vampedvixen Posted October 5, 2015 ID:993685 Share Posted October 5, 2015 My computer is screwed up. Some malware on it is refusing me to connect to the Internet and has killed my Malwarebytes anti-malware program, yet everything else works for now. Help? Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted October 5, 2015 ID:993693 Share Posted October 5, 2015 Hello, They call me TwinHeadedEagle around here, and I'll try to help your with your issue. Before we start please read and note the following:We're primarily oriented on malware removal here, so you must know that some issues just cannot be solved and you must be prepared for this. Some tools we use here will remove your browser search history, so backup your important links and all the files whose loss is unacceptable.Limit your internet access to posting here, some infections just wait to steal typed-in passwords.Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time. Keep in mind that private life gets in the way too. Note that we may live in totally different time zones, what may cause some delays between answers.Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed. I can't foresee everything, so if anything not covered in my instructions happens, please stop and inform me! There are no silly questions. Never be afraid to ask if in doubt! Rules and policies We won't support any piracy. That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding! The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding! Failure to follow these guidelines will result with closing your topic and withdrawning any assistance. Please download Farbar Recovery Scan Tool and save it to your desktop. Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. Double-click to run it. When the tool opens click Yes to disclaimer.Press Scan button.It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply. Link to post Share on other sites More sharing options...
vampedvixen Posted October 5, 2015 Author ID:993818 Share Posted October 5, 2015 Okay! Wonderful! I'm grateful for your help THIS Is FRST:Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:04-10-2015Ran by admin (administrator) on CESAR-HP (05-10-2015 16:13:29)Running from H:\Loaded Profiles: admin (Available Profiles: admin & Guest)Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)Internet Explorer Version 11 (Default browser: FF)Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/==================== Processes (Whitelisted) =================(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)(HP) C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe(Microsoft Corporation) C:\Windows\System32\wlanext.exe(HP) C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe(HP) C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe(Intel Corporation) C:\Windows\System32\hkcmd.exe(Intel Corporation) C:\Windows\System32\igfxpers.exe(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe(Comfort Software Group) C:\Program Files (x86)\FreeCountdownTimer\FreeCountdownTimer.exe(Flux Software LLC) C:\Users\admin\AppData\Local\FluxSoftware\Flux\flux.exe(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe(Wondershare) C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe(Microsoft Corporation) C:\Windows\System32\msiexec.exe(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\Messenger\Ymsgr_tray.exe(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe(Microsoft Corporation) C:\Windows\System32\dllhost.exe==================== Registry (Whitelisted) ===========================(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-09] (Synaptics Incorporated)HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)HKLM-x32\...\Run: [] => [X]HKLM-x32\...\Run: [sMessaging] => C:\Users\MARIA\AppData\Local\Strongvault Online Backup\SMessaging.exe [31664 2012-04-04] (Stronghold Online Backup)HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-08-01] (Apple Inc.)HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [448856 2014-08-19] (DivX, LLC)HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2014-01-10] ()HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1994752 2014-02-20] (Wondershare)Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)HKU\S-1-5-21-571689730-3727486918-3289345957-1007\...\Run: [FreeCT] => C:\Program Files (x86)\FreeCountdownTimer\FreeCountdownTimer.exe [2432280 2014-02-25] (Comfort Software Group)HKU\S-1-5-21-571689730-3727486918-3289345957-1007\...\Run: [f.lux] => C:\Users\admin\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC)HKU\S-1-5-21-571689730-3727486918-3289345957-1007\...\Run: [Messenger (Yahoo!)] => C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe [6595928 2012-05-25] (Yahoo! Inc.)HKU\S-1-5-21-571689730-3727486918-3289345957-1007\...\Run: [GoogleChromeAutoLaunch_D9394DE6386755479577597100432920] => C:\Users\admin\AppData\Local\Chromium\Application\chrome.exe [667136 2015-08-11] (The Chromium Authors)HKU\S-1-5-21-571689730-3727486918-3289345957-1007\...\Policies\system: [LogonHoursAction] 2HKU\S-1-5-21-571689730-3727486918-3289345957-1007\...\Policies\system: [DontDisplayLogonHoursWarnings] 1HKU\S-1-5-21-571689730-3727486918-3289345957-1007\...\MountPoints2: {46e78923-8891-11e1-ba6a-806e6f6e6963} - F:\VTech_toy_Setup.exeLsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll==================== Internet (Whitelisted) ====================(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)Tcpip\Parameters: [DhcpNameServer] 192.168.2.1Tcpip\..\Interfaces\{AA6AFD6A-7F39-4D99-A486-2DD4F6ACEFF2}: [DhcpNameServer] 192.168.2.1Internet Explorer:==================HKU\S-1-5-21-571689730-3727486918-3289345957-1007\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://us.yhs4.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_mp3_15_39¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0E0Czy0AyByEyD0B0B0A0DtD0A0CyB0AtN0D0Tzu0StCtAyCtCtN1L2XzutAtFtCtBtFzyzytFtDtN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2S0AtCzy0DyD0ByCzytGzz0C0FtBtGyEtA0AtBtGzz0AtA0AtG0A0FtDyC0F0FtDzzyBzztBtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szy0FtByCtAyB0D0CtG0AyD0FyDtGyEzyyB0DtGzzzytAyBtGyBzzyEyC0EtAzzyD0FzzyBzz2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtDyEzz%26cr%3D1332149538%26a%3Dwncy_mp3_15_39%26os%3DWindows%2B7%2BHome%2BPremiumHKU\S-1-5-21-571689730-3727486918-3289345957-1007\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT/1SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBoxSearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBoxSearchScopes: HKLM -> {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL =SearchScopes: HKLM -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDFSearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDFSearchScopes: HKLM -> {64F56A9F-1B22-4B6B-B8E3-E33C1EBA0109} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://us.yhs4.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_mp3_15_39¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0E0Czy0AyByEyD0B0B0A0DtD0A0CyB0AtN0D0Tzu0StCtAyCtCtN1L2XzutAtFtCtBtFzyzytFtDtN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2S0AtCzy0DyD0ByCzytGzz0C0FtBtGyEtA0AtBtGzz0AtA0AtG0A0FtDyC0F0FtDzzyBzztBtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szy0FtByCtAyB0D0CtG0AyD0FyDtGyEzyyB0DtGzzzytAyBtGyBzzyEyC0EtAzzyD0FzzyBzz2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtDyEzz%26cr%3D1332149538%26a%3Dwncy_mp3_15_39%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}SearchScopes: HKLM -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=hxxp://www.ebay.com/sch/i.html?_nkw={searchTerms}SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL =SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBoxSearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDFSearchScopes: HKLM-x32 -> {64F56A9F-1B22-4B6B-B8E3-E33C1EBA0109} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDFSearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=hxxp://www.ebay.com/sch/i.html?_nkw={searchTerms}SearchScopes: HKU\S-1-5-21-571689730-3727486918-3289345957-1007 -> DefaultScope {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL =SearchScopes: HKU\S-1-5-21-571689730-3727486918-3289345957-1007 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBoxSearchScopes: HKU\S-1-5-21-571689730-3727486918-3289345957-1007 -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL =SearchScopes: HKU\S-1-5-21-571689730-3727486918-3289345957-1007 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDFSearchScopes: HKU\S-1-5-21-571689730-3727486918-3289345957-1007 -> {64F56A9F-1B22-4B6B-B8E3-E33C1EBA0109} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}SearchScopes: HKU\S-1-5-21-571689730-3727486918-3289345957-1007 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}SearchScopes: HKU\S-1-5-21-571689730-3727486918-3289345957-1007 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=hxxp://www.ebay.com/sch/i.html?_nkw={searchTerms}BHO: TrueSuite Website Log On -> {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} -> C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll [2011-08-19] (HP)BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)BHO-x32: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No FileBHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-06-06] (Adobe Systems Incorporated)BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2012-11-11] (Oracle Corporation)BHO-x32: TrueSuite Website Log On -> {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} -> C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll [2011-08-19] (HP)BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)BHO-x32: No Name -> {B69F34DD-F0F9-42DC-9EDD-957187DA688D} -> No FileBHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2012-11-11] (Oracle Corporation)StartMenuInternet: IEXPLORE.EXE - iexplore.exeFireFox:========FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\ody3vmmi.defaultFF DefaultSearchEngine: GoogleFF DefaultSearchEngine.US: Search Provided by YahooFF SelectedSearchEngine: Yahoo!FF Homepage: hxxp://us.yhs4.