Sarchie Posted August 29, 2015 ID:986087 Share Posted August 29, 2015 Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:28-08-2015Ran by Sarchie (administrator) on DADSLAPTOP (29-08-2015 09:20:16)Running from C:\Users\Sarchie\DownloadsLoaded Profiles: Sarchie (Available Profiles: Sarchie & Madison & Administrator)Platform: Windows 8.1 (X64) Language: English (United States)Internet Explorer Version 11 (Default browser: IE)Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/==================== Processes (Whitelisted) =================(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe(AMD) C:\Windows\System32\atiesrxx.exe(AMD) C:\Windows\System32\atieclxx.exe(IObit) C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe(Hewlett-Packard Company) C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe(Seagate Technology LLC) C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe(Seagate Technology LLC) C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\MobileService.exe(IObit) C:\Program Files (x86)\IObit\Start Menu 8\StartMenuServices.exe(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe(IObit) C:\Program Files (x86)\IObit\Start Menu 8\StartMenu8.exe(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe(IObit) C:\Program Files (x86)\IObit\Smart Defrag 4\SmartDefrag.exe(IObit) C:\Program Files (x86)\IObit\Start Menu 8\StartMenu_Hook.exe(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe(IObit) C:\Program Files (x86)\IObit\Start Menu 8\InstallServices.exe(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe(Seagate Technology LLC) C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe(Seagate Technology LLC) C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe(IObit) C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe(IObit) C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe(Seagate Technology LLC) C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DeviceAgent.exe(IObit) C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFTips.exe(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe() C:\Program Files (x86)\IObit\Advanced SystemCare 8\RealTimeProtector.exe(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare 8\Monitor.exe(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare 8\ASCService.exe(IObit) C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare 8\ASC.exe(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare 8\ASCTray.exe(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe(Google Inc.) C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe==================== Registry (Whitelisted) ===========================(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)HKLM-x32\...\Run: [iObit Malware Fighter] => C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe [5889824 2015-07-28] (IObit)HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-06-08] (Oracle Corporation)HKLM-x32\...\Run: [DBAgent] => C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe [1518664 2014-09-17] (Seagate Technology LLC)Winlogon\Notify\ScCertProp: wlnotify.dll [X]HKU\S-1-5-21-62209294-3957149853-557076774-1002\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2015-01-29] (Google Inc.)HKU\S-1-5-21-62209294-3957149853-557076774-1002\...\Run: [uploader] => C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe [127080 2014-09-17] (Seagate Technology LLC)HKU\S-1-5-21-62209294-3957149853-557076774-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8455960 2015-08-19] (Piriform Ltd)HKU\S-1-5-18\...\Run: [Advanced SystemCare 8] => C:\Program Files (x86)\IObit\Advanced SystemCare 8\ASCTray.exe [2429728 2015-04-08] (IObit)IFEO\IObitDownloader.exe: [Debugger] C:\Program Files (x86)\IObit\Advanced SystemCare 8\AutoReactivator.exeIFEO\MakeSFX.exe: [Debugger] C:\Program Files (x86)\IObit\Advanced SystemCare 8\AutoReactivator.exeIFEO\Promote.exe: [Debugger] C:\Program Files (x86)\IObit\Advanced SystemCare 8\AutoReactivator.exeIFEO\psia.exe: [Debugger] C:\Program Files (x86)\IObit\Advanced SystemCare 8\AutoReactivator.exeIFEO\SDSendBugReport.exe: [Debugger] C:\Program Files (x86)\IObit\Advanced SystemCare 8\AutoReactivator.exeIFEO\SD_FreeSoftwareDownloader.exe: [Debugger] C:\Program Files (x86)\IObit\Advanced SystemCare 8\AutoReactivator.exeIFEO\sh_installer.exe: [Debugger] C:\Program Files (x86)\IObit\Advanced SystemCare 8\AutoReactivator.exeIFEO\sua.exe: [Debugger] C:\Program Files (x86)\IObit\Advanced SystemCare 8\AutoReactivator.exeGroupPolicy: Group Policy on Chrome detected <======= ATTENTIONCHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION==================== Internet (Whitelisted) ====================(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)HKU\S-1-5-21-62209294-3957149853-557076774-1002\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTIONHKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.msn.com/HPNOT13/1HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.comHKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.comHKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT13/1HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhomeHKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://home.microsoft.com/search/search.aspHKU\S-1-5-21-62209294-3957149853-557076774-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?ocid=iehpSearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKU\S-1-5-21-62209294-3957149853-557076774-1002 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =SearchScopes: HKU\S-1-5-21-62209294-3957149853-557076774-1002 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL =BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll [2015-07-30] (IObit)BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-22] (Google Inc.)BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\ssv.dll [2015-07-30] (Oracle Corporation)BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-22] (Google Inc.)BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)BHO-x32: Advanced SystemCare Surfing Protection -> {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> C:\Program Files (x86)\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll [2015-04-01] (IObit)BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-07-30] (Oracle Corporation)BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2012-07-09] (Hewlett-Packard)Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-22] (Google Inc.)Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-22] (Google Inc.)Toolbar: HKU\S-1-5-21-62209294-3957149853-557076774-1002 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-22] (Google Inc.)Handler-x32: x-owacid2 - {5B290518-830E-4C57-A66B-E4F748900C27} - C:\Program Files (x86)\Microsoft\SMIME Client (2010)\mimectl.dll [2013-02-03] (Microsoft Corporation)Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 205.171.2.25Tcpip\..\Interfaces\{C74D958B-8E71-4FC0-96E8-D2CDBCF458E9}: [DhcpNameServer] 192.168.0.1 205.171.2.25FireFox:========FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_15_0_0_239.dll [2014-11-26] ()FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\Microsoft Office\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_239.dll [2014-11-26] ()FF Plugin-x32: @java.com/DTPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll [2015-07-30] (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\plugin2\npjp2.dll [2015-07-30] (Oracle Corporation)FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\Microsoft Office\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\Microsoft Office\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-22] (VideoLAN)FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-22] (VideoLAN)FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)FF Plugin HKU\S-1-5-21-62209294-3957149853-557076774-1002: hp.com/HPDetect -> C:\Users\Sarchie\AppData\Roaming\HewlettPackard\HPDetect\1.0.0.0\npHPDetect.dll [2012-08-30] (HP)Chrome:=======CHR dev: Chrome dev build detected! <======= ATTENTIONCHR Profile: C:\Users\Sarchie\AppData\Local\Google\Chrome\User Data\DefaultCHR Extension: (No Name) - C:\Users\Sarchie\AppData\Local\Google\Chrome\User Data\Default\Extensions\medljlgfgmhiiggoieoahmbjhlfabbbd [2015-01-28]==================== Services (Whitelisted) ========================(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)R2 AdvancedSystemCareService8; C:\Program Files (x86)\IObit\Advanced SystemCare 8\ASCService.exe [821024 2015-08-05] (IObit)R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.) [File not signed]S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-12-09] (Microsoft Corporation)S3 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [85504 2012-08-10] (Hewlett-Packard Company) [File not signed]R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89840 2015-03-28] (Hewlett-Packard Company)S3 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2451456 2012-07-13] (Realsil Microelectronics Inc.) [File not signed]R2 IMFservice; C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe [882464 2015-07-17] (IObit)S3 InstallRoot; C:\Program Files (x86)\DoD-PKE\InstallRoot\InstallRootService.exe [655544 2014-01-15] ()R2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2909472 2015-07-30] (IObit)R2 Seagate Dashboard Services; C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe [16000 2014-09-17] (Seagate Technology LLC)R2 Seagate MobileBackup Service; C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\MobileService.exe [157776 2014-09-17] (Seagate Technology LLC)S4 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1363160 2014-11-28] (Secunia)S4 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [765144 2014-11-28] (Secunia)R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1026944 2015-06-19] (Enigma Software Group USA, LLC.)S3 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [339968 2014-11-24] (IDT, Inc.) [File not signed]R2 StartMenuService; C:\Program Files (x86)\IObit\Start Menu 8\StartMenuServices.exe [1055008 2015-05-20] (IObit)S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2014-07-02] (Microsoft Corporation)R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-08-18] (Microsoft Corporation)R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-08-18] (Microsoft Corporation)===================== Drivers (Whitelisted) ==========================(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-20] (Advanced Micro Devices)S2 APXACC; C:\Windows\system32\DRIVERS\appexDrv.sys [199008 2012-06-23] (AppEx Networks Corporation)R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3881472 2015-01-27] (Qualcomm Atheros Communications, Inc.)R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [223232 2015-05-19] (Advanced Micro Devices)R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)S3 CSRBC; C:\Windows\System32\Drivers\csrbcx64.sys [32768 2008-10-24] (CSR)S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [15920 2015-01-29] (Enigma Software Group USA, LLC.)S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2015-01-29] ()R3 FileMonitor; C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\FileMonitor.sys [23048 2015-03-25] (IObit)R1 HWiNFO32; C:\WINDOWS\SysWOW64\drivers\HWiNFO64A.SYS [26528 2014-12-24] (REALiX)S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2014-11-28] (Secunia)R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [294104 2015-02-03] (Realtek Semiconductor Corp.)S3 S3XXx64; C:\Windows\system32\DRIVERS\S3XXx64.sys [73856 2015-02-17] (Identiv)R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [21184 2014-06-04] (IObit)S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [41272 2012-08-24] (Synaptics Incorporated)S3 SmbDrvI; C:\Windows\System32\drivers\Smb_driver_Intel.sys [43832 2012-08-24] (Synaptics Incorporated)S3 SWDUMon; C:\Windows\system32\DRIVERS\SWDUMon.sys [16152 2015-01-28] ()S3 WinRing0_1_2_0; C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [14544 2010-11-01] (OpenLibSys.org)R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2013-06-27] (Hewlett-Packard Development Company, L.P.)S3 MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [X]========================== Drivers MD5 =======================C:\Windows\System32\drivers\1394ohci.sys E1832BD9FD7E0FC2DC9FA5935DE3E8C1C:\Windows\System32\drivers\3ware.sys AD508A1A46EC21B740AB31C28EFDFDB1C:\Windows\system32\DRIVERS\Accelerometer.sys 899B7E724BF19F17978B6A37B864A277C:\Windows\System32\drivers\ACPI.sys E796AE43DDD1844281DB4D57294D17C0C:\Windows\System32\Drivers\acpiex.sys AC8279D229398BCF05C3154ADCA86813C:\Windows\System32\drivers\acpipagr.sys A8970D9BF23CD309E0403978A1B58F3FC:\Windows\System32\drivers\acpipmi.sys 111A89C99C5B4F1A7BCE5F643DD86F65C:\Windows\System32\drivers\acpitime.sys 5758387D68A20AE7D3245011B07E36E7C:\Windows\System32\drivers\ADP80XX.SYS 7C1FDF1B48298CBA7CE4BDD4978951ADC:\Windows\system32\drivers\afd.sys 374E27295F0A9DCAA8FC96370F9BEEA5C:\Windows\System32\drivers\agp440.sys 7DFAEBA9AD62D20102B576D5CAC45EC8C:\Windows\System32\DRIVERS\ahcache.sys FE14D249D39368CA62D8DA6BC94AC694C:\Windows\System32\drivers\amdk8.sys 7589DE749DB6F71A68489DCE04158729C:\Windows\system32\DRIVERS\atikmdag.sys 4A77FC1632F57CC25E9B1020E044FF5DC:\Windows\system32\DRIVERS\atikmpag.sys 686B26A4F0320076474030A510B19747C:\Windows\System32\drivers\amdppm.sys B46D2D89AFF8A9490FA8C98C7A5616E3C:\Windows\System32\drivers\amdsata.sys D2BF2F94A47D332814910FD47C6BBCD2C:\Windows\System32\drivers\amdsbs.sys A8E04943C7BBA7219AA50400272C3C6EC:\Windows\System32\drivers\amdxata.sys CEA5F4F27CFC08E3A44D576811B35F50C:\Windows\System32\drivers\amd_sata.sys A84645EFF919CCC2D0EC8159C05FA034C:\Windows\System32\drivers\amd_xata.sys 7D997D187869919A1C77D3CFA2F282F8C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys E8CCB797DAF80779C768BD3A9FC8FCAFC:\Windows\system32\drivers\appid.sys 415DD71628795197F7AFC176CBADC74EC:\Windows\system32\DRIVERS\appexDrv.sys 44695679881DEB85CAD7C249B151066EC:\Windows\System32\drivers\arcsas.sys 65045784366F7EC5FB4E71BCF923187BC:\Windows\system32\DRIVERS\asyncmac.sys 3DB7721F06BC2FEDB25029EA23AB27DAC:\Windows\System32\drivers\atapi.sys 74B14192CF79A72F7536B27CB8814FBDC:\Windows\system32\DRIVERS\athwbx.sys FF3A0F772EB85E20E3F9865716B7AAA2C:\Windows\system32\drivers\AtihdWB6.sys 27787D738F2EE74D9B9A614F2F2BDC22C:\Windows\System32\drivers\bxvbda.sys A4A73F631FE2AA2826FBE4A399B04DEFC:\Windows\System32\drivers\BasicDisplay.sys 8CC7F7E4AFCBA605921B137ED7992C68C:\Windows\System32\drivers\BasicRender.sys 38A82F4EE8C416A6744B6D30381ED768C:\Windows\System32\drivers\bcmfn2.sys C1ABB0F7E3BEA48A0417BDF6FF14AB21C:\Windows\System32\Drivers\Beep.sys EC19013E4CF87609534165DF897274D6C:\Windows\System32\DRIVERS\bowser.sys 6B4FFFDDC618FCF64473CAA86E305697C:\Windows\System32\drivers\BthAvrcpTg.sys A8F23D453A424FF4DE04989C4727ECC7C:\Windows\System32\drivers\bthhfenum.sys 272A62B660A48AEF366F8A1836CED19FC:\Windows\System32\drivers\BthHFHid.sys 71FE2A48E4C93DDB9798C024880B6C07C:\Windows\System32\drivers\bthmodem.sys 66B791F6B11DC4303DD18A224A501542C:\Windows\System32\Drivers\BTHport.sys B810B2B39CCA90DC6BF42AF1658AE0D1C:\Windows\System32\Drivers\BTHUSB.sys 52A1B7ECAB4C9EF70FD41241691E09D3C:\Windows\System32\DRIVERS\cdfs.sys 2FA6510E33F7DEFEC03658B74101A9B9C:\Windows\System32\drivers\cdrom.sys C6796EA22B513E3457514D92DCDB1A3DC:\Windows\System32\drivers\circlass.sys BE9936EDD3267FAAFF94A7835867F00BC:\Windows\System32\drivers\CLFS.sys 8EB7E70C2D348FE2476A2E3F2D585E3DC:\Windows\system32\DRIVERS\CLVirtualDrive.sys 075CCE75090786F124573A788C8656E6C:\Windows\System32\drivers\CmBatt.sys EF6EF85DADC3184A10D8F2F7159973CBC:\Windows\System32\Drivers\cng.sys 5E5AB950693F2C6D6ACBEE3A74697ED7C:\Windows\System32\drivers\CompositeBus.sys 03AAED827C36F35D70900558B8274905C:\Windows\System32\drivers\condrv.sys A1FF7DFBFBE164CF92603C651D304DD2C:\Windows\System32\Drivers\csrbcx64.sys 625C1EC250D3CE0E796D6C16E69D9160C:\Windows\System32\drivers\dam.sys 389C998C64319CD97625B0550E52ECFAC:\Windows\System32\drivers\dc3d.sys D06E443457FADC6B1AFAF3AA4B6936F6C:\Windows\System32\Drivers\dfsc.sys A03F362C5557E238CBFA914689C77248C:\Windows\system32\DRIVERS\ssudbus.sys 73BDD44A6088916964945886F9025409C:\Windows\System32\drivers\disk.sys 4D40C9B33F738797CF50E77CB7C53E85C:\Windows\System32\drivers\dmvsc.sys EB70A894708D1BC176AFD690FF06085FC:\Windows\system32\drivers\drmkaud.sys 00C594D5A1DBD22AD8B2902B9F6EFF94C:\Windows\System32\drivers\dxgkrnl.sys E1BB0B6F00F470B451AB45EA13EBA0B3C:\Windows\System32\drivers\evbda.sys 114BCFDF367FF37C3F1B0A96AF542E4DC:\Windows\System32\drivers\EhStorClass.sys 43531A5993380CC5113242C29D265FD9C:\Windows\System32\drivers\EhStorTcgDrv.sys 6F8E738A9505A388B1157FDDE7B3101BC:\Windows\System32\drivers\errdev.sys DFFFAE1442BA4076E18EED5E406FA0D3C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys 7AEC5E76816178BF6C543A155D8208B6C:\Windows\System32\DRIVERS\EsgScanner.sys 3B32CAA07D672F8A2E0DF5CB3A873F45C:\Windows\System32\Drivers\exfat.sys 7729D294A555C7AEB281ED8E4D0E01E4C:\Windows\System32\Drivers\fastfat.sys 7C4E0D5900B2A1D11EDD626D6DDB937BC:\Windows\System32\drivers\fdc.sys 5D8402613E778B3BD45E687A8372710BC:\Windows\System32\drivers\fileinfo.sys BCFD8B149B3ADF92D0DB1E909CAF0265C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\FileMonitor.sys D409D4A4517865131999FAC96D366CBFC:\Windows\System32\drivers\filetrace.sys A1A66C4FDAFD6B0289523232AFB7D8AFC:\Windows\System32\drivers\flpydisk.sys BE743083CF7063C486A4398E3AEFE59AC:\Windows\System32\drivers\fltmgr.sys C1FB505A73FA2E9019D32444AB33B75AC:\Windows\System32\drivers\FsDepends.sys A7C31B168F371E8E6796219F23E354DBC:\Windows\System32\Drivers\Fs_Rec.sys 09F460AFEDCA03F3BF6E07D1CCC9AC42C:\Windows\system32\drivers\ftdibus.sys 7442BCA60ED46CC31C2F39728BBDD9ADC:\Windows\system32\drivers\ftser2k.sys 121AF3148CDDA212CFFBC4F6240699C2C:\Windows\System32\DRIVERS\fvevol.sys F152D55E497E12256290C43B31C7D0CEC:\Windows\System32\drivers\fxppm.sys 9591D0B9351ED489EAFD9D1CE52A8015C:\Windows\System32\drivers\gagp30kx.sys FC3EF65EE20D39F8749C2218DBA681CAC:\Windows\System32\drivers\vmgencounter.sys 0BF5CAD281E25F1418E5B8875DC5ADD1C:\Windows\System32\Drivers\msgpioclx.sys 8DF1254093B5C354CE725EB6B9B0DE19C:\Windows\System32\drivers\HDAudBus.sys D4B7ED39C7900384D9E5C1283F1E7926C:\Windows\System32\drivers\HidBatt.sys 10A70BC1871CD955D85CD88372724906C:\Windows\System32\drivers\hidbth.sys 42F88B57CAE42FC10059C887B3FCFCEAC:\Windows\System32\drivers\hidi2c.sys C241A8BAFBBFC90176EA0F5240EACC17C:\Windows\System32\drivers\hidir.sys 9BDDEE26255421017E161CCB9D5EDA95C:\Windows\System32\drivers\hidusb.sys 8DB8EAB9D0C6A5DF0BDCADEA239220B4C:\Windows\System32\DRIVERS\hpdskflt.sys D104FF402FC3DDB686E6DEF00334DB26C:\Windows\System32\drivers\HpSAMD.sys A6AACEA4C785789BDA5912AD1FEDA80DC:\Windows\System32\drivers\HTTP.sys E87A6D3B8FECD5B93BC0CFBB48C27970C:\WINDOWS\SysWOW64\drivers\HWiNFO64A.SYS E5805896A55D4166C20F216249F40FA3C:\Windows\System32\drivers\hwpolicy.sys 90656C0B3864804B090434EFC582404FC:\Windows\System32\drivers\hyperkbd.sys 6D6F9E3BF0484967E52F7E846BFF1CA1C:\Windows\system32\DRIVERS\HyperVideo.sys 907C870F8C31F8DDD6F090857B46AB25C:\Windows\System32\drivers\i8042prt.sys 49EE0AE9E5B64FFBBD06D55C4984B598C:\Windows\System32\drivers\iaLPSSi_GPIO.sys 5D90E32E36CE5D4C535D17CE08AEAF05C:\Windows\System32\drivers\iaLPSSi_I2C.sys DD05E7E80F52ADE9AEB292819920F32CC:\Windows\System32\drivers\iaStorA.sys 050F2539E14F9D5E90A4B61738EC29BDC:\Windows\System32\drivers\iaStorAV.sys 08BFE413B0B4AA8DFA4B5684CE06D3DCC:\Windows\System32\drivers\iaStorV.sys A2200C3033FA4EF249FC096A7A7D02A2C:\Windows\System32\drivers\intelide.sys 4E448FCFFD00E8D657CD9E48D3E47157C:\Windows\System32\drivers\intelpep.sys 7AA01AB1C110916825E6E1389F1B9AF2C:\Windows\System32\drivers\intelppm.sys 47E74A8E53C7C24DCE38311E1451C1D9C:\Windows\System32\DRIVERS\ipfltdrv.sys 9DB76D7F9E4E53EFE5DD8C53DE837514C:\Windows\System32\drivers\IPMIDrv.sys 9C096BF5E10CA8BFA56F32522A89FAF1C:\Windows\System32\drivers\ipnat.sys B7342B3C58E91107F6E946A93D9D4EFDC:\Windows\System32\drivers\irenum.sys AE44C526AB5F8A487D941CEB57B10C97C:\Windows\System32\drivers\isapnp.sys 8AFEEA3955AA43616A60F133B1D25F21C:\Windows\System32\drivers\msiscsi.sys D90AB68D0FAC9F357F663670FDBB511EC:\Windows\System32\drivers\kbdclass.sys 5917AFE4A3F695A54B99C1849C8207FEC:\Windows\System32\drivers\kbdhid.sys 8CD840A062F6BDF41DDE3ACB96164B72C:\Windows\system32\DRIVERS\kdnic.sys 813871C7D402A05F2E3A7075F9584A05C:\Windows\System32\Drivers\ksecdd.sys 4E829B18D5BAEC29893792A3C671A847C:\Windows\System32\Drivers\ksecpkg.sys 46711F40D0F9E63F786ED23F9BD5215EC:\Windows\system32\drivers\ksthunk.sys 11AFB527AA370B1DAFD5C36F35F6D45FC:\Windows\system32\DRIVERS\lltdio.sys C09010B3680860131631F53E8FE7BAD8C:\Windows\System32\drivers\lsi_sas.sys C755AE4635457AA2A11F79C0DF857ABCC:\Windows\System32\drivers\lsi_sas2.sys ADAC09CBE7A2040B7F68B5E5C9A75141C:\Windows\System32\drivers\lsi_sas3.sys 04D1274BB9BBCCF12BD12374002AA191C:\Windows\System32\drivers\lsi_sss.sys 327469EEF3833D0C584B7E88A76AEC0CC:\Windows\system32\drivers\luafv.sys DDEE191AB32DFC22C6465002ECDF5EE4C:\Windows\System32\drivers\megasas.sys EB5C03A070F30D64A6DF80E53B22F53FC:\Windows\System32\drivers\megasr.sys F6F13533196DE7A582D422B0241E4363C:\Windows\System32\drivers\modem.sys 8B38C44F69259987C95135C9627E2378C:\Windows\System32\drivers\monitor.sys 601589000CC90F0DF8DA2CC254A3CCC9C:\Windows\System32\drivers\mouclass.sys 08374E4E5B8914DE6067CBA99F61E930C:\Windows\System32\drivers\mouhid.sys 5FCBAB60598AE119E02B4C27DE6B99EAC:\Windows\System32\drivers\mountmgr.sys 9A788037D768809DFD677F4BA08A224AC:\Windows\System32\drivers\mpsdrv.sys 6FC047578785B0435F4E2660946D1ADCC:\Windows\system32\drivers\mrxdav.sys DB32958F0E704EFBF7F15161A569E39FC:\Windows\System32\DRIVERS\mrxsmb.sys 6FBDF2B1B025A8E6E069234362FFFFB7C:\Windows\System32\DRIVERS\mrxsmb10.sys BCBD64220AD85C26823453FF1DC3EFBDC:\Windows\System32\DRIVERS\mrxsmb20.sys 57C2473D501331211D6885FD59F3E44BC:\Windows\system32\DRIVERS\bridge.sys F3C060444777A59FC63D920719E43CCDC:\Windows\System32\Drivers\Msfs.sys D13329FBF8345B28AB30F44CC247DC08C:\Windows\System32\drivers\msgpiowin32.sys C6B474E46F9E543B875981ED3FFE6ADDC:\Windows\System32\drivers\mshidkmdf.sys 65C92EB9D08DB5C69F28C7FFD4E84E31C:\Windows\System32\drivers\mshidumdf.sys 52299F086AC2DAFD100DD5DC4A8614BAC:\Windows\System32\drivers\msisadrv.sys 36D92AF3343C3A3E57FEF11C449AEA4CC:\Windows\system32\drivers\MSKSSRV.sys A9BBBD2BAE6142253B9195E949AC2E8DC:\Windows\system32\DRIVERS\mslldp.sys 51B3AC0560848CD6D65AC2033E293113C:\Windows\system32\drivers\MSPCLOCK.sys 7B2128EB875DCBC006E6A913211006D6C:\Windows\system32\drivers\MSPQM.sys 1E88171579B218115C7A772F8DE04BD8C:\Windows\System32\Drivers\MsRPC.sys BBE2A455053E63BECBF42C2F9B21FAE0C:\Windows\System32\drivers\mssmbios.sys 8D6B7D515C5CBCDB75B928A0B73C3C5EC:\Windows\system32\drivers\MSTEE.sys 115019AE01E0EB9C048530D2928AB4A2C:\Windows\System32\drivers\MTConfig.sys 96D604A35070360F0DD4A7A8AF410B5EC:\Windows\System32\Drivers\mup.sys 619CA29326B82372621DB2C0964D8365C:\Windows\System32\drivers\mvumis.sys B8C35C94DCB2DFEAF03BB42131F2F77FC:\Windows\system32\DRIVERS\nwifi.sys 008F7CED69FD5B30CBDE1E03C6F36A27C:\Windows\System32\drivers\ndis.sys 97DC5967F65503213FD1F1B3E4A6F983C:\Windows\system32\DRIVERS\ndiscap.sys 8CECC8DA55F3274181FD1EA28AD76664C:\Windows\system32\DRIVERS\NdisImPlatform.sys 269882812E9A68FFF1AFE1283D428322C:\Windows\system32\DRIVERS\ndistapi.sys DC1D9F692C2AD84C214584C28501C1F7C:\Windows\system32\DRIVERS\ndisuio.sys B832B35055BA2B7B4181861FF94D8E59C:\Windows\System32\drivers\NdisVirtualBus.sys 1F58E48EF75F34C35D8E93A0DC535CFEC:\Windows\system32\DRIVERS\ndiswan.sys DEC29080202D4F9F17F55E18BCFCC41AC:\Windows\system32\DRIVERS\ndiswan.sys DEC29080202D4F9F17F55E18BCFCC41AC:\Windows\System32\Drivers\NDProxy.sys 0BBE2FA30BAD58C9ADC01E4F84A3D2A1C:\Windows\System32\drivers\Ndu.sys 3083926D1CC5B56EA0786527B557DD1BC:\Windows\System32\DRIVERS\netbios.sys 42FF4975D032CAE558AE4BB8448F6E5AC:\Windows\System32\DRIVERS\netbt.sys 0217532E19A748F0E5D569307363D5FDC:\Windows\System32\drivers\netvsc63.sys D4DCE03870314D3354F3501F9DDD4123C:\Windows\System32\Drivers\Npfs.sys 8F44A2F57C9F1A19AC9C6288C10FB351C:\Windows\System32\drivers\npsvctrig.sys CBDB4F0871C88DF930FC0E8588CA67FCC:\Windows\System32\drivers\nsiproxy.sys 0E046FF5823B95326D10CF1B4AF23541C:\Windows\System32\Drivers\Ntfs.sys 7F68063A5A0461E02BC860CE0E6BFDDCC:\Windows\System32\Drivers\Null.sys EF1B290FC9F0E47CC0B537292BEE5904C:\Windows\System32\drivers\nvraid.sys BC6B5942AFF25EBAF62DE43C3807EDF8C:\Windows\System32\drivers\nvstor.sys 1F43ABFFAC3D6CA356851D517392966EC:\Windows\System32\drivers\nv_agp.sys 6934A936A7369DFE37B7DBA93F5E5E49C:\Windows\System32\drivers\parport.sys 764B1121867B2D9B31C491668AC72B2BC:\Windows\System32\drivers\partmgr.sys BAFF6122CFC9F95CA175AD8C348179A4C:\Windows\System32\drivers\pci.sys 91ED124E261EA8FAA1C0FFDF2A71B0C4C:\Windows\System32\drivers\pciide.sys 346E38FCC6859A727DD28AFAD1F0AFF4C:\Windows\System32\drivers\pcmcia.sys 4D3BDCC1C7B40C9D7B6AD990E6DEC397C:\Windows\System32\drivers\pcw.sys BF28771D1436C88BE1D297D3098B0F7DC:\Windows\System32\drivers\pdc.sys ED54A75050211DC77F9B98C41E026858C:\Windows\System32\drivers\peauth.sys 0ECEE590F2E2EF969FB74A6FC583A1E6C:\Windows\System32\drivers\point64.sys E4799B87675C59AA1F620DE5C6F113BBC:\Windows\system32\DRIVERS\raspptp.sys E075CC071022BD4E9BE7C024717C0E0AC:\Windows\System32\drivers\processr.sys ECD373F9571C745894367CC2635EA44FC:\Windows\system32\DRIVERS\pacer.sys FC0141B4A5AD6D637D883C1A89FC45C5C:\Windows\System32\DRIVERS\psi_mf_amd64.sys DD3FD48D69F5FBBB21D46D1514C1C2DBC:\Windows\system32\drivers\qwavedrv.sys 83868EB2924E6BC21A54337C65D614D1C:\Windows\System32\DRIVERS\rasacd.sys B337B1F1E82A83E20A1743E008E25C0FC:\Windows\system32\DRIVERS\AgileVpn.sys 3EE5097945A7F680E320953271EB2D4FC:\Windows\system32\DRIVERS\rasl2tp.sys 1BD3022FD6E450B00DE560265638FD2AC:\Windows\system32\DRIVERS\raspppoe.sys 5247F308C4103CDC4FE12AE1D235800AC:\Windows\system32\DRIVERS\rassstp.sys 41F631007A158FEBB67F0E2AD1601BBAC:\Windows\System32\DRIVERS\rdbss.sys A1A5E79C0D1352AFDC08328A623DA051C:\Windows\System32\drivers\rdpbus.sys 6B21EBF892CD8CACB71669B35AB5DE32C:\Windows\System32\drivers\rdpdr.sys 680C1DAE268B6FB67FA21B389A8B79EFC:\Windows\System32\drivers\rdpvideominiport.sys BC8A79C625568DDB7DCA49D0C2741A64C:\Windows\System32\drivers\rdyboost.sys A26AEC49F318FEE141DDDB2C5F99B3E6C:\Windows\System32\Drivers\ReFS.sys 615DFD97DEA56CE1C3A52185A3038FF8C:\Windows\system32\DRIVERS\RtsP2Stor.sys 0F6F714ED34B4BA6493A7B0902451A5DC:\Windows\system32\DRIVERS\rspndr.sys 2D05A5508F4685412F2B89E8C2189ABCC:\Windows\system32\DRIVERS\Rt630x64.sys BDADF1B669FDF8D498B7D7DF402A4359C:\Windows\System32\drivers\vms3cap.sys 1A063730F221B2746FF00457AE17E4F0C:\Windows\system32\DRIVERS\S3XXx64.sys A53AD7D8005429E1E446A401F2BCA681C:\Windows\System32\drivers\sbp2port.sys C624A1B32211C3166EDB3F4AB02A30B7C:\Windows\System32\DRIVERS\scfilter.sys 13BEA6C882D4D877A5A85CA149C86BC1C:\Windows\System32\drivers\sdbus.sys C54B6B2170BF628FD42F799A66956D75C:\Windows\System32\drivers\sdstor.sys 0B1E929D11A8E358106955603FAC65E8C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legitC:\Windows\System32\drivers\SerCx.sys DB2FF24CE0BDD15FE75870AFE312BA89C:\Windows\System32\drivers\SerCx2.sys 0044B31F93946D5D41982314381FE431C:\Windows\System32\drivers\serenum.sys 3CD600C089C1251BEEB4CD4CD5164F9EC:\Windows\System32\drivers\serial.sys D864381BC9C725FAB01D94C060660166C:\Windows\System32\drivers\sermouse.sys 148195AE95D9BC7375A08846439FDAC1C:\Windows\System32\drivers\sfloppy.sys 472B7A5AC181C050888DB454663DD764C:\Windows\System32\drivers\SiSRaid2.sys 2F518D13DD6F3053837FE606F1A2EA1FC:\Windows\System32\drivers\sisraid4.sys 1AC9A200A9C49C4508F04AAFFCA34A3FC:\Windows\System32\Drivers\SmartDefragDriver.sys E77CB3736A702D46A6FB15FB4A9894E3C:\Windows\System32\drivers\Smb_driver_AMDASF.sys AF5CC3F9B88F140D78FC967ABF0F4EC7C:\Windows\System32\drivers\Smb_driver_Intel.sys 19555D03CB179BED8B8AAA239A36BDA4C:\Windows\System32\drivers\spaceport.sys D24B1945ED1F9C96DA786DBBF1E983CEC:\Windows\System32\drivers\SpbCx.sys F337BE11071818FC3F5DC2940B6BDE34C:\Windows\System32\DRIVERS\srv.sys 6416E79A58A8FCC33A447A4DDDD3BF04C:\Windows\System32\DRIVERS\srv2.sys 00D8AC8E3053290BDE6EA2FB6810D2FCC:\Windows\System32\DRIVERS\srvnet.sys D047CD668E6277FD80F0C613946F034CC:\Windows\system32\DRIVERS\ssudmdm.sys 5252D7BC56E5E0ED715AEA8FE173A455C:\Windows\System32\drivers\stexstor.sys 366DEA74BBA65B362BCCFC6FC2ADFD8BC:\Windows\system32\DRIVERS\stwrt64.sys 2A560BCECE25A62075AB13F7BFF4D9EFC:\Windows\System32\drivers\storahci.sys 0ED2E318ABB68C1A35A8B8038BDB4C90C:\Windows\System32\drivers\vmstorfl.sys 8B9486B64E5FC17FB9CC04CA10B77A34C:\Windows\System32\drivers\stornvme.sys 6B06E2D11E604BE2B1A406C4CB3B90DEC:\Windows\System32\drivers\storvsc.sys 548759755BC73DAD663250239D7E0B9FC:\Windows\system32\DRIVERS\SWDUMon.sys F86D3216B54CCBB45022011B3C276C43C:\Windows\System32\drivers\swenum.sys 65454187E0F8B6C0DCECB0287D06EC43C:\Windows\system32\DRIVERS\SynTP.sys 0F34FE968C91D02CE30D76C257F2BDA0C:\Windows\System32\drivers\tcpip.sys 746DDF7D59AB8D721C88D48434597E8DC:\Windows\system32\DRIVERS\tcpip.sys 746DDF7D59AB8D721C88D48434597E8DC:\Windows\System32\drivers\tcpipreg.sys 41CF802064F72E55F50CA0A221FD36D4C:\Windows\system32\DRIVERS\tdx.sys FFF28F9F6823EB1756C60F1649560BBFC:\Windows\System32\drivers\terminpt.sys 232D185D2337F141311D0CF1983E1431C:\Windows\system32\drivers\tpm.sys 82F909359600D3603FE852DB7F135626C:\Windows\System32\drivers\tsusbflt.sys BF8F54CA37E9C9D6582C31C5761F8C93C:\Windows\System32\drivers\TsUsbGD.sys 20185BEB7512EDE4EFECDFA148AC9F99C:\Windows\system32\DRIVERS\tunnel.sys C8E0E78B5D284C2FF59BDFFDAF997242C:\Windows\System32\drivers\uagp35.sys F6EEAD052943B5A3104C1405BB856C54C:\Windows\System32\drivers\uaspstor.sys FE6067B1FD4E63650C667B33D080565BC:\Windows\System32\drivers\ucx01000.sys 807F8CF3E973305FC435C61CBBEE2A49C:\Windows\System32\DRIVERS\udfs.sys C61EAF8E1E4B2F62BA4FDF457440B2C6C:\Windows\System32\drivers\UEFI.sys 9578691F297E1B1F519970FE6D47CB21C:\Windows\System32\drivers\uliagpkx.sys 5EAB5117DDB24FC4D39E6FFFCF1837B9C:\Windows\System32\drivers\umbus.sys DA34C39A18E60E7C3FA0630566408034C:\Windows\System32\drivers\umpass.sys AE8294875E5446E359B1E8035D40C05EC:\Windows\System32\drivers\usbccgp.sys FF78D053A05E5A394F4E3C1816CC65A8C:\Windows\System32\drivers\usbcir.sys 0139248F6B95CF0D837B5B46A2722D40C:\Windows\System32\drivers\usbehci.sys 48BA326A3DBA5B5BEB5F2777F4618696C:\Windows\system32\DRIVERS\usbfilter.sys 4875DC63E548812C75D4FDEF84970C89C:\Windows\System32\drivers\usbhub.sys FEF0BC107812B36849741C3211BA6B60C:\Windows\System32\drivers\UsbHub3.sys 95B0179BDA907252025DEEA183699FB3C:\Windows\System32\drivers\usbohci.sys 3019097FB6C985EF24C058090FF3BDBDC:\Windows\System32\drivers\usbprint.sys 4D655E3B684BE9B0F7FFD8A2935C348CC:\Windows\system32\DRIVERS\usbscan.sys 0F030491BA4A27BD46F8B8ACEEE83F1AC:\Windows\System32\drivers\USBSTOR.SYS 66732C13628BDB1AB0D6FD46027327C2C:\Windows\System32\drivers\usbuhci.sys 064260B3A5868AC894A4943543BC7AB7C:\Windows\System32\Drivers\usbvideo.sys 5C8F604F6DC74177CDD8372D7B1ADFF0C:\Windows\System32\drivers\USBXHCI.SYS 44603DA5A87FB491EF59C889EBBB4DDBC:\Windows\System32\drivers\vdrvroot.sys FEB26E3B8345A7E8D62F945C4AE86562C:\Windows\System32\drivers\VerifierExt.sys A026EDEAA5EECAE0B08E2748B616D4BDC:\Windows\System32\drivers\vhdmp.sys F6ECFD6128A16A4851CFE98D4E01B011C:\Windows\System32\drivers\viaide.sys 06D38968028E9AB19DE9B618C7B6D199C:\Windows\System32\drivers\vmbus.sys 511AD3FF957A0127E6BD336FF6F89C38C:\Windows\System32\drivers\VMBusHID.sys DA40BEA0A863CE768C940CA9723BF81FC:\Windows\System32\drivers\volmgr.sys 55D7D963DE85162F1C49721E502F9744C:\Windows\System32\drivers\volmgrx.sys CCB9E901F7254BF96D28EB1B0E5329B7C:\Windows\System32\drivers\volsnap.sys 64CA2B4A49A8EAF495E435623ECCE7DBC:\Windows\System32\drivers\vpci.sys EF31713EE4C7CCFE4049F7E7F15645A2C:\Windows\System32\drivers\vsmraid.sys 4539F45F9F4C9757A86A56C949421E07C:\Windows\System32\drivers\vstxraid.sys 0849B7260F26FE05EA56DED0672E2F4BC:\Windows\System32\drivers\vwifibus.sys BE970C369E43B509C1EDA2B8FA7CECB0C:\Windows\system32\DRIVERS\vwififlt.sys 35BF5C5F5E3C9902C98978C7640574DAC:\Windows\system32\DRIVERS\vwifimp.sys 65ED7B9CFEA893DF7748D5FF692690DEC:\Windows\System32\drivers\wacompen.sys 0910AB9ED404C1434E2D0376C2AD5D8BC:\Windows\system32\DRIVERS\wanarp.sys B41F3E5780D97CFD44A717153AD9CF2CC:\Windows\system32\DRIVERS\wanarp.sys B41F3E5780D97CFD44A717153AD9CF2CC:\Windows\System32\drivers\WdBoot.sys 81285DDC994F03379DB46419300B2DCBC:\Windows\System32\drivers\Wdf01000.sys CB6C63FF8342B467E2EF76E98D5B934DC:\Windows\System32\drivers\WdFilter.sys 26B8FED3F3B85F5F0C4BD03FD00B9941C:\Windows\System32\Drivers\WdNisDrv.sys CE67080F00E0AF32755096CEA6430ABAC:\Windows\System32\DRIVERS\wfplwfs.sys 715ABA3DD164D06457A2A3C92F6EA9D5C:\Windows\System32\drivers\wimmount.sys 5F66B7BB330AA80067FC66149A692620C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys 0C0195C48B6B8582FA6F6373032118DAC:\Windows\System32\drivers\WinUsb.sys AC263C2F66405589528995AA41040599C:\Windows\System32\drivers\WirelessButtonDriver64.sys 4F2A80D65AE6F845776E2F06AE6782EDC:\Windows\System32\drivers\wmiacpi.sys 2834D9D3B4F554A39C72F00EA3F0E128C:\Windows\System32\Drivers\Wof.sys 7FC5667DF73D4B04AA457CC3A4180E09C:\Windows\System32\DRIVERS\wpcfltr.sys A2468CC3509394A33C4C32F99563D845C:\Windows\System32\drivers\WpdUpFltr.sys 9F2904B55F6CECCD1A8D986B5CE2609AC:\Windows\system32\drivers\ws2ifsl.sys AE072B0339D0A18E455DC21666CAD572C:\Windows\System32\drivers\WSDPrint.sys F586F3F1BF962FE9AE4316E0D896B22FC:\Windows\System32\drivers\WSDScan.sys 58035FD3369879E02D65989C44D27450C:\Windows\System32\drivers\WudfPf.sys 481286719402E4BAEFEA0604AB1B5113C:\Windows\System32\drivers\WUDFRd.sys D7B4859227B02BCC1055B279A63C937FC:\Windows\System32\drivers\WUDFRd.sys D7B4859227B02BCC1055B279A63C937FC:\Windows\System32\drivers\WUDFRd.sys D7B4859227B02BCC1055B279A63C937FC:\Windows\System32\drivers\WUDFRd.sys D7B4859227B02BCC1055B279A63C937F==================== NetSvcs (Whitelisted) ===================(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)==================== Three Months Created files and folders ========(If an entry is included in the fixlist, the file/folder will be moved.)2015-08-29 09:20 - 2015-08-29 09:23 - 00041182 _____ C:\Users\Sarchie\Downloads\FRST.txt2015-08-29 09:19 - 2015-08-29 09:20 - 00000000 ____D C:\FRST2015-08-29 09:18 - 2015-08-29 09:18 - 02186752 _____ (Farbar) C:\Users\Sarchie\Downloads\FRST64.exe2015-08-29 08:53 - 2015-08-29 09:12 - 00000268 _____ C:\WINDOWS\Tasks\ASC8_SkipUac_Sarchie.job2015-08-29 08:53 - 2015-08-29 08:53 - 00003192 _____ C:\WINDOWS\System32\Tasks\ASC8_PerformanceMonitor2015-08-29 08:53 - 2015-08-29 08:53 - 00002372 _____ C:\WINDOWS\System32\Tasks\ASC8_SkipUac_Sarchie2015-08-29 08:53 - 2015-08-29 08:53 - 00002165 _____ C:\Users\Public\Desktop\Advanced SystemCare 8.lnk2015-08-27 12:28 - 2015-08-27 12:28 - 01380056 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll2015-08-27 12:28 - 2015-08-27 12:28 - 01097216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll2015-08-27 12:28 - 2015-08-27 12:28 - 00411455 _____ C:\WINDOWS\system32\ApnDatabase.xml2015-08-27 12:28 - 2015-08-27 12:28 - 00228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll2015-08-27 12:27 - 2015-08-27 12:27 - 02819072 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll2015-08-27 12:27 - 2015-08-27 12:27 - 01633792 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll2015-08-27 12:27 - 2015-08-27 12:27 - 00951296 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll2015-08-27 12:27 - 2015-08-27 12:27 - 00749568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll2015-08-27 12:27 - 2015-08-27 12:27 - 00118616 _____ (Microsoft Corporation) C:\WINDOWS\system32\consent.exe2015-08-27 12:27 - 2015-08-27 12:27 - 00041984 _____ (Microsoft Corporation) C:\WINDOWS\system32\UtcResources.dll2015-08-27 12:25 - 2015-08-27 12:25 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzsync.exe2015-08-26 10:10 - 2015-08-10 19:20 - 25191936 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll2015-08-26 10:10 - 2015-08-10 18:20 - 19871232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll2015-08-26 09:24 - 2015-08-26 09:24 - 00000000 ____D C:\Users\Sarchie\Desktop\Air Strike Logo Project2015-08-26 04:53 - 2015-08-08 07:55 - 00794088 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe2015-08-26 04:53 - 2015-08-08 07:55 - 00179688 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl2015-08-25 04:11 - 2015-08-25 04:11 - 00000000 ____D C:\62f59513b83b1632bd4fb92015-08-19 10:38 - 2015-08-19 10:39 - 00000000 ____D C:\Users\Sarchie\Desktop\4WayRots2015-08-19 04:37 - 2015-08-28 05:34 - 00020316 _____ C:\Users\Sarchie\Desktop\Daily jump plan (Autosaved).xlsx2015-08-18 12:36 - 2015-08-18 12:36 - 00270168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys2015-08-18 12:36 - 2015-08-18 12:36 - 00114520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys2015-08-18 12:36 - 2015-08-18 12:36 - 00044560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys2015-08-18 12:22 - 2015-07-28 17:24 - 00025776 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe2015-08-18 12:22 - 2015-07-28 08:24 - 01148416 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll2015-08-18 12:22 - 2015-07-28 08:24 - 01116160 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll2015-08-18 12:22 - 2015-07-28 08:24 - 00774144 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll2015-08-18 12:22 - 2015-07-28 08:24 - 00743424 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll2015-08-18 12:22 - 2015-07-28 08:24 - 00437248 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll2015-08-18 12:22 - 2015-07-28 08:24 - 00069120 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll2015-08-18 11:58 - 2015-08-26 04:52 - 00505416 _____ C:\WINDOWS\system32\FNTCACHE.DAT2015-08-14 10:15 - 2015-08-14 10:15 - 00000000 ____D C:\ProgramData\Brother2015-08-12 11:56 - 2015-07-30 08:04 - 00124624 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll2015-08-12 11:56 - 2015-07-30 07:48 - 00103120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll2015-08-12 07:34 - 2015-07-16 14:36 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll2015-08-12 07:34 - 2015-07-16 14:36 - 00417792 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec2015-08-12 07:34 - 2015-07-16 14:35 - 02885632 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll2015-08-12 07:34 - 2015-07-16 14:26 - 05923328 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll2015-08-12 07:34 - 2015-07-16 14:23 - 00615936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll2015-08-12 07:34 - 2015-07-16 14:21 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll2015-08-12 07:34 - 2015-07-16 13:53 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll2015-08-12 07:34 - 2015-07-16 13:51 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll2015-08-12 07:34 - 2015-07-16 13:50 - 00341504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec2015-08-12 07:34 - 2015-07-16 13:45 - 02279424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll2015-08-12 07:34 - 2015-07-16 13:45 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll2015-08-12 07:34 - 2015-07-16 13:41 - 00479232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll2015-08-12 07:34 - 2015-07-16 13:39 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll2015-08-12 07:34 - 2015-07-16 13:38 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll2015-08-12 07:34 - 2015-07-16 13:36 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll2015-08-12 07:34 - 2015-07-16 13:34 - 14451200 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll2015-08-12 07:34 - 2015-07-16 13:32 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl2015-08-12 07:34 - 2015-07-16 13:14 - 02880000 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll2015-08-12 07:34 - 2015-07-16 13:13 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll2015-08-12 07:34 - 2015-07-16 13:12 - 04520448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll2015-08-12 07:34 - 2015-07-16 13:12 - 02427904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll2015-08-12 07:34 - 2015-07-16 13:10 - 12856832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll2015-08-12 07:34 - 2015-07-16 13:06 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll2015-08-12 07:34 - 2015-07-16 13:01 - 01545728 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll2015-08-12 07:34 - 2015-07-16 12:52 - 01048576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll2015-08-12 07:34 - 2015-07-16 12:49 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll2015-08-12 07:34 - 2015-07-16 12:42 - 01951232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll2015-08-12 07:34 - 2015-07-16 12:38 - 01310720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll2015-08-12 07:34 - 2015-07-16 12:37 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll2015-08-12 07:34 - 2015-07-15 18:29 - 07458648 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe2015-08-12 07:34 - 2015-07-15 18:29 - 01735000 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll2015-08-12 07:34 - 2015-07-15 18:29 - 00101720 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mountmgr.sys2015-08-12 07:34 - 2015-07-15 18:28 - 01499920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll2015-08-12 07:34 - 2015-07-13 13:46 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\csrsrv.dll2015-08-12 07:34 - 2015-07-13 13:45 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\basesrv.dll2015-08-12 07:34 - 2015-07-10 11:54 - 01217024 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysmain.dll2015-08-12 07:34 - 2015-07-01 16:19 - 00228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebClnt.dll2015-08-12 07:34 - 2015-07-01 16:16 - 00104448 _____ (Microsoft Corporation) C:\WINDOWS\system32\davclnt.dll2015-08-12 07:34 - 2015-07-01 15:37 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebClnt.dll2015-08-12 07:34 - 2015-07-01 15:35 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\davclnt.dll2015-08-12 07:33 - 2015-07-29 08:37 - 01994752 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll2015-08-12 07:33 - 2015-07-29 08:30 - 01381888 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll2015-08-12 07:33 - 2015-07-29 08:23 - 01559552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll2015-08-12 07:33 - 2015-07-24 12:57 - 04177408 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys2015-08-12 07:33 - 2015-07-24 12:57 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll2015-08-12 07:33 - 2015-07-24 12:52 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll2015-08-12 07:33 - 2015-07-24 11:27 - 00301568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll2015-08-12 07:33 - 2015-07-24 11:23 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll2015-08-12 07:33 - 2015-07-13 21:22 - 02529880 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll2015-08-12 07:33 - 2015-07-13 21:21 - 01901776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll2015-08-12 07:33 - 2015-07-10 12:19 - 01101824 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvidcrl.dll2015-08-12 07:33 - 2015-07-10 11:42 - 02345472 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll2015-08-12 07:33 - 2015-07-10 11:14 - 00856064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdvidcrl.dll2015-08-12 07:33 - 2015-07-10 11:13 - 07032320 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll2015-08-12 07:33 - 2015-07-10 10:47 - 01556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll2015-08-12 07:33 - 2015-07-10 10:31 - 06213120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll2015-08-12 07:33 - 2015-07-09 11:13 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\notepad.exe2015-08-12 07:33 - 2015-07-09 11:13 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\notepad.exe2015-08-12 07:33 - 2015-07-09 10:30 - 00212992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\notepad.exe2015-08-12 05:02 - 2015-08-22 06:39 - 00000000 ____D C:\Users\Sarchie\Desktop\LEXAR2015-08-11 10:39 - 2015-08-11 10:39 - 00469690 _____ C:\Users\Sarchie\Desktop\China Flight.xps2015-08-06 18:20 - 2015-08-06 18:20 - 00000000 ____D C:\Users\Sarchie\AppData\Local\Cyberlink2015-08-06 18:13 - 2015-08-06 18:13 - 00000000 ____D C:\Users\Sarchie\AppData\Roaming\dvdcss2015-08-06 15:00 - 2015-08-06 15:00 - 03704320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll2015-08-06 15:00 - 2015-08-06 15:00 - 02228736 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll2015-08-06 15:00 - 2015-08-06 15:00 - 00891904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll2015-08-06 15:00 - 2015-08-06 15:00 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll2015-08-06 15:00 - 2015-08-06 15:00 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll2015-08-06 15:00 - 2015-08-06 15:00 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll2015-08-06 15:00 - 2015-08-06 15:00 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe2015-08-06 15:00 - 2015-08-06 15:00 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll2015-08-06 15:00 - 2015-08-06 15:00 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll2015-08-06 15:00 - 2015-08-06 15:00 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll2015-08-06 15:00 - 2015-08-06 15:00 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe2015-08-06 15:00 - 2015-08-06 15:00 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe2015-08-04 10:47 - 2015-08-28 05:39 - 00023730 _____ C:\Users\Sarchie\Desktop\Daily Qualification summary.xlsx2015-08-03 06:39 - 2015-08-03 06:39 - 00000000 ____D C:\ProgramData\HP2015-08-03 05:54 - 2015-08-03 05:54 - 00000000 ____D C:\Users\Sarchie\AppData\Roaming\Nero2015-08-03 05:53 - 2015-08-03 05:53 - 00003520 _____ C:\WINDOWS\System32\Tasks\Seagate_Install_Launch2015-08-03 05:51 - 2015-08-03 05:51 - 00002805 _____ C:\Users\Public\Desktop\Seagate Dashboard.lnk2015-08-03 05:51 - 2015-08-03 05:51 - 00000000 ____D C:\ProgramData\Nero2015-08-03 05:51 - 2015-08-03 05:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seagate Dashboard2015-08-03 05:51 - 2015-08-03 05:51 - 00000000 ____D C:\Program Files (x86)\Seagate2015-08-03 05:50 - 2015-08-03 05:50 - 00000000 ____D C:\Users\Sarchie\AppData\Roaming\Seagate2015-07-30 20:43 - 2015-07-30 20:43 - 00002408 _____ C:\WINDOWS\System32\Tasks\Uninstaller_SkipUac_Sarchie2015-07-30 20:43 - 2015-07-30 20:43 - 00001257 _____ C:\Users\Public\Desktop\Start Menu 8.lnk2015-07-30 20:43 - 2015-07-30 20:43 - 00001210 _____ C:\Users\Public\Desktop\IObit Uninstaller.lnk2015-07-30 20:43 - 2015-07-30 20:43 - 00000304 _____ C:\WINDOWS\Tasks\Uninstaller_SkipUac_Sarchie.job2015-07-30 20:35 - 2015-07-30 20:35 - 01113944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys2015-07-30 20:35 - 2015-07-30 20:35 - 00487256 _____ (Microsoft Corporation) C:\WINDOWS\system32\netcfgx.dll2015-07-30 20:35 - 2015-07-30 20:35 - 00393560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netcfgx.dll2015-07-30 20:31 - 2015-07-30 20:31 - 00001157 _____ C:\Users\Public\Desktop\IObit Malware Fighter.lnk2015-07-30 20:31 - 2015-07-30 20:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Malware Fighter2015-07-30 20:29 - 2015-07-30 20:27 - 00097888 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll2015-07-24 20:31 - 2015-07-24 20:31 - 18823680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll2015-07-24 20:31 - 2015-07-24 20:31 - 15159296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll2015-07-24 20:31 - 2015-07-24 20:31 - 01201664 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys2015-07-24 20:31 - 2015-07-24 20:31 - 00081920 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BTHUSB.SYS2015-07-24 20:29 - 2015-07-24 20:29 - 02476376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys2015-07-24 20:29 - 2015-07-24 20:29 - 00428888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS2015-07-19 21:10 - 2015-08-29 09:10 - 00000362 _____ C:\WINDOWS\Tasks\HPCeeScheduleForSarchie.job2015-07-16 13:57 - 2015-08-29 09:02 - 00000928 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job2015-07-16 13:57 - 2015-08-29 08:48 - 00000924 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job2015-07-16 13:57 - 2015-07-16 13:57 - 00002487 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk2015-07-16 13:49 - 2015-07-16 13:49 - 00003886 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task2015-07-14 20:00 - 2015-07-09 12:40 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll2015-07-14 20:00 - 2015-06-27 23:07 - 00442712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll2015-07-14 20:00 - 2015-06-27 23:07 - 00178008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys2015-07-14 20:00 - 2015-06-27 23:06 - 01311960 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll2015-07-14 20:00 - 2015-06-27 23:06 - 00332120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll2015-07-14 20:00 - 2015-06-27 10:42 - 00747520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll2015-07-14 20:00 - 2015-06-26 21:13 - 00202240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys2015-07-14 20:00 - 2015-06-26 21:12 - 00401408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys2015-07-14 20:00 - 2015-06-26 21:12 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys2015-07-14 20:00 - 2015-06-26 21:08 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll2015-07-14 20:00 - 2015-06-26 21:08 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll2015-07-14 20:00 - 2015-06-26 20:40 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll2015-07-14 20:00 - 2015-06-26 20:14 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll2015-07-14 20:00 - 2015-06-26 20:05 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll2015-07-14 20:00 - 2015-06-26 20:00 - 00989184 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll2015-07-14 20:00 - 2015-06-26 19:53 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll2015-07-14 20:00 - 2015-06-26 19:26 - 00802816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll2015-07-14 20:00 - 2015-06-26 17:21 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll2015-07-14 20:00 - 2015-06-15 16:41 - 00065024 _____ (Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe2015-07-14 20:00 - 2015-06-15 16:24 - 03320320 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll2015-07-14 20:00 - 2015-06-15 15:16 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msiexec.exe2015-07-14 20:00 - 2015-06-15 15:09 - 03607552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll2015-07-14 20:00 - 2015-06-15 14:50 - 02774528 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll2015-07-14 20:00 - 2015-06-15 13:57 - 02460160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll2015-07-14 20:00 - 2015-05-30 15:18 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll2015-07-14 20:00 - 2015-05-30 13:36 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll2015-07-14 20:00 - 2015-05-30 13:35 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll2015-07-14 19:57 - 2015-06-15 16:38 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll2015-07-14 19:57 - 2015-06-15 16:02 - 00087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdc.ocx2015-07-14 19:57 - 2015-06-15 15:58 - 00199680 _____ (Microsoft Corporation) C:\WINDOWS\system32\msrating.dll2015-07-14 19:57 - 2015-06-15 15:57 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll2015-07-14 19:57 - 2015-06-15 15:55 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll2015-07-14 19:57 - 2015-06-15 15:13 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll2015-07-14 19:57 - 2015-06-15 14:47 - 00073216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdc.ocx2015-07-14 19:57 - 2015-06-15 14:44 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrating.dll2015-07-14 19:57 - 2015-06-15 14:43 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll2015-07-14 19:57 - 2015-06-15 14:42 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll2015-07-14 19:57 - 2015-06-15 14:41 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll2015-07-14 19:57 - 2015-06-15 14:32 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll2015-07-14 19:57 - 2015-06-15 14:30 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl2015-07-14 19:57 - 2015-06-15 14:30 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll2015-07-14 19:51 - 2015-06-15 23:36 - 01661576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll2015-07-14 19:51 - 2015-06-15 23:36 - 01212248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll2015-07-10 07:39 - 2015-08-04 08:00 - 00000000 ___HD C:\$Windows.~BT2015-07-03 07:33 - 2015-08-29 09:10 - 00003180 _____ C:\WINDOWS\System32\Tasks\HPCeeScheduleForSarchie2015-06-28 15:29 - 2015-06-28 15:29 - 00000000 ____D C:\Users\Sarchie\AppData\Roaming\WebApp2015-06-28 13:05 - 2015-06-28 13:05 - 00000000 ____D C:\Users\Sarchie\Documents\CyberLink2015-06-24 01:29 - 2015-06-24 01:29 - 01217192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FM20.DLL2015-06-20 06:35 - 2015-06-20 06:35 - 00564224 _____ (Microsoft Corporation) C:\WINDOWS\system32\apphelp.dll2015-06-20 06:35 - 2015-06-20 06:35 - 00536920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcupdate_GenuineIntel.dll2015-06-20 06:34 - 2015-06-20 06:34 - 22292672 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll2015-06-20 06:34 - 2015-06-20 06:34 - 19734960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll2015-06-20 06:34 - 2015-06-20 06:34 - 03109376 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll2015-06-20 06:34 - 2015-06-20 06:34 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll2015-06-20 06:33 - 2015-06-20 06:33 - 07784448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll2015-06-20 06:33 - 2015-06-20 06:33 - 05264384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll2015-06-20 06:33 - 2015-06-20 06:33 - 00971776 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll2015-06-20 06:33 - 2015-06-20 06:33 - 00811008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll2015-06-20 06:33 - 2015-06-20 06:33 - 00522240 _____ (Microsoft Corporation) C:\WINDOWS\system32\GeofenceMonitorService.dll2015-06-20 06:33 - 2015-06-20 06:33 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GeofenceMonitorService.dll2015-06-20 06:33 - 2015-06-20 06:33 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll2015-06-20 06:33 - 2015-06-20 06:33 - 00210944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll2015-06-20 06:33 - 2015-06-20 06:33 - 00130048 _____ (Microsoft Corporation) C:\WINDOWS\system32\WiFiDisplay.dll2015-06-20 06:32 - 2015-06-20 06:32 - 06521800 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe2015-06-20 06:32 - 2015-06-20 06:32 - 01488000 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll2015-06-20 06:32 - 2015-06-20 06:32 - 00332800 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhcpl.dll2015-06-20 06:32 - 2015-06-20 06:32 - 00261376 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll2015-06-20 06:31 - 2015-06-20 06:31 - 03084288 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll2015-06-20 06:31 - 2015-06-20 06:31 - 02471424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll2015-06-20 06:31 - 2015-06-20 06:31 - 00513480 _____ C:\WINDOWS\SysWOW64\locale.nls2015-06-20 06:31 - 2015-06-20 06:31 - 00513480 _____ C:\WINDOWS\system32\locale.nls2015-06-20 06:31 - 2015-06-20 06:31 - 00294912 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemEventsBrokerServer.dll2015-06-20 06:30 - 2015-06-20 06:30 - 00020992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usb8023.sys2015-06-19 20:05 - 2015-08-14 17:19 - 00001161 _____ C:\Users\Sarchie\Desktop\SpyHunter.lnk2015-06-19 20:04 - 2015-01-29 20:43 - 00022704 _____ C:\WINDOWS\system32\Drivers\EsgScanner.sys2015-06-19 16:13 - 2015-06-19 16:13 - 00000000 ____D C:\Users\Sarchie\Desktop\DCIM2015-06-14 06:09 - 2015-06-14 06:09 - 00373641 _____ C:\Users\Sarchie\Downloads\306 FTG Status of Funds FY15 9 June 2015.pptx2015-06-11 18:00 - 2015-05-21 07:08 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll2015-06-11 17:59 - 2015-03-19 21:49 - 00309760 _____ (Microsoft Corporation) C:\WINDOWS\system32\compstui.dll2015-06-11 17:59 - 2015-03-19 21:08 - 00477184 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll2015-06-11 17:59 - 2015-03-19 20:37 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll2015-06-11 17:59 - 2015-03-19 20:07 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll2015-06-10 19:03 - 2015-05-22 21:04 - 00620032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll2015-06-10 19:03 - 2015-05-22 12:47 - 00814080 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll2015-06-10 19:03 - 2015-05-22 12:08 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll2015-06-10 19:03 - 2015-04-24 20:34 - 00653824 _____ (Microsoft Corporation) C:\WINDOWS\system32\comctl32.dll2015-06-10 19:03 - 2015-04-24 20:33 - 00549888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comctl32.dll2015-06-08 17:40 - 2015-06-08 17:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java2015-06-08 17:39 - 2015-07-30 20:29 - 00000000 ____D C:\Program Files (x86)\Java2015-06-08 17:35 - 2015-01-10 15:32 - 00128288 _____ (IObit) C:\WINDOWS\system32\IObitSmartDefragExtension.dll2015-06-08 17:32 - 2015-06-08 17:32 - 00001150 _____ C:\Users\Public\Desktop\Smart Defrag 4.lnk2015-06-07 18:45 - 2015-06-07 18:50 - 37766136 _____ (Hewlett-Packard Company ) C:\Users\Sarchie\Downloads\sp64950.exe2015-06-07 18:37 - 2015-06-07 18:37 - 00000000 ____D C:\Program Files (x86)\Hp2015-06-03 19:35 - 2015-06-03 19:35 - 00000000 ____D C:\Users\Sarchie\AppData\Local\GWX2015-06-03 19:32 - 2015-06-03 19:32 - 00000000 ____D C:\Users\Sarchie\AppData\Local\F-Secure2015-06-03 19:32 - 2015-06-03 19:32 - 00000000 ____D C:\ProgramData\F-Secure==================== Three Months Modified files and folders ========(If an entry is included in the fixlist, the file/folder will be moved.)2015-08-29 09:10 - 2014-04-16 23:56 - 01549563 _____ C:\WINDOWS\WindowsUpdate.log2015-08-29 09:08 - 2014-09-06 17:13 - 00252416 ___SH C:\Users\Sarchie\Downloads\Thumbs.db2015-08-29 09:00 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\system32\sru2015-08-29 08:58 - 2014-04-10 21:03 - 00003592 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-62209294-3957149853-557076774-10022015-08-29 08:53 - 2014-11-24 18:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced SystemCare 82015-08-29 08:47 - 2015-05-07 17:17 - 00002882 _____ C:\WINDOWS\System32\Tasks\Driver Booster SkipUAC (Sarchie)2015-08-29 08:47 - 2014-04-17 05:57 - 00000000 __RDO C:\Users\Sarchie\OneDrive2015-08-29 08:46 - 2015-01-28 21:12 - 00001716 _____ C:\WINDOWS\Tasks\KTMJRRLI.job2015-08-29 08:45 - 2013-08-22 08:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT2015-08-29 08:44 - 2014-06-14 07:37 - 00065536 _____ C:\WINDOWS\system32\spu_storage.bin2015-08-28 20:44 - 2015-01-09 02:38 - 00148480 ___SH C:\Users\Sarchie\Desktop\Thumbs.db2015-08-28 20:36 - 2014-04-17 05:51 - 00003942 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{204FCB7D-7A65-4939-9E13-9DF46001DA38}2015-08-28 09:53 - 2014-03-18 04:03 - 00006428 _____ C:\WINDOWS\system32\PerfStringBackup.INI2015-08-28 09:44 - 2014-04-17 20:55 - 97140736 _____ C:\WINDOWS\system32\config\SOFTWARE.iodefrag.bak2015-08-28 09:44 - 2014-04-17 20:55 - 00876544 _____ C:\WINDOWS\system32\config\DEFAULT.iodefrag.bak2015-08-28 09:44 - 2014-04-17 20:55 - 00036864 _____ C:\WINDOWS\system32\config\SAM.iodefrag.bak2015-08-28 09:44 - 2014-04-17 20:55 - 00028672 _____ C:\WINDOWS\system32\config\SECURITY.iodefrag.bak2015-08-28 09:05 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\SysWOW64\inetsrv2015-08-28 09:05 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\system32\inetsrv2015-08-27 19:52 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\AppReadiness2015-08-27 19:35 - 2014-10-29 17:05 - 00000000 ____D C:\Users\Sarchie\AppData\Roaming\vlc2015-08-27 12:28 - 2012-07-26 01:59 - 00000000 ____D C:\WINDOWS\CbsTemp2015-08-27 04:45 - 2013-08-22 07:25 - 00786432 ___SH C:\WINDOWS\system32\config\BBI2015-08-27 04:20 - 2014-11-28 20:36 - 00000836 _____ C:\Users\Public\Desktop\CCleaner.lnk2015-08-27 04:20 - 2014-11-28 20:36 - 00000000 ____D C:\Program Files\CCleaner2015-08-26 04:55 - 2014-04-16 16:38 - 00000000 ____D C:\ProgramData\ProductData2015-08-26 04:48 - 2014-12-11 12:32 - 00000000 ____D C:\WINDOWS\system32\appraiser2015-08-26 04:48 - 2014-07-12 14:16 - 00000000 ___SD C:\WINDOWS\system32\CompatTel2015-08-25 11:09 - 2015-04-09 20:31 - 00000000 ____D C:\Users\Sarchie\Paralog2015-08-24 09:36 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\system32\NDF2015-08-19 05:50 - 2014-04-10 21:29 - 00000000 ____D C:\ProgramData\Microsoft Help2015-08-19 04:34 - 2014-04-16 23:36 - 00000000 ____D C:\Users\Sarchie2015-08-18 12:54 - 2013-08-22 09:36 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools2015-08-18 12:54 - 2013-08-22 09:36 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools2015-08-18 12:54 - 2013-08-22 09:36 - 00000000 ____D C:\Program Files\Windows Defender2015-08-18 12:54 - 2013-08-22 09:36 - 00000000 ____D C:\Program Files (x86)\Windows Defender2015-08-18 11:56 - 2014-07-25 21:46 - 61304832 _____ C:\WINDOWS\system32\config\COMPONENTS.iodefrag.bak2015-08-15 12:49 - 2014-08-02 14:50 - 00026112 _____ C:\Users\Sarchie\Desktop\Passwords.xls2015-08-15 08:17 - 2014-04-11 19:17 - 00000000 ____D C:\WINDOWS\system32\MRT2015-08-15 07:59 - 2014-04-11 19:17 - 132483416 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe2015-08-15 07:56 - 2012-07-25 23:26 - 00000269 _____ C:\WINDOWS\win.ini2015-08-12 17:48 - 2014-04-20 07:34 - 00000000 ____D C:\Program Files\Microsoft Silverlight2015-08-12 17:48 - 2014-04-20 07:34 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight2015-08-12 11:56 - 2014-04-20 07:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight2015-08-12 08:44 - 2013-08-22 09:36 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories2015-08-12 08:44 - 2013-08-22 09:36 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories2015-08-08 12:49 - 2014-04-10 20:51 - 00000000 ____D C:\Users\Sarchie\AppData\Local\Packages2015-08-06 12:06 - 2014-04-10 20:55 - 00000000 ____D C:\Users\Sarchie\AppData\Roaming\Adobe2015-08-04 08:09 - 2014-04-17 01:15 - 00000000 ___DC C:\WINDOWS\Panther2015-08-03 06:20 - 2014-07-14 16:07 - 06696960 _____ C:\WINDOWS\system32\config\DRIVERS.iodefrag.bak2015-07-30 20:43 - 2015-03-11 18:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Start Menu 82015-07-30 20:42 - 2014-04-16 16:29 - 00000000 ____D C:\ProgramData\IObit2015-07-30 20:29 - 2014-04-19 18:34 - 00000000 ____D C:\ProgramData\Oracle==================== Files in the root of some directories =======2015-01-25 10:12 - 2015-01-25 10:12 - 0001248 _____ () C:\Users\Sarchie\AppData\Roaming\KTMJRRLI2015-01-28 21:00 - 2015-01-28 21:00 - 0000038 ___SH () C:\Users\Sarchie\AppData\Local\69ff07055291669bb2b218.728211122014-11-01 21:29 - 2014-11-01 21:29 - 0000017 _____ () C:\Users\Sarchie\AppData\Local\resmon.resmoncfg2015-03-19 18:21 - 2015-04-04 09:20 - 0000469 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc==================== Bamital & volsnap =================(There is no automatic fix for files that do not pass verification.)C:\WINDOWS\system32\winlogon.exe => File is digitally signedC:\WINDOWS\system32\wininit.exe => File is digitally signedC:\WINDOWS\explorer.exe => File is digitally signedC:\WINDOWS\SysWOW64\explorer.exe => File is digitally signedC:\WINDOWS\system32\svchost.exe => File is digitally signedC:\WINDOWS\SysWOW64\svchost.exe => File is digitally signedC:\WINDOWS\system32\services.exe => File is digitally signedC:\WINDOWS\system32\User32.dll => File is digitally signedC:\WINDOWS\SysWOW64\User32.dll => File is digitally signedC:\WINDOWS\system32\userinit.exe => File is digitally signedC:\WINDOWS\SysWOW64\userinit.exe => File is digitally signedC:\WINDOWS\system32\rpcss.dll => File is digitally signedC:\WINDOWS\system32\dnsapi.dll => File is digitally signedC:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signedC:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed==================== BCD ================================Firmware Boot Manager---------------------identifier {fwbootmgr}displayorder {5f373801-c5ef-11e3-8250-806e6f6e6963} {2c11dd43-c56b-11e3-be7d-806e6f6e6963} {2c11dd44-c56b-11e3-be7d-806e6f6e6963}timeout 0Windows Boot Manager--------------------identifier {bootmgr}device partition=\Device\HarddiskVolume2path \EFI\Microsoft\Boot\bootmgfw.efidescription Windows Boot Managerlocale en-USinherit {globalsettings}integrityservices Enabledefault {current}resumeobject {aff1b9d1-c130-11e3-84be-ee9674bbfbc4}displayorder {current}toolsdisplayorder {memdiag}timeout 30Firmware Application (101fffff)-------------------------------identifier {2c11dd43-c56b-11e3-be7d-806e6f6e6963}description USB Drive (UEFI)Firmware Application (101fffff)-------------------------------identifier {2c11dd44-c56b-11e3-be7d-806e6f6e6963}description Internal CD/DVD ROM Drive (UEFI)Firmware Application (101fffff)-------------------------------identifier {5f373801-c5ef-11e3-8250-806e6f6e6963}description Internal Hard Disk or Solid State DiskWindows Boot Loader-------------------identifier {aff1b9cb-c130-11e3-84be-ee9674bbfbc4}device ramdisk=[\Device\HarddiskVolume1]\Recovery\WindowsRE\Winre.wim,{aff1b9cc-c130-11e3-84be-ee9674bbfbc4}path \windows\system32\winload.efidescription Windows Recovery Environmentlocale en-USinherit {bootloadersettings}displaymessage Recoverydisplaymessageoverride Recoveryosdevice ramdisk=[\Device\HarddiskVolume1]\Recovery\WindowsRE\Winre.wim,{aff1b9cc-c130-11e3-84be-ee9674bbfbc4}systemroot \windowsnx OptInbootmenupolicy Standardwinpe YesWindows Boot Loader-------------------identifier {current}device partition=C:path \WINDOWS\system32\winload.efidescription Windows 8.1locale en-USinherit {bootloadersettings}recoverysequence {aff1b9d3-c130-11e3-84be-ee9674bbfbc4}integrityservices Enablerecoveryenabled Yesisolatedcontext Yesallowedinmemorysettings 0x15000075osdevice partition=C:systemroot \WINDOWSresumeobject {aff1b9d1-c130-11e3-84be-ee9674bbfbc4}nx OptInbootmenupolicy StandardWindows Boot Loader-------------------identifier {aff1b9d3-c130-11e3-84be-ee9674bbfbc4}device ramdisk=[\Device\HarddiskVolume5]\Recovery\WindowsRE\Winre.wim,{aff1b9d4-c130-11e3-84be-ee9674bbfbc4}path \windows\system32\winload.efidescription Windows Recovery Environmentlocale en-USinherit {bootloadersettings}displaymessage Recoveryosdevice ramdisk=[\Device\HarddiskVolume5]\Recovery\WindowsRE\Winre.wim,{aff1b9d4-c130-11e3-84be-ee9674bbfbc4}systemroot \windowsnx OptInbootmenupolicy Standardwinpe YesWindows Boot Loader-------------------identifier {d009b88a-1921-11e2-be71-8434977b9e34}device ramdisk=[\Device\HarddiskVolume1]\Recovery\WindowsRE\Winre.wim,{d009b88b-1921-11e2-be71-8434977b9e34}path \windows\system32\winload.efidescription Windows Recovery Environmentlocale en-USinherit {bootloadersettings}displaymessage Recoveryosdevice ramdisk=[\Device\HarddiskVolume1]\Recovery\WindowsRE\Winre.wim,{d009b88b-1921-11e2-be71-8434977b9e34}systemroot \windowsnx OptInbootmenupolicy Standardwinpe YesResume from Hibernate---------------------identifier {aff1b9c7-c130-11e3-84be-ee9674bbfbc4}device partition=C:path \WINDOWS\system32\winresume.efidescription Windows Resume Applicationlocale en-USinherit {resumeloadersettings}recoverysequence {aff1b9cb-c130-11e3-84be-ee9674bbfbc4}recoveryenabled Yesisolatedcontext Yesallowedinmemorysettings 0x15000075filedevice partition=C:filepath \hiberfil.sysbootmenupolicy Standarddebugoptionenabled NoResume from Hibernate---------------------identifier {aff1b9d1-c130-11e3-84be-ee9674bbfbc4}device partition=C:path \WINDOWS\system32\winresume.efidescription Windows Resume Applicationlocale en-USinherit {resumeloadersettings}recoverysequence {aff1b9d3-c130-11e3-84be-ee9674bbfbc4}recoveryenabled Yesisolatedcontext Yesallowedinmemorysettings 0x15000075filedevice partition=C:filepath \hiberfil.sysbootmenupolicy Standarddebugoptionenabled NoResume from Hibernate---------------------identifier {bdc08554-1918-11e2-8485-be91f4ecd9f1}device partition=C:path \Windows\system32\winresume.efidescription Windows Resume Applicationlocale en-USinherit {resumeloadersettings}recoverysequence {d009b88a-1921-11e2-be71-8434977b9e34}recoveryenabled Yesisolatedcontext Yesallowedinmemorysettings 0x15000075filedevice partition=C:filepath \hiberfil.sysbootmenupolicy Standarddebugoptionenabled NoWindows Memory Tester---------------------identifier {memdiag}device partition=\Device\HarddiskVolume2path \EFI\Microsoft\Boot\memtest.efidescription Windows Memory Diagnosticlocale en-USinherit {globalsettings}badmemoryaccess YesEMS Settings------------identifier {emssettings}bootems NoDebugger Settings-----------------identifier {dbgsettings}debugtype Serialdebugport 1baudrate 115200RAM Defects-----------identifier {badmemory}Global Settings---------------identifier {globalsettings}inherit {dbgsettings} {emssettings} {badmemory}Boot Loader Settings--------------------identifier {bootloadersettings}inherit {globalsettings} {hypervisorsettings}Hypervisor Settings-------------------identifier {hypervisorsettings}hypervisordebugtype Serialhypervisordebugport 1hypervisorbaudrate 115200Resume Loader Settings----------------------identifier {resumeloadersettings}inherit {globalsettings}Device options--------------identifier {aff1b9cc-c130-11e3-84be-ee9674bbfbc4}description Windows Recoveryramdisksdidevice partition=\Device\HarddiskVolume1ramdisksdipath \Recovery\WindowsRE\boot.sdiDevice options--------------identifier {aff1b9d0-c130-11e3-84be-ee9674bbfbc4}description Windows Setupramdisksdidevice partition=C:ramdisksdipath \$WINDOWS.~BT\Sources\SafeOS\boot.sdiDevice options--------------identifier {aff1b9d4-c130-11e3-84be-ee9674bbfbc4}description Windows Recoveryramdisksdidevice partition=\Device\HarddiskVolume5ramdisksdipath \Recovery\WindowsRE\boot.sdiDevice options--------------identifier {d009b88b-1921-11e2-be71-8434977b9e34}description Windows Recoveryramdisksdidevice partition=\Device\HarddiskVolume1ramdisksdipath \Recovery\WindowsRE\boot.sdiDevice options--------------identifier {d009b891-1921-11e2-be71-8434977b9e34}description Windows Setupramdisksdidevice partition=C:ramdisksdipath \$WINDOWS.~BT\Sources\SafeOS\boot.sdi LastRegBack: 2015-08-25 18:24==================== End of FRST.txt ============================ Files attachedAddition.txtFRST.txt Link to post Share on other sites More sharing options...
kevinf80 Posted August 29, 2015 ID:986091 Share Posted August 29, 2015 Hello and welcome,P2P/Piracy Warning: If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy. I strongly recommend that you UNinstall all apps related to IOBit or Advanced System Care..... Next, Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.Run FRST and press the Fix button just once and wait.The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Next, Please open Malwarebytes Anti-Malware. On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits". Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button. A Threat Scan will begin. With some infections, you may or may not see this message box. 'Could not load DDA driver' Click 'Yes' to this message, to allow the driver to load after a restart. Allow the computer to restart. Continue with the rest of these instructions. When the scan is complete, click Apply Actions. Wait for the prompt to restart the computer to appear, then click on Yes. After the restart once you are back at your desktop, open MBAM once more.To get the log from Malwarebytes do the following: Click on the History tab > Application Logs. Double click on the scan log which shows the Date and time of the scan just performed. Click Export > From export you have three options: Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…If Malwarebytes is not installed follow these instructions first:Download Malwarebytes Anti-Malware to your desktop.Double-click mbam-setup and follow the prompts to install the program. At the end, be sure a checkmark is placed next to the following: Launch Malwarebytes Anti-Malware A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program. Click Finish. Follow the instructions above....Next, Download AdwCleaner by Xplode onto your Desktop. Double click on Adwcleaner.exe to run the tool. Click on the Scan in the Actions box Please wait fot the scan to finish.. When "Waiting for action.Please uncheck elements you want to keep" shows in top line.. Click on the Cleaning box. Next click OK on the "Closing Programs" pop up box. Click OK on the Information box & again OK to allow the necessary reboot After restart the AdwCleaner(C*)-Notepad log will appear, please copy/paste it in your next reply. Where * is the number relative to list of scans completed...Next, Please download Junkware Removal Tool to your desktop.Shut down your protection software now to avoid potential conflicts. (re-enable when done) Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator". The tool will open and start scanning your system. Please be patient as this can take a while to complete depending on your system's specifications. On completion, a log (JRT.txt) is saved to your desktop and will automatically open. Post the contents of JRT.txt into your next message.Next, Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktopEnsure to get the correct version for your system....32 Bit version:https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en64 Bit version:https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=enRight click on the Tool, select “Run as Administrator” the tool will expand to the options WindowIn the "Scan Type" window, select Quick ScanPerform a scan and Click Finish when the scan is done.Retrieve the MSRT log as follows, and post it in your next reply:1) Select the Windows key and R key together to open the "Run" function2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:notepad c:\windows\debug\mrt.logLet me see those logs, also give an update on any remaining issues or concerns... Thank you, Kevin... Fixlist.txt Link to post Share on other sites More sharing options...
Sarchie Posted August 29, 2015 Author ID:986116 Share Posted August 29, 2015 Fix result of Farbar Recovery Scan Tool (x64) Version:28-08-2015Ran by Sarchie (2015-08-29 12:32:51) Run:1Running from C:\Users\Sarchie\DownloadsLoaded Profiles: Sarchie (Available Profiles: Sarchie & Madison & Administrator)Boot Mode: Normal==============================================fixlist content:*****************StartCloseProcesses:(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exeIFEO\IObitDownloader.exe: [Debugger] C:\Program Files (x86)\IObit\Advanced SystemCare 8\AutoReactivator.exeIFEO\MakeSFX.exe: [Debugger] C:\Program Files (x86)\IObit\Advanced SystemCare 8\AutoReactivator.exeIFEO\Promote.exe: [Debugger] C:\Program Files (x86)\IObit\Advanced SystemCare 8\AutoReactivator.exeIFEO\psia.exe: [Debugger] C:\Program Files (x86)\IObit\Advanced SystemCare 8\AutoReactivator.exeIFEO\SDSendBugReport.exe: [Debugger] C:\Program Files (x86)\IObit\Advanced SystemCare 8\AutoReactivator.exeIFEO\SD_FreeSoftwareDownloader.exe: [Debugger] C:\Program Files (x86)\IObit\Advanced SystemCare 8\AutoReactivator.exeIFEO\sh_installer.exe: [Debugger] C:\Program Files (x86)\IObit\Advanced SystemCare 8\AutoReactivator.exeIFEO\sua.exe: [Debugger] C:\Program Files (x86)\IObit\Advanced SystemCare 8\AutoReactivator.exeGroupPolicy: Group Policy on Chrome detected <======= ATTENTIONCHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTIONHKU\S-1-5-21-62209294-3957149853-557076774-1002\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTIONTask: {6683214A-58CB-4504-962A-65EBA7EB89D3} - \APSnotifierPP1 -> No File <==== ATTENTIONTask: {B1757C11-8E9F-4329-BEA6-103104BB551A} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe [2015-06-19] (Enigma Software Group USA, LLC.)C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exeC:\Program Files\Enigma Software Group\SpyHunterC:\Program Files\Enigma Software GroupTask: C:\WINDOWS\Tasks\KTMJRRLI.job => C:\Users\Sarchie\AppData\Roaming\KTMJRRLI.exe <==== ATTENTIONC:\Users\Sarchie\AppData\Roaming\KTMJRRLI.exeEmptytemp:End*****************Processes closed successfully.C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe => No running process found"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\IObitDownloader.exe" => key removed successfully"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MakeSFX.exe" => key removed successfully"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\Promote.exe" => key removed successfully"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\psia.exe" => key removed successfully"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SDSendBugReport.exe" => key removed successfully"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SD_FreeSoftwareDownloader.exe" => key removed successfully"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\sh_installer.exe" => key removed successfully"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\sua.exe" => key removed successfullyC:\WINDOWS\system32\GroupPolicy\Machine => moved successfullyC:\WINDOWS\system32\GroupPolicy\GPT.ini => moved successfully"HKLM\SOFTWARE\Policies\Google" => key removed successfully"HKU\S-1-5-21-62209294-3957149853-557076774-1002\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6683214A-58CB-4504-962A-65EBA7EB89D3}" => key removed successfully"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6683214A-58CB-4504-962A-65EBA7EB89D3}" => key removed successfullyHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APSnotifierPP1 => key not found."HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{B1757C11-8E9F-4329-BEA6-103104BB551A}" => key removed successfully"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B1757C11-8E9F-4329-BEA6-103104BB551A}" => key removed successfullyC:\WINDOWS\System32\Tasks\SpyHunter4Startup => moved successfully"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SpyHunter4Startup" => key removed successfullyC:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe => moved successfullyC:\Program Files\Enigma Software Group\SpyHunter => moved successfullyC:\Program Files\Enigma Software Group => moved successfullyC:\WINDOWS\Tasks\KTMJRRLI.job => moved successfully"C:\Users\Sarchie\AppData\Roaming\KTMJRRLI.exe" => File/Folder not found.EmptyTemp: => 43.3 MB temporary data Removed.The system needed a reboot..==== End of Fixlog 12:33:07 ==== Link to post Share on other sites More sharing options...
Sarchie Posted August 29, 2015 Author ID:986125 Share Posted August 29, 2015 Malwarebytes Anti-Malwarewww.malwarebytes.orgError, 8/29/2015 12:47 PM, SYSTEM, DADSLAPTOP, Update, Bad md5 or size: akadomains, 11,Error, 8/29/2015 12:47 PM, SYSTEM, DADSLAPTOP, Update, Bad md5 or size: akaips, 11,Update, 8/29/2015 12:47 PM, SYSTEM, DADSLAPTOP, Manual, Domain Database, 0.0.0.0, 2015.7.24.2,Update, 8/29/2015 12:47 PM, SYSTEM, DADSLAPTOP, Manual, Rootkit Database, 2015.6.2.1, 2015.8.16.1,Update, 8/29/2015 12:48 PM, SYSTEM, DADSLAPTOP, Manual, AKA IP Database, 0.0.0.0, 2015.8.29.1,Update, 8/29/2015 12:48 PM, SYSTEM, DADSLAPTOP, Manual, Remediation Database, 2015.5.13.1, 2015.8.28.2,Update, 8/29/2015 12:48 PM, SYSTEM, DADSLAPTOP, Manual, AKA Domain Database, 0.0.0.0, 2015.8.29.1,Update, 8/29/2015 12:48 PM, SYSTEM, DADSLAPTOP, Manual, IP Database, 0.0.0.0, 2015.7.24.3,Update, 8/29/2015 12:48 PM, SYSTEM, DADSLAPTOP, Manual, Malware Database, 2015.6.3.3, 2015.8.29.3,Error, 8/29/2015 12:49 PM, SYSTEM, DADSLAPTOP, Update, Bad md5 or size: akadomains, 11,Error, 8/29/2015 12:49 PM, SYSTEM, DADSLAPTOP, Update, Bad md5 or size: akaips, 11,Update, 8/29/2015 12:49 PM, SYSTEM, DADSLAPTOP, Manual, AKA IP Database, 0.0.0.0, 2015.8.29.1,Update, 8/29/2015 12:49 PM, SYSTEM, DADSLAPTOP, Manual, AKA Domain Database, 0.0.0.0, 2015.8.29.1,Scan, 8/29/2015 1:39 PM, SYSTEM, DADSLAPTOP, Manual, Start:8/29/2015 12:49 PM, Duration:48 min 40 sec, Threat Scan, Completed, 0 Malware Detections, 55 Non-Malware Detections,Error, 8/29/2015 1:41 PM, SYSTEM, DADSLAPTOP, Protection, IsLicensed, 13,Protection, 8/29/2015 1:41 PM, SYSTEM, DADSLAPTOP, Protection, Malware Protection, Stopping,Protection, 8/29/2015 1:41 PM, SYSTEM, DADSLAPTOP, Protection, Malware Protection, Stopped,Error, 8/29/2015 1:46 PM, SYSTEM, DADSLAPTOP, Protection, IsLicensed, 13,Protection, 8/29/2015 1:46 PM, SYSTEM, DADSLAPTOP, Protection, Malware Protection, Stopping,Protection, 8/29/2015 1:46 PM, SYSTEM, DADSLAPTOP, Protection, Malware Protection, Stopped,(end) Link to post Share on other sites More sharing options...
Sarchie Posted August 29, 2015 Author ID:986126 Share Posted August 29, 2015 # AdwCleaner v5.004 - Logfile created 29/08/2015 at 14:04:44# Updated 26/08/2015 by Xplode# Database : 2015-08-25.1 [server]# Operating system : Windows 8.1 (x64)# Username : Sarchie - DADSLAPTOP# Running from : C:\Users\Sarchie\Desktop\AdwCleaner.exe# Option : Cleaning# Support : http://toolslib.net/forum***** [ Services ] *****[-] Service Deleted : swdumon***** [ Folders ] *****[-] Folder Deleted : C:\ProgramData\ce2175c7000067bd***** [ Files ] *****[-] File Deleted : C:\WINDOWS\Sysnative\drivers\swdumon.sys***** [ Shortcuts ] *****[-] Shortcut Disinfected : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Feature Mananger.lnk***** [ Scheduled tasks ] ********** [ Registry ] *****[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION [PlusHD Cinema 2.1cV28.01-bg.exe][-] Key Deleted : HKLM\SOFTWARE\ad1b3f71-92e3-9740-135e-ff4b2a9c0e97[-] Key Deleted : HKCU\Software\IObit Apps[-] Key Deleted : HKCU\Software\SlimWare Utilities Inc[-] Key Deleted : HKCU\Software\AppDataLow\Software\IObit Apps[-] Key Deleted : HKLM\SOFTWARE\IObit Apps[-] Key Deleted : HKLM\SOFTWARE\SlimWare Utilities Inc[!] Key Not Deleted : [x64] HKCU\Software\IObit Apps[!] Key Not Deleted : [x64] HKCU\Software\SlimWare Utilities Inc[!] Key Not Deleted : HKU\S-1-5-21-62209294-3957149853-557076774-1002\Software\AppDataLow\Software\IObit Apps***** [ Web browsers ] ******************************:: Winsock settings cleared########## EOF - C:\AdwCleaner\AdwCleaner[C6].txt - [1554 bytes] ########## Link to post Share on other sites More sharing options...
Sarchie Posted August 29, 2015 Author ID:986127 Share Posted August 29, 2015 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Junkware Removal Tool (JRT) by MalwarebytesVersion: 7.5.9 (08.27.2015:1)OS: Windows 8.1 x64Ran by Sarchie on Sat 08/29/2015 at 14:13:04.57~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ TasksSuccessfully deleted: [Task] C:\WINDOWS\system32\tasks\Driver Booster ScanSuccessfully deleted: [Task] C:\WINDOWS\system32\tasks\Driver Booster SkipUAC (Sarchie)Successfully deleted: [Task] C:\WINDOWS\system32\tasks\Driver Booster SkipUAC (SYSTEM)Successfully deleted: [Task] C:\WINDOWS\system32\tasks\Driver Booster UpdateSuccessfully deleted: [Task] C:\WINDOWS\system32\tasks\Uninstaller_SkipUac_AdministratorSuccessfully deleted: [Task] C:\WINDOWS\system32\tasks\Uninstaller_SkipUac_SarchieSuccessfully deleted: [Task] C:\WINDOWS\Tasks\Uninstaller_SkipUac_Sarchie.job ~~~ Registry ValuesSuccessfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\\SearchAssistant ~~~ Registry KeysSuccessfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\Update PlumoWebSuccessfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\Util PlumoWeb ~~~ Files ~~~ FoldersSuccessfully deleted: [Folder] C:\ProgramData\googleSuccessfully deleted: [Folder] C:\ProgramData\iobit\driver boosterSuccessfully deleted: [Folder] C:\ProgramData\productdataSuccessfully deleted: [Folder] C:\users\Public\Documents\downloaded installersSuccessfully deleted: [Folder] C:\Users\Sarchie\AppData\Roaming\iobit\driver boosterSuccessfully deleted: [Folder] C:\Users\Sarchie\AppData\Roaming\productdataSuccessfully deleted: [Folder] C:\WINDOWS\SysWOW64\ai_recyclebin ~~~ Chrome[C:\Users\Sarchie\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset[C:\Users\Sarchie\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:[C:\Users\Sarchie\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset[C:\Users\Sarchie\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Scan was completed on Sat 08/29/2015 at 14:16:45.75End of JRT log~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Link to post Share on other sites More sharing options...
kevinf80 Posted August 29, 2015 ID:986129 Share Posted August 29, 2015 The log from Malwarebytes is not correct, check and post the correct one :- Scan, 8/29/2015 1:39 PM, SYSTEM, DADSLAPTOP, Manual, Start:8/29/2015 12:49 PM, Duration:48 min 40 sec, Threat Scan, Completed, 0 Malware Detections, 55 Non-Malware Detections, Link to post Share on other sites More sharing options...
Sarchie Posted August 29, 2015 Author ID:986133 Share Posted August 29, 2015 ---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.27, August 2015 (build 5.27.11700.0)Started On Sat Aug 29 13:58:29 2015---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.27, August 2015 (build 5.27.11700.0)Started On Sat Aug 29 14:22:49 2015Engine: 1.1.11903.0Signatures: 1.203.693.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Sat Aug 29 14:27:02 2015Return code: 0 (0x0) Link to post Share on other sites More sharing options...
kevinf80 Posted August 29, 2015 ID:986139 Share Posted August 29, 2015 Need to see the log from Malwarebytes.... To get the log from Malwarebytes do the following: Click on the History tab > Application Logs. Double click on the scan log which shows the Date and time of the scan just performed. Click Export > From export you have three options: Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply… Link to post Share on other sites More sharing options...
Sarchie Posted August 29, 2015 Author ID:986140 Share Posted August 29, 2015 Malwarebytes Anti-Malwarewww.malwarebytes.orgError, 8/29/2015 12:47 PM, SYSTEM, DADSLAPTOP, Update, Bad md5 or size: akadomains, 11,Error, 8/29/2015 12:47 PM, SYSTEM, DADSLAPTOP, Update, Bad md5 or size: akaips, 11,Update, 8/29/2015 12:47 PM, SYSTEM, DADSLAPTOP, Manual, Domain Database, 0.0.0.0, 2015.7.24.2,Update, 8/29/2015 12:47 PM, SYSTEM, DADSLAPTOP, Manual, Rootkit Database, 2015.6.2.1, 2015.8.16.1,Update, 8/29/2015 12:48 PM, SYSTEM, DADSLAPTOP, Manual, AKA IP Database, 0.0.0.0, 2015.8.29.1,Update, 8/29/2015 12:48 PM, SYSTEM, DADSLAPTOP, Manual, Remediation Database, 2015.5.13.1, 2015.8.28.2,Update, 8/29/2015 12:48 PM, SYSTEM, DADSLAPTOP, Manual, AKA Domain Database, 0.0.0.0, 2015.8.29.1,Update, 8/29/2015 12:48 PM, SYSTEM, DADSLAPTOP, Manual, IP Database, 0.0.0.0, 2015.7.24.3,Update, 8/29/2015 12:48 PM, SYSTEM, DADSLAPTOP, Manual, Malware Database, 2015.6.3.3, 2015.8.29.3,Error, 8/29/2015 12:49 PM, SYSTEM, DADSLAPTOP, Update, Bad md5 or size: akadomains, 11,Error, 8/29/2015 12:49 PM, SYSTEM, DADSLAPTOP, Update, Bad md5 or size: akaips, 11,Update, 8/29/2015 12:49 PM, SYSTEM, DADSLAPTOP, Manual, AKA IP Database, 0.0.0.0, 2015.8.29.1,Update, 8/29/2015 12:49 PM, SYSTEM, DADSLAPTOP, Manual, AKA Domain Database, 0.0.0.0, 2015.8.29.1,Scan, 8/29/2015 1:39 PM, SYSTEM, DADSLAPTOP, Manual, Start:8/29/2015 12:49 PM, Duration:48 min 40 sec, Threat Scan, Completed, 0 Malware Detections, 55 Non-Malware Detections,Error, 8/29/2015 1:41 PM, SYSTEM, DADSLAPTOP, Protection, IsLicensed, 13,Protection, 8/29/2015 1:41 PM, SYSTEM, DADSLAPTOP, Protection, Malware Protection, Stopping,Protection, 8/29/2015 1:41 PM, SYSTEM, DADSLAPTOP, Protection, Malware Protection, Stopped,Error, 8/29/2015 1:46 PM, SYSTEM, DADSLAPTOP, Protection, IsLicensed, 13,Protection, 8/29/2015 1:46 PM, SYSTEM, DADSLAPTOP, Protection, Malware Protection, Stopping,Protection, 8/29/2015 1:46 PM, SYSTEM, DADSLAPTOP, Protection, Malware Protection, Stopped,Error, 8/29/2015 2:07 PM, SYSTEM, DADSLAPTOP, Protection, IsLicensed, 13,Protection, 8/29/2015 2:07 PM, SYSTEM, DADSLAPTOP, Protection, Malware Protection, Stopping,Protection, 8/29/2015 2:07 PM, SYSTEM, DADSLAPTOP, Protection, Malware Protection, Stopped,Update, 8/29/2015 2:34 PM, SYSTEM, DADSLAPTOP, Manual, Malware Database, 2015.8.29.3, 2015.8.29.4,Scan, 8/29/2015 2:34 PM, SYSTEM, DADSLAPTOP, Manual, Start:8/29/2015 2:34 PM, Duration:0 min 33 sec, Threat Scan, Cancelled, 0 Malware Detections, 0 Non-Malware Detections,(end) Link to post Share on other sites More sharing options...
Sarchie Posted August 29, 2015 Author ID:986147 Share Posted August 29, 2015 Malwarebytes Anti-Malwarewww.malwarebytes.orgError, 8/29/2015 12:47 PM, SYSTEM, DADSLAPTOP, Update, Bad md5 or size: akadomains, 11,Error, 8/29/2015 12:47 PM, SYSTEM, DADSLAPTOP, Update, Bad md5 or size: akaips, 11,Update, 8/29/2015 12:47 PM, SYSTEM, DADSLAPTOP, Manual, Domain Database, 0.0.0.0, 2015.7.24.2,Update, 8/29/2015 12:47 PM, SYSTEM, DADSLAPTOP, Manual, Rootkit Database, 2015.6.2.1, 2015.8.16.1,Update, 8/29/2015 12:48 PM, SYSTEM, DADSLAPTOP, Manual, AKA IP Database, 0.0.0.0, 2015.8.29.1,Update, 8/29/2015 12:48 PM, SYSTEM, DADSLAPTOP, Manual, Remediation Database, 2015.5.13.1, 2015.8.28.2,Update, 8/29/2015 12:48 PM, SYSTEM, DADSLAPTOP, Manual, AKA Domain Database, 0.0.0.0, 2015.8.29.1,Update, 8/29/2015 12:48 PM, SYSTEM, DADSLAPTOP, Manual, IP Database, 0.0.0.0, 2015.7.24.3,Update, 8/29/2015 12:48 PM, SYSTEM, DADSLAPTOP, Manual, Malware Database, 2015.6.3.3, 2015.8.29.3,Error, 8/29/2015 12:49 PM, SYSTEM, DADSLAPTOP, Update, Bad md5 or size: akadomains, 11,Error, 8/29/2015 12:49 PM, SYSTEM, DADSLAPTOP, Update, Bad md5 or size: akaips, 11,Update, 8/29/2015 12:49 PM, SYSTEM, DADSLAPTOP, Manual, AKA IP Database, 0.0.0.0, 2015.8.29.1,Update, 8/29/2015 12:49 PM, SYSTEM, DADSLAPTOP, Manual, AKA Domain Database, 0.0.0.0, 2015.8.29.1,Scan, 8/29/2015 1:39 PM, SYSTEM, DADSLAPTOP, Manual, Start:8/29/2015 12:49 PM, Duration:48 min 40 sec, Threat Scan, Completed, 0 Malware Detections, 55 Non-Malware Detections,Error, 8/29/2015 1:41 PM, SYSTEM, DADSLAPTOP, Protection, IsLicensed, 13,Protection, 8/29/2015 1:41 PM, SYSTEM, DADSLAPTOP, Protection, Malware Protection, Stopping,Protection, 8/29/2015 1:41 PM, SYSTEM, DADSLAPTOP, Protection, Malware Protection, Stopped,Error, 8/29/2015 1:46 PM, SYSTEM, DADSLAPTOP, Protection, IsLicensed, 13,Protection, 8/29/2015 1:46 PM, SYSTEM, DADSLAPTOP, Protection, Malware Protection, Stopping,Protection, 8/29/2015 1:46 PM, SYSTEM, DADSLAPTOP, Protection, Malware Protection, Stopped,Error, 8/29/2015 2:07 PM, SYSTEM, DADSLAPTOP, Protection, IsLicensed, 13,Protection, 8/29/2015 2:07 PM, SYSTEM, DADSLAPTOP, Protection, Malware Protection, Stopping,Protection, 8/29/2015 2:07 PM, SYSTEM, DADSLAPTOP, Protection, Malware Protection, Stopped,Update, 8/29/2015 2:34 PM, SYSTEM, DADSLAPTOP, Manual, Malware Database, 2015.8.29.3, 2015.8.29.4,Scan, 8/29/2015 2:34 PM, SYSTEM, DADSLAPTOP, Manual, Start:8/29/2015 2:34 PM, Duration:0 min 33 sec, Threat Scan, Cancelled, 0 Malware Detections, 0 Non-Malware Detections,Scan, 8/29/2015 3:17 PM, SYSTEM, DADSLAPTOP, Manual, Start:8/29/2015 2:35 PM, Duration:42 min 50 sec, Threat Scan, Completed, 0 Malware Detections, 0 Non-Malware Detections,Error, 8/29/2015 3:26 PM, SYSTEM, DADSLAPTOP, Protection, IsLicensed, 13,Protection, 8/29/2015 3:26 PM, SYSTEM, DADSLAPTOP, Protection, Malware Protection, Stopping,Protection, 8/29/2015 3:26 PM, SYSTEM, DADSLAPTOP, Protection, Malware Protection, Stopped,(end) Link to post Share on other sites More sharing options...
Sarchie Posted August 29, 2015 Author ID:986151 Share Posted August 29, 2015 mbam-check result log version: 2.1.1.1001========================================User Account type: AdministratorOS: Windows 8.1 64 bit Operating SystemCurrent Version and Build: 6.3.9200.0Malwarebytes Anti-Malware: 2.1.8.1057Installed On: 2015/08/29Malware Database: 0000.00.00.00Rootkit Database: 0000.00.00.00Remediation Database: 0000.00.00.00IP Database: 0000.00.00.00Domain Database: 0000.00.00.00License: FreeMalware Protection: 4 (The service is running.)Malicious Website Protection: 1 (The service is not running.)Chameleon: 0 <--CAN NOT OPEN SC_HANDLE, SERVICE IS NOT RUNNING FOR: MBAMChameleonLog Created: 2015/08/29 15:33:28Compatibility Flag Settings:================================= Malwarebytes Anti-Malware Shell Extension Block Check:======================================================HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked:MBAM Startup Entries:=====================HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnceHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceMalwarebytes Anti-Malware Service and Driver Status:=======================================================--------------Driver File Info:--------------C:\WINDOWS\system32\drivers\mbam.sysFile Size: 25816 BYTES FileVersion: 0.1.15.0 MD5: [a8d28d5b3e2a528d1ef0e338e44f2820]C:\WINDOWS\system32\drivers\mwac.sysFile Size: 64216 BYTES FileVersion: 1.0.6.0 MD5: [85cfe7ab85b43b6b7ac7961aa3983a9f]C:\WINDOWS\system32\drivers\mbamswissarmy.sysFile Size: 113880 BYTES FileVersion: 0.2.22.0 MD5: [8f22037d3f5a6bb676525d825a1388b9]C:\WINDOWS\system32\drivers\mbamchameleon.sysFile Size: 109272 BYTES FileVersion: 1.1.20.0 MD5: [e681ce4ae5c09651d53cb4387ca3560e]--------------MBAMProtector:--------------Type: 2State: 4 (The service is running.) (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)WIN32_EXIT_CODE: 0SERVICE_EXIT_CODE: 0CHECKPOINT: 0WAIT_HINT: 0--------------MBAMService:--------------Type: 16State: 1 (The service is not running.) (State is stopped)WIN32_EXIT_CODE: 0SERVICE_EXIT_CODE: 0CHECKPOINT: 0WAIT_HINT: 0--------------MBAMScheduler:--------------Type: N/AState: 0 <--CAN NOT OPEN SC_HANDLE, SERVICE IS NOT RUNNING FOR: MBAMSchedulerWIN32_EXIT_CODE: N/ASERVICE_EXIT_CODE: N/ACHECKPOINT: N/AWAIT_HINT: N/A--------------MBAMChameleon:--------------Type: N/AState: 0 <--CAN NOT OPEN SC_HANDLE, SERVICE IS NOT RUNNING FOR: MBAMChameleonWIN32_EXIT_CODE: N/ASERVICE_EXIT_CODE: N/ACHECKPOINT: N/AWAIT_HINT: N/A--------------MBAMWebAccessControl:--------------Type: 2State: 1 (The service is not running.) (State is stopped)WIN32_EXIT_CODE: 1077SERVICE_EXIT_CODE: 0CHECKPOINT: 0WAIT_HINT: 0Required Dependencies:======================--------------BFE:--------------Type: 32State: 4 (The service is running.)WIN32_EXIT_CODE: 0SERVICE_EXIT_CODE: 0CHECKPOINT: 0WAIT_HINT: 0HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE DisplayName REG_SZ @%SystemRoot%\system32\bfe.dll,-1001 ErrorControl REG_DWORD 1 Group REG_SZ NetworkProvider ImagePath REG_EXPAND_SZ %systemroot%\system32\svchost.exe -k LocalServiceNoNetwork Start REG_DWORD 2 Type REG_DWORD 32 Description REG_SZ @%SystemRoot%\system32\bfe.dll,-1002 DependOnService REG_MULTI_SZ RpcSs WfpLwfs ObjectName REG_SZ NT AUTHORITY\LocalService ServiceSidType REG_DWORD 3 RequiredPrivileges REG_MULTI_SZ SeAuditPrivilege FailureActions REG_BINARY Binary DataHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters ServiceDllUnloadOnStop REG_DWORD 1 ServiceMain REG_SZ BfeServiceMain ServiceDll REG_EXPAND_SZ %SystemRoot%\System32\bfe.dllHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\PolicyHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\BootTimeHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\BootTime\Filter {89a89b7c-b5ab-4ed6-bf05-d3059281a5c5}REG_BINARY Binary Data {84750a0c-b836-48e3-ab80-104985c857db}REG_BINARY Binary Data {dc95b53e-01cf-4058-821d-350b3d0d4676}REG_BINARY Binary Data {0c41d586-9c19-4e01-9d66-b5b98a97576e}REG_BINARY Binary Data {12c38916-82ac-4737-8f38-b6957ffebad6}REG_BINARY Binary Data {c970a45d-57f9-4e32-a5bd-886a9662641e}REG_BINARY Binary Data {0c3be01b-fe70-4cc4-89dc-c07996b67e6d}REG_BINARY Binary Data {074f7f68-ee10-428a-89d1-ba78f6c327ca}REG_BINARY Binary Data {c016105c-eb34-4519-a5fd-5f4e4ad4d18e}REG_BINARY Binary Data {a47525e2-725b-4888-8af1-ba5a60c04f4d}REG_BINARY Binary Data {0ccc96a3-8c5c-45e2-b80e-7e37b16cc1ad}REG_BINARY Binary Data {2dd96961-5757-434f-b617-34e732517c0e}REG_BINARY Binary Data {2db25e6c-f07a-44f4-b6c8-50a330d2790b}REG_BINARY Binary Data {c42f1cd6-3a95-4ae2-a513-793c3ae610c7}REG_BINARY Binary Data {935b7f48-0ede-44dd-9bc2-e00bb635cda3}REG_BINARY Binary Data {941dad9d-7b1a-4354-997b-00cf1aa9b35c}REG_BINARY Binary DataHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Options EnablePacketQueue REG_DWORD 0HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\PersistentHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\Callout {22001ee0-8e87-4f75-ba58-248f5918a63a}REG_BINARY Binary Data {79f2a265-b693-4cc9-b480-cbcd87bd4747}REG_BINARY Binary Data {c4b50f21-503e-4d7a-abd4-ed0a823a2453}REG_BINARY Binary Data {91e902db-2cef-4040-b8e2-02fe4fd49c25}REG_BINARY Binary DataHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\Filter {89a89b7c-b5ab-4ed6-bf05-d3059281a5c5}REG_BINARY Binary Data {84750a0c-b836-48e3-ab80-104985c857db}REG_BINARY Binary Data {e72646bc-7d3f-4c5c-a679-b3716f8c6cc8}REG_BINARY Binary Data {b98b75dc-17c0-4e84-bd4e-2080527ca6a6}REG_BINARY Binary Data {dc95b53e-01cf-4058-821d-350b3d0d4676}REG_BINARY Binary Data {f444c576-6e60-4ea2-9faa-80d57ed12cd2}REG_BINARY Binary Data {0c41d586-9c19-4e01-9d66-b5b98a97576e}REG_BINARY Binary Data {12c38916-82ac-4737-8f38-b6957ffebad6}REG_BINARY Binary Data {c970a45d-57f9-4e32-a5bd-886a9662641e}REG_BINARY Binary Data {0c3be01b-fe70-4cc4-89dc-c07996b67e6d}REG_BINARY Binary Data {4d9581d2-aef8-4993-84cd-b986ced80d42}REG_BINARY Binary Data {be7cbdf4-b192-4aa5-94f8-1fb5c5ee07bc}REG_BINARY Binary Data {716b48eb-0a35-4a76-92ab-1d987230d288}REG_BINARY Binary Data {1165065e-4996-4338-abaf-4b8556b4d431}REG_BINARY Binary Data {07a24961-a760-4e80-b263-6d275e1b09cb}REG_BINARY Binary Data {5b0cb2e2-ab87-4974-9f1c-2f22a654eeb9}REG_BINARY Binary Data {b6b2ca61-fb98-4422-adc2-e7cf56b3680c}REG_BINARY Binary Data {0aa7fff8-919f-453c-928c-28a12122ba38}REG_BINARY Binary Data {074f7f68-ee10-428a-89d1-ba78f6c327ca}REG_BINARY Binary Data {c016105c-eb34-4519-a5fd-5f4e4ad4d18e}REG_BINARY Binary Data {a47525e2-725b-4888-8af1-ba5a60c04f4d}REG_BINARY Binary Data {0ccc96a3-8c5c-45e2-b80e-7e37b16cc1ad}REG_BINARY Binary Data {91ffecf0-0a9e-4572-95f1-a7111af86967}REG_BINARY Binary Data {64e55933-15a5-495d-a928-ccca43d44875}REG_BINARY Binary Data {13bfd422-6f75-4408-8924-9400ec0cb19c}REG_BINARY Binary Data {cbfb56db-3c85-4543-9bc2-76ea28cdd74e}REG_BINARY Binary Data {2dd96961-5757-434f-b617-34e732517c0e}REG_BINARY Binary Data {375fb39b-08c6-40f2-bdf2-08fa63f970a2}REG_BINARY Binary Data {2db25e6c-f07a-44f4-b6c8-50a330d2790b}REG_BINARY Binary Data {c42f1cd6-3a95-4ae2-a513-793c3ae610c7}REG_BINARY Binary Data {b6fdab6b-dcc6-43e3-99ce-7aeca65063a4}REG_BINARY Binary Data {3697a558-3ed3-49be-a4c1-c1a4448653b4}REG_BINARY Binary Data {935b7f48-0ede-44dd-9bc2-e00bb635cda3}REG_BINARY Binary Data {941dad9d-7b1a-4354-997b-00cf1aa9b35c}REG_BINARY Binary Data {b02a4013-b6b5-4859-9168-1e3299e43b24}REG_BINARY Binary Data {d870c96c-75ee-46a6-8a02-8e4401a73423}REG_BINARY Binary Data {8b50e2ec-7cf0-4b71-b42e-5b0536f6cab8}REG_BINARY Binary Data {4137b143-2770-43d4-91a2-55bb0a069830}REG_BINARY Binary Data {3180114b-8338-4740-9a16-444134ad62f4}REG_BINARY Binary Data {17043d46-fac2-4561-bca1-0c7a05e95f5f}REG_BINARY Binary Data {567d3836-3f5b-4067-b9c4-952f677010a2}REG_BINARY Binary Data {4e718c57-c397-4221-9fbb-14fd51701d6a}REG_BINARY Binary Data {3a90a266-1519-4d23-911b-e84cd0f02ab8}REG_BINARY Binary Data {70694559-714a-4a38-a0cd-51439e06f1d8}REG_BINARY Binary Data {56b4fdc4-bb4e-4c42-a9d8-f627ee15ac21}REG_BINARY Binary Data {1ba41ed8-151d-4577-9272-317856bc637c}REG_BINARY Binary Data {9248d57e-f843-4159-807d-3813173e2096}REG_BINARY Binary Data {4658cd86-525d-44ed-98a5-791a7b8655f1}REG_BINARY Binary DataHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\Provider {decc16ca-3f33-4346-be1e-8fb4ae0f3d62}REG_BINARY Binary Data {4b153735-1049-4480-aab4-d1b9bdc03710}REG_BINARY Binary Data {1bebc969-61a5-4732-a177-847a0817862a}REG_BINARY Binary Data {aa6a7d87-7f8f-4d2a-be53-fda555cd5fe3}REG_BINARY Binary Data {d4bd4a0f-7591-4da2-ae67-3aa97c3c34c2}REG_BINARY Binary Data {839cd73f-1907-49ea-9aa5-0e6be9048087}REG_BINARY Binary Data {15b8e02e-2fbd-4316-a46f-9dd9b1535a3c}REG_BINARY Binary DataHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\SubLayer {b3cdd441-af90-41ba-a745-7c6008ff2300}REG_BINARY Binary Data {b3cdd441-af90-41ba-a745-7c6008ff2301}REG_BINARY Binary Data {b3cdd441-af90-41ba-a745-7c6008ff2302}REG_BINARY Binary Data {9ba30013-c84e-47e5-ac6e-1e1aed72fa69}REG_BINARY Binary Data {8c36b346-4e0c-4049-8b55-5295ac35567c}REG_BINARY Binary Data--------------fltmgr:--------------Type: 2State: 4 (The service is running.) (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)WIN32_EXIT_CODE: 0SERVICE_EXIT_CODE: 0CHECKPOINT: 0WAIT_HINT: 0HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FltMgr AttachWhenLoaded REG_DWORD 1 DisplayName REG_SZ @%SystemRoot%\system32\drivers\fltmgr.sys,-10001 ErrorControl REG_DWORD 3 Group REG_SZ FSFilter Infrastructure ImagePath REG_EXPAND_SZ system32\drivers\fltmgr.sys Start REG_DWORD 0 Tag REG_DWORD 1 Type REG_DWORD 2 Description REG_SZ @%SystemRoot%\system32\drivers\fltmgr.sys,-10000C:\WINDOWS\system32\drivers\fltmgr.sysFile Size: 354112 BYTES FileVersion: 6.3.9600.17326 MD5: [c1fb505a73fa2e9019d32444ab33b75a]C:\WINDOWS\SysWOW64\mscomctl.ocxFile Size: 1070232 BYTES FileVersion: 6.1.98.39 MD5: [766f501b61c22723536af696a74133d4]C:\WINDOWS\SysWOW64\olepro32.dllFile Size: 86016 BYTES FileVersion: 6.3.9600.17415 MD5: [afe3ca77ff01edcb79ab3f9e87b7a50b]MBAM Registry Settings and License Info:========================================--------------Settings:--------------Advanced: AutomaticQuarantine: true AutostartProtection: true LimitedMode: false SelfProtection: false StartSilentMode: false StartupDelay: -15ApplicationState: First-Run-After-Installation: falseGeneral: DaysUntilNotifyExpiration: 5 Language: en RightClickAccess: false SilentErrors: falseLogging: ExportLog: falseMarketing: LastPostScanMarketingIndex: 3Notification:ProtectionTray: DisplayMilliseconds: 3000ScanHistory: Duration_Complete: 1092503 Duration_Driver: 31113 Duration_Filesystem: 117 Duration_Heuristics: 1369076 Duration_Loading: 0 Duration_MasterBootRecord: 1 Duration_Memory: 40000 Duration_PreScan: 23805 Duration_Registry: 23626 Duration_Sector: 0 Duration_Startup: 19965 ItemCount_Complete: 377104 ItemCount_Driver: 355 ItemCount_Filesystem: 55835 ItemCount_Heuristics: 17866 ItemCount_Loading: 0 ItemCount_MasterBootRecord: 0 ItemCount_Memory: 2797 ItemCount_PreScan: 0 ItemCount_Registry: 665 ItemCount_Sector: 0 ItemCount_Startup: 609 LastScanDateEpoch: 1440880501926 LastScanType: 1 (Threat Scan)Update: LastUpdate: 2015-08-29T20:34:14 NotifyInstallReady: true NotifyOutdatedDatabase: 7 ProxyPassword: ProxyPort: 0 ProxyServer: ProxyUsername: UseProxy: false UseProxyAuthentication: false--------------Account:-------------- Account Status: Free Expiration Time: Activation Time: Trial Used: false--------------Access Policies:--------------Scheduler Queue:================tasks: 757b04b3-21a0-4bf6-a382-15a81cc66571: parameters: NotifyWhenUpdateCompletes: true ProcessLaunchedFromScheduler: true TaskType: 3 triggers: ed2f6ea5-ab1f-4371-83bb-5c305cbeafb0: dateinterval: 0:0:0 lastscheduled: Sat, 29 Aug 2015 14:31:23.312105 -0700 lasttriggered: Fri, 13 Feb 2015 06:24:57.838797 -0700 nextscheduled: Sat, 29 Aug 2015 15:31:23.312105 -0700 recovery: 00:00:00 start: Thu, 29 Jan 2015 19:31:23.312105 -0700 timeinterval: 01:00:00 type: 3 uuid: ed2f6ea5-ab1f-4371-83bb-5c305cbeafb0 type: update uuid: 757b04b3-21a0-4bf6-a382-15a81cc66571 cb227d7f-3c0c-47c1-a3b0-e4e57a4a9c6b: parameters: AutoDelete: false CheckForUpdatesBeforeScanStart: true ProcessLaunchedFromScheduler: true ScanConfig: ExitWhenQuarantineCompletes: false ExportLog: true FileSystemOption: true Quarantine: Prompt RebootSystemWhenMalwareDetected: false ScanArchives: true ScanExtra: true ScanHeuristic: true ScanMemoryObjects: true ScanPUM: 2 ScanPUP: 2 ScanRegistry: true ScanRootkits: false ScanStartup: true ScanTargets: ScanType: 1 (Threat Scan) Silent: true StartTaskFromSystemAccount: false TaskType: 0 triggers: 42c01351-9006-4699-b8fc-9da0087a5e39: dateinterval: 1:0:0 lastscheduled: Sat, 29 Aug 2015 03:53:58 -0700 lasttriggered: Thu, 12 Feb 2015 16:54:03.035520 -0700 nextscheduled: Sun, 30 Aug 2015 03:53:58 -0700 recovery: 23:00:00 start: Fri, 30 Jan 2015 03:53:58 -0700 timeinterval: 00:00:00 type: 4 uuid: 42c01351-9006-4699-b8fc-9da0087a5e39 type: scan uuid: cb227d7f-3c0c-47c1-a3b0-e4e57a4a9c6bPending File Rename Operations:================================If any Malwarebytes Anti-Malware items are listed below, the user must reboot to complete a Malwarebytes Anti-Malware upgrade installation.MBAMProtector Registry Values:==============================HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMProtector Type REG_DWORD 2 Start REG_DWORD 3 ErrorControl REG_DWORD 1 ImagePath REG_EXPAND_SZ \??\C:\WINDOWS\system32\drivers\mbam.sys Group REG_SZ FSFilter Anti-Virus DependOnService REG_MULTI_SZ FltMgr WOW64 REG_DWORD 1HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMProtector\Instances DefaultInstance REG_SZ MBAMProtector InstanceHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMProtector\Instances\MBAMProtector Instance Altitude REG_SZ 328800 Flags REG_DWORD 0HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMProtector\Parameters PassThruFile REG_SZ mbampt.exe ProductPath REG_SZ C:\Program Files (x86)\Malwarebytes Anti-MalwareMBAMService Registry Values:============================HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMService Type REG_DWORD 16 Start REG_DWORD 2 ErrorControl REG_DWORD 1 ImagePath REG_EXPAND_SZ "C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe" DependOnService REG_MULTI_SZ MBAMProtector WOW64 REG_DWORD 1 ObjectName REG_SZ LocalSystem Description REG_SZ Malwarebytes Anti-Malware service DelayedAutostart REG_DWORD 0MBAMScheduler Registry Values:============================== Terminal Services Status for (null) entries in PM logs and GetUserToken errors:===============================================================================--------------TERMService:--------------Type: 32State: 1 (The service is not running.) (State is stopped)WIN32_EXIT_CODE: 1077SERVICE_EXIT_CODE: 0CHECKPOINT: 0WAIT_HINT: 0TermService Start is set to: 3 (Manual Startup)Proxy Status: No proxy is SetLAN Settings:=============only 'Automatically detect settings' is selectedSystemPartition:================HKEY_LOCAL_MACHINE\SYSTEM\Setup\ SystemPartition REG_SZ \Device\HarddiskVolume2Balloon Tips Status:====================EnabledTime Format Settings:=====================Should be: h:mm:ss tt AM PM :Currently:REG_SZ h:mm:ss ttREG_SZ AMREG_SZ PMREG_SZ :Language and Regional Settings:===============================ACP: Language is English (United States)MACCP: Language is English (United States)OEMCP: Language is English (United States)Startup Folders for Error_Expanding_Variables Check:====================================================All Users Startup Folder Exists.Current User's Startup Folder Exists.Context Menu Entries:===================== List of MBAM Related Directories:=================================C:\Program Files (x86)\Malwarebytes Anti-Malware\7z.dll File Size: 920888 BYTES FileVersion: 9.20.0.0 MD5: [90cc5c5c5347eee0909d5bbbe4ea4321]changes.txt File Size: 3003 BYTES FileVersion: N/A MD5: [17b6dc5b45f9558ea11ee7b95da9b684]cloud-enumeration.dll File Size: 286008 BYTES FileVersion: 1.0.0.0 MD5: [932c98b79d8dc1409d6c74efd715135e]cloud.dll File Size: 351544 BYTES FileVersion: 1.0.0.0 MD5: [5d383e601d77e4e82b64c6c3e4b823b3]license.rtf File Size: 235316 BYTES FileVersion: N/A MD5: [5980b191ffe5d53bfef600b97ad533b5]master.conf File Size: 1258 BYTES FileVersion: N/A MD5: [9702ca5e82d3756c6d8af34a2ababaea]mbam.dll File Size: 602936 BYTES FileVersion: 1.0.37.0 MD5: [a3043182dcef5612c928517985bd545a]mbam.exe File Size: 6554424 BYTES FileVersion: 2.3.55.0 MD5: [abff2b3a80aa5348be5e43efd6b415d1]mbamcore.dll File Size: 1971512 BYTES FileVersion: 1.3.11.0 MD5: [51b5bea5015b2e37c4f4d496441f8369]mbamdor.exe File Size: 54072 BYTES FileVersion: 1.0.1.0 MD5: [a994a921e954ba55bea4cc8767f64e0f]mbamext.dll File Size: 310584 BYTES FileVersion: 3.0.6.0 MD5: [7a4c3c98cc41d06e26cc4cc5d9d06200]mbampt.exe File Size: 39736 BYTES FileVersion: 1.0.0.0 MD5: [f872caff0cc1fe69d55cbb10c087a00a]mbamresearch.exe File Size: 1947960 BYTES FileVersion: 1.1.0.0 MD5: [7fb4e7cfabfdc99b88165ecfc0c532c5]mbamscheduler.exe File Size: 1871160 BYTES FileVersion: 3.1.3.0 MD5: [301e3fdfcf33640bb8763ba444bc5093]mbamservice.exe File Size: 1133880 BYTES FileVersion: 3.2.13.0 MD5: [83c982a395d00baff6515fb38424ea76]mbamsrv.dll File Size: 3841336 BYTES FileVersion: 2.1.2.0 MD5: [b3273340603058e7e89964abeea0aa4b]mbamtoast.dll File Size: 96568 BYTES FileVersion: 1.70.0.0 MD5: [595eaba9462f8fdfbe6246bbaaa40f4e]msvcp100.dll File Size: 421688 BYTES FileVersion: 10.0.40219.325 MD5: [650f2286252c8854ac5846940d181d3a]msvcr100.dll File Size: 774456 BYTES FileVersion: 10.0.40219.325 MD5: [005f96c221719c03671c0262a4a93521]Qt5Core.dll File Size: 4645688 BYTES FileVersion: 5.4.1.0 MD5: [a8fceb6261751b709a84ce4a3726439f]Qt5Gui.dll File Size: 4639032 BYTES FileVersion: 5.4.1.0 MD5: [cdfa353db0a56a394b1fd8346c905069]Qt5Network.dll File Size: 672056 BYTES FileVersion: 5.4.1.0 MD5: [e4fd655cc85eb6063a8cef66f4e5ed55]Qt5Widgets.dll File Size: 4473656 BYTES FileVersion: 5.4.1.0 MD5: [5a48fe8fc8b20960713e172a83cca0f5]Third-party-notices.txt File Size: 70041 BYTES FileVersion: N/A MD5: [915ab4fe416654fbc412019a0a1002ac]unins000.dat File Size: 30888 BYTES FileVersion: N/A MD5: [4a5c72a9f51bff28af91e1ab7f848c6a]unins000.exe File Size: 718037 BYTES FileVersion: 51.52.0.0 MD5: [d2796ecf50731e696f0c065d24c0827a]C:\Program Files (x86)\Malwarebytes Anti-Malware\\ChameleonC:\Program Files (x86)\Malwarebytes Anti-Malware\\Chameleon\Windowschameleon.chm File Size: 235882 BYTES FileVersion: N/A MD5: [c4190b71f037714aa77aba294434ba5b]firefox.com File Size: 893752 BYTES FileVersion: 3.1.25.0 MD5: [0692c8163852ab5674e2eb3b36131ef3]firefox.exe File Size: 893752 BYTES FileVersion: 3.1.25.0 MD5: [0692c8163852ab5674e2eb3b36131ef3]firefox.pif File Size: 893752 BYTES FileVersion: 3.1.25.0 MD5: [0692c8163852ab5674e2eb3b36131ef3]firefox.scr File Size: 893752 BYTES FileVersion: 3.1.25.0 MD5: [0692c8163852ab5674e2eb3b36131ef3]iexplore.exe File Size: 893752 BYTES FileVersion: 3.1.25.0 MD5: [0692c8163852ab5674e2eb3b36131ef3]mbam-chameleon.com File Size: 893752 BYTES FileVersion: 3.1.25.0 MD5: [0692c8163852ab5674e2eb3b36131ef3]mbam-chameleon.exe File Size: 893752 BYTES FileVersion: 3.1.25.0 MD5: [0692c8163852ab5674e2eb3b36131ef3]mbam-chameleon.pif File Size: 893752 BYTES FileVersion: 3.1.25.0 MD5: [0692c8163852ab5674e2eb3b36131ef3]mbam-chameleon.scr File Size: 893752 BYTES FileVersion: 3.1.25.0 MD5: [0692c8163852ab5674e2eb3b36131ef3]mbam-killer.exe File Size: 1496888 BYTES FileVersion: 3.0.13.0 MD5: [10ddd12d628a5388865f2ae25019dd76]rundll32.exe File Size: 893752 BYTES FileVersion: 3.1.25.0 MD5: [0692c8163852ab5674e2eb3b36131ef3]svchost.exe File Size: 893752 BYTES FileVersion: 3.1.25.0 MD5: [0692c8163852ab5674e2eb3b36131ef3]windows.exe File Size: 893752 BYTES FileVersion: 3.1.25.0 MD5: [0692c8163852ab5674e2eb3b36131ef3]winlogon.exe File Size: 893752 BYTES FileVersion: 3.1.25.0 MD5: [0692c8163852ab5674e2eb3b36131ef3]C:\Program Files (x86)\Malwarebytes Anti-Malware\\imageformatsqgif.dll File Size: 28472 BYTES FileVersion: 5.4.1.0 MD5: [8858629a544c7c0536c35561040a2d78]C:\Program Files (x86)\Malwarebytes Anti-Malware\\Languageslang_ar.qm File Size: 87320 BYTES FileVersion: N/A MD5: [7a7c7e14fcf3f14d6b269295e877750c]lang_bg.qm File Size: 109563 BYTES FileVersion: N/A MD5: [654b95c228a72131aca7cb26e964dcf9]lang_ca.qm File Size: 92640 BYTES FileVersion: N/A MD5: [533208d2306e5ad1e5972650f69d8c22]lang_cs.qm File Size: 105006 BYTES FileVersion: N/A MD5: [508844d9e9aa364aa53bc77adf4f42a8]lang_da.qm File Size: 88045 BYTES FileVersion: N/A MD5: [e3bc3cdfcf360d319319299d8cd66506]lang_de.qm File Size: 133736 BYTES FileVersion: N/A MD5: [9b6c6a0d6bc188c1d86ea9342b8035da]lang_el.qm File Size: 126414 BYTES FileVersion: N/A MD5: [3d112a79eca581d1775fd96b3c5870bb]lang_en.qm File Size: 2849 BYTES FileVersion: N/A MD5: [d495fecf1db29d41317196416d5ea6c2]lang_es.qm File Size: 132948 BYTES FileVersion: N/A MD5: [455f47414f13f8942ee6652dd194c46a]lang_et.qm File Size: 107454 BYTES FileVersion: N/A MD5: [ef9d8fcc151759a2cf100afe2889d5e5]lang_fi.qm File Size: 89336 BYTES FileVersion: N/A MD5: [09f12751811f8c1a46f6308ab1968ff7]lang_fr.qm File Size: 136774 BYTES FileVersion: N/A MD5: [581b5833e2fa89003ff8349390323790]lang_he.qm File Size: 98616 BYTES FileVersion: N/A MD5: [a9cb152f93da040fb9451d750f359c3e]lang_hu.qm File Size: 108619 BYTES FileVersion: N/A MD5: [042e132aa420bb7807dc6ea150d21c84]lang_id.qm File Size: 105573 BYTES FileVersion: N/A MD5: [1352510fd6296523d239363d90d493ad]lang_it.qm File Size: 129004 BYTES FileVersion: N/A MD5: [993c14184487084aedf79471b337606b]lang_ja.qm File Size: 73730 BYTES FileVersion: N/A MD5: [e1ae65ac342628156abb2cdc36508929]lang_ko.qm File Size: 85538 BYTES FileVersion: N/A MD5: [e495736a22b566cd27cef405507c0b55]lang_lt.qm File Size: 90775 BYTES FileVersion: N/A MD5: [2605701cc94ca4ee2ef0be3aaa617d64]lang_lv.qm File Size: 90647 BYTES FileVersion: N/A MD5: [c9dda1e18b4869c60b8df14907dd5e46]lang_nl.qm File Size: 128186 BYTES FileVersion: N/A MD5: [193e199cefe0429da41d564af35786e7]lang_no.qm File Size: 118156 BYTES FileVersion: N/A MD5: [a7a243c9ac9e1efc71f8cdeb8c6ed4bf]lang_pl.qm File Size: 128623 BYTES FileVersion: N/A MD5: [9e4c6ca1532843c77ddb07b8a1bcac08]lang_pt_BR.qm File Size: 131550 BYTES FileVersion: N/A MD5: [418b8766d7e7a2a4806ed4d97d18e80f]lang_pt_PT.qm File Size: 131702 BYTES FileVersion: N/A MD5: [34f70f2a89733552373fa935200c2a0a]lang_ro.qm File Size: 90440 BYTES FileVersion: N/A MD5: [24bf3ee283cf5a3fd4c93bba6c9fc12b]lang_ru.qm File Size: 132186 BYTES FileVersion: N/A MD5: [08e1303dba20e8e1957ae1de2ccb4550]lang_sk.qm File Size: 89139 BYTES FileVersion: N/A MD5: [82ddef8ec6d13b1d4601e7104243ecc9]lang_sl.qm File Size: 107472 BYTES FileVersion: N/A MD5: [c8e3fae6ae3980aec292baa6cb8eac89]lang_sv.qm File Size: 105939 BYTES FileVersion: N/A MD5: [646ad8e20658650d4d1daa63b5abb9b6]lang_tr.qm File Size: 88788 BYTES FileVersion: N/A MD5: [6c4e9b16e496ab46d4a1d3333d972762]lang_vi.qm File Size: 105393 BYTES FileVersion: N/A MD5: [d1b2c9264ef72792b53255d4dfeb3098]lang_zh_TW.qm File Size: 87358 BYTES FileVersion: N/A MD5: [1ebfe79770cf695df897750b3c2d5a08]C:\Program Files (x86)\Malwarebytes Anti-Malware\\platformsqwindows.dll File Size: 928568 BYTES FileVersion: 5.4.1.0 MD5: [15d93b1f5171eacf7724b2f728a064c4]C:\Program Files (x86)\Malwarebytes Anti-Malware\\Pluginsfixdamage.exe File Size: 821560 BYTES FileVersion: 1.1.0.1010 MD5: [57da74e5d020877f0aa23133081a1d5c]C:\Users\Sarchie\AppData\Roaming\Malwarebytes\Malwarebytes Anti-MalwareC:\ProgramData\Malwarebytes\Malwarebytes Anti-Malwareactions.ref File Size: 2936 BYTES FileVersion: N/A MD5: [e3c1b99d5f0fac05c13d1b160528b1f5]akadomains.ref File Size: 594978 BYTES FileVersion: N/A MD5: [9b34ec4eee724a06529ba10167669930]akaips.ref File Size: 308509 BYTES FileVersion: N/A MD5: [36d863774121705f670e574df12f7055]domains.ref File Size: 94 BYTES FileVersion: N/A MD5: [da07da8abeb59d060bc709b28e62bb94]exclusions.dat File Size: 84 BYTES FileVersion: N/A MD5: [6ac0065599fb20a1d68c92e93e390834]ips.ref File Size: 35 BYTES FileVersion: N/A MD5: [c78acab9f50caa91df2cc3302080c012]rules.ref File Size: 10142291 BYTES FileVersion: N/A MD5: [44c8aa95fb4f1fcba4ff10fea5d382cf]swissarmy.ref File Size: 25954 BYTES FileVersion: N/A MD5: [2c81587c27a36ed4925f2942c7a56053]C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Configurationbuild.conf File Size: 4611 BYTES FileVersion: N/A MD5: [7c2a9c5e44f1df766ca5f3b5ec1e74fe]database.conf File Size: 4 BYTES FileVersion: N/A MD5: [2261e7eca4cd0615a97263c0ad5045c2]gatekeeper.conf File Size: 4 BYTES FileVersion: N/A MD5: [2261e7eca4cd0615a97263c0ad5045c2]license.conf File Size: 1370 BYTES FileVersion: N/A MD5: [0d78c1c81fca7e6b495f5842a4ec473a]manifest.conf File Size: 3392 BYTES FileVersion: N/A MD5: [fc0896fba3c4c0372f91f3bf5a1bc53a]marketing.conf File Size: 11105 BYTES FileVersion: N/A MD5: [4bbcad9dd8e558eb9996d32f37cd25e2]net.conf File Size: 6907 BYTES FileVersion: N/A MD5: [524481819633bb163c9e3f011e336d1a]notifications.conf File Size: 4 BYTES FileVersion: N/A MD5: [2261e7eca4cd0615a97263c0ad5045c2]scheduler.conf File Size: 2214 BYTES FileVersion: N/A MD5: [56c9387d62c5e01d590e9dd1d1b732a4]settings.conf File Size: 2073 BYTES FileVersion: N/A MD5: [74873ad27b7b6726a754f6f93dcac60d]statistics.conf File Size: 597 BYTES FileVersion: N/A MD5: [de7efffa330c16b0dd98a49d301d813f]C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restorebuild.conf File Size: 4194 BYTES FileVersion: N/A MD5: [402aa68f7a914337069a7a826a856503]database.conf File Size: 4 BYTES FileVersion: N/A MD5: [2261e7eca4cd0615a97263c0ad5045c2]gatekeeper.conf File Size: 4 BYTES FileVersion: N/A MD5: [2261e7eca4cd0615a97263c0ad5045c2]license.conf File Size: 23 BYTES FileVersion: N/A MD5: [0ec01df616b565180556881d8042255b]manifest.conf File Size: 2836 BYTES FileVersion: N/A MD5: [12da8707e6aa5c2dfafca55395a8bdbd]marketing.conf File Size: 11105 BYTES FileVersion: N/A MD5: [4bbcad9dd8e558eb9996d32f37cd25e2]net.conf File Size: 6133 BYTES FileVersion: N/A MD5: [78d9d986b84b11f36330303a86a2be82]notifications.conf File Size: 4 BYTES FileVersion: N/A MD5: [2261e7eca4cd0615a97263c0ad5045c2]scheduler.conf File Size: 4 BYTES FileVersion: N/A MD5: [2261e7eca4cd0615a97263c0ad5045c2]settings.conf File Size: 1725 BYTES FileVersion: N/A MD5: [5454026126dac24f6e96eeb0c64123d3]statistics.conf File Size: 4 BYTES FileVersion: N/A MD5: [2261e7eca4cd0615a97263c0ad5045c2]C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logsprotection-log-2015-08-29.xml File Size: 8701 BYTES FileVersion: N/A MD5: [6565f744fcdf357630840a25af9949ee]C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\QuarantineMalware Exclusions:===================Unable to access exclusion information: Error code 20001Web Exclusions:================Unable to access exclusion information: Error code 20001Quarantined Items:===================Unable to access quarantine information: Error code 20001===============================================================END OF FILE Link to post Share on other sites More sharing options...
kevinf80 Posted August 30, 2015 ID:986174 Share Posted August 30, 2015 What is the current status of your system, are there any remaining issues or concerns? Next, Download Security Check by screen317 from either of the following:http://screen317.spywareinfoforum.org/SecurityCheck.exe or http://screen317.changelog.fr/SecurityCheck.exeSave it to your Desktop. (If your security alerts either accept the alert, or turn the security off while Secuirity Check runs)Double click SecurityCheck.exe (Vista or Windows 7/8 users right click and select "Run as Administrator") and follow the onscreen instructions inside of the black box. Press any key when asked.A Notepad document should open automatically called checkup.txt; please post the contents of that document.If Security Check will not run or you get an alert saying it is not supported, Re-boot your PC then try again... Thanks, Kevin... Link to post Share on other sites More sharing options...
Sarchie Posted August 30, 2015 Author ID:986212 Share Posted August 30, 2015 Computer is back to normal!Thank you!!! Results of screen317's Security Check version 1.008 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Windows Defender WMI entry may not exist for antivirus; attempting automatic update.`````````Anti-malware/Other Utilities Check:````````` SpyHunter 4 Secunia PSI (3.0.0.10004) Java 8 Update 51 Java version 32-bit out of Date! Adobe Flash Player 15.0.0.239 Flash Player out of Date! Adobe Reader XI ````````Process Check: objlist.exe by Laurent```````` Windows Defender MSMpEng.exe Windows Defender MpCmdRun.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: %````````````````````End of Log`````````````````````` Link to post Share on other sites More sharing options...
kevinf80 Posted August 31, 2015 ID:986314 Share Posted August 31, 2015 Thanks for the update, we continue as follows: Go here http://www.adobe.com/shockwave/welcome/ and have Adobe Flashplayer checked. Accept new version if required. There maybe an offer of Google Chrome etc, untick those options if offered... Next, Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.Please follow these steps to remove older version of Java components and upgrade the application. Upgrading Java: Go to http://java.com/en/ and click on "Do I have Java"It will check your current version and then offer to update to the latest versionWatch for and make sure you untick the box next to whatever free program they prompt you to install during the installation, unless you want it. ***Note: Check in Programs and Features (or Add/Remove Programs if you are an XP user) to make certain there are no old versions of Java still installed, if so - remove them. <<-- Very Important Next, To clean up: Download "Delfix by Xplode" and save it to your desktop.Or use the following if first link is down:"Delfix link mirror"Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administratorMake Sure the following items are checked: Remove disinfection tools Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created. Reset system settingsNow click on "Run" and wait patiently until the tool has completed.The tool will create a log when it has completed. We don't need you to post this.Any remnant files/logs from tools we have used can be deleted… Next, Read the following link to fully understand PC security and best practices, you may find it useful....http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2316629 Let me know if we are ok to close out.... Kevin... Link to post Share on other sites More sharing options...
Sarchie Posted August 31, 2015 Author ID:986420 Share Posted August 31, 2015 Thank you for your help. Please close this one out. Link to post Share on other sites More sharing options...
kevinf80 Posted August 31, 2015 ID:986436 Share Posted August 31, 2015 Thanks for the update, it was a pleasure to work with you... Take care and surf safe, Kevin... Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 8, 2015 Root Admin ID:987900 Share Posted September 8, 2015 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts