C:\Windows\System32\drivers\lvalarmk.sys [27528 2015-04-06] (National Instruments Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-07-09] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)

S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2010-10-13] (Marvell Semiconductor, Inc.)

S3 ni1045k; C:\Windows\system32\drivers\ni1045kl.sys [12984 2014-05-16] (National Instruments Corporation)

S3 ni1065k; C:\Windows\system32\drivers\ni1065k.sys [30032 2014-05-16] (National Instruments Corporation)

S3 ni488lock; C:\Windows\system32\drivers\ni488lock.sys [18504 2009-12-15] (National Instruments Corporation)

S3 nicdcck; C:\Windows\System32\drivers\nicdcckl.sys [15192 2014-08-07] (National Instruments Corporation)

S3 nicdrk; C:\Windows\System32\drivers\nicdrkl.sys [15192 2014-08-07] (National Instruments Corporation)

S3 nicmrk; C:\Windows\System32\drivers\nicmrkl.sys [15208 2015-04-06] (National Instruments Corporation)

S3 nicondrk; C:\Windows\System32\drivers\nicondrkl.sys [15176 2015-04-02] (National Instruments Corporation)

S3 nicsrk; C:\Windows\System32\drivers\nicsrkl.sys [15176 2015-04-06] (National Instruments Corporation)

R3 nidimk; C:\Windows\system32\drivers\nidimkl.sys [15200 2014-07-30] (National Instruments Corporation)

S3 nidmxfk; C:\Windows\System32\drivers\nidmxfkl.sys [15176 2015-04-06] (National Instruments Corporation)

S3 nidsark; C:\Windows\System32\drivers\nidsarkl.sys [15184 2015-02-25] (National Instruments Corporation)

S3 nidwgk; C:\Windows\system32\drivers\nidwgkl.sys [11872 2010-02-19] (National Instruments Corporation)

S3 niemrk; C:\Windows\System32\drivers\niemrkl.sys [15176 2015-04-06] (National Instruments Corporation)

S3 niesrk; C:\Windows\System32\drivers\niesrkl.sys [15176 2015-04-06] (National Instruments Corporation)

R3 NIEthernetDeviceEnumerator; C:\Windows\System32\DRIVERS\niede.sys [38064 2010-06-15] (National Instruments Corporation)

S3 nihorbrk; C:\Windows\System32\drivers\nihorbrkl.sys [15176 2015-04-02] (National Instruments Corporation)

S3 nihsdrk; C:\Windows\system32\drivers\nihsdrkl.sys [12376 2009-12-03] (National Instruments Corporation)

R3 nimdbgk; C:\Windows\system32\drivers\nimdbgkl.sys [15200 2014-07-30] (National Instruments Corporation)

R3 nimru2k; C:\Windows\system32\drivers\nimru2kl.sys [15200 2014-09-17] (National Instruments Corporation)

S3 nimsdrk; C:\Windows\System32\drivers\nimsdrkl.sys [15232 2015-04-06] (National Instruments Corporation)

S3 nimstsk; C:\Windows\System32\drivers\nimstskl.sys [15200 2015-04-06] (National Instruments Corporation)

R3 nimxdfk; C:\Windows\system32\drivers\nimxdfkl.sys [15184 2015-01-13] (National Instruments Corporation)

S3 nimxpk; C:\Windows\System32\drivers\nimxpkl.sys [15208 2015-04-06] (National Instruments Corporation)

S3 ninshsdk; C:\Windows\System32\drivers\ninshsdkl.sys [15200 2015-01-27] (National Instruments Corporation)

S3 niorbk; C:\Windows\system32\drivers\niorbkl.sys [15184 2014-07-31] (National Instruments Corporation)

S3 nipalfwedl; C:\Windows\System32\drivers\nipalfwedl.sys [15232 2014-12-04] (National Instruments Corporation)

R0 NIPALK; C:\Windows\System32\drivers\nipalk.sys [778072 2014-12-04] (National Instruments Corporation)

S3 nipalusbedl; C:\Windows\System32\drivers\nipalusbedl.sys [15224 2014-12-04] (National Instruments Corporation)

R0 nipbcfk; C:\Windows\System32\drivers\nipbcfk.sys [19288 2014-02-28] (National Instruments Corporation)

S3 nipsdk; C:\Windows\system32\drivers\nipsdkl.sys [11904 2010-05-06] (National Instruments Corporation)

R0 nipxibaf; C:\Windows\System32\drivers\nipxibaf.sys [89992 2014-06-12] (National Instruments Corporation)

R0 nipxibrc; C:\Windows\System32\drivers\nipxibrc.sys [70336 2014-05-16] (National Instruments Corporation)

S3 nipxifpk; C:\Windows\system32\drivers\nipxifpk.sys [37272 2013-09-10] (National Instruments Corporation)

S3 nipxigpk; C:\Windows\system32\drivers\nipxigpk.sys [22680 2011-08-09] (National Instruments Corporation)

R2 nipxirmk; C:\Windows\system32\drivers\nipxirmkl.sys [15184 2014-11-14] (National Instruments Corporation)

S3 niraptrk; C:\Windows\System32\drivers\niraptrkl.sys [15176 2015-04-06] (National Instruments Corporation)

S3 niraptrkw; C:\Windows\System32\DRIVERS\niraptrkw.sys [14664 2015-04-06] (National Instruments Corporation)

S3 niRFSA2k; C:\Windows\system32\drivers\niRFSA2kl.sys [11840 2010-06-21] (National Instruments Corporation)

S3 niscdk; C:\Windows\System32\drivers\niscdkl.sys [15216 2014-10-22] (National Instruments Corporation)

S3 nisdigk; C:\Windows\System32\drivers\nisdigkl.sys [15192 2015-04-06] (National Instruments Corporation)

S3 nisftk; C:\Windows\System32\drivers\nisftkl.sys [15184 2015-01-27] (National Instruments Corporation)

S3 nisldk; C:\Windows\system32\drivers\nisldkl.sys [11856 2009-06-18] (National Instruments Corporation)

S4 Nismdkmbeuvn; No ImagePath

S3 nispdk; C:\Windows\System32\drivers\nispdkl.sys [15216 2014-10-22] (National Instruments Corporation)

S3 nisrcdk; C:\Windows\system32\drivers\nisrcdkl.sys [11936 2010-06-04] (National Instruments Corporation)

S3 nissrk; C:\Windows\System32\drivers\nissrkl.sys [15176 2015-04-06] (National Instruments Corporation)

S3 nistc2k; C:\Windows\System32\drivers\nistc2kl.sys [15152 2014-08-07] (National Instruments Corporation)

S3 nistc3rk; C:\Windows\System32\drivers\nistc3rkl.sys [15168 2015-02-25] (National Instruments Corporation)

S3 nistcrk; C:\Windows\System32\drivers\nistcrkl.sys [15200 2015-02-25] (National Instruments Corporation)

R2 nistreamk; C:\Windows\System32\drivers\nistreamkl.sys [20632 2010-06-17] (National Instruments Corporation)

S3 niswdk; C:\Windows\System32\drivers\niswdkl.sys [15176 2015-02-23] (National Instruments Corporation)

S3 nitfurk; C:\Windows\System32\drivers\nitfurkl.sys [15216 2015-04-02] (National Instruments Corporation)

S3 nitiork; C:\Windows\System32\drivers\nitiorkl.sys [15200 2014-08-07] (National Instruments Corporation)

S3 niufurk; C:\Windows\System32\drivers\niufurkl.sys [15208 2015-04-06] (National Instruments Corporation)

S3 niufurkw; C:\Windows\System32\DRIVERS\niufurkw.sys [14696 2015-04-06] (National Instruments Corporation)

R3 NiViPciK; C:\Windows\System32\drivers\NiViPciKl.sys [15200 2014-06-13] (National Instruments Corporation)

R2 NiViPxiK; C:\Windows\System32\drivers\NiViPxiKl.sys [15200 2014-06-13] (National Instruments Corporation)

S3 niwfrk; C:\Windows\System32\drivers\niwfrkl.sys [15176 2015-04-06] (National Instruments Corporation)

S3 nixfmrrk; C:\Windows\System32\drivers\nixfmrrkl.sys [15184 2015-04-02] (National Instruments Corporation)

S3 nixsrk; C:\Windows\System32\drivers\nixsrkl.sys [15176 2015-04-06] (National Instruments Corporation)

R3 rismcx64; C:\Windows\System32\DRIVERS\rismcx64.sys [59008 2009-07-20] (RICOH Company, Ltd.)

R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1798400 2009-12-18] ()

R0 symsnap; C:\Windows\System32\DRIVERS\symsnap.sys [170032 2009-09-21] (StorageCraft)

S3 USA19H; C:\Windows\System32\DRIVERS\USA19Hx64.sys [740096 2007-10-30] (Keyspan)

S3 USA19HP; C:\Windows\System32\DRIVERS\USA19Hx64p.SYS [35840 2007-10-23] (Keyspan)

S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]

S3 Usbtmc; C:\Windows\System32\Drivers\ausbtmc.sys [22528 2011-08-10] (IVI Foundation) [File not signed]

S3 VProEventMonitor; C:\Windows\System32\DRIVERS\vproeventmonitor.sys [20528 2009-09-21] (Symantec Corporation)

S3 SWVNIC; system32\DRIVERS\swvnic.sys [X]

S3 usb6xxxk; system32\drivers\usb6xxxkl.sys [X]

U2 V2iMount; No ImagePath

S3 vpnva; system32\DRIVERS\vpnva64.sys [X]

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== Three Months Created files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-07-09 09:41 - 2015-07-09 09:44 - 00031005 _____ C:\Users\kuechl\Desktop\FRST.txt

2015-07-09 09:41 - 2015-07-09 09:44 - 00000000 ____D C:\FRST

2015-07-09 09:41 - 2015-07-05 10:14 - 02112512 _____ (Farbar) C:\Users\kuechl\Desktop\FRST64.exe

2015-07-09 09:39 - 2015-07-09 09:39 - 00001072 _____ C:\Users\kuechl\Desktop\JRT.txt

2015-07-09 09:02 - 2015-07-09 09:02 - 00000207 _____ C:\Windows\tweaking.com-regbackup-TYR-Windows-7-Professional-(64-bit).dat

2015-07-09 09:02 - 2015-07-09 09:02 - 00000000 ____D C:\RegBackup

2015-07-09 09:01 - 2015-07-09 02:54 - 02953724 _____ (Malwarebytes Corporation) C:\Users\kuechl\Desktop\JRT.exe

2015-07-09 07:08 - 2015-07-09 08:28 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-07-09 07:07 - 2015-07-09 07:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-07-09 07:07 - 2015-07-09 07:07 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-07-09 07:07 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-07-09 07:07 - 2015-06-18 08:41 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-07-09 07:07 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-07-06 13:09 - 2015-07-09 08:24 - 00001884 _____ C:\Users\Public\Desktop\ANSYS Simplorer.lnk

2015-07-06 13:09 - 2015-07-09 08:24 - 00001877 _____ C:\Users\Public\Desktop\ANSYS Electronics Desktop.lnk

2015-07-06 13:09 - 2015-07-09 08:24 - 00001868 _____ C:\Users\Public\Desktop\ANSYS Maxwell.lnk

2015-07-06 13:09 - 2015-07-09 08:24 - 00001861 _____ C:\Users\Public\Desktop\ANSYS SIwave.lnk

2015-07-06 13:09 - 2015-07-06 13:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ANSYS Electromagnetics

2015-07-06 12:53 - 2015-07-06 12:53 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task

2015-07-06 12:08 - 2015-07-06 12:08 - 00000519 _____ C:\Users\kuechl\Documents\error.txt

2015-07-06 11:29 - 2015-07-06 11:29 - 00000000 ____D C:\Users\kuechl\AppData\Roaming\Ansoft

2015-07-06 10:48 - 2015-07-06 10:48 - 06912054 _____ C:\Users\kuechl\Desktop\Error1.bmp

2015-07-06 10:47 - 2015-07-06 10:47 - 02305078 _____ C:\Users\kuechl\Desktop\error2.bmp

2015-07-06 09:49 - 2015-07-06 12:54 - 00000000 ____D C:\Program Files\AnsysEM

2015-07-02 20:59 - 2015-07-02 20:59 - 00000000 ____D C:\Ansys

2015-06-19 15:09 - 2015-06-22 13:00 - 05708800 _____ (ats) C:\Users\kuechl\Desktop\ATS_BillofMaterials.exe

2015-06-18 16:53 - 2015-06-24 17:11 - 00184928 _____ C:\Users\kuechl\Documents\Test_2014.seproj

2015-06-18 11:05 - 2015-06-18 11:19 - 00000000 ____D C:\ProgramData\PXISA

2015-06-18 09:59 - 2015-06-18 10:16 - 1740440384 _____ C:\Users\kuechl\Desktop\NIDAQ1451f1.exe

2015-06-17 21:42 - 2015-06-18 11:16 - 00003242 _____ C:\Windows\System32\Tasks\NIUpdateServiceStartupTask

2015-06-17 21:33 - 2015-07-08 10:43 - 00001110 _____ C:\Users\Public\Desktop\NI MAX.lnk

2015-06-17 21:33 - 2015-06-18 10:35 - 00001104 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NI MAX.lnk

2015-06-09 18:38 - 2015-04-29 13:22 - 14635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll

2015-06-09 18:38 - 2015-04-29 13:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll

2015-06-09 18:38 - 2015-04-29 13:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx

2015-06-09 18:38 - 2015-04-29 13:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll

2015-06-09 18:38 - 2015-04-29 13:19 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL

2015-06-09 18:38 - 2015-04-29 13:07 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll

2015-06-09 18:38 - 2015-04-29 13:07 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll

2015-06-09 18:38 - 2015-04-29 13:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx

2015-06-09 18:38 - 2015-04-29 13:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll

2015-06-09 18:38 - 2015-04-29 13:05 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL

2015-06-09 18:37 - 2015-05-25 13:24 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-06-09 18:37 - 2015-05-25 13:23 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2015-06-09 18:37 - 2015-05-25 13:23 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2015-06-09 18:37 - 2015-05-25 13:21 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2015-06-09 18:37 - 2015-05-25 13:19 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2015-06-09 18:37 - 2015-05-25 13:19 - 01255424 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll

2015-06-09 18:37 - 2015-05-25 13:19 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2015-06-09 18:37 - 2015-05-25 13:19 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll

2015-06-09 18:37 - 2015-05-25 13:19 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2015-06-09 18:37 - 2015-05-25 13:19 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll

2015-06-09 18:37 - 2015-05-25 13:19 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2015-06-09 18:37 - 2015-05-25 13:19 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll

2015-06-09 18:37 - 2015-05-25 13:19 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2015-06-09 18:37 - 2015-05-25 13:19 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2015-06-09 18:37 - 2015-05-25 13:19 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2015-06-09 18:37 - 2015-05-25 13:19 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2015-06-09 18:37 - 2015-05-25 13:19 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll

2015-06-09 18:37 - 2015-05-25 13:19 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2015-06-09 18:37 - 2015-05-25 13:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2015-06-09 18:37 - 2015-05-25 13:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll

2015-06-09 18:37 - 2015-05-25 13:19 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2015-06-09 18:37 - 2015-05-25 13:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll

2015-06-09 18:37 - 2015-05-25 13:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2015-06-09 18:37 - 2015-05-25 13:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2015-06-09 18:37 - 2015-05-25 13:19 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2015-06-09 18:37 - 2015-05-25 13:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2015-06-09 18:37 - 2015-05-25 13:18 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll

2015-06-09 18:37 - 2015-05-25 13:18 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe

2015-06-09 18:37 - 2015-05-25 13:18 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe

2015-06-09 18:37 - 2015-05-25 13:18 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe

2015-06-09 18:37 - 2015-05-25 13:18 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe

2015-06-09 18:37 - 2015-05-25 13:18 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe

2015-06-09 18:37 - 2015-05-25 13:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe

2015-06-09 18:37 - 2015-05-25 13:18 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe

2015-06-09 18:37 - 2015-05-25 13:18 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll

2015-06-09 18:37 - 2015-05-25 13:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe

2015-06-09 18:37 - 2015-05-25 13:18 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2015-06-09 18:37 - 2015-05-25 13:18 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2015-06-09 18:37 - 2015-05-25 13:18 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe

2015-06-09 18:37 - 2015-05-25 13:14 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll

2015-06-09 18:37 - 2015-05-25 13:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 13:07 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2015-06-09 18:37 - 2015-05-25 13:07 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2015-06-09 18:37 - 2015-05-25 13:04 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2015-06-09 18:37 - 2015-05-25 13:01 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll

2015-06-09 18:37 - 2015-05-25 13:01 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll

2015-06-09 18:37 - 2015-05-25 13:01 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2015-06-09 18:37 - 2015-05-25 13:01 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2015-06-09 18:37 - 2015-05-25 13:01 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2015-06-09 18:37 - 2015-05-25 13:01 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2015-06-09 18:37 - 2015-05-25 13:01 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2015-06-09 18:37 - 2015-05-25 13:01 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll

2015-06-09 18:37 - 2015-05-25 13:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2015-06-09 18:37 - 2015-05-25 13:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll

2015-06-09 18:37 - 2015-05-25 13:01 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2015-06-09 18:37 - 2015-05-25 13:01 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2015-06-09 18:37 - 2015-05-25 13:01 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2015-06-09 18:37 - 2015-05-25 13:00 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe

2015-06-09 18:37 - 2015-05-25 13:00 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe

2015-06-09 18:37 - 2015-05-25 13:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe

2015-06-09 18:37 - 2015-05-25 13:00 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe

2015-06-09 18:37 - 2015-05-25 13:00 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe

2015-06-09 18:37 - 2015-05-25 13:00 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2015-06-09 18:37 - 2015-05-25 13:00 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe

2015-06-09 18:37 - 2015-05-25 12:59 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2015-06-09 18:37 - 2015-05-25 12:59 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2015-06-09 18:37 - 2015-05-25 12:59 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2015-06-09 18:37 - 2015-05-25 12:59 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2015-06-09 18:37 - 2015-05-25 12:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll

2015-06-09 18:37 - 2015-05-25 12:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 12:08 - 03206144 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2015-06-09 18:37 - 2015-05-25 12:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll

2015-06-09 18:37 - 2015-05-25 11:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2015-06-09 18:37 - 2015-05-25 11:50 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2015-06-09 18:37 - 2015-05-25 11:48 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 11:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 11:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll

2015-06-09 18:37 - 2015-05-25 11:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll

2015-06-09 18:37 - 2015-04-24 13:17 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll

2015-06-09 18:37 - 2015-04-24 12:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll

2015-06-09 18:37 - 2015-04-10 22:19 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys

2015-06-09 18:36 - 2015-06-01 14:16 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2015-06-09 18:36 - 2015-06-01 13:07 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2015-06-09 18:36 - 2015-05-27 09:35 - 24917504 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2015-06-09 18:36 - 2015-05-27 09:08 - 19607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2015-06-09 18:36 - 2015-05-22 22:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2015-06-09 18:36 - 2015-05-22 22:15 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2015-06-09 18:36 - 2015-05-22 22:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2015-06-09 18:36 - 2015-05-22 22:15 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2015-06-09 18:36 - 2015-05-22 22:14 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec

2015-06-09 18:36 - 2015-05-22 22:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2015-06-09 18:36 - 2015-05-22 22:10 - 02278912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2015-06-09 18:36 - 2015-05-22 22:09 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2015-06-09 18:36 - 2015-05-22 22:08 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2015-06-09 18:36 - 2015-05-22 22:06 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2015-06-09 18:36 - 2015-05-22 22:05 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2015-06-09 18:36 - 2015-05-22 22:05 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2015-06-09 18:36 - 2015-05-22 22:04 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2015-06-09 18:36 - 2015-05-22 21:57 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2015-06-09 18:36 - 2015-05-22 21:52 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2015-06-09 18:36 - 2015-05-22 21:49 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2015-06-09 18:36 - 2015-05-22 21:48 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2015-06-09 18:36 - 2015-05-22 21:47 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2015-06-09 18:36 - 2015-05-22 21:47 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2015-06-09 18:36 - 2015-05-22 21:38 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2015-06-09 18:36 - 2015-05-22 21:37 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2015-06-09 18:36 - 2015-05-22 21:37 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2015-06-09 18:36 - 2015-05-22 21:28 - 12829696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2015-06-09 18:36 - 2015-05-22 21:20 - 01950720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2015-06-09 18:36 - 2015-05-22 21:16 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2015-06-09 18:36 - 2015-05-22 21:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2015-06-09 18:36 - 2015-05-22 14:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2015-06-09 18:36 - 2015-05-22 14:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2015-06-09 18:36 - 2015-05-22 14:01 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2015-06-09 18:36 - 2015-05-22 14:00 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2015-06-09 18:36 - 2015-05-22 14:00 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2015-06-09 18:36 - 2015-05-22 14:00 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec

2015-06-09 18:36 - 2015-05-22 14:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2015-06-09 18:36 - 2015-05-22 13:59 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2015-06-09 18:36 - 2015-05-22 13:53 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2015-06-09 18:36 - 2015-05-22 13:52 - 06026240 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2015-06-09 18:36 - 2015-05-22 13:52 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2015-06-09 18:36 - 2015-05-22 13:48 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2015-06-09 18:36 - 2015-05-22 13:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2015-06-09 18:36 - 2015-05-22 13:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2015-06-09 18:36 - 2015-05-22 13:47 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2015-06-09 18:36 - 2015-05-22 13:47 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2015-06-09 18:36 - 2015-05-22 13:40 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2015-06-09 18:36 - 2015-05-22 13:36 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2015-06-09 18:36 - 2015-05-22 13:29 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2015-06-09 18:36 - 2015-05-22 13:25 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2015-06-09 18:36 - 2015-05-22 13:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2015-06-09 18:36 - 2015-05-22 13:21 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2015-06-09 18:36 - 2015-05-22 13:07 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2015-06-09 18:36 - 2015-05-22 13:06 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2015-06-09 18:36 - 2015-05-22 13:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2015-06-09 18:36 - 2015-05-22 13:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2015-06-09 18:36 - 2015-05-22 12:57 - 14404096 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2015-06-09 18:36 - 2015-05-22 12:50 - 02426880 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2015-06-09 18:36 - 2015-05-22 12:38 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2015-06-09 18:36 - 2015-05-22 12:26 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2015-06-05 13:37 - 2015-06-05 13:37 - 00000000 ____D C:\Users\kuechl\Documents\Lock_Dam

2015-06-05 04:53 - 2015-05-22 13:18 - 01021440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2015-06-05 04:53 - 2015-05-22 13:18 - 00757248 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2015-06-05 04:53 - 2015-05-22 13:18 - 00700416 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2015-06-05 04:53 - 2015-05-22 13:18 - 00423424 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2015-06-05 04:53 - 2015-05-22 13:18 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2015-06-05 04:53 - 2015-05-22 13:18 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll

2015-06-05 04:53 - 2015-05-22 13:13 - 01119232 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2015-06-05 04:53 - 2015-05-21 08:19 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll

2015-06-03 21:18 - 2015-06-03 21:18 - 00000000 ____D C:\Users\kuechl\Documents\Wood

2015-05-30 03:51 - 2015-07-09 09:22 - 00000664 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1715567821-813497703-1801674531-1130.job

2015-05-30 03:51 - 2015-07-01 11:43 - 00003692 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-1715567821-813497703-1801674531-1130

2015-05-28 20:59 - 2015-05-29 12:49 - 00000132 _____ C:\Users\kuechl\Documents\Untitled.m

2015-05-13 03:04 - 2015-05-01 08:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll

2015-05-13 03:04 - 2015-05-01 08:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll

2015-05-12 18:19 - 2015-04-17 22:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll

2015-05-12 18:19 - 2015-04-17 21:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll

2015-05-12 18:18 - 2015-04-12 22:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe

2015-05-12 18:17 - 2015-04-19 22:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2015-05-12 18:17 - 2015-04-19 22:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll

2015-05-12 18:17 - 2015-04-19 21:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2015-05-12 18:17 - 2015-04-07 22:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll

2015-05-12 18:17 - 2015-04-07 22:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll

2015-05-12 18:17 - 2015-04-07 22:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll

2015-05-12 18:17 - 2015-03-03 23:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll

2015-05-12 18:17 - 2015-03-03 23:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll

2015-05-12 18:17 - 2015-03-03 23:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe

2015-05-12 18:17 - 2015-03-03 23:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll

2015-05-12 18:17 - 2015-03-03 23:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll

2015-05-12 18:17 - 2015-03-03 23:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll

2015-05-12 18:17 - 2015-03-03 23:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe

2015-05-12 18:17 - 2015-02-18 02:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe

2015-05-12 18:17 - 2015-02-18 02:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe

2015-05-12 18:17 - 2015-01-28 22:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll

2015-05-12 18:17 - 2015-01-28 22:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll

2015-05-11 10:11 - 2015-05-13 15:59 - 00000000 ____D C:\Users\kuechl\Documents\Engineering Mtgs

2015-05-06 08:48 - 2015-05-06 08:49 - 00308856 _____ C:\Windows\Minidump\050615-27768-01.dmp

2015-04-30 03:09 - 2015-04-30 03:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin

2015-04-24 09:42 - 2015-04-24 09:42 - 00308856 _____ C:\Windows\Minidump\042415-28860-01.dmp

2015-04-17 14:28 - 2015-07-08 10:43 - 00002190 _____ C:\Users\Public\Desktop\COMSOL Multiphysics 5.1.lnk

2015-04-17 14:28 - 2015-04-17 14:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\COMSOL Multiphysics 5.1

2015-04-17 14:06 - 2015-04-17 14:27 - 00000000 ____D C:\Users\kuechl\Documents\Comsol_5_1

2015-04-16 09:49 - 2015-07-08 10:43 - 00001783 _____ C:\Users\Public\Desktop\iTunes.lnk

2015-04-16 09:49 - 2015-04-16 09:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2015-04-16 09:48 - 2015-04-16 09:48 - 00000000 ____D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7

2015-04-16 09:48 - 2015-04-16 09:48 - 00000000 ____D C:\Program Files\iTunes

2015-04-16 09:48 - 2015-04-16 09:48 - 00000000 ____D C:\Program Files\iPod

2015-04-16 09:48 - 2015-04-16 09:48 - 00000000 ____D C:\Program Files (x86)\iTunes

2015-04-14 14:47 - 2015-03-24 22:24 - 03298816 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2015-04-14 14:47 - 2015-03-24 22:24 - 02553856 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2015-04-14 14:47 - 2015-03-24 22:24 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2015-04-14 14:47 - 2015-03-24 22:24 - 00191488 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2015-04-14 14:47 - 2015-03-24 22:24 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2015-04-14 14:47 - 2015-03-24 22:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll

2015-04-14 14:47 - 2015-03-24 22:24 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2015-04-14 14:47 - 2015-03-24 22:24 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2015-04-14 14:47 - 2015-03-24 22:23 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2015-04-14 14:47 - 2015-03-24 22:23 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2015-04-14 14:47 - 2015-03-24 22:23 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll

2015-04-14 14:47 - 2015-03-24 22:00 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2015-04-14 14:47 - 2015-03-24 22:00 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2015-04-14 14:47 - 2015-03-24 22:00 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2015-04-14 14:47 - 2015-03-24 22:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2015-04-14 14:47 - 2015-03-24 22:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll

2015-04-14 14:46 - 2015-03-09 22:25 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2015-04-14 14:46 - 2015-03-09 22:21 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2015-04-14 14:46 - 2015-03-09 22:08 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2015-04-14 14:46 - 2015-03-09 22:05 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2015-04-14 14:46 - 2015-03-05 00:12 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll

2015-04-14 14:46 - 2015-03-04 23:05 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll

2015-04-14 14:45 - 2015-02-24 22:18 - 00754688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys

2015-04-14 14:44 - 2015-03-03 23:55 - 00367552 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys

2015-04-14 14:44 - 2015-03-03 23:41 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll

2015-04-14 14:44 - 2015-03-03 23:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll

2015-04-14 03:38 - 2015-04-14 03:38 - 01217192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FM20.DLL

2015-04-13 02:32 - 2015-07-08 10:43 - 00001908 _____ C:\Users\Public\Desktop\Garmin Express.lnk

2015-04-13 02:31 - 2015-04-30 03:09 - 00003554 _____ C:\Windows\System32\Tasks\GarminUpdaterTask

2015-04-12 02:02 - 2015-04-12 02:02 - 00000000 ____D C:\Users\Default\AppData\Roaming\Garmin

2015-04-12 02:02 - 2015-04-12 02:02 - 00000000 ____D C:\Users\Default\AppData\Local\Garmin_Ltd._or_its_subsid

2015-04-12 02:02 - 2015-04-12 02:02 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Garmin

2015-04-12 02:02 - 2015-04-12 02:02 - 00000000 ____D C:\Users\Default User\AppData\Local\Garmin_Ltd._or_its_subsid

 

==================== Three Months Modified files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-07-09 09:44 - 2012-04-03 18:59 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-07-09 09:41 - 2012-02-15 13:54 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-07-09 09:41 - 2010-09-16 08:59 - 00000128 _____ C:\Windows\system32\config\netlogon.ftl

2015-07-09 09:31 - 2009-07-13 23:45 - 00021680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-07-09 09:31 - 2009-07-13 23:45 - 00021680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-07-09 09:18 - 2014-11-07 13:51 - 00000568 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1715567821-813497703-1801674531-1130.job

2015-07-09 08:28 - 2012-11-21 14:02 - 00000000 ____D C:\ProgramData\Kaspersky Lab

2015-07-09 08:26 - 2010-09-15 19:57 - 01889035 _____ C:\Windows\WindowsUpdate.log

2015-07-09 08:14 - 2014-12-11 11:23 - 00000548 _____ C:\Windows\Tasks\MATLAB R2014b Startup Accelerator.job

2015-07-09 08:11 - 2014-08-20 09:49 - 00000548 _____ C:\Windows\Tasks\MATLAB R2014a Startup Accelerator.job

2015-07-09 07:48 - 2014-08-25 13:49 - 00000000 ____D C:\Users\kuechl\AppData\Local\Adobe

2015-07-09 07:47 - 2012-02-15 13:54 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-07-09 07:36 - 2010-09-16 08:49 - 00000000 ____D C:\ProgramData\NVIDIA

2015-07-09 07:36 - 2010-09-16 08:46 - 00476746 _____ C:\Windows\PFRO.log

2015-07-09 07:36 - 2009-07-14 00:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-07-09 07:36 - 2009-07-13 23:51 - 00212357 _____ C:\Windows\setupact.log

2015-07-09 07:36 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\tracing

2015-07-09 07:07 - 2011-12-06 13:20 - 00000000 ____D C:\ProgramData\Malwarebytes

2015-07-08 16:27 - 2010-10-18 15:40 - 00004096 ___SH C:\VSNAP.IDX

2015-07-08 16:21 - 2014-11-25 06:14 - 00007597 _____ C:\Users\kuechl\AppData\Local\Resmon.ResmonCfg

2015-07-08 16:01 - 2010-09-20 12:20 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-07-08 12:30 - 2010-09-17 14:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MATLAB

2015-07-08 11:27 - 2012-04-03 18:59 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-07-08 11:27 - 2012-04-03 18:59 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-07-08 11:27 - 2011-06-07 08:09 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-07-08 10:43 - 2015-01-20 12:10 - 00000997 _____ C:\Users\kuechl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Cadence SPB Switch Release.lnk

2015-07-08 10:43 - 2014-12-25 21:24 - 00001971 _____ C:\Users\Public\Desktop\Sonos.lnk

2015-07-08 10:43 - 2014-12-15 09:54 - 00000922 _____ C:\Users\Public\Desktop\EMQuest Viewer.lnk

2015-07-08 10:43 - 2014-11-06 17:11 - 00002190 _____ C:\Users\Public\Desktop\COMSOL Multiphysics 5.0.lnk

2015-07-08 10:43 - 2014-10-23 10:45 - 00001112 _____ C:\Users\Public\Desktop\Rhinoceros 5 (64-bit).lnk

2015-07-08 10:43 - 2014-08-20 09:51 - 00001313 _____ C:\Users\Public\Desktop\MATLAB R2014a.lnk

2015-07-08 10:43 - 2014-06-03 14:47 - 00002230 _____ C:\Users\Public\Desktop\Google Earth.lnk

2015-07-08 10:43 - 2014-05-10 08:28 - 00002023 _____ C:\Users\Public\Desktop\Flash Programming Utility.lnk

2015-07-08 10:43 - 2014-05-10 08:12 - 00001471 _____ C:\Users\Public\Desktop\IDE.exe.lnk

2015-07-08 10:43 - 2014-05-02 15:14 - 00001096 _____ C:\Users\Public\Desktop\WDS3.lnk

2015-07-08 10:43 - 2014-04-25 10:24 - 00001886 _____ C:\Users\Public\Desktop\Axsdb.lnk

2015-07-08 10:43 - 2014-04-25 10:17 - 00001309 _____ C:\Users\Public\Desktop\AxCodeBlocks.lnk

2015-07-08 10:43 - 2014-03-30 09:48 - 00002005 _____ C:\Users\Public\Desktop\COMSOL Multiphysics 4.4.lnk

2015-07-08 10:43 - 2013-10-14 10:16 - 00001536 _____ C:\Users\Public\Desktop\Adobe Application Manager.lnk

2015-07-08 10:43 - 2013-06-06 15:27 - 00002039 _____ C:\Users\Public\Desktop\Canon Quick Menu.lnk

2015-07-08 10:43 - 2013-06-06 15:19 - 00002374 _____ C:\Users\Public\Desktop\Canon CanoScan 9000F II On-screen Manual.lnk

2015-07-08 10:43 - 2012-10-20 11:59 - 00001203 _____ C:\Users\Public\Desktop\Norton PC Checkup 3.0.lnk

2015-07-08 10:43 - 2012-08-22 21:28 - 00002201 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2015-07-08 10:43 - 2012-02-23 11:54 - 00001002 _____ C:\Users\Public\Desktop\Designer 7.0.lnk

2015-07-08 10:43 - 2012-02-21 16:05 - 00002435 _____ C:\Users\Public\Desktop\Tunnelier.lnk

2015-07-08 10:43 - 2011-12-19 22:13 - 00002043 _____ C:\Users\Public\Desktop\Google SketchUp 8.lnk

2015-07-08 10:43 - 2011-12-18 21:56 - 00001126 _____ C:\Users\Public\Desktop\CabinetVIEW FF-Advanced.lnk

2015-07-08 10:43 - 2011-12-18 21:41 - 00001081 _____ C:\Users\Public\Desktop\Door-DrawerCRUNCHER.lnk

2015-07-08 10:43 - 2011-12-14 20:38 - 00002304 _____ C:\Users\Public\Desktop\Waveform Editor.lnk

2015-07-08 10:43 - 2011-09-12 15:33 - 00002651 _____ C:\Users\Public\Desktop\FilterPro Desktop.lnk

2015-07-08 10:43 - 2011-09-11 14:19 - 00002044 _____ C:\Users\Public\Desktop\Adobe Acrobat X Pro.lnk

2015-07-08 10:43 - 2011-09-11 14:13 - 00001103 _____ C:\Users\Public\Desktop\Adobe Content Viewer.lnk

2015-07-08 10:43 - 2011-09-10 21:59 - 00002491 _____ C:\Users\Public\Desktop\Driver Detective.lnk

2015-07-08 10:43 - 2011-08-23 13:59 - 00001199 _____ C:\Users\Public\Desktop\Mobile VPN with SSL client.lnk

2015-07-08 10:43 - 2011-08-12 10:11 - 00001911 _____ C:\Users\Public\Desktop\DNR Garmin.lnk

2015-07-08 10:43 - 2010-12-06 17:51 - 00002097 _____ C:\Users\Public\Desktop\Blue Marble Desktop.lnk

2015-07-08 10:43 - 2010-09-16 10:14 - 00000957 _____ C:\Users\Public\Desktop\SigmaPlot 11.0.lnk

2015-07-08 10:43 - 2010-09-16 09:28 - 00001419 _____ C:\Users\kuechl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-07-08 10:42 - 2015-02-25 12:05 - 00001353 _____ C:\Users\kuechl\Desktop\matlab.exe - 2014b.lnk

2015-07-08 10:42 - 2014-05-10 08:13 - 00000639 _____ C:\Users\kuechl\Desktop\Silicon Labs IDE.lnk

2015-07-08 10:42 - 2014-04-25 10:27 - 00001642 _____ C:\Users\kuechl\Desktop\AX_RadioLAB.exe - Shortcut.lnk

2015-07-08 10:42 - 2014-04-25 10:17 - 00001309 _____ C:\Users\kuechl\Desktop\AxCodeBlocks.lnk

2015-07-08 10:42 - 2014-04-08 14:21 - 00002507 _____ C:\Users\kuechl\Desktop\SmartRF Studio 7.lnk

2015-07-08 10:42 - 2013-10-02 12:11 - 00002526 _____ C:\Users\kuechl\Desktop\GoToMeeting Quick Connect.lnk

2015-07-08 10:42 - 2013-03-11 15:52 - 00003237 _____ C:\Users\kuechl\Desktop\ATS Trident Receiver SR5000.lnk

2015-07-08 10:42 - 2012-10-09 19:11 - 00001189 _____ C:\Users\kuechl\Desktop\LTspice IV.lnk

2015-07-08 10:42 - 2012-08-17 12:13 - 00001729 _____ C:\Users\kuechl\Desktop\WHS Host.exe - Shortcut.lnk

2015-07-08 10:42 - 2012-07-08 08:54 - 00000596 _____ C:\Users\kuechl\Desktop\Robin.lnk

2015-07-08 10:42 - 2011-12-19 11:34 - 00001879 _____ C:\Users\kuechl\Desktop\CabinetCRUNCHER-FF-A.exe - Shortcut.lnk

2015-07-08 10:42 - 2011-11-22 09:57 - 00001134 _____ C:\Users\kuechl\Desktop\Dynamics GP 10.0.lnk

2015-07-08 10:42 - 2011-11-16 16:51 - 00000981 _____ C:\Users\kuechl\Desktop\Elsie.lnk

2015-07-08 10:42 - 2011-06-23 21:24 - 00000652 _____ C:\Users\kuechl\Desktop\VueScan.lnk

2015-07-08 10:42 - 2010-09-23 15:41 - 00002156 _____ C:\Users\kuechl\Desktop\Intranet.lnk

2015-07-08 10:42 - 2010-09-22 14:00 - 00000475 _____ C:\Users\kuechl\Desktop\Silicon Laboratories IDE.lnk

2015-07-08 10:42 - 2010-09-16 10:27 - 00001924 _____ C:\Users\kuechl\Desktop\Start Download Manager.lnk

2015-07-08 10:42 - 2010-09-16 09:02 - 00001437 _____ C:\Users\kuechj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-07-08 10:42 - 2010-09-16 09:02 - 00001415 _____ C:\Users\kuechj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk

2015-07-08 10:42 - 2010-09-15 09:38 - 00001441 _____ C:\Users\jp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-07-08 10:42 - 2010-09-15 09:38 - 00001419 _____ C:\Users\jp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk

2015-07-07 18:30 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\registration

2015-07-07 16:57 - 2010-10-26 14:44 - 00000000 ____D C:\Users\kuechl\Documents\Ansoft

2015-07-06 12:58 - 2011-09-11 14:19 - 00002465 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller X.lnk

2015-07-06 12:58 - 2011-09-11 14:19 - 00002453 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat X Pro.lnk

2015-07-06 12:58 - 2011-09-11 14:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle ES2

2015-07-06 11:58 - 2013-06-06 15:49 - 00000000 ____D C:\ProgramData\CanonIJPLM

2015-07-06 10:10 - 2010-10-26 14:38 - 00000000 ____D C:\AnsoftLibraries

2015-07-06 09:40 - 2009-07-14 00:13 - 00786578 _____ C:\Windows\system32\PerfStringBackup.INI

2015-07-04 05:28 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\system32\NDF

2015-07-01 13:37 - 2010-09-17 14:26 - 00000000 ____D C:\Users\kuechl\Documents\MATLAB

2015-07-01 11:43 - 2014-11-07 13:51 - 00003596 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-1715567821-813497703-1801674531-1130

2015-07-01 09:37 - 2010-09-21 13:42 - 00000000 ____D C:\Users\kuechl\Documents\Bank

2015-06-25 14:05 - 2010-09-30 14:29 - 00000000 ____D C:\Users\kuechl\Documents\SignalExpress Data

2015-06-23 13:30 - 2010-09-16 08:38 - 00300704 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2015-06-23 10:44 - 2010-09-29 15:39 - 00000000 ____D C:\ProgramData\National Instruments

2015-06-23 08:22 - 2014-04-30 13:34 - 00000523 _____ C:\Users\Public\connection.xml

2015-06-18 11:16 - 2011-10-26 14:01 - 00003540 _____ C:\Windows\System32\Tasks\NIUpdateServiceCheckTask

2015-06-18 11:13 - 2010-09-29 13:08 - 00000000 ____D C:\Program Files\National Instruments

2015-06-18 11:12 - 2010-09-29 15:43 - 00246532 _____ C:\Windows\SysWOW64\niorbmap

2015-06-18 11:04 - 2010-09-29 15:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\National Instruments

2015-06-18 11:04 - 2010-09-29 13:08 - 00000000 ____D C:\Program Files (x86)\National Instruments

2015-06-18 10:30 - 2010-09-29 15:43 - 00000000 ____D C:\Users\Public\Documents\National Instruments

2015-06-17 21:42 - 2010-09-29 16:02 - 00000000 ____D C:\Users\kuechl\AppData\Local\National Instruments

2015-06-10 13:55 - 2010-10-26 16:08 - 00000000 ____D C:\Advanced Telemetry Systems, Inc

2015-06-10 08:37 - 2014-11-12 11:23 - 00000000 __SHD C:\Users\kuechl\AppData\Local\EmieBrowserModeList

2015-06-10 08:37 - 2014-04-13 06:47 - 00000000 __SHD C:\Users\kuechl\AppData\Local\EmieUserList

2015-06-10 08:37 - 2014-04-13 06:47 - 00000000 __SHD C:\Users\kuechl\AppData\Local\EmieSiteList

2015-06-10 06:37 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\rescache

2015-06-10 03:40 - 2009-07-13 23:45 - 05045704 _____ C:\Windows\system32\FNTCACHE.DAT

2015-06-10 03:35 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\PolicyDefinitions

2015-06-10 03:13 - 2013-08-15 03:01 - 00000000 ____D C:\Windows\system32\MRT

2015-06-10 03:03 - 2010-09-29 21:45 - 140135120 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-06-09 14:38 - 2010-09-16 09:01 - 00009361 __RSH C:\ProgramData\ntuser.pol

2015-06-09 12:18 - 2012-11-27 18:34 - 00004750 _____ C:\Users\kuechl\AppData\Roaming\LTspiceIV.ini

 

==================== Files in the root of some directories =======

 

2012-11-27 18:34 - 2015-06-09 12:18 - 0004750 _____ () C:\Users\kuechl\AppData\Roaming\LTspiceIV.ini

2010-09-16 09:28 - 2010-09-16 09:28 - 0000000 _____ () C:\Users\kuechl\AppData\Local\AtStart.txt

2010-09-16 09:28 - 2010-09-16 09:28 - 0000000 _____ () C:\Users\kuechl\AppData\Local\DSwitch.txt

2011-10-29 07:53 - 2012-07-18 12:12 - 0000342 _____ () C:\Users\kuechl\AppData\Local\n9YZ4PKY7AXuapsI0PP9hxFMr5R2YqAmcc8

2010-09-16 09:28 - 2010-09-16 09:28 - 0000000 _____ () C:\Users\kuechl\AppData\Local\QSwitch.txt

2014-11-25 06:14 - 2015-07-08 16:21 - 0007597 _____ () C:\Users\kuechl\AppData\Local\Resmon.ResmonCfg

2011-09-06 11:47 - 2012-11-21 13:44 - 0011161 _____ () C:\ProgramData\LUUnInstall.LiveUpdate

 

Some files in TEMP:

====================

C:\Users\jp\AppData\Local\Temp\Setup.exe

C:\Users\kuechl\AppData\Local\Temp\1308490058-twapi.dll

C:\Users\kuechl\AppData\Local\Temp\DefaultAssets.exe

C:\Users\kuechl\AppData\Local\Temp\DefaultOfflineContent.exe

C:\Users\kuechl\AppData\Local\Temp\DIFxAPI.dll

C:\Users\kuechl\AppData\Local\Temp\DPInstx64.exe

C:\Users\kuechl\AppData\Local\Temp\DPInstx86.exe

C:\Users\kuechl\AppData\Local\Temp\DPInst_Monx64.exe

C:\Users\kuechl\AppData\Local\Temp\DPInst_Monx86.exe

C:\Users\kuechl\AppData\Local\Temp\G2MInstallerExtractor.exe

C:\Users\kuechl\AppData\Local\Temp\gxlcdsmp.dll

C:\Users\kuechl\AppData\Local\Temp\ISSetup.dll

C:\Users\kuechl\AppData\Local\Temp\jre-6u22-windows-i586-iftw-rv.exe

C:\Users\kuechl\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe

C:\Users\kuechl\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe

C:\Users\kuechl\AppData\Local\Temp\jucheck.dll

C:\Users\kuechl\AppData\Local\Temp\libusbtp.dll

C:\Users\kuechl\AppData\Local\Temp\MSETUP4.EXE

C:\Users\kuechl\AppData\Local\Temp\MYPCBU.exe

C:\Users\kuechl\AppData\Local\Temp\NetFx20SP2_x86.exe

C:\Users\kuechl\AppData\Local\Temp\NLStubInstallerResources.dll

C:\Users\kuechl\AppData\Local\Temp\ose00000.exe

C:\Users\kuechl\AppData\Local\Temp\OS_Detect.exe

C:\Users\kuechl\AppData\Local\Temp\PCCU_Installer.exe

C:\Users\kuechl\AppData\Local\Temp\Risweb32.exe

C:\Users\kuechl\AppData\Local\Temp\setuplauncher.exe

C:\Users\kuechl\AppData\Local\Temp\siinst.exe

C:\Users\kuechl\AppData\Local\Temp\sqlite3.dll

C:\Users\kuechl\AppData\Local\Temp\strings.dll

C:\Users\kuechl\AppData\Local\Temp\SymcPCCUInstaller.exe

C:\Users\kuechl\AppData\Local\Temp\vcredist_x64.exe

C:\Users\kuechl\AppData\Local\Temp\vcredist_x86.exe

C:\Users\kuechl\AppData\Local\Temp\vcredist_x86_2005.exe

C:\Users\kuechl\AppData\Local\Temp\WebUpdate.exe

C:\Users\kuechl\AppData\Local\Temp\WindowsInstaller-KB893803-x86.exe

C:\Users\kuechl\AppData\Local\Temp\_PC_DRIVERS_HQAssets.exe

 

 

==================== Bamital & volsnap Check =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2015-07-03 01:00

 

==================== End of log ============================

 

I'll attach the Additonal.txt file.  This post is to long.

 

Thanks!!

Addition.txt

[Psychotic]

Hi there,
my name is Marius and I will assist you with your malware related problems.

Before we move on, please read the following points carefully.

• First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
• Perform everything in the correct order. Sometimes one step requires the previous one.
• If you have any problems while following my instructions, Stop there and tell me the exact nature of your problem.
• Do not run any other scans without instruction or add/remove software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
• Post all logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
• Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
• My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

 

 

Is this an enterprise/business computer?

[JPSmith]

Sort of...  It's my Dad's he uses it for just about everything.  Including work.

[Psychotic]

These logs show that this computer is part of an enterprise domain. This should be handled by your dad´s IT department.

[JPSmith]

It's a small company.  There isn't really one.

[Psychotic]

OK, then we´ll handle this. Just be patient while I analyze your logs.

[Psychotic]

Fix with FRST (normal mode)

WARNING: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
 

• Download the attached fixlist.txt and save it to the location where FRST is saved to.
• Run FRST.exe (on 64bit, run FRST64.exe) and press the Fix button just once and wait.
• The tool will make a log (Fixlog.txt) which you find where you saved FRST. Please post it to your reply.

 

 

 

Full System Scan with Malwarebytes Antimalware

• 
  If not existing, please download

Malwarebytes Anti-Malware to your desktop. Double-click the downloaded setup file and follow the prompts to install the program. At the end, be sure a checkmark is placed next to the following:

• Launch Malwarebytes Anti-Malware
• A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.

[*]Click Finish.

If the program is already installed:

• Run Malwarebytes Antimalware
• On the Dashboard, click the 'Update Now >>' link
• After the update completes, click the 'Scan Now >>' button.
• Or, on the Dashboard, click the Scan Now >> button.
• If an update is available, click the Update Now button.
• A Threat Scan will begin.
• When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
• In most cases, a restart will be required.
• Wait for the prompt to restart the computer to appear, then click on Yes.
  

• After the restart once you are back at your desktop, open MBAM once more.
• Click on the History tab > Application Logs.
• Double click on the scan log which shows the Date and time of the scan just performed.
• Click 'Copy to Clipboard'
• Paste the contents of the clipboard into your reply.
  

 

fixlist.txt

[JPSmith]

OK...  So I put the script you gave me in the same folder and ran FRST64.exe like you said.  It did an update and I lost your script.  I didn't notice until after I had already started the MalwareBytes scan after the computer had restarted.  Do you want me to run it again??  

 

Here is the FixLog.txt

 

Fix result of Farbar Recovery Scan Tool (x64) Version:13-07-2015

Ran by kuechl at 2015-07-14 09:39:38 Run:1

Running from C:\Users\kuechl\Desktop

Loaded Profiles: kuechl (Available Profiles: kuechl & kuechj & jp)

Boot Mode: Normal

==============================================

 

fixlist content:

*****************

HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-1715567821-813497703-1801674531-1130\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

 

EmptyTemp:

Reboot:

 

*****************

 

"HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully

"HKU\S-1-5-21-1715567821-813497703-1801674531-1130\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully

EmptyTemp: => 30.1 GB temporary data Removed.

 

 

The system needed a reboot.. 

 

==== End of Fixlog 09:42:48 ====

 

Here is the MLB log:

 

Malwarebytes Anti-Malware

www.malwarebytes.org

 

Scan Date: 7/14/2015

Scan Time: 9:49 AM

Logfile: 

Administrator: Yes

 

Version: 2.1.8.1057

Malware Database: v2015.07.14.04

Rootkit Database: v2015.07.14.01

License: Trial

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

 

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: kuechl

 

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 502147

Time Elapsed: 25 min, 41 sec

 

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

 

Processes: 0

(No malicious items detected)

 

Modules: 0

(No malicious items detected)

 

Registry Keys: 0

(No malicious items detected)

 

Registry Values: 0

(No malicious items detected)

 

Registry Data: 0

(No malicious items detected)

 

Folders: 0

(No malicious items detected)

 

Files: 0

(No malicious items detected)

 

Physical Sectors: 0

(No malicious items detected)

 

 

(end)

[Psychotic]

No, that´s okay.

 

Scan with ESET Online Scan

Please go to here to run the online scannner from ESET.

• Turn off the real time scanner of any existing antivirus program while performing the online scan
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Click Start
• Make sure that the option Remove found threats is unticked
• Click on Advanced Settings and ensure these options are ticked:
  • Scan for potentially unwanted applications
• Scan for potentially unsafe applications
• Enable Anti-Stealth Technology

[*]Click Scan[*]Wait for the scan to finish[*]If any threats were found, click the 'List of found threats' , then click Export to text file.... [*]Save it to your desktop, then please copy and paste that log as a reply to this topic.

[AdvancedSetup]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!