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_mp3_15_39¶m1=1¶m2=f%3D1%26b%3DFirefox%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0E0Czy0AyByEyD0B0B0A0DtD0A0CyB0AtN0D0Tzu0StCtAyCtCtN1L2XzutAtFtCtBtFzyzytFtDtN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2S0AtCzy0DyD0ByCzytGzz0C0FtBtGyEtA0AtBtGzz0AtA0AtG0A0FtDyC0F0FtDzzyBzztBtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szy0FtByCtAyB0D0CtG0AyD0FyDtGyEzyyB0DtGzzzytAyBtGyBzzyEyC0EtAzzyD0FzzyBzz2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtDyEzz%26cr%3D1332149538%26a%3Dwncy_mp3_15_39%26os%3DWindows%2B7%2BHome%2BPremiumFF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_185.dll [2015-09-21] ()FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2014-05-22] (DivX, LLC.)FF Plugin: @microsoft.com/GENUINE -> disabled [No File]FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_185.dll [2015-09-21] ()FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll [No File]FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-21] ()FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll [2014-05-22] (DivX, LLC.)FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll [2014-08-13] (DivX, LLC)FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2012-11-11] (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2012-11-11] (Oracle Corporation)FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)FF Plugin-x32: @millisecond.com/npInquisit,version=3.0 -> C:\Program Files (x86)\Millisecond Software\Inquisit 3.0 Mozilla Plugin\npInquisit_3060.dll [2011-10-26] (Millisecond Software)FF Plugin-x32: @millisecond.com/npInquisit,version=4.0 -> C:\Program Files (x86)\Millisecond Software\Inquisit 4 Web Plugin\npInquisit.dll [2014-06-30] (Millisecond Software)FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-14] (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-14] (Google Inc.)FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2011-06-06] (Adobe Systems Inc.)FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll [2014-10-10] (pdfforge GmbH)FF Plugin HKU\S-1-5-21-571689730-3727486918-3289345957-1007: @millisecond.com/npInquisit,version=3.0 -> C:\Program Files (x86)\Millisecond Software\Inquisit 3.0 Mozilla Plugin\npInquisit_3060.dll [2011-10-26] (Millisecond Software)FF Plugin HKU\S-1-5-21-571689730-3727486918-3289345957-1007: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\admin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-12-05] (Unity Technologies ApS)FF user.js: detected! => C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\ody3vmmi.default\user.js [2014-10-18]FF SearchPlugin: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\ody3vmmi.default\searchplugins\8tracks.xml [2014-09-27]FF SearchPlugin: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\ody3vmmi.default\searchplugins\imdb.xml [2014-07-12]FF SearchPlugin: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\ody3vmmi.default\searchplugins\youtube.xml [2014-07-12]FF Extension: No Name - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\ody3vmmi.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2015-02-27]FF Extension: Reddit Enhancement Suite - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\ody3vmmi.default\Extensions\jid1-xUfzOsOFlzSOXg@jetpack.xpi [2014-07-12]FF Extension: Pin It Button - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\ody3vmmi.default\Extensions\jid1-YcMV6ngYmQRA2w@jetpack.xpi [2014-12-29]FF Extension: UserZoom Survey Tool - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\ody3vmmi.default\Extensions\userzoom_survey_tool@jetpack.xpi [2014-09-22]FF Extension: turkopticon - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\ody3vmmi.default\Extensions\{4324f4a6-3a89-477e-b388-6bca032df78b}.xpi [2014-07-31]FF Extension: Adblock Plus - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\ody3vmmi.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-07-08]StartMenuInternet: FIREFOX.EXE - firefox.exeChrome:=======CHR HomePage: Default -> hxxp://google.com/CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3323913&octid=EB_ORIGINAL_CTID&ISID=MDF938C9F-6FCF-4161-B456-81615399A8DD&SearchSource=55&CUI=&UM=5&UP=SPADBF55E5-8D2C-430B-9D5D-2352F9158FDA&SSPV=","","hxxps://search.yahoo.com/?type=523482&fr=yo-yhp-ch","hxxp://astromenda.com/?f=7&a=ast_mp3_14_42_ff&cd=2XzuyEtN2Y1L1Qzu0E0Czy0AyByEyD0B0B0A0DtD0A0CyB0AtN0D0Tzu0StCtDtBtCtN1L2XzutAtFtBtFtCtFyDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyCtAyD0A0DtAtC0EtG0A0DtAtAtG0CtDtAyEtGyC0FyByDtGyByByDtA0C0A0F0CzytByC0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0F0DyC0F0ByDyEtCtGtByC0ByEtGyE0CzytBtG0A0BtCyCtGtCtDyBzy0CzzzztD0EzztAzz2Q&cr=522890998&ir=","hxxp://us.yhs4.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_mp3_15_39¶m1=1¶m2=f%3D7%26b%3DChrome%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0E0Czy0AyByEyD0B0B0A0DtD0A0CyB0AtN0D0Tzu0StCtAyCtCtN1L2XzutAtFtCtBtFzyzytFtDtN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2S0AtCzy0DyD0ByCzytGzz0C0FtBtGyEtA0AtBtGzz0AtA0AtG0A0FtDyC0F0FtDzzyBzztBtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szy0FtByCtAyB0D0CtG0AyD0FyDtGyEzyyB0DtGzzzytAyBtGyBzzyEyC0EtAzzyD0FzzyBzz2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtDyEzz%26cr%3D1332149538%26a%3Dwncy_mp3_15_39%26os%3DWindows%2B7%2BHome%2BPremium"CHR Profile: C:\Users\admin\AppData\Local\Google\Chrome\User Data\DefaultCHR Extension: (Website Logon) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfmogjcijkfeahcajecmmegieipfbdcc [2014-08-22]CHR Extension: (Chrome Hotword Shared Module) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-14]CHR Extension: (Chrome Web Store Payments) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-22]CHR Extension: (BackStop) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pidcjgldchekcoolelhbjfbnccjkckfj [2015-05-25]CHR HKLM-x32\...\Chrome\Extension: [bfmogjcijkfeahcajecmmegieipfbdcc] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx [2011-08-18]CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - <no Path/update_url>==================== Services (Whitelisted) ========================(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1771560 2014-10-10] (pdfforge GmbH)S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-10-10] (pdfforge GmbH)S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)===================== Drivers (Whitelisted) ==========================(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)S3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [133672 2011-09-20] (Broadcom Corporation.)S3 BTWDPAN; C:\Windows\System32\DRIVERS\btwdpan.sys [89640 2011-09-20] (Broadcom Corporation.)S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-10-04] (Malwarebytes Corporation)S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)==================== NetSvcs (Whitelisted) ===================(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)==================== One Month Created files and folders ========(If an entry is included in the fixlist, the file/folder will be moved.)2015-10-05 16:13 - 2015-10-05 16:13 - 00000000 ____D C:\FRST2015-10-04 23:11 - 2015-10-04 23:11 - 00000020 _____ C:\Users\admin\Desktop\krishouse.txt2015-10-04 22:05 - 2015-10-04 22:05 - 00013719 _____ C:\Users\admin\Desktop\AdwCleaner[C1].txt2015-10-04 21:58 - 2015-10-04 21:58 - 00000000 ____D C:\AdwCleaner2015-10-04 21:54 - 2015-10-04 21:54 - 00000000 ____D C:\Users\admin\AppData\Roaming\GlarySoft2015-10-04 21:54 - 2015-10-04 21:54 - 00000000 ____D C:\Users\admin\AppData\Roaming\DiskDefrag2015-10-04 21:54 - 2015-10-04 21:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 52015-10-04 21:53 - 2015-10-04 22:35 - 00000000 ____D C:\Program Files (x86)\Glary Utilities 52015-10-01 21:46 - 2015-10-01 21:46 - 00000070 _____ C:\Users\admin\Desktop\vbrgtfnhy.txt2015-10-01 00:37 - 2015-10-01 00:37 - 00000033 _____ C:\Users\admin\Desktop\YWCA.txt2015-09-29 00:06 - 2015-10-04 13:42 - 00001768 _____ C:\Users\admin\Desktop\mixes to make.txt2015-09-27 01:03 - 2015-09-27 14:01 - 00018816 _____ C:\Users\admin\Desktop\archetypes.txt2015-09-26 18:08 - 2015-10-05 16:11 - 00000280 _____ C:\Windows\setupact.log2015-09-26 18:08 - 2015-09-26 18:08 - 00002494 _____ C:\Windows\PFRO.log2015-09-26 18:08 - 2015-09-26 18:08 - 00000000 _____ C:\Windows\setuperr.log2015-09-23 14:30 - 2015-09-23 14:30 - 00000000 ____D C:\Users\admin\Documents\HyperCam32015-09-23 14:25 - 2015-09-26 18:10 - 00000000 ____D C:\Program Files (x86)\3602015-09-23 14:24 - 2015-09-23 14:25 - 00000000 ____D C:\Users\admin\AppData\Local\Chromium2015-09-23 14:24 - 2015-09-23 14:24 - 00003494 _____ C:\Windows\System32\Tasks\PROPCCleanerSoftware_Popup2015-09-23 14:24 - 2015-09-23 14:24 - 00003230 _____ C:\Windows\System32\Tasks\PROPCCleanerSoftware_Start2015-09-23 14:24 - 2015-09-23 14:24 - 00001066 _____ C:\Users\Public\Desktop\MP3 Rocket 7.3.1.lnk2015-09-23 14:24 - 2015-09-23 14:24 - 00000000 ____D C:\Users\admin\AppData\Roaming\updates2015-09-23 14:24 - 2015-09-23 14:24 - 00000000 ____D C:\Users\admin\AppData\Local\PRO_PC_Cleaner_Software2015-09-23 14:24 - 2015-09-23 14:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MP3 Rocket2015-09-23 14:23 - 2015-10-04 23:23 - 00000270 _____ C:\Windows\Tasks\UpdateTask.job2015-09-23 14:23 - 2015-09-23 14:28 - 00000000 ____D C:\Users\admin\Documents\PROPCCleanerSoftware2015-09-23 14:23 - 2015-09-23 14:23 - 00003210 _____ C:\Windows\System32\Tasks\UpdateTask2015-09-23 14:23 - 2015-09-23 14:23 - 00000000 ____D C:\Users\admin\Documents\ProPCCleaner2015-09-23 14:22 - 2015-09-23 14:30 - 00000000 ____D C:\Users\admin\AppData\Local\{F5D7C38B-D17F-AF33-BCE7-8ADB988F7643}2015-09-22 23:45 - 2015-10-04 23:35 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys2015-09-22 23:45 - 2015-09-23 13:17 - 00001056 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk2015-09-22 23:45 - 2015-09-22 23:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware2015-09-22 23:45 - 2015-09-22 23:45 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware2015-09-22 23:45 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys2015-09-22 23:45 - 2015-06-18 08:41 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys2015-09-22 23:45 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys2015-09-20 19:43 - 2015-10-02 19:15 - 00000000 ____D C:\Users\admin\Downloads\Doctor Who S092015-09-19 09:21 - 2015-09-19 09:21 - 00000000 ____D C:\Windows\TEMPfolder2015-09-19 09:21 - 2015-09-19 09:21 - 00000000 ____D C:\Windows\system32\upuo2015-09-16 21:21 - 2015-09-16 21:21 - 00000000 ____D C:\Users\admin\Downloads\Other2015-09-15 11:13 - 2015-09-15 11:13 - 00000726 _____ C:\Users\admin\Desktop\birthday party.txt2015-09-09 08:44 - 2015-08-17 21:42 - 00393304 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll2015-09-09 08:44 - 2015-08-17 21:14 - 00344168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll2015-09-09 08:44 - 2015-08-15 02:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb2015-09-09 08:44 - 2015-08-15 02:33 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll2015-09-09 08:44 - 2015-08-15 02:18 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll2015-09-09 08:44 - 2015-08-15 02:18 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll2015-09-09 08:44 - 2015-08-15 02:09 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll2015-09-09 08:44 - 2015-08-15 02:06 - 19856896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2015-09-09 08:44 - 2015-08-15 02:04 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe2015-09-09 08:44 - 2015-08-15 01:57 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe2015-09-09 08:44 - 2015-08-15 01:53 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb2015-09-09 08:44 - 2015-08-15 01:46 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll2015-09-09 08:44 - 2015-08-15 01:40 - 00504832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll2015-09-09 08:44 - 2015-08-15 01:40 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll2015-09-09 08:44 - 2015-08-15 01:39 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll2015-09-09 08:44 - 2015-08-15 01:39 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll2015-09-09 08:44 - 2015-08-15 01:38 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll2015-09-09 08:44 - 2015-08-15 01:35 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2015-09-09 08:44 - 2015-08-15 01:33 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2015-09-09 08:44 - 2015-08-15 01:32 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll2015-09-09 08:44 - 2015-08-15 01:30 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2015-09-09 08:44 - 2015-08-15 01:29 - 00665600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll2015-09-09 08:44 - 2015-08-15 01:29 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll2015-09-09 08:44 - 2015-08-15 01:29 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2015-09-09 08:44 - 2015-08-15 01:24 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe2015-09-09 08:44 - 2015-08-15 01:23 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll2015-09-09 08:44 - 2015-08-15 01:21 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll2015-09-09 08:44 - 2015-08-15 01:16 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll2015-09-09 08:44 - 2015-08-15 01:12 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2015-09-09 08:44 - 2015-08-15 01:11 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll2015-09-09 08:44 - 2015-08-15 01:04 - 12857344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2015-09-09 08:44 - 2015-08-15 01:02 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll2015-09-09 08:44 - 2015-08-15 01:01 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2015-09-09 08:44 - 2015-08-15 00:55 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll2015-09-09 08:44 - 2015-08-15 00:43 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll2015-09-09 08:44 - 2015-08-15 00:39 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2015-09-09 08:44 - 2015-08-15 00:37 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll2015-09-09 08:44 - 2015-08-05 13:56 - 01110016 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll2015-09-09 08:44 - 2015-08-05 13:56 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll2015-09-09 08:44 - 2015-08-05 13:40 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll2015-09-09 08:44 - 2015-07-14 23:17 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll2015-09-09 08:44 - 2015-07-14 22:54 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll2015-09-09 08:44 - 2015-07-09 13:58 - 01632256 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll2015-09-09 08:44 - 2015-07-09 13:58 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll2015-09-09 08:44 - 2015-07-09 13:42 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll2015-09-09 08:44 - 2015-07-09 13:42 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll2015-09-09 08:43 - 2015-08-15 02:48 - 25190400 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll2015-09-09 08:43 - 2015-08-15 02:17 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll2015-09-09 08:43 - 2015-08-15 02:17 - 00585216 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll2015-09-09 08:43 - 2015-08-15 02:17 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec2015-09-09 08:43 - 2015-08-15 02:17 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll2015-09-09 08:43 - 2015-08-15 02:10 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll2015-09-09 08:43 - 2015-08-15 02:06 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll2015-09-09 08:43 - 2015-08-15 02:04 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll2015-09-09 08:43 - 2015-08-15 02:04 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll2015-09-09 08:43 - 2015-08-15 02:04 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe2015-09-09 08:43 - 2015-08-15 02:00 - 05923328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll2015-09-09 08:43 - 2015-08-15 01:53 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll2015-09-09 08:43 - 2015-08-15 01:42 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll2015-09-09 08:43 - 2015-08-15 01:41 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll2015-09-09 08:43 - 2015-08-15 01:39 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec2015-09-09 08:43 - 2015-08-15 01:22 - 02126336 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl2015-09-09 08:43 - 2015-08-15 01:22 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll2015-09-09 08:43 - 2015-08-15 01:16 - 14451712 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll2015-09-09 08:43 - 2015-08-15 01:14 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll2015-09-09 08:43 - 2015-08-15 01:10 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2015-09-09 08:43 - 2015-08-15 01:07 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll2015-09-09 08:43 - 2015-08-15 01:01 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll2015-09-09 08:43 - 2015-08-15 00:43 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2015-09-09 08:43 - 2015-07-22 20:06 - 05568960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe2015-09-09 08:43 - 2015-07-22 20:06 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys2015-09-09 08:43 - 2015-07-22 20:06 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys2015-09-09 08:43 - 2015-07-22 20:03 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll2015-09-09 08:43 - 2015-07-22 20:03 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll2015-09-09 08:43 - 2015-07-22 20:03 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll2015-09-09 08:43 - 2015-07-22 20:03 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll2015-09-09 08:43 - 2015-07-22 20:03 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll2015-09-09 08:43 - 2015-07-22 20:02 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll2015-09-09 08:43 - 2015-07-22 20:02 - 01390592 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll2015-09-09 08:43 - 2015-07-22 20:02 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll2015-09-09 08:43 - 2015-07-22 20:02 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll2015-09-09 08:43 - 2015-07-22 20:02 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll2015-09-09 08:43 - 2015-07-22 20:02 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll2015-09-09 08:43 - 2015-07-22 20:02 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll2015-09-09 08:43 - 2015-07-22 20:02 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll2015-09-09 08:43 - 2015-07-22 20:02 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll2015-09-09 08:43 - 2015-07-22 20:02 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll2015-09-09 08:43 - 2015-07-22 20:02 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll2015-09-09 08:43 - 2015-07-22 20:02 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll2015-09-09 08:43 - 2015-07-22 20:02 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe2015-09-09 08:43 - 2015-07-22 20:02 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll2015-09-09 08:43 - 2015-07-22 20:02 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll2015-09-09 08:43 - 2015-07-22 20:02 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe2015-09-09 08:43 - 2015-07-22 20:02 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll2015-09-09 08:43 - 2015-07-22 20:02 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll2015-09-09 08:43 - 2015-07-22 20:02 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll2015-09-09 08:43 - 2015-07-22 20:02 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll2015-09-09 08:43 - 2015-07-22 20:02 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll2015-09-09 08:43 - 2015-07-22 20:02 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll2015-09-09 08:43 - 2015-07-22 20:02 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll2015-09-09 08:43 - 2015-07-22 20:02 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll2015-09-09 08:43 - 2015-07-22 20:01 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe2015-09-09 08:43 - 2015-07-22 20:01 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe2015-09-09 08:43 - 2015-07-22 20:01 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe2015-09-09 08:43 - 2015-07-22 19:58 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll2015-09-09 08:43 - 2015-07-22 19:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 19:51 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll2015-09-09 08:43 - 2015-07-22 13:57 - 03989952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe2015-09-09 08:43 - 2015-07-22 13:57 - 03934656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe2015-09-09 08:43 - 2015-07-22 13:54 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll2015-09-09 08:43 - 2015-07-22 13:53 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll2015-09-09 08:43 - 2015-07-22 13:53 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll2015-09-09 08:43 - 2015-07-22 13:53 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll2015-09-09 08:43 - 2015-07-22 13:53 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll2015-09-09 08:43 - 2015-07-22 13:53 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll2015-09-09 08:43 - 2015-07-22 13:53 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll2015-09-09 08:43 - 2015-07-22 13:53 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll2015-09-09 08:43 - 2015-07-22 13:53 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll2015-09-09 08:43 - 2015-07-22 13:53 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll2015-09-09 08:43 - 2015-07-22 13:53 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll2015-09-09 08:43 - 2015-07-22 13:53 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll2015-09-09 08:43 - 2015-07-22 13:53 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll2015-09-09 08:43 - 2015-07-22 13:53 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll2015-09-09 08:43 - 2015-07-22 13:52 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll2015-09-09 08:43 - 2015-07-22 13:52 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll2015-09-09 08:43 - 2015-07-22 13:52 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll2015-09-09 08:43 - 2015-07-22 13:52 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll2015-09-09 08:43 - 2015-07-22 13:52 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe2015-09-09 08:43 - 2015-07-22 13:52 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe2015-09-09 08:43 - 2015-07-22 13:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll2015-09-09 08:43 - 2015-07-22 13:47 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll2015-09-09 08:43 - 2015-07-22 13:46 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 12:48 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll2015-09-09 08:43 - 2015-07-22 12:45 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys2015-09-09 08:43 - 2015-07-22 12:44 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys2015-09-09 08:43 - 2015-07-22 12:44 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys2015-09-09 08:43 - 2015-07-22 12:34 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe2015-09-09 08:43 - 2015-07-22 12:34 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe2015-09-09 08:43 - 2015-07-22 12:31 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 12:31 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 12:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll2015-09-09 08:43 - 2015-07-22 12:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll2015-09-09 08:42 - 2015-09-01 23:04 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll2015-09-09 08:42 - 2015-09-01 23:04 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll2015-09-09 08:42 - 2015-09-01 23:04 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll2015-09-09 08:42 - 2015-09-01 22:48 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll2015-09-09 08:42 - 2015-09-01 22:48 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll2015-09-09 08:42 - 2015-09-01 21:51 - 03209216 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys2015-09-09 08:42 - 2015-09-01 21:47 - 00372736 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll2015-09-09 08:42 - 2015-09-01 21:33 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll2015-09-09 08:42 - 2015-08-27 14:18 - 02004480 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll2015-09-09 08:42 - 2015-08-27 14:18 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll2015-09-09 08:42 - 2015-08-27 14:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll2015-09-09 08:42 - 2015-08-27 14:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll2015-09-09 08:42 - 2015-08-27 13:58 - 01391104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll2015-09-09 08:42 - 2015-08-27 13:58 - 01241088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll2015-09-09 08:42 - 2015-08-27 13:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll2015-09-09 08:42 - 2015-08-27 13:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll2015-09-09 08:42 - 2015-08-04 14:03 - 00692672 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi2015-09-09 08:42 - 2015-08-04 14:00 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi2015-09-09 08:42 - 2015-08-04 13:56 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll2015-09-09 08:42 - 2015-08-04 13:56 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll2015-09-09 08:42 - 2015-08-04 13:56 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll2015-09-09 08:42 - 2015-08-04 13:55 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe2015-09-09 08:42 - 2015-08-04 13:55 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe2015-09-09 08:42 - 2015-08-04 13:47 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll2015-09-09 08:42 - 2015-08-04 12:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys2015-09-09 08:42 - 2015-06-25 06:06 - 00115136 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe2015-09-09 08:42 - 2015-06-25 06:01 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll2015-09-09 08:42 - 2015-06-25 06:01 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll2015-09-09 08:42 - 2015-06-25 05:44 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll2015-09-09 08:41 - 2015-09-01 23:04 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll2015-09-09 08:41 - 2015-09-01 22:48 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll2015-09-09 08:41 - 2015-09-01 22:47 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll2015-09-09 08:41 - 2015-08-26 14:07 - 03165696 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll2015-09-09 08:41 - 2015-08-26 14:07 - 02606080 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll2015-09-09 08:41 - 2015-08-26 14:07 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll2015-09-09 08:41 - 2015-08-26 14:07 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll2015-09-09 08:41 - 2015-08-26 14:07 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll2015-09-09 08:41 - 2015-08-26 14:07 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll2015-09-09 08:41 - 2015-08-26 14:07 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll2015-09-09 08:41 - 2015-08-26 14:06 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe2015-09-09 08:41 - 2015-08-26 14:06 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll2015-09-09 08:41 - 2015-08-26 14:06 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe2015-09-09 08:41 - 2015-08-26 14:06 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll2015-09-09 08:41 - 2015-08-26 13:56 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll2015-09-09 08:41 - 2015-08-26 13:56 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll2015-09-09 08:41 - 2015-08-26 13:56 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll2015-09-09 08:41 - 2015-08-26 13:56 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll2015-09-09 08:41 - 2015-08-26 13:55 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe==================== One Month Modified files and folders ========(If an entry is included in the fixlist, the file/folder will be moved.)2015-10-05 16:12 - 2014-05-27 00:56 - 00000000 ____D C:\Users\admin\AppData\LocalLow\AuthenTec2015-10-05 16:11 - 2014-08-22 16:33 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job2015-10-05 16:11 - 2013-02-06 20:27 - 00065536 _____ C:\Windows\system32\Ikeext.etl2015-10-05 16:11 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT2015-10-04 23:25 - 2012-04-17 09:37 - 01575146 _____ C:\Windows\WindowsUpdate.log2015-10-04 23:23 - 2009-07-14 00:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A02015-10-04 23:23 - 2009-07-14 00:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A02015-10-04 22:37 - 2014-08-22 16:33 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job2015-10-04 22:37 - 2014-05-27 00:54 - 00000000 ____D C:\Users\admin2015-10-04 22:36 - 2015-04-05 03:00 - 00000000 ___SD C:\Windows\system32\GWX2015-10-04 22:36 - 2012-08-22 14:27 - 00000000 ____D C:\Users\Guest2015-10-04 22:35 - 2015-08-13 14:18 - 00000000 ____D C:\Users\admin\AppData\LocalLow\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}2015-10-04 22:35 - 2014-07-10 07:54 - 00000000 ____D C:\Users\admin\AppData\Roaming\PhotoFiltre2015-10-04 22:35 - 2014-07-10 06:38 - 00000000 ____D C:\Users\admin\AppData\Local\PCP_100_v32015-10-04 22:35 - 2014-07-09 08:13 - 00000000 ____D C:\ProgramData\AVG Secure Search2015-10-04 22:35 - 2013-01-23 09:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox2015-10-04 22:35 - 2012-08-26 19:27 - 00000000 ____D C:\Users\Guest\AppData\LocalLow\Conduit2015-10-04 22:35 - 2012-04-17 10:24 - 00000000 ___RD C:\Users\Public\Recorded TV2015-10-04 22:35 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\registration2015-10-04 22:34 - 2014-07-08 07:59 - 00000000 ____D C:\Users\admin\AppData\Local\Mozilla2015-10-04 22:11 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\tracing2015-10-04 20:30 - 2015-03-27 20:58 - 00000000 ____D C:\Users\admin\Desktop\Weeklies2015-10-04 16:25 - 2014-07-09 08:13 - 00000000 ____D C:\Users\admin\AppData\Local\CrashDumps2015-10-04 01:48 - 2014-10-18 05:04 - 00000000 ____D C:\Users\admin\Incomplete2015-10-03 11:05 - 2012-09-15 15:36 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job2015-10-03 00:39 - 2014-10-18 05:06 - 00000000 ____D C:\Songs2015-10-02 19:04 - 2014-10-02 04:09 - 00000863 _____ C:\Users\admin\Desktop\Upcoming Episodes.txt2015-10-01 16:39 - 2015-08-14 23:55 - 00000000 ____D C:\Firefox2015-09-30 17:58 - 2014-10-18 05:03 - 00000000 ____D C:\Users\admin\AppData\Roaming\MP3Rocket2015-09-29 19:27 - 2012-09-02 00:01 - 00000166 _____ C:\Windows\SysWOW64\DOErrors.log2015-09-29 14:46 - 2014-07-25 11:32 - 00000000 ____D C:\Users\admin\Desktop\Photos2015-09-27 01:06 - 2014-07-10 04:49 - 00000000 ____D C:\Users\admin\Desktop\Mixes2015-09-26 15:41 - 2014-08-22 16:34 - 00002143 _____ C:\Users\Public\Desktop\Google Chrome.lnk2015-09-23 22:09 - 2014-11-23 21:59 - 00000000 __SHD C:\Users\admin\AppData\Local\EmieBrowserModeList2015-09-23 22:09 - 2014-07-27 02:13 - 00000000 __SHD C:\Users\admin\AppData\Local\EmieUserList2015-09-23 22:09 - 2014-07-27 02:13 - 00000000 __SHD C:\Users\admin\AppData\Local\EmieSiteList2015-09-23 14:30 - 2014-10-18 05:03 - 00000000 ____D C:\Program Files (x86)\MP3 Rocket2015-09-23 14:23 - 2014-07-08 07:59 - 00000660 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk2015-09-23 13:18 - 2011-10-21 20:51 - 00000000 ____D C:\Windows\en2015-09-23 13:17 - 2014-09-07 23:37 - 00001091 _____ C:\Users\Public\Desktop\Yahoo! Messenger.lnk2015-09-23 13:17 - 2014-08-21 14:56 - 00001737 _____ C:\Users\Public\Desktop\iTunes.lnk2015-09-23 13:17 - 2014-08-21 14:49 - 00002507 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk2015-09-23 13:17 - 2014-08-20 16:08 - 00000860 _____ C:\Users\Public\Desktop\CCleaner.lnk2015-09-23 13:17 - 2014-07-22 21:34 - 00000933 _____ C:\Users\Public\Desktop\Winamp.lnk2015-09-23 13:17 - 2014-07-17 18:32 - 00001106 _____ C:\Users\Public\Desktop\OpenOffice 4.1.0.lnk2015-09-23 13:17 - 2014-07-08 08:28 - 00002105 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk2015-09-23 13:17 - 2014-07-08 07:59 - 00000660 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk2015-09-23 13:17 - 2014-05-27 00:56 - 00001389 _____ C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk2015-09-23 13:17 - 2012-04-17 09:31 - 00001333 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk2015-09-23 13:17 - 2012-04-17 09:31 - 00001314 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk2015-09-23 13:17 - 2011-10-21 20:53 - 00002429 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk2015-09-23 13:17 - 2011-10-21 20:50 - 00001446 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk2015-09-23 13:17 - 2011-10-21 20:50 - 00001362 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk2015-09-23 13:17 - 2011-10-21 20:50 - 00001293 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Movie Maker.lnk2015-09-23 13:17 - 2011-10-21 20:49 - 00002474 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk2015-09-23 13:17 - 2011-10-21 20:46 - 00002423 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2010.lnk2015-09-23 13:17 - 2009-07-14 00:57 - 00001511 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk2015-09-23 13:17 - 2009-07-14 00:57 - 00001340 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk2015-09-23 13:17 - 2009-07-14 00:57 - 00001292 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk2015-09-23 13:17 - 2009-07-14 00:57 - 00001234 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk2015-09-23 13:17 - 2009-07-14 00:54 - 00001198 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk2015-09-23 13:16 - 2014-10-21 16:41 - 00002501 _____ C:\Users\admin\Desktop\Small World 2.lnk2015-09-23 13:16 - 2014-07-18 14:35 - 00001087 _____ C:\Users\admin\Desktop\Free Countdown Timer.lnk2015-09-23 13:16 - 2014-07-10 07:54 - 00001003 _____ C:\Users\admin\Desktop\PhotoFiltre.lnk2015-09-23 13:16 - 2009-07-14 01:01 - 00001218 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk2015-09-23 13:16 - 2009-07-14 00:49 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk2015-09-23 13:15 - 2015-01-19 14:14 - 00000000 ____D C:\Users\admin\AppData\Roaming\Rainmaker Software Group LLC.2015-09-23 13:15 - 2013-01-23 09:57 - 00000000 ____D C:\Program Files (x86)\ZD Systems2015-09-22 23:45 - 2013-02-26 00:43 - 00000000 ____D C:\ProgramData\Malwarebytes2015-09-22 18:13 - 2014-07-25 03:13 - 00000000 ____D C:\Users\admin\AppData\Roaming\SoftGrid Client2015-09-21 20:37 - 2012-09-15 15:36 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2015-09-21 20:37 - 2012-09-15 15:36 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater2015-09-21 20:37 - 2011-10-21 20:35 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl2015-09-20 23:17 - 2015-06-25 22:43 - 00000157 _____ C:\Users\admin\Desktop\what i did all week.txt2015-09-19 09:21 - 2011-10-21 20:11 - 00357888 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll2015-09-19 09:21 - 2011-10-21 20:11 - 00270336 _____ C:\Windows\SysWOW64\dnsapi.dll2015-09-16 19:33 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\rescache2015-09-14 21:32 - 2014-08-22 16:33 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA2015-09-14 21:32 - 2014-08-22 16:33 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore2015-09-12 09:52 - 2009-07-14 01:13 - 00006510 _____ C:\Windows\system32\PerfStringBackup.INI2015-09-12 09:44 - 2009-07-14 00:45 - 02866744 _____ C:\Windows\system32\FNTCACHE.DAT2015-09-12 09:41 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\PolicyDefinitions2015-09-12 00:04 - 2014-10-18 06:04 - 00000246 _____ C:\Users\admin\AppData\Roaming\WB.CFG2015-09-11 23:54 - 2013-01-23 09:57 - 00000045 _____ C:\user.js2015-09-11 08:51 - 2014-07-08 12:22 - 00000000 ____D C:\Windows\system32\MRT2015-09-10 20:37 - 2014-08-22 16:33 - 00000000 ____D C:\Users\admin\AppData\Local\Google2015-09-06 21:59 - 2015-08-26 15:22 - 00000390 _____ C:\Users\admin\Desktop\songs heard on the radio.txt==================== Files in the root of some directories =======2014-10-18 06:04 - 2015-09-12 00:04 - 0000246 _____ () C:\Users\admin\AppData\Roaming\WB.CFG2014-10-19 19:04 - 2015-01-17 19:04 - 0000001 _____ () C:\Users\admin\AppData\Local\DSI.DAT2015-03-07 16:43 - 2015-03-07 16:43 - 0000000 _____ () C:\Users\admin\AppData\Local\{D90E9AF4-8937-4253-94B9-72BABD5C4C72}==================== Bamital & volsnap =================(There is no automatic fix for files that do not pass verification.)C:\Windows\system32\winlogon.exe => File is digitally signedC:\Windows\system32\wininit.exe => File is digitally signedC:\Windows\SysWOW64\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\system32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\system32\services.exe => File is digitally signedC:\Windows\system32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\system32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\system32\rpcss.dll => File is digitally signedC:\Windows\system32\dnsapi.dll[2011-10-21 20:11] - [2015-09-19 09:21] - 0357888 ____A (Microsoft Corporation) AD1AE1EDA97CAE7BEEAF9402498462ACC:\Windows\SysWOW64\dnsapi.dll[2011-10-21 20:11] - [2015-09-19 09:21] - 0270336 ____A () D41D8CD98F00B204E9800998ECF8427EC:\Windows\SysWOW64\dnsapi.dll => no Company Name <===== ATTENTIONC:\Windows\system32\Drivers\volsnap.sys => File is digitally signedLastRegBack: 2015-09-21 13:26==================== End of FRST.txt ============================ Link to post Share on other sites More sharing options...
vampedvixen Posted October 5, 2015 Author ID:993819 Share Posted October 5, 2015 THIS IS ADDITION:Additional scan result of Farbar Recovery Scan Tool (x64) Version:04-10-2015Ran by admin (2015-10-05 16:15:07)Running from H:\Windows 7 Home Premium Service Pack 1 (X64) (2012-08-21 04:39:34)Boot Mode: Normal============================================================================== Accounts: =============================admin (S-1-5-21-571689730-3727486918-3289345957-1007 - Administrator - Enabled) => C:\Users\adminAdministrator (S-1-5-21-571689730-3727486918-3289345957-500 - Administrator - Disabled)Guest (S-1-5-21-571689730-3727486918-3289345957-501 - Limited - Disabled) => C:\Users\GuestHomeGroupUser$ (S-1-5-21-571689730-3727486918-3289345957-1009 - Limited - Enabled)==================== Security Center ========================(If an entry is included in the fixlist, it will be removed.)AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}==================== Installed Programs ======================(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )AC3File 0.6b (HKLM-x32\...\AC3File_is1) (Version: 0.6b - Alexander Vigovsky)Adobe Flash Player 19 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 19.0.0.185 - Adobe Systems Incorporated)Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.185 - Adobe Systems Incorporated)Adobe Reader X (10.1.0) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.0 - Adobe Systems Incorporated)Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.1.629 - Adobe Systems, Inc.)Aimersoft DVD Ripper(Build 3.0.0.2) (HKLM-x32\...\Aimersoft DVD Ripper_is1) (Version: - Aimersoft Software)Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)AuthenTec TrueAPI (Version: 1.3.0.139 - AuthenTec, Inc.) HiddenBonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 5.100.82.86 - Broadcom Corporation)Broadcom Bluetooth Software (HKLM\...\{6E7F4CA3-B2DE-413C-A7A1-43AA5BE19EA1}) (Version: 6.5.0.2300 - Broadcom Corporation)Broadcom InConcert Maestro (HKLM\...\{57DD35E9-D9BB-4089-BB05-EF933C586CB3}) (Version: 1.0.5.2300 - Broadcom Corporation)CCleaner (HKLM\...\CCleaner) (Version: 4.16 - Piriform)Chromium (HKU\S-1-5-21-571689730-3727486918-3289345957-1007\...\Chromium) (Version: 46.0.2480.0 - Chromium)CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.0.4528 - CyberLink Corp.)D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) HiddenDealPly (HKU\.DEFAULT\...\DealPly) (Version: - ) <==== ATTENTIONDivX Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.3.80 - DivX, LLC)ESU for Microsoft Windows 7 SP1 (HKLM-x32\...\{E96CAA2A-0244-4A2A-8403-0C3C9534778B}) (Version: 2.1.1 - Hewlett-Packard)f.lux (HKU\S-1-5-21-571689730-3727486918-3289345957-1007\...\Flux) (Version: - )Free Countdown Timer 3.1.0 (HKLM-x32\...\{404245D0-E836-4737-9C12-D4D0034540F5}_is1) (Version: 3.1 - Comfort Software Group)Free YouTube Download version 3.1.42.1212 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.1.42.1212 - DVDVideoSoft Ltd.)Free YouTube to DVD Converter version 3.0.24.918 (HKLM-x32\...\Free YouTube to DVD Converter_is1) (Version: 3.0.24.918 - DVDVideoSoft Ltd.)Free YouTube to MP3 Converter version 3.11.32.918 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.11.32.918 - DVDVideoSoft Ltd.)Free YouTube to MP3 WMA Converter 5.8.2 (HKLM-x32\...\Free YouTube to MP3 WMA Converter_is1) (Version: - FreeAudioVideoSoftTech, Inc.)Google Chrome (HKLM-x32\...\Google Chrome) (Version: 45.0.2454.101 - Google Inc.)Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) HiddenGoogle Update Helper (x32 Version: 1.3.28.15 - Google Inc.) HiddenHewlett-Packard ACLM.NET v1.1.2.0 (x32 Version: 1.00.0000 - Hewlett-Packard) HiddenHP Application Assistant (HKLM\...\{6032497A-4479-462B-ADB8-A0A372BB9A23}) (Version: 1.0.409.3882 - Hewlett-Packard)HP Documentation (HKLM-x32\...\{BC6CB499-9F29-4B41-8B8B-FA7248525256}) (Version: 1.1.0.0 - Hewlett-Packard)HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)HP Launch Box (HKLM\...\{BF1E75D0-E7AF-4BEA-9FBC-567F0C54BDF9}) (Version: 1.0.12 - Hewlett-Packard Company)HP On Screen Display (HKLM-x32\...\{ED1BD69A-07E3-418C-91F1-D856582581BF}) (Version: 1.3.5 - Hewlett-Packard Company)HP Power Manager (HKLM-x32\...\{E44578C7-4667-4124-8BC2-1161BCA54978}) (Version: 1.4.4 - Hewlett-Packard Company)HP Quick Launch (HKLM-x32\...\{285F722C-0E45-47DE-B38E-5B3B10FA4A7C}) (Version: 2.5.2 - Hewlett-Packard Company)HP QuickWeb (HKLM-x32\...\{BB4FC2AD-DF12-4EE1-8AA7-2C0A26B5E2FB}) (Version: 3.1.1.10197 - Hewlett-Packard Company)HP Security Assistant (HKLM\...\{562608FE-2051-4488-BF22-8CE4C03046AC}) (Version: 1.0.12 - Hewlett-Packard)HP Setup (HKLM-x32\...\{F5E7D9AF-60F6-4A30-87E3-4EA94D322CE1}) (Version: 9.0.15076.3891 - Hewlett-Packard Company)HP Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.2.14901.3869 - Hewlett-Packard Company)HP SimplePass PE 2011 (HKLM-x32\...\{4741965C-AFD0-4D00-81D1-1039F96D4DC3}) (Version: 5.3.0.264 - Hewlett-Packard)HP Software Framework (HKLM-x32\...\{AF240B18-034B-4A82-B3FC-0B879C4BAE2E}) (Version: 4.5.1.1 - Hewlett-Packard Company)HP Support Assistant (HKLM-x32\...\{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}) (Version: 6.1.12.1 - Hewlett-Packard Company)IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6365.0 - IDT)Inquisit 4 Web Plugin (HKLM-x32\...\{3D3A7DD1-29A5-4F1B-80FB-DE9E437DCB55}) (Version: 4.0.6.0 - Millisecond Software)Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)Intel® Identity Protection Technology 1.1.2.0 (HKLM-x32\...\{C01A86F5-56E7-101F-9BC9-E3F1025EB779}) (Version: 1.1.2.0 - Intel Corporation)Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2476 - Intel Corporation)iTunes (HKLM\...\{77DE5105-D05E-448C-96CB-7FA381903753}) (Version: 11.3.1.2 - Apple Inc.)Java 7 Update 9 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217009FF}) (Version: 7.0.90 - Oracle)Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) HiddenMalwarebytes Anti-Malware version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) HiddenMicrosoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)Microsoft Office Click-to-Run 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)Microsoft Office Starter 2010 - English (HKLM-x32\...\{90140011-0066-0409-0000-0000000FF1CE}) (Version: 14.0.5139.5005 - Microsoft Corporation)Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Mozilla Firefox 40.0.2 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 40.0.2 (x86 en-US)) (Version: 40.0.2 - Mozilla)Mozilla Firefox 40.0.3 (x86 en-US) (HKU\S-1-5-21-571689730-3727486918-3289345957-1007\...\Mozilla Firefox 40.0.3 (x86 en-US)) (Version: 40.0.3 - Mozilla)MP3 Rocket (HKLM-x32\...\MP3 Rocket) (Version: 7.3.1 - MP3 Rocket Inc)MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)OpenOffice 4.1.0 (HKLM-x32\...\{C87EF11D-36E9-479D-9898-7541EA1E8A6A}) (Version: 4.10.9764 - Apache Software Foundation)opensource (x32 Version: 1.0.14960.3876 - Your Company Name) HiddenPazera Free Audio Extractor 2.1 (HKLM-x32\...\{6899C238-3E4A-4A04-B251-A0C9EDC7EDBC}_is1) (Version: 2.1 - Jacek Pazera)PDF Architect 2 (HKLM-x32\...\PDF Architect 2) (Version: 2.0.24.16092 - pdfforge GmbH)PDF Architect 2 View Module (HKLM-x32\...\{D691E998-CF53-4F6C-AC20-E4284660E0E7}) (Version: 2.1.6.19758 - pdfforge GmbH)PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)PhotoFiltre (HKU\S-1-5-21-571689730-3727486918-3289345957-1007\...\PhotoFiltre) (Version: - )PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7601.85 - Realtek Semiconductor Corp.)Small World 2 (HKLM-x32\...\{C9D3A5EE-9298-4547-A165-15D2643E37E0}) (Version: 2.5.1.1365 - Days of Wonder, Inc.)SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version: - )Strongvault Online Backup (x32 Version: 5.0.2.34 - Strongvault Online Backup) Hidden <==== ATTENTIONswMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) HiddenSynaptics TouchPad Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.11.0 - Synaptics Incorporated)Unity Web Player (HKU\S-1-5-21-571689730-3727486918-3289345957-1007\...\UnityWebPlayer) (Version: 4.6.1f1 - Unity Technologies ApS)VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) HiddenVTech Download Agent Library (x32 Version: 1.00.0000 - VTech) HiddenWinamp (HKLM-x32\...\Winamp) (Version: 5.666 - Nullsoft, Inc)Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)Wondershare DVD Creator(Build 3.1.0) (HKLM-x32\...\Wondershare DVD Creator_is1) (Version: - Wondershare Software)Yahoo! Messenger (HKLM-x32\...\Yahoo! Messenger) (Version: - Yahoo! Inc.)Yahoo! Software Update (HKLM-x32\...\Yahoo! Software Update) (Version: - )==================== Custom CLSID (Whitelisted): ==========================(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)==================== Restore Points =========================25-09-2015 17:42:28 Windows Update29-09-2015 13:08:11 Windows Update03-10-2015 11:18:05 Windows Update04-10-2015 22:27:36 Restore Operation04-10-2015 23:24:22 Windows Update==================== Hosts content: ===============================(If needed Hosts: directive could be included in the fixlist to reset Hosts.)2009-07-13 22:34 - 2015-08-16 19:32 - 00000826 ____A C:\Windows\system32\Drivers\etc\hosts==================== Scheduled Tasks (Whitelisted) =============(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)Task: {064FFF95-4440-4564-9EDB-1AAD288D974F} - System32\Tasks\PROPCCleanerSoftware_Start => C:\Program Files (x86)\PRO PC Cleaner Software\PROPCCleanerSoftware.exe <==== ATTENTIONTask: {0FA8A0F9-0FA2-41CF-ACBF-E79906411B1F} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-571689730-3727486918-3289345957-1004 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exeTask: {1483D9CE-A986-49A9-B48E-826686872F0D} - System32\Tasks\{15D9A2C0-AC54-48A1-9C67-1A920B771C05} => pcalua.exe -a "C:\Program Files (x86)\Common Files\DVDVideoSoft\Uninstall.exe"Task: {1E11012D-70BF-4FE2-84F3-4894403A1FD3} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-571689730-3727486918-3289345957-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exeTask: {2021F237-7B3D-4EC2-8652-6593F311BFC4} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-09-09] (Hewlett-Packard Company)Task: {2D4F0F29-67C8-4CC3-8C42-E3C27717358D} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-571689730-3727486918-3289345957-1003 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exeTask: {3B89E72A-F97E-4947-B999-5D0133D2DF95} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-571689730-3727486918-3289345957-1003 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exeTask: {472B0EC5-A423-4A3C-9829-5F980D2F706F} - System32\Tasks\{21C0BEFE-9B19-466D-B637-48BF24B011E1} => pcalua.exe -a H:\apps\USBLoader\USBLoader.exe -d H:\apps\USBLoaderTask: {47E30DC1-E1C7-4FAE-8D54-B919272C49AA} - System32\Tasks\UpdateTask => C:\Users\admin\AppData\Local\{F5D7C~1\UNINST~1.EXETask: {4D2C225C-9991-4F9F-8132-691D60D524BA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)Task: {4EF6AF79-EE56-48D1-BE38-C41BF30486BE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)Task: {54E724B8-BF8A-4603-99BC-5B3796992C8C} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-09-28] (CyberLink)Task: {5581A0FC-9FD5-4EE9-B0CC-FE3244FF41B9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-09-09] (Hewlett-Packard Company)Task: {66CCED08-B98B-45F8-BE02-589B78612289} - System32\Tasks\PROPCCleanerSoftware_Popup => C:\Program Files (x86)\PRO PC Cleaner Software\Splash.exe <==== ATTENTIONTask: {80AFEA4A-7B7A-45BD-A401-16EAD4B21A73} - System32\Tasks\Norton Identity Safe\Norton Error Analyzer => C:\Program Files (x86)\Norton Identity Safe\Engine\2013.2.0.18\SymErr.exeTask: {8227A258-8FCC-4E10-91ED-FC1E464AC32E} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-20] (Microsoft Corporation)Task: {86B96C8B-251E-4D18-8EB2-1013C4FE079C} - System32\Tasks\Real Player online update program => C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exeTask: {951AAA58-B53F-4306-AD6E-D7989F511AEA} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-571689730-3727486918-3289345957-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exeTask: {AEF6F519-1059-4794-8F6B-B7A91E0C45AE} - \ProPCCleaner_Start -> No File <==== ATTENTIONTask: {C45EBF43-4BC1-442B-8C45-08BBFBCEC90E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2011-06-14] (Hewlett-Packard)Task: {C6B88C55-ED95-4A20-BFC1-79D0B468611C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Total Care Tune-Up => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPTuneUp.exe [2011-03-22] (Hewlett-Packard Company)Task: {D2C68D5C-2404-4DB1-B82D-061D78F384C0} - \ProPCCleaner_Popup -> No File <==== ATTENTIONTask: {D9B8E7EB-B111-4683-95FE-93FED26B0C8D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-09-21] (Adobe Systems Incorporated)Task: {DA88E904-5A65-44D7-B1DF-C5477AD02FC9} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-571689730-3727486918-3289345957-1004 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exeTask: {DBE827A9-C3AF-44FA-BD1D-C7452BBF5A11} - System32\Tasks\Registration => C:\Program Files (x86)\Hewlett-Packard\HP Setup\Dependencies\RemEngine.exe [2011-09-28] ()Task: {E298B075-B2A4-48ED-984F-5C3ED95D8A73} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-07-23] (Piriform Ltd)Task: {E817AA6D-A21B-421A-9FAB-812F496555C9} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiserTask: {F1BBB7D5-1901-45A8-B898-F72CE48A746F} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)Task: {F5CF6C65-CB32-434D-AA97-3BE580929005} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe [2011-09-09] (Hewlett-Packard Company)Task: {FE930143-EF41-4A94-A2EE-62381843772E} - System32\Tasks\{7F2F05B1-8090-4BB3-BC57-E4CEBE0D26CE} => pcalua.exe -a "C:\Program Files (x86)\WildGames\Uninstall.exe"Task: {FEB04ABD-5B90-46A6-897E-6B94C1187791} - System32\Tasks\Norton Identity Safe\Norton Error Processor => C:\Program Files (x86)\Norton Identity Safe\Engine\2013.2.0.18\SymErr.exe(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\UpdateTask.job => C:\Users\admin\AppData\Local\{F5D7C~1\UNINST~1.EXE==================== Loaded Modules (Whitelisted) ==============2011-08-26 15:53 - 2011-08-26 15:53 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll2014-01-10 01:26 - 2014-01-10 01:26 - 01861968 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe2014-07-31 12:16 - 2014-07-31 12:16 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll2014-07-31 12:16 - 2014-07-31 12:16 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll2014-01-10 01:28 - 2014-01-10 01:28 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll2014-11-10 14:45 - 2013-07-24 10:24 - 00137728 _____ () C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSCreateVC.dll2014-11-10 14:45 - 2014-02-15 12:48 - 00295936 _____ () C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\DAQExp.dll2014-09-07 23:37 - 2012-05-25 04:25 - 00921600 _____ () C:\Program Files (x86)\Yahoo!\Messenger\yui.dll==================== Alternate Data Streams (Whitelisted) =========(If an entry is included in the fixlist, only the ADS will be removed.)==================== Safe Mode (Whitelisted) ===================(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMSwissArmy => ""="Driver"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMSwissArmy => ""="Driver"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sndappv2 => ""="service"==================== EXE Association (Whitelisted) ===============(If an entry is included in the fixlist, the registry item will be restored to default or removed.)==================== Internet Explorer trusted/restricted ===============(If an entry is included in the fixlist, it will be removed from the registry.)==================== Other Areas ============================(Currently there is no automatic fix for this section.)HKU\S-1-5-21-571689730-3727486918-3289345957-1007\Control Panel\Desktop\\Wallpaper -> C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmpDNS Servers: 192.168.2.1HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)Windows Firewall is enabled.==================== MSCONFIG/TASK MANAGER disabled items ==(Currently there is no automatic fix for this section.)MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk => C:\Windows\pss\Bluetooth.lnk.CommonStartupMSCONFIG\startupreg: Browser Infrastructure Helper => C:\Users\cesar\AppData\Local\Smartbar\Application\Linkury.exe startupMSCONFIG\startupreg: CanonMyPrinter => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logonMSCONFIG\startupreg: CanonSolutionMenuEx => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE /logonMSCONFIG\startupreg: HPQuickWebProxy => "C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe"MSCONFIG\startupreg: ROC_ROC_NT => "C:\Program Files (x86)\AVG Secure Search\ROC_ROC_NT.exe" / /PROMPT /CMPID=ROC_NTMSCONFIG\startupreg: Sendori Tray => "C:\Program Files (x86)\Sendori\SendoriTray.exe"MSCONFIG\startupreg: SpeedUpMyPC => "C:\Program Files (x86)\Uniblue\SpeedUpMyPC\launcher.exe" -d 20000MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"MSCONFIG\startupreg: SysTrayApp => C:\Program Files\IDT\WDM\sttray64.exeMSCONFIG\startupreg: VideoDownloadConverter Search Scope Monitor => "C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zsrchmn.exe" /m=2 /w /hMSCONFIG\startupreg: VideoDownloadConverter_4z Browser Plugin Loader => C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbrmon.exe==================== FirewallRules (Whitelisted) ===============(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)FirewallRules: [{F103F968-67E5-42C5-9731-8EA3DE10DC29}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exeFirewallRules: [{76533C77-8237-4ECD-87FB-D6F973377481}] => (Allow) LPort=2869FirewallRules: [{7D8F74B8-0A4F-40B7-B95B-44DA8CE0ACFA}] => (Allow) LPort=1900FirewallRules: [{CF9DFBCE-F2D5-4065-9DA7-E426D950E067}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exeFirewallRules: [{15F62E00-BA6F-48F1-A0DC-65366E853B65}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exeFirewallRules: [{1EC24062-BD90-4552-AC18-EB6E7C903EDF}] => (Allow) LPort=443FirewallRules: [{C3F6CE8C-1D64-40F5-B707-9F74EC5BDD2E}] => (Allow) LPort=443FirewallRules: [{19E23885-EC1E-4EE3-8821-A0BB95CD3E84}] => (Allow) LPort=37674FirewallRules: [{A4D58AB9-570C-4440-B950-C6B13B87F51D}] => (Allow) LPort=37674FirewallRules: [{DCEB1CF4-0A80-4FF8-A6BA-134F54C37379}] => (Allow) LPort=37675FirewallRules: [{61BF8D5F-742F-45DE-AC20-255FF011D613}] => (Allow) C:\Windows\System32\dmwu.exeFirewallRules: [{EF279384-0290-43DF-9B07-E3AA31FE241F}] => (Allow) C:\Windows\System32\dmwu.exeFirewallRules: [{4E83D668-F45D-4FFF-A63F-84FE320ADBAA}] => (Allow) C:\Windows\System32\ARFC\wrtc.exeFirewallRules: [{006F8997-09BD-4E25-8186-9B56D3635A72}] => (Allow) C:\Windows\System32\ARFC\wrtc.exeFirewallRules: [{CD6C1E42-ACB2-46E9-A1AA-8F0EE85376FB}] => (Allow) C:\Windows\System32\dmwu.exeFirewallRules: [{D19EB79D-52E3-4546-B31C-C16873DD29EA}] => (Allow) C:\Windows\System32\dmwu.exeFirewallRules: [{0A22BCC1-2E18-473A-A850-FC02DA06FA75}] => (Allow) C:\Windows\System32\ARFC\wrtc.exeFirewallRules: [{BD636CF3-A20F-43EB-8C07-A0B95D20761C}] => (Allow) C:\Windows\System32\ARFC\wrtc.exeFirewallRules: [{AF356C42-DF93-4E10-AFA7-9EC0A1B886E9}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exeFirewallRules: [{3E8F9F7A-8331-425C-A886-1473EE708FDB}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exeFirewallRules: [{9FABCD99-5092-407B-9C5A-07EBB21C5A1A}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exeFirewallRules: [{AE1B4FD5-86EC-4CA6-B303-0FD55ACCD0B1}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exeFirewallRules: [{8C86BED1-A4F9-4481-982B-F49937B2CA8B}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exeFirewallRules: [{2DAA328D-EDAC-4B34-9770-C3279AE26774}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exeFirewallRules: [{62BB3B50-4B9E-476F-AFE9-084C47FEBEFC}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exeFirewallRules: [{E2E215B9-3A90-446A-91C5-226A0B7C8845}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exeFirewallRules: [{EBD1F94B-08B5-4C87-B676-EC0A6C53846C}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exeFirewallRules: [TCP Query User{7DB5A01B-4C13-44E1-93EA-F6A46E2E361F}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre7\bin\javaw.exeFirewallRules: [uDP Query User{58F12915-8A39-4413-B14C-83E13DB27356}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre7\bin\javaw.exeFirewallRules: [{EFA270B6-115B-41DA-BF3E-63A34C45142C}] => (Allow) C:\Small World 2\Small World 2.exeFirewallRules: [TCP Query User{190B55EC-F5C0-499C-992F-2ECB6983275E}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre7\bin\javaw.exeFirewallRules: [uDP Query User{4E6B42DB-EAC1-414C-815A-13A2566272C5}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre7\bin\javaw.exeFirewallRules: [{09F34221-F7C8-40CE-B22A-9E9E289B5105}] => (Allow) C:\Firefox\firefox.exeFirewallRules: [{8838DB57-8D3F-4715-A22A-7068BF79D1FB}] => (Allow) C:\Firefox\firefox.exeFirewallRules: [TCP Query User{1D513490-C54E-4A0F-B94B-C69423ADFC4F}C:\firefox\firefox.exe] => (Block) C:\firefox\firefox.exeFirewallRules: [uDP Query User{3C63D9AE-DE5B-4D51-B0E5-B3606350D0B2}C:\firefox\firefox.exe] => (Block) C:\firefox\firefox.exeFirewallRules: [{AD308CB1-24DB-4AF8-A19E-F6CEA281BB14}] => (Allow) C:\Users\admin\AppData\Local\Chromium\Application\chrome.exeFirewallRules: [{0FFCBA6A-06BB-43AA-92A8-5A39C56B57EB}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe==================== Faulty Device Manager Devices =============Name: Teredo Tunneling Pseudo-InterfaceDescription: Microsoft Teredo Tunneling AdapterClass Guid: {4d36e972-e325-11ce-bfc1-08002be10318}Manufacturer: MicrosoftService: tunnelProblem: : This device cannot start. (Code10)Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.Name: Broadcom 20702 Bluetooth 4.0 AdapterDescription: Broadcom 20702 Bluetooth 4.0 AdapterClass Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}Manufacturer: BroadcomService: BTHUSBProblem: : This device is disabled. (Code 22)Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.==================== Event log errors: =========================Application errors:==================Error: (10/05/2015 04:12:47 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (10/05/2015 04:12:32 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application name: SMessaging.exe, version: 5.0.2.34, time stamp: 0x4f7c54eaFaulting module name: KERNELBASE.dll, version: 6.1.7601.18939, time stamp: 0x55afd8e7Exception code: 0xe0434f4dFault offset: 0x0000c42dFaulting process id: 0x%9Faulting application start time: 0xSMessaging.exe0Faulting application path: SMessaging.exe1Faulting module path: SMessaging.exe2Report Id: SMessaging.exe3Error: (10/04/2015 11:36:17 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (10/04/2015 11:07:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: Task Scheduling Error: m->NextScheduledSPRetry 1540417Error: (10/04/2015 11:07:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: Task Scheduling Error: m->NextScheduledEvent 1540417Error: (10/04/2015 11:07:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: Task Scheduling Error: Continuously busy for more than a secondError: (10/04/2015 11:07:33 PM) (Source: CVHSVC) (EventID: 100) (User: )Description: Information only.(Patch task for {90140011-0066-0409-0000-0000000FF1CE}): DownloadLatest Failed: There are currently no active network connections. Background Intelligent Transfer Service (BITS) will try again when an adapter is connected.Error: (10/04/2015 11:07:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: Task Scheduling Error: m->NextScheduledSPRetry 1539387Error: (10/04/2015 11:07:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: Task Scheduling Error: m->NextScheduledEvent 1539387Error: (10/04/2015 11:07:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: Task Scheduling Error: Continuously busy for more than a secondSystem errors:=============Error: (10/05/2015 04:15:18 PM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: The Intel® Management and Security Application Local Management Service service failed to start due to the following error:%%1053Error: (10/05/2015 04:15:18 PM) (Source: Service Control Manager) (EventID: 7009) (User: )Description: A timeout was reached (30000 milliseconds) while waiting for the Intel® Management and Security Application Local Management Service service to connect.Error: (10/05/2015 04:13:09 PM) (Source: Microsoft Antimalware) (EventID: 1119) (User: )Description: %Trojan:Win32/Patched.AO60 has encountered a critical error when taking action on malware or other potentially unwanted software.For more information please see the following:%Trojan:Win32/Patched.AO603 Name: Trojan:Win32/Patched.AO ID: 2147706672 Severity: %Trojan:Win32/Patched.AO600 Category: %Trojan:Win32/Patched.AO602 Path: 4.8.0204.02 Detection Origin: 4.8.0204.04 Detection Type: 4.8.0204.08 Detection Source: %Trojan:Win32/Patched.AO608 User: {65A2E5A3-A287-4B96-B632-D3C5F8A2B0E4}9 Process Name: %Trojan:Win32/Patched.AO609 Action: {65A2E5A3-A287-4B96-B632-D3C5F8A2B0E4}1 Action Status: {65A2E5A3-A287-4B96-B632-D3C5F8A2B0E4}8 Error Code: {65A2E5A3-A287-4B96-B632-D3C5F8A2B0E4}3 Error description: {65A2E5A3-A287-4B96-B632-D3C5F8A2B0E4}4 Signature Version: 2015-10-05T20:12:00.054Z1 Engine Version: 2015-10-05T20:12:00.054Z2Error: (10/05/2015 04:12:42 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT AUTHORITY)Description: There was an error while attempting to read the local hosts file.Error: (10/05/2015 04:12:00 PM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: The MBAMService service failed to start due to the following error:%%1053Error: (10/05/2015 04:12:00 PM) (Source: Service Control Manager) (EventID: 7009) (User: )Description: A timeout was reached (30000 milliseconds) while waiting for the MBAMService service to connect.Error: (10/05/2015 04:11:27 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT AUTHORITY)Description: There was an error while attempting to read the local hosts file.Error: (10/05/2015 04:11:26 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT AUTHORITY)Description: There was an error while attempting to read the local hosts file.Error: (10/05/2015 04:11:25 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT AUTHORITY)Description: There was an error while attempting to read the local hosts file.Error: (10/05/2015 04:11:25 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT AUTHORITY)Description: There was an error while attempting to read the local hosts file.==================== Memory info ===========================Processor: Intel® Core i3-2350M CPU @ 2.30GHzPercentage of memory in use: 31%Total physical RAM: 4813.86 MBAvailable physical RAM: 3316.14 MBTotal Virtual: 9625.92 MBAvailable Virtual: 8026.97 MB==================== Drives ================================Drive c: () (Fixed) (Total:674.46 GB) (Free:360.48 GB) NTFS ==>[system with boot components (obtained from reading drive)]Drive d: (Recovery) (Fixed) (Total:20.02 GB) (Free:19.93 GB) NTFSDrive e: (HP_TOOLS) (Fixed) (Total:3.96 GB) (Free:3.96 GB) FAT32Drive f: (VTech) (CDROM) (Total:0.02 GB) (Free:0 GB) CDFSDrive h: (USB20FD) (Removable) (Total:7.59 GB) (Free:7.55 GB) FAT32==================== MBR & Partition Table ==========================================================================Disk: 0 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: D11C5464)Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)Partition 2: (Not Active) - (Size=674.5 GB) - (Type=07 NTFS)Partition 3: (Not Active) - (Size=20 GB) - (Type=07 NTFS)Partition 4: (Not Active) - (Size=4 GB) - (Type=0C)========================================================Disk: 1 (MBR Code: Windows XP) (Size: 7.6 GB) (Disk ID: C3072E18)Partition 1: (Not Active) - (Size=7.6 GB) - (Type=0C)==================== End of Addition.txt ============================ Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted October 5, 2015 ID:993821 Share Posted October 5, 2015 Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools. Link to post Share on other sites More sharing options...
vampedvixen Posted October 5, 2015 Author ID:993827 Share Posted October 5, 2015 Sorry, I didn't know how to do that. I'll use the more reply option from now on!FRST.txtAddition.txt Link to post Share on other sites More sharing options...
vampedvixen Posted October 9, 2015 Author ID:994548 Share Posted October 9, 2015 Is that better? Did I do it right? Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted October 9, 2015 ID:994555 Share Posted October 9, 2015 Fix with Farbar Recovery Scan Tool This fix was created for this user for use on that particular machine. Running it on another one may cause damage and render the system unstable. Download attached fixlist.txt file and save it to the Desktop:Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!Right-click on icon and select Run as Administrator to start the tool.(XP users click run after receipt of Windows Security Warning - Open File).Press the Fix button just once and wait.If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.When finished FRST will generate a log on the Desktop, called Fixlog.txt.Please upload it to your reply. Fix with AdwCleanerPlease download AdwCleaner by Xplode and save the file to your Desktop.Right-click on icon and select Run as Administrator to start the tool.Accept the Terms of use.Wait until the database is updated.Click Scan.When finished, please click Cleaning.Your PC should reboot now.After reboot, logfile will be opened. Copy its content into your next reply.Note: Reports will be saved in your system partition, usually at C:\Adwcleaner Fix with Junkware Removal ToolPlease download JRT by Thisisu and save the file to your desktop.Temporary disable your AntiVirus and AntiSpyware protection - instructions here.Right-click on icon and select Run as Administrator to start the tool.Follow the prompts and let this process run uninterrupted.This scan can take a while, depending on your System specs.Upon completion, a log (JRT.txt) will open on your desktop.Please include the contents of that file in your reply.Do not forget to re-enable your previously switched off protection software!Please also manually reboot your machine after this procedure.fixlist.txt Link to post Share on other sites More sharing options...
vampedvixen Posted October 9, 2015 Author ID:994582 Share Posted October 9, 2015 Okay, all done. I forgot to save the log file when ADwCleaner rebooted my computer, so I included all the files from that folder that were saved after the reboot. I'm not sure which one you wanted to look at, sorry.JRT.txtAdwCleanerC1.txtQuarantine.logAdwCleanerS1.txtFixlog.txt Link to post Share on other sites More sharing options...
vampedvixen Posted October 9, 2015 Author ID:994585 Share Posted October 9, 2015 Also, I don't know if it matters but my internet went from 'everything is fine but you can't connect' to actually giving me a reading of 'No Internet Access'. Not sure if that's a step in the right direction or not, but at least it's not lying to me anymore. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted October 9, 2015 ID:994586 Share Posted October 9, 2015 Excellent. How is your PC behaving now? Link to post Share on other sites More sharing options...
vampedvixen Posted October 9, 2015 Author ID:994593 Share Posted October 9, 2015 Well, I can run Malware Bytes again, so whatever was blocking that program from running seems to have gone. Unfortunately, my internet connection is still showing as "Identifying... No Internet access" even thought my chromebook is running off the same wireless fine. I'm starting to think it's either not a Malware issue, or the Malware switched something and even if it's gone the configurations are still messed up. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted October 10, 2015 ID:994622 Share Posted October 10, 2015 Is your connection wireless? Can you right click and then Troubleshoot problems at your connection icon? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 23, 2015 Root Admin ID:997398 Share Posted October 23, 2015 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts