Trojan in MBAM's own folder disappears from Quarantine: I *hope* it's just a false positive

[PrincessVoid]

Hello, long time MBAM Free user who has mostly been happy with it until now. I'm running Windows 7 Home Premium. Yesterday I found my first Trojan while running a scan in my own LUA: a Trojan.Agent.ENM in the file 00011334.tmp. This is especially alarming since it was found in the actual Malwarebytes Anti-Malware folder in Program Files-- and even though the Scan History says it was quarantined, it is nowhere in my Quarantine list. I do not remember whether it was ever there.

 

After a few hours searching the forums for this issue, I updated the program and databases to prepare for creating this post. (I successfully used the Administrator account after having had database/program update problems in my LUA for a few months-- I didn't know till now that running MBAM as an Administrator makes a difference.) This time the scan as Administrator only turned up the two PUPs that also came up in the previous scan that turned up the now-missing Trojan.

 

Since the file isn't showing up in the Quarantine list to be restored and examined, I couldn't post about this issue in the False Positive board-- and by now I am too uneasy about the fact that a possible Trojan on my computer has mysteriously vanished. Logs are attached below:

 

MBAM logs

mbamscanlog-11-18-2015-1.txt Using version 2.1.8.1057. Trojan and 2 PUPs found.

mbamscanlog-11-18-2015-2.txt Using version 2.2.0.1024. Which only found the PUPs.

 

Farbar Recovery Scan Tool

Addition.txt

FRST.txt

 

If you need additional information or there are formatting issues, please tell me. I'm just as concerned about what this could mean for your program as I am about my own computer. Thank you in advance for your time.

FRST.txt

Addition.txt

mbamscanlog-11-18-2015-1.txt

mbamscanlog-11-18-2015-2.txt

[AdvancedSetup]

Hello and

Sorry for the delay.

Please read the following and post back the logs when ready and we'll see about getting you cleaned up.

General P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Before we proceed further, please read all of the following instructions carefully.

If there is anything that you do not understand kindly ask before proceeding.

If needed please print out these instructions.

• Please do not post logs using CODE, QUOTE, or FONT tags. Just paste them as direct text.
• If the log is too large then you can use attachments by clicking on the More Reply Options button.
• Please enable your system to show hidden files: How to see hidden files in Windows
• Make sure you're subscribed to this topic:
  • Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly
• Removing malware can be unpredictable...It is unlikely but things can go very wrong! Please make sure you Backup all files that cannot be replaced if something were to happen. You can copy them to a CD/DVD, external drive or a pen drive
• Please don't run any other scans, download, install or uninstall any programs unless requested by me while I'm working with you.
• The removal of malware is not instantaneous, please be patient. Often we are also on a different Time Zone.
• Perform everything in the correct order. Sometimes one step requires the previous one.
• If you have any problems while following my instructions, Stop there and tell me the exact nature of the issue.
• You can check here if you're not sure if your computer is 32-bit or 64-bit
• Please disable your antivirus while running any requested scanners so that they do not interfere with the scanners.
• When we are done, I'll give you instructions on how to cleanup all the tools and logs
• Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.
• Your topic will be closed if you haven't replied within 3 days
• (If I have not responded within 24 hours, please send me a Private Message as a reminder)

STEP 0

RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes

so that your normal security software can then run and clean your computer of infections.

When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies

that stop us from using certain tools. When finished it will display a log file that shows the processes that were

terminated while the program was running.

As RKill only terminates a program's running process, and does not delete any files, after running it you should not reboot

your computer as any malware processes that are configured to start automatically will just be started again.

Instead, after running RKill you should immediately scan your computer using the requested scans I've included.

Please download Rkill by Grinler from one of the links below and save it to your desktop.

Link 1

Link 2

• On Windows XP double-click on the Rkill desktop icon to run the tool.
• On Windows Vista/Windows 7 or 8, right-click on the Rkill desktop icon and select Run As Administrator
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
• If not, delete the file, then download and use the one provided in Link 2.
• If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
• If the tool does not run from any of the links provided, please let me know.
• Do not reboot the computer, you will need to run the application again.

STEP 01

Backup the Registry:

Modifying the Registry can create unforeseen problems, so it always wise to create a backup before doing so.

• Please download ERUNT from one of the following links: Link1 | Link2 | Link3
• ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.
• Double click on erunt-setup.exe to Install ERUNT by following the prompts.
• NOTE: Do not choose to allow ERUNT to add an Entry to the Startup folder. Click NO.
• Start ERUNT either by double clicking on the desktop icon or choosing to start the program at the end of the setup process.
• Choose a location for the backup.
  • Note: the default location is C:\Windows\ERDNT which is acceptable.
• Make sure that at least the first two check boxes are selected.
• Click on OK
• Then click on YES to create the folder.
• Note: if it is necessary to restore the registry, open the backup folder and start ERDNT.exe

STEP 02

Please run a Threat Scan with MBAM. If you're unable to run or complete the scan as shown below please see the following: MBAM Clean Removal Process 2x

When reinstalling the program please try the latest version.

Right click and choose "Run as administrator" to open Malwarebytes Anti-Malware and from the Dashboard please Check for Updates by clicking the Update Now... link

Open up Malwarebytes > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.

Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.

Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.

[PrincessVoid]

Confused about Step 00's RKill: The DOS box ran but did not disappear, so I am unsure whether it is safe to continue. (I have sent the computer to sleep so that all windows may be retained.) Here is what the DOS box says:

 

Rkill 2.8.2 by Lawrence Abrams (Grinler)

http://www.bleepingcomputer.com/

Copyright 2008-2015 BleepingComputer.com

More Information about Rkill can be found at this link:

 http://www.bleepingcomputer.com/forums/topic308364.html

 

Program started at: 11/30/2015 08:29:36 AM in x64 mode.

Windows Version: Windows 7 Home Premium Service Pack 1

 

Checking for Windows services to stop:

 

 * No malware services found to stop.

 

Checking for processes to terminate:

 

 * No malware processes found to kill.

 

Checking Registry for malware related settings:

 

 * No issues found in the Registry.

 

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

 

Performing miscellaneous checks:

 

 * Windows Defender Disabled

 

   [HKLM\SOFTWARE\Microsoft\Windows Defender]

   "DisableAntiSpyware" = dword:00000001

 

[PrincessVoid]

UPDATE: A dialog box just popped up titled "RKIll finished" saying that "You should now be able to run your normal security programs so that you can scan for computer infections." and that it has saved a log file to the desktop. The log file contains the same information I have just posted above. I clicked OK, but still put the computer to sleep until I am sure that it is a real RKill dialog box and therefore safe to proceed.

 

Also, I will not have time to back up the registry and run the MBAM scan as required until about 12 hours from the time of this posting. I can still see and respond to this topic before then, though I would not be at my computer as I do so. Sorry for the additional delay on my end, thank you for your help so far, and have a good day in the meantime.

[AdvancedSetup]

No problem. Please post when ready

[PrincessVoid]

Tried to move forward in above steps (re-disabled antivirus and firewall and re-ran Rkill since it has been well over 5 hours), but now a new problem: This version of ERUNT's install program doesn't have a setting about whether to add a shortcut to the Startup folder, unless I am mistaking that with "Start Menu." If I leave the folder name field blank and then click "Next"-- i,e, if I'm trying to tell it "no, I don't want to make a shortcut in the Startup folder or anywhere else in the Start Menu"-- then it won't let me proceed with the install. It gives me this error: "You must enter a folder name."

 

Could I just place the shortcut in any other Start Menu folder besides Startup and be sure it won't have any unintended effect on my computer until we cleanup all these programs? Please advise. Meanwhile, I am sending the computer back to sleep.

[AdvancedSetup]

Let's have you just move forward without RKill and don't worry about ERUNT for now. After some more logs we'll see what's going on with it.

 

Please go ahead and run through the following steps and post back the logs when ready.
 
STEP 04
Please download Junkware Removal Tool to your desktop.

• Shutdown your antivirus to avoid any conflicts.
• Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next reply message
• When completed make sure to re-enable your antivirus
  

STEP 05
Lets clean out any adware now: (this will require a reboot so save all your work)

Please download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool.
  Vista/Windows 7/8 users right-click and select Run As Administrator
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• When it's done you'll see: Pending: Please uncheck elements you don't want removed.
• Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
• Look over the log especially under Files/Folders for any program you want to save.
• If there's a program you may want to save, just uncheck it from AdwCleaner.
• If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
• If you're ready to clean it all up.....click the Clean button.
• After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
• Copy and paste the contents of that logfile in your next reply.
• A copy of that logfile will also be saved in the C:\AdwCleaner folder.
• Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
• To restore an item that has been deleted:
• Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.
  

STEP 06
Please open Malwarebytes Anti-Malware and from the Dashboard please Check for Updates by clicking the Update Now... link
Open up Malwarebytes > Settings > Detection and Protection > Enable Scan for rootkits, Under Non Malware Protection set both PUP and PUM to Treat detections as malware.
Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button. Remove any threats found
Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.


STEP 07


Please go here to run the online antivirus scannner from ESET.

• Turn off the real time scanner of any existing antivirus program while performing the online scan
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Click Start
• Make sure that the option Remove found threats is unticked
• Click on Advanced Settings and ensure these options are ticked:
  
  • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
    

  
  [*]Click Scan [*]Wait for the scan to finish [*]If any threats were found, click the 'List of found threats' , then click Export to text file.... [*]Save it to your desktop, then please copy and paste that log as a reply to this topic.
  

STEP 08
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.
  

[PrincessVoid]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Malwarebytes

Version: 8.0.1 (11.24.2015)

Operating System: Windows 7 Home Premium x64 

Ran by Maintenance (Administrator) on Tue 12/01/2015 at 22:38:23.88

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

File System: 6 

 

Successfully deleted: C:\Users\Maintenance\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.ask.com_0.localstorage-journal (File) 

Successfully deleted: C:\Users\Maintenance\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.ask.com_0.localstorage (File) 

Successfully deleted: C:\Users\Maintenance\AppData\Roaming\Mozilla\Firefox\Profiles\7g779zrt.default\extensions\staged (Folder) 

Successfully deleted: C:\Users\Maintenance\AppData\Roaming\Mozilla\Firefox\Profiles\7g779zrt.default\searchplugins\safesearch.xml (File) 

Successfully deleted: C:\Users\Maintenance\AppData\Roaming\pccustubinstaller (Folder) 

Successfully deleted: C:\windows\SysWOW64\sho1B0E.tmp (File) 

 

 

 

Registry: 2 

 

Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{335316A2-709A-4F4B-97C8-4FB619D37BAE} (Registry Key)

Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} (Registry Key)

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Tue 12/01/2015 at 22:43:58.95

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[PrincessVoid]

Re: Step 05, AdwCleaner: I would have been perfectly fine with deleting everything, but the ask.com files found in this scan are connected to my antivirus's web browser toolbar. So even if I deleted them, updating or reinstalling the toolbar might only put them back on my computer anyway. I would feel better keeping it since I do occasionally use its SafeSearch feature, but would I actually be better off removing it since it's shown up as adware/spyware/etc.?

 

# AdwCleaner v5.023 - Logfile created 01/12/2015 at 22:51:29

# Updated 30/11/2015 by Xplode

# Database : 2015-11-30.1 [server]

# Operating system : Windows 7 Home Premium Service Pack 1 (x64)

# Username : Maintenance - SOPHIE-THE-PC

# Running from : C:\Users\Maintenance\Desktop\AdwCleaner.exe

# Option : Scan

# Support : http://toolslib.net/forum

 

***** [ Services ] *****

 

 

***** [ Folders ] *****

 

 

***** [ Files ] *****

 

File Found : C:\Users\Charlyne Joy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_nortonsafe.search.ask.com_0.localstorage

File Found : C:\Users\Charlyne Joy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_nortonsafe.search.ask.com_0.localstorage-journal

File Found : C:\Users\Charlyne Joy\AppData\Roaming\Mozilla\Firefox\Profiles\g06b4fm6.default\searchplugins\safesearch.xml

File Found : C:\Users\Charlyne Joy\AppData\Roaming\Mozilla\Firefox\Profiles\g06b4fm6.default\user.js

 

***** [ DLL ] *****

 

 

***** [ Shortcuts ] *****

 

 

***** [ Scheduled tasks ] *****

 

 

***** [ Registry ] *****

 

 

***** [ Web browsers ] *****

 

[C:\Users\Charlyne Joy\AppData\Roaming\Mozilla\Firefox\Profiles\g06b4fm6.default\prefs.js] [Preference] Found : user_pref("extensions.enabledItems", "{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}:6.0.04,{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07,{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}:6.0.12,{CAFEEFAC-0016-0000-0013[...]

[C:\Users\Charlyne Joy\AppData\Roaming\Mozilla\Firefox\Profiles\g06b4fm6.default\prefs.js] [Preference] Found : user_pref("extensions.web@veoh.com.install-event-fired", true);

[C:\Users\Charlyne Joy\AppData\Local\Google\Chrome\User Data\Default\Web data] [search Provider] Found : aol.com

[C:\Users\Charlyne Joy\AppData\Local\Google\Chrome\User Data\Default\Web data] [search Provider] Found : ask.com

 

########## EOF - C:\AdwCleaner\AdwCleaner[s1].txt - [1840 bytes] ##########

[AdvancedSetup]

Yes, an unfortunate choice they made adding that to their antivirus. I do not have enough personal experience to say how it would or would not effect your antivirus. I'll post some information about the Ask toolbar and let you decide. Myself I just don't like, want, need any add-on toolbar.

 

 

Please read the following which explains why the ASK toolbar is not good. Granted much of this is very old information and they may no longer use such methods, but again it certainly leaves one to wonder why they really need one. Basically ask.com pays them to add it to their software

IAC / Ask.com toolbars
 

 

Thanks

 

[PrincessVoid]

No, they unfortunately don't seem to have changed their tactics, if this relatively long-lived thread on Norton's Product Suggestions subforum is any indication: http://community.norton.com/en/forums/get-rid-ask . Further research shows at least 10 pages of search results with similar complaints on Norton's own Community forums during this year alone. I will likely attempt to remove the toolbar for good, but of course not until after we have finished here.

 

First, I'll let AdwCleaner complete its cleaning and then proceed through the rest of the steps within 12-24 hours. One last question about this tool: If I wanted to get rid of a Quarantined file for good, how would I go about that?

[PrincessVoid]

# AdwCleaner v5.023 - Logfile created 02/12/2015 at 01:29:17

# Updated 30/11/2015 by Xplode

# Database : 2015-11-30.1 [server]

# Operating system : Windows 7 Home Premium Service Pack 1 (x64)

# Username : Maintenance - SOPHIE-THE-PC

# Running from : C:\Users\Maintenance\Desktop\AdwCleaner.exe

# Option : Cleaning

# Support : http://toolslib.net/forum

 

***** [ Services ] *****

 

 

***** [ Folders ] *****

 

 

***** [ Files ] *****

 

[-] File Deleted : C:\Users\Charlyne Joy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_nortonsafe.search.ask.com_0.localstorage

[-] File Deleted : C:\Users\Charlyne Joy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_nortonsafe.search.ask.com_0.localstorage-journal

[-] File Deleted : C:\Users\Charlyne Joy\AppData\Roaming\Mozilla\Firefox\Profiles\g06b4fm6.default\searchplugins\safesearch.xml

[-] File Deleted : C:\Users\Charlyne Joy\AppData\Roaming\Mozilla\Firefox\Profiles\g06b4fm6.default\user.js

 

***** [ DLLs ] *****

 

 

***** [ Shortcuts ] *****

 

 

***** [ Scheduled tasks ] *****

 

 

***** [ Registry ] *****

 

 

***** [ Web browsers ] *****

 

[-] [C:\Users\Charlyne Joy\AppData\Roaming\Mozilla\Firefox\Profiles\g06b4fm6.default\prefs.js] [Preference] Deleted : user_pref("extensions.enabledItems", "{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}:6.0.04,{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07,{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}:6.0.12,{CAFEEFAC-0016-0000-0013[...]

[-] [C:\Users\Charlyne Joy\AppData\Roaming\Mozilla\Firefox\Profiles\g06b4fm6.default\prefs.js] [Preference] Deleted : user_pref("extensions.web@veoh.com.install-event-fired", true);

[-] [C:\Users\Charlyne Joy\AppData\Local\Google\Chrome\User Data\Default\Web Data] [search Provider] Deleted : aol.com

[-] [C:\Users\Charlyne Joy\AppData\Local\Google\Chrome\User Data\Default\Web Data] [search Provider] Deleted : ask.com

 

*************************

 

:: "Tracing" keys removed

:: Winsock settings cleared

 

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [1980 bytes] ##########

[PrincessVoid]

Malwarebytes Anti-Malware

www.malwarebytes.org

 

Scan Date: 12/2/2015

Scan Time: 8:54 AM

Logfile: 

Administrator: Yes

 

Version: 2.2.0.1024

Malware Database: v2015.12.02.04

Rootkit Database: v2015.11.26.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

 

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: Maintenance

 

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 439972

Time Elapsed: 53 min, 34 sec

 

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

 

Processes: 0

(No malicious items detected)

 

Modules: 0

(No malicious items detected)

 

Registry Keys: 0

(No malicious items detected)

 

Registry Values: 0

(No malicious items detected)

 

Registry Data: 0

(No malicious items detected)

 

Folders: 0

(No malicious items detected)

 

Files: 0

(No malicious items detected)

 

Physical Sectors: 0

(No malicious items detected)

 

 

(end)

[PrincessVoid]

Re: Step 07, ESET Online Scanner: From Chrome, my default browser, clicking on the site's Run button gives me this: "To run ESET Online Scanner in a browser other than Internet Explorer, you'll need to download ESET Smart Installer." (link to Smart Installer disabled because I pasted the previous as plain text.) Should I switch to IE and use that for the scan, download the Smart Installer, or neither?

[AdvancedSetup]

Downloading and running the installer will typically run the scan faster than via the online method. Either way should be fine though.

 

When you say to clean or remove quarantine do you mean for MBAM or one of the other programs?

[PrincessVoid]

Okay, thanks. Just wanted to ensure their installer was safe to use (since these days so many other installers don't seem to be). Next reply should be ESET and then possibly Farbar as well (which I already got as part of the prerequisites for posting here).

 

I was specifically asking about AdwCleaner's Quarantine function. I found the Quarantined files in the folder you said they would be in, but what would be the best way of getting rid of them? I understand that quarantining a file is typically meant to render it harmless, but still.

[AdvancedSetup]

We'll leave it for now but yes it has a removal feature that will delete everything. For now though it's okay to leave as is.

[PrincessVoid]

Step 07, ESET Online Scanner: No threats found.

 

Should I tick the box that says "Uninstall application on close?"

[AdvancedSetup]

Yes you can remove it.

 

Please then restart and run the other logs

[PrincessVoid]

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:01-12-2015

Ran by Maintenance (administrator) on SOPHIE-THE-PC (03-12-2015 23:44:27)

Running from C:\Users\Maintenance\Desktop

Loaded Profiles: Maintenance (Available Profiles: Charlyne Joy & Maintenance & Guest)

Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Security Suite\Engine\22.5.5.15\n360.exe

(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.5.60\ccSvcHst.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE

(Symantec Corporation) C:\Program Files (x86)\Norton Security Suite\Engine\22.5.5.15\n360.exe

(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.5.60\ccSvcHst.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe

(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe

(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

 

 

==================== Registry (Whitelisted) ===========================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [] => [X]

HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [521272 2010-03-22] (Conexant Systems, Inc.)

HKLM\...\Run: [smartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2009-11-19] ()

HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2052392 2010-03-10] (Synaptics Incorporated)

HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [566184 2010-09-28] (TOSHIBA Corporation)

HKLM\...\Run: [smoothView] => C:\Program Files\Toshiba\SmoothView\SmoothView.exe [508216 2009-07-28] (TOSHIBA Corporation)

HKLM\...\Run: [00TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [915320 2010-05-10] (TOSHIBA Corporation)

HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)

HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2010-02-05] (TOSHIBA Corporation)

HKLM\...\Run: [TosNC] => C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [595816 2010-03-19] (TOSHIBA Corporation)

HKLM\...\Run: [TosReelTimeMonitor] => C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [35672 2010-03-03] (TOSHIBA Corporation)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-10-16] (Apple Inc.)

HKLM-x32\...\Run: [ToshibaServiceStation] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1295736 2011-02-11] (TOSHIBA Corporation)

HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe [3218792 2010-08-17] (Toshiba)

HKLM-x32\...\Run: [ToshibaAppPlace] => C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe [552960 2010-09-23] (Toshiba)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60688 2015-10-13] (Apple Inc.)

HKLM-x32\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe [2620728 2015-07-22] (Malwarebytes Corporation)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-08-06] (Apple Inc.)

HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [597040 2015-10-06] (Oracle Corporation)

Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)

Winlogon\Notify\igfxcui: 

HKU\S-1-5-21-3208776619-4077163121-3333539032-1003\...\MountPoints2: {3a2cc7be-28d8-11e5-aef0-00266cb19146} - E:\LG_PC_Programs.exe

HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE -> 

ShellIconOverlayIdentifiers: [  OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Security Suite\Engine64\22.5.5.15\buShell.dll [2015-11-05] (Symantec Corporation)

ShellIconOverlayIdentifiers: [  OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Security Suite\Engine64\22.5.5.15\buShell.dll [2015-11-05] (Symantec Corporation)

ShellIconOverlayIdentifiers: [  OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Security Suite\Engine64\22.5.5.15\buShell.dll [2015-11-05] (Symantec Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Malwarebytes Anti-Exploit.lnk [2015-06-01]

ShortcutTarget: Malwarebytes Anti-Exploit.lnk -> C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe (Malwarebytes Corporation)

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76

Tcpip\..\Interfaces\{036A4A82-A363-41B4-B689-C23ECE8701CB}: [DhcpNameServer] 75.75.75.75 75.75.76.76

Tcpip\..\Interfaces\{2F1DEC18-7668-4085-A9F9-06E1CA2939A6}: [DhcpNameServer] 75.75.75.75 75.75.76.76

 

Internet Explorer:

==================

HKU\S-1-5-21-3208776619-4077163121-3333539032-1003\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKU\S-1-5-21-3208776619-4077163121-3333539032-1003\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://start.toshiba.com/g/

SearchScopes: HKLM -> DefaultScope {35BE7F72-74E2-47D4-9214-A1B8952A5B01} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage};

SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM -> {335316A2-709A-4F4B-97C8-4FB619D37BAE} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNF

SearchScopes: HKLM -> {35BE7F72-74E2-47D4-9214-A1B8952A5B01} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage};

SearchScopes: HKLM -> {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = hxxp://www.ask.com/web?&o=101881&l=dis&q={SEARCHTERMS}

SearchScopes: HKLM-x32 -> DefaultScope {C2E30FE1-1859-4D39-8762-0F0684279A5C} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNF

SearchScopes: HKLM-x32 -> {C2E30FE1-1859-4D39-8762-0F0684279A5C} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNF

SearchScopes: HKU\S-1-5-21-3208776619-4077163121-3333539032-1003 -> DefaultScope {CEAFEBAE-7043-424E-BFBF-168262636EC4} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNF_en

SearchScopes: HKU\S-1-5-21-3208776619-4077163121-3333539032-1003 -> {CEAFEBAE-7043-424E-BFBF-168262636EC4} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNF_en

BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Security Suite\Engine64\22.5.5.15\coIEPlg.dll [2015-11-05] (Symantec Corporation)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-23] (Google Inc.)

BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll => No File

BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Security Suite\Engine\22.5.5.15\coIEPlg.dll [2015-11-05] (Symantec Corporation)

BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Security Suite\Engine\21.7.0.11\IPS\IPSBHO.DLL => No File

BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\ssv.dll [2015-10-22] (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)

BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-23] (Google Inc.)

BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\jp2ssv.dll [2015-10-22] (Oracle Corporation)

BHO-x32: TOSHIBA Media Controller Plug-in -> {F3C88694-EFFA-4d78-B409-54B7B2535B14} -> C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll [2010-03-02] (<TOSHIBA>)

Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine64\22.5.5.15\coIEPlg.dll [2015-11-05] (Symantec Corporation)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-23] (Google Inc.)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\22.5.5.15\coIEPlg.dll [2015-11-05] (Symantec Corporation)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-23] (Google Inc.)

 

FireFox:

========

FF ProfilePath: C:\Users\Maintenance\AppData\Roaming\Mozilla\Firefox\Profiles\7g779zrt.default

FF Homepage: about:home

FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_19_0_0_245.dll [2015-11-10] ()

FF Plugin: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_245.dll [2015-11-10] ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-08] ()

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-08-26] (Google, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=11.65.2 -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\dtplugin\npDeployJava1.dll [2015-10-22] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.65.2 -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\plugin2\npjp2.dll [2015-10-22] (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-15] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-15] (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2015-08-27] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2015-08-27] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2015-08-27] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2015-08-27] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2015-08-27] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll [2011-07-11] (Nullsoft, Inc.)

FF Extension: NoScript - C:\Users\Maintenance\AppData\Roaming\Mozilla\Firefox\Profiles\7g779zrt.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-09-13] [not signed]

FF HKLM\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_22.5.2.15\coFFAddon

FF Extension: Norton Identity Safe - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_22.5.2.15\coFFAddon [2015-11-18] [not signed]

FF HKLM-x32\...\Firefox\Extensions: [{40211632-250D-4B8C-B04E-DA45BAE6DF8C}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn => not found

FF HKLM-x32\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_22.5.2.15\coFFAddon

 

Chrome: 

=======

CHR HomePage: Default -> hxxp://start.toshiba.com/g/

CHR StartupUrls: Default -> "hxxp://start.toshiba.com/g/"

CHR Session Restore: Default -> is enabled.

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.86\ppGoogleNaClPluginChrome.dll => No File

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.86\pdf.dll => No File

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.86\gcswf32.dll => No File

CHR Plugin: (Shockwave Flash) - C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll => No File

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll => No File

CHR Plugin: (Java Deployment Toolkit 7.0.0.147) - C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll => No File

CHR Plugin: (Java Platform SE 7) - C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll => No File

CHR Plugin: (downloadUpdater) - C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll => No File

CHR Plugin: (downloadUpdater2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll => No File

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll => No File

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll => No File

CHR Plugin: (Winamp Application Detector) - C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.)

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll => No File

CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll => No File

CHR Profile: C:\Users\Maintenance\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (YouTube) - C:\Users\Maintenance\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-30]

CHR Extension: (Norton Security Toolbar) - C:\Users\Maintenance\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjabmdjcfcfdmffimndhafhblfmpjdpe [2015-11-30]

CHR Extension: (Google Search) - C:\Users\Maintenance\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-30]

CHR Extension: (Norton Identity Safe) - C:\Users\Maintenance\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2014-09-13]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Maintenance\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-09-19]

CHR Extension: (Gmail) - C:\Users\Maintenance\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-01]

CHR HKLM\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security Suite\Engine\22.5.5.15\Exts\Chrome.crx [2015-11-30]

CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security Suite\Engine\22.5.5.15\Exts\Chrome.crx [2015-11-30]

CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx

 

==================== Services (Whitelisted) ========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-10-07] (Apple Inc.)

R2 MbaeSvc; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [713016 2015-07-22] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)

R2 N360; C:\Program Files (x86)\Norton Security Suite\Engine\22.5.5.15\N360.exe [282016 2015-11-20] (Symantec Corporation)

R2 PCCUJobMgr; C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.5.60\ccSvcHst.exe [126392 2009-08-24] (Symantec Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)

 

===================== Drivers (Whitelisted) ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

S3 AndnetBus; C:\Windows\System32\DRIVERS\lgandnetbus64.sys [20992 2015-01-21] (LG Electronics Inc.)

S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [30720 2015-01-26] (LG Electronics Inc.)

S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [37376 2015-01-26] (LG Electronics Inc.)

R1 BHDrvx64; C:\Program Files (x86)\Norton Security Suite\NortonData\22.5.2.15\Definitions\BASHDefs\20151113.001\BHDrvx64.sys [1665608 2015-10-08] (Symantec Corporation)

R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1605050.00F\ccSetx64.sys [173808 2015-07-10] (Symantec Corporation)

S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [498512 2015-11-18] (Symantec Corporation)

R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [157520 2015-11-18] (Symantec Corporation)

R1 ESProtectionDriver; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [63064 2015-07-22] ()

R1 IDSVia64; C:\Program Files (x86)\Norton Security Suite\NortonData\22.5.2.15\Definitions\IPSDefs\20151202.001\IDSvia64.sys [767224 2015-10-19] (Symantec Corporation)

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)

S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation)

R3 NAVENG; C:\Program Files (x86)\Norton Security Suite\NortonData\22.5.2.15\Definitions\VirusDefs\20151202.025\ENG64.SYS [138488 2015-10-27] (Symantec Corporation)

R3 NAVEX15; C:\Program Files (x86)\Norton Security Suite\NortonData\22.5.2.15\Definitions\VirusDefs\20151202.025\EX64.SYS [2148080 2015-10-27] (Symantec Corporation)

R3 SRTSP; C:\Windows\System32\Drivers\N360x64\1605050.00F\SRTSP64.SYS [928496 2015-11-11] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1605050.00F\SRTSPX64.SYS [50936 2015-07-10] (Symantec Corporation)

S3 ssmirrdr; C:\Windows\System32\DRIVERS\ssmirrdr.sys [10112 2011-03-14] (support.com, Inc)

R0 SymEFASI; C:\Windows\System32\drivers\N360x64\1605050.00F\SYMEFASI64.SYS [1621232 2015-11-11] (Symantec Corporation)

R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [111344 2015-08-24] (Symantec Corporation)

R1 SymIRON; C:\Windows\system32\drivers\N360x64\1605050.00F\Ironx64.SYS [297720 2015-07-10] (Symantec Corporation)

R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1605050.00F\SYMNETS.SYS [577768 2015-11-11] (Symantec Corporation)

S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [19968 2013-02-11] (Microsoft Corporation)

S3 Andbus; system32\DRIVERS\lgandbus64.sys [X]

S3 AndDiag; system32\DRIVERS\lganddiag64.sys [X]

S3 AndGps; system32\DRIVERS\lgandgps64.sys [X]

S3 ANDModem; system32\DRIVERS\lgandmodem64.sys [X]

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One Month Created files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-12-03 23:44 - 2015-12-03 23:44 - 00000000 ____D C:\Users\Maintenance\Desktop\FRST-OlderVersion

2015-12-03 00:25 - 2015-12-03 00:25 - 02870984 _____ (ESET) C:\Users\Maintenance\Downloads\esetsmartinstaller_enu.exe

2015-12-02 08:51 - 2015-12-02 08:51 - 00000000 ____D C:\windows\System32\Tasks\Norton 360

2015-12-02 01:32 - 2015-12-02 01:32 - 00003228 _____ C:\windows\System32\Tasks\Norton WSC Integration

2015-12-01 22:51 - 2015-12-02 01:29 - 00000000 ____D C:\AdwCleaner

2015-12-01 22:49 - 2015-12-01 22:49 - 01736704 _____ C:\Users\Maintenance\Desktop\AdwCleaner.exe

2015-12-01 22:43 - 2015-12-01 22:43 - 00001548 _____ C:\Users\Maintenance\Desktop\JRT.txt

2015-12-01 22:37 - 2015-12-01 22:37 - 01599336 _____ (Malwarebytes) C:\Users\Maintenance\Desktop\JRT.exe

2015-12-01 05:51 - 2015-12-01 05:51 - 00791393 _____ (Lars Hederer ) C:\Users\Maintenance\Downloads\erunt-setup.exe

2015-11-30 08:29 - 2015-12-01 05:50 - 00003674 _____ C:\Users\Maintenance\Desktop\Rkill.txt

2015-11-30 08:19 - 2015-11-30 08:19 - 02019656 _____ (Bleeping Computer, LLC) C:\Users\Maintenance\Desktop\rkill.exe

2015-11-18 22:32 - 2015-11-18 22:34 - 00034848 _____ C:\Users\Maintenance\Desktop\Addition.txt

2015-11-18 22:31 - 2015-12-03 23:44 - 00025545 _____ C:\Users\Maintenance\Desktop\FRST.txt

2015-11-18 22:30 - 2015-12-03 23:44 - 00000000 ____D C:\FRST

2015-11-18 22:29 - 2015-12-03 23:44 - 02350080 _____ (Farbar) C:\Users\Maintenance\Desktop\FRST64.exe

2015-11-18 22:26 - 2015-11-18 22:26 - 00001335 _____ C:\Users\Maintenance\Desktop\mbamscanlog-11-18-2015-2.txt

2015-11-18 21:41 - 2015-11-18 21:41 - 00001432 _____ C:\Users\Maintenance\Desktop\mbamscanlog-11-18-2015-1.txt

2015-11-18 02:55 - 2015-11-18 02:55 - 00057940 _____ C:\Users\Charlyne Joy\Downloads\BibBookmark_SINGSON.pdf

2015-11-18 00:35 - 2015-11-18 00:35 - 00100615 _____ C:\Users\Charlyne Joy\Downloads\Celtic_Pillows_Janine.pdf

2015-11-17 19:06 - 2015-11-17 19:06 - 00321972 _____ C:\Users\Charlyne Joy\Downloads\misti_cosmo_jacket_revisions.pdf

2015-11-17 16:49 - 2015-11-17 16:49 - 00182167 _____ C:\Users\Charlyne Joy\Downloads\pattern_fakeislehat.pdf

2015-11-17 16:22 - 2015-11-17 16:22 - 00294034 _____ C:\Users\Charlyne Joy\Downloads\Free_Hearts_Colour_work_Chart.pdf

2015-11-17 16:01 - 2015-11-17 16:01 - 00678307 _____ C:\Users\Charlyne Joy\Downloads\swirlyhat.pdf

2015-11-17 15:35 - 2015-11-17 15:35 - 00369631 _____ C:\Users\Charlyne Joy\Downloads\Ola.pdf

2015-11-14 11:09 - 2015-11-14 11:09 - 565095514 _____ C:\windows\MEMORY.DMP

2015-11-14 11:09 - 2015-11-14 11:09 - 00614368 _____ C:\windows\Minidump\111415-42338-01.dmp

2015-11-14 11:09 - 2015-11-14 11:09 - 00000000 ____D C:\windows\Minidump

2015-11-12 13:12 - 2015-11-03 11:55 - 03211264 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys

2015-11-11 16:26 - 2015-11-11 16:32 - 250015760 _____ C:\Users\Charlyne Joy\Downloads\Flora and Fauna of West Campus.zip

2015-11-11 11:21 - 2015-11-11 11:21 - 00344576 _____ C:\Users\Charlyne Joy\Downloads\basic_video_production_techniques.ppt

2015-11-10 17:14 - 2015-11-03 16:10 - 00390344 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll

2015-11-10 17:14 - 2015-11-03 15:51 - 00342728 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll

2015-11-10 17:14 - 2015-10-30 17:46 - 25818624 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2015-11-10 17:14 - 2015-10-30 17:40 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2015-11-10 17:14 - 2015-10-30 17:40 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll

2015-11-10 17:14 - 2015-10-30 17:25 - 02886656 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2015-11-10 17:14 - 2015-10-30 17:25 - 00417792 _____ (Microsoft Corporation) C:\windows\system32\html.iec

2015-11-10 17:14 - 2015-10-30 17:25 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2015-11-10 17:14 - 2015-10-30 17:25 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll

2015-11-10 17:14 - 2015-10-30 17:24 - 00585728 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll

2015-11-10 17:14 - 2015-10-30 17:24 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll

2015-11-10 17:14 - 2015-10-30 17:17 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2015-11-10 17:14 - 2015-10-30 17:16 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2015-11-10 17:14 - 2015-10-30 17:13 - 00616960 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2015-11-10 17:14 - 2015-10-30 17:12 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe

2015-11-10 17:14 - 2015-10-30 17:12 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe

2015-11-10 17:14 - 2015-10-30 17:11 - 05990912 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2015-11-10 17:14 - 2015-10-30 17:11 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2015-11-10 17:14 - 2015-10-30 17:11 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll

2015-11-10 17:14 - 2015-10-30 17:04 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe

2015-11-10 17:14 - 2015-10-30 17:01 - 00489984 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll

2015-11-10 17:14 - 2015-10-30 16:58 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2015-11-10 17:14 - 2015-10-30 16:53 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll

2015-11-10 17:14 - 2015-10-30 16:52 - 20331520 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2015-11-10 17:14 - 2015-10-30 16:49 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2015-11-10 17:14 - 2015-10-30 16:49 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll

2015-11-10 17:14 - 2015-10-30 16:47 - 00504832 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll

2015-11-10 17:14 - 2015-10-30 16:46 - 00315392 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll

2015-11-10 17:14 - 2015-10-30 16:46 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2015-11-10 17:14 - 2015-10-30 16:45 - 00341504 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec

2015-11-10 17:14 - 2015-10-30 16:45 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll

2015-11-10 17:14 - 2015-10-30 16:44 - 00152064 _____ (Microsoft Corporation) C:\windows\system32\occache.dll

2015-11-10 17:14 - 2015-10-30 16:44 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll

2015-11-10 17:14 - 2015-10-30 16:42 - 02279936 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2015-11-10 17:14 - 2015-10-30 16:39 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2015-11-10 17:14 - 2015-10-30 16:39 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2015-11-10 17:14 - 2015-10-30 16:37 - 00480256 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2015-11-10 17:14 - 2015-10-30 16:36 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2015-11-10 17:14 - 2015-10-30 16:36 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll

2015-11-10 17:14 - 2015-10-30 16:36 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe

2015-11-10 17:14 - 2015-10-30 16:34 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll

2015-11-10 17:14 - 2015-10-30 16:32 - 00720896 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2015-11-10 17:14 - 2015-10-30 16:31 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2015-11-10 17:14 - 2015-10-30 16:29 - 02126336 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2015-11-10 17:14 - 2015-10-30 16:29 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll

2015-11-10 17:14 - 2015-10-30 16:28 - 00416256 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll

2015-11-10 17:14 - 2015-10-30 16:23 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll

2015-11-10 17:14 - 2015-10-30 16:22 - 14457856 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2015-11-10 17:14 - 2015-10-30 16:21 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll

2015-11-10 17:14 - 2015-10-30 16:19 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll

2015-11-10 17:14 - 2015-10-30 16:18 - 00279040 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll

2015-11-10 17:14 - 2015-10-30 16:17 - 02487808 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2015-11-10 17:14 - 2015-10-30 16:17 - 00130048 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll

2015-11-10 17:14 - 2015-10-30 16:16 - 04527616 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2015-11-10 17:14 - 2015-10-30 16:11 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll

2015-11-10 17:14 - 2015-10-30 16:10 - 00689152 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2015-11-10 17:14 - 2015-10-30 16:09 - 12854272 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2015-11-10 17:14 - 2015-10-30 16:09 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl

2015-11-10 17:14 - 2015-10-30 16:09 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll

2015-11-10 17:14 - 2015-10-30 16:04 - 01547264 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2015-11-10 17:14 - 2015-10-30 15:53 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll

2015-11-10 17:14 - 2015-10-30 15:51 - 02011136 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2015-11-10 17:14 - 2015-10-30 15:48 - 01311744 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2015-11-10 17:14 - 2015-10-30 15:46 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll

2015-11-10 17:14 - 2015-10-20 12:42 - 03168768 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll

2015-11-10 17:14 - 2015-10-20 12:42 - 02608128 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll

2015-11-10 17:14 - 2015-10-20 12:42 - 00696320 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll

2015-11-10 17:14 - 2015-10-20 12:42 - 00192512 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll

2015-11-10 17:14 - 2015-10-20 12:42 - 00098816 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll

2015-11-10 17:14 - 2015-10-20 12:42 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll

2015-11-10 17:14 - 2015-10-20 12:42 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\wups.dll

2015-11-10 17:14 - 2015-10-20 12:41 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe

2015-11-10 17:14 - 2015-10-20 12:41 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll

2015-11-10 17:14 - 2015-10-20 12:41 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe

2015-11-10 17:14 - 2015-10-20 12:41 - 00012288 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll

2015-11-10 17:14 - 2015-10-20 11:46 - 00566784 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll

2015-11-10 17:14 - 2015-10-20 11:46 - 00174080 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll

2015-11-10 17:14 - 2015-10-20 11:46 - 00093696 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll

2015-11-10 17:14 - 2015-10-20 11:46 - 00030208 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll

2015-11-10 17:14 - 2015-10-20 11:45 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe

2015-11-10 17:12 - 2015-10-19 19:12 - 05570496 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe

2015-11-10 17:12 - 2015-10-19 19:12 - 00154560 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys

2015-11-10 17:12 - 2015-10-19 19:12 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys

2015-11-10 17:12 - 2015-10-19 19:09 - 01730496 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll

2015-11-10 17:12 - 2015-10-19 19:06 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll

2015-11-10 17:12 - 2015-10-19 19:06 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll

2015-11-10 17:12 - 2015-10-19 19:06 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll

2015-11-10 17:12 - 2015-10-19 19:06 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll

2015-11-10 17:12 - 2015-10-19 19:05 - 01461760 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll

2015-11-10 17:12 - 2015-10-19 19:05 - 01216512 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll

2015-11-10 17:12 - 2015-10-19 19:05 - 01164800 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll

2015-11-10 17:12 - 2015-10-19 19:05 - 00729600 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll

2015-11-10 17:12 - 2015-10-19 19:05 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll

2015-11-10 17:12 - 2015-10-19 19:05 - 00424960 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll

2015-11-10 17:12 - 2015-10-19 19:05 - 00344064 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll

2015-11-10 17:12 - 2015-10-19 19:05 - 00315392 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll

2015-11-10 17:12 - 2015-10-19 19:05 - 00312320 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll

2015-11-10 17:12 - 2015-10-19 19:05 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe

2015-11-10 17:12 - 2015-10-19 19:05 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll

2015-11-10 17:12 - 2015-10-19 19:05 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll

2015-11-10 17:12 - 2015-10-19 19:05 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe

2015-11-10 17:12 - 2015-10-19 19:05 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll

2015-11-10 17:12 - 2015-10-19 19:05 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll

2015-11-10 17:12 - 2015-10-19 19:05 - 00044032 _____ (Microsoft Corporation) C:\windows\system32\cryptbase.dll

2015-11-10 17:12 - 2015-10-19 19:05 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll

2015-11-10 17:12 - 2015-10-19 19:05 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll

2015-11-10 17:12 - 2015-10-19 19:05 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll

2015-11-10 17:12 - 2015-10-19 19:05 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll

2015-11-10 17:12 - 2015-10-19 19:05 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll

2015-11-10 17:12 - 2015-10-19 19:04 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe

2015-11-10 17:12 - 2015-10-19 19:04 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe

2015-11-10 17:12 - 2015-10-19 19:04 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe

2015-11-10 17:12 - 2015-10-19 19:00 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll

2015-11-10 17:12 - 2015-10-19 18:59 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:52 - 03991488 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe

2015-11-10 17:12 - 2015-10-19 18:52 - 03935680 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe

2015-11-10 17:12 - 2015-10-19 18:48 - 01311768 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll

2015-11-10 17:12 - 2015-10-19 18:45 - 00552960 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll

2015-11-10 17:12 - 2015-10-19 18:45 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll

2015-11-10 17:12 - 2015-10-19 18:45 - 00251392 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll

2015-11-10 17:12 - 2015-10-19 18:45 - 00223232 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll

2015-11-10 17:12 - 2015-10-19 18:45 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll

2015-11-10 17:12 - 2015-10-19 18:45 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll

2015-11-10 17:12 - 2015-10-19 18:45 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll

2015-11-10 17:12 - 2015-10-19 18:45 - 00036864 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptbase.dll

2015-11-10 17:12 - 2015-10-19 18:45 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe

2015-11-10 17:12 - 2015-10-19 18:45 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll

2015-11-10 17:12 - 2015-10-19 18:45 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll

2015-11-10 17:12 - 2015-10-19 18:45 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll

2015-11-10 17:12 - 2015-10-19 18:44 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll

2015-11-10 17:12 - 2015-10-19 18:44 - 00665088 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll

2015-11-10 17:12 - 2015-10-19 18:44 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll

2015-11-10 17:12 - 2015-10-19 18:44 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll

2015-11-10 17:12 - 2015-10-19 18:44 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe

2015-11-10 17:12 - 2015-10-19 18:44 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll

2015-11-10 17:12 - 2015-10-19 18:39 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll

2015-11-10 17:12 - 2015-10-19 18:39 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00686080 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 17:41 - 00159232 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys

2015-11-10 17:12 - 2015-10-19 17:40 - 00290816 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys

2015-11-10 17:12 - 2015-10-19 17:40 - 00129024 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys

2015-11-10 17:12 - 2015-10-19 17:29 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe

2015-11-10 17:12 - 2015-10-19 17:29 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe

2015-11-10 17:12 - 2015-10-19 17:27 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 17:27 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 17:27 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll

2015-11-10 17:12 - 2015-10-19 17:27 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll

2015-11-10 17:12 - 2015-09-23 07:15 - 00460776 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys

2015-11-10 17:12 - 2015-09-23 07:15 - 00299632 _____ (Microsoft Corporation) C:\windows\system32\bcryptprimitives.dll

2015-11-10 17:12 - 2015-09-23 07:09 - 00251000 _____ (Microsoft Corporation) C:\windows\SysWOW64\bcryptprimitives.dll

2015-11-10 17:11 - 2015-10-29 11:50 - 00342016 _____ (Microsoft Corporation) C:\windows\system32\apphelp.dll

2015-11-10 17:11 - 2015-10-29 11:50 - 00072192 _____ (Microsoft Corporation) C:\windows\system32\aelupsvc.dll

2015-11-10 17:11 - 2015-10-29 11:50 - 00023552 _____ (Microsoft Corporation) C:\windows\system32\sdbinst.exe

2015-11-10 17:11 - 2015-10-29 11:50 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\shimeng.dll

2015-11-10 17:11 - 2015-10-29 11:50 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\shimeng.dll

2015-11-10 17:11 - 2015-10-29 11:49 - 00295936 _____ (Microsoft Corporation) C:\windows\SysWOW64\apphelp.dll

2015-11-10 17:11 - 2015-10-29 11:49 - 00020992 _____ (Microsoft Corporation) C:\windows\SysWOW64\sdbinst.exe

2015-11-10 17:11 - 2015-10-13 10:41 - 00497664 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys

2015-11-10 17:11 - 2015-10-13 10:40 - 00118272 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tdx.sys

2015-11-10 17:11 - 2015-10-12 22:57 - 00950720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ndis.sys

2015-11-10 17:10 - 2015-10-01 12:00 - 00275456 _____ (Microsoft Corporation) C:\windows\system32\InkEd.dll

2015-11-10 17:10 - 2015-10-01 12:00 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\jnwmon.dll

2015-11-10 17:10 - 2015-10-01 11:50 - 00216064 _____ (Microsoft Corporation) C:\windows\SysWOW64\InkEd.dll

2015-11-04 11:52 - 2015-11-05 06:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

 

==================== One Month Modified files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-12-03 23:44 - 2009-07-13 21:20 - 00000000 ____D C:\Windows

2015-12-03 23:40 - 2010-10-15 11:41 - 00000894 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-12-03 23:38 - 2009-07-13 23:08 - 00000006 ____H C:\windows\Tasks\SA.DAT

2015-12-03 23:37 - 2009-07-13 23:13 - 00783464 _____ C:\windows\system32\PerfStringBackup.INI

2015-12-03 23:37 - 2009-07-13 22:45 - 00018736 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-12-03 23:37 - 2009-07-13 22:45 - 00018736 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-12-03 23:37 - 2009-07-13 21:20 - 00000000 ____D C:\windows\inf

2015-12-03 23:36 - 2010-10-15 11:41 - 00000898 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-12-03 23:35 - 2013-10-01 08:07 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2015-12-03 04:07 - 2012-09-01 15:54 - 00000000 ____D C:\Users\Maintenance\AppData\Local\ElevatedDiagnostics

2015-12-03 04:07 - 2009-07-13 21:20 - 00000000 ____D C:\windows\rescache

2015-12-02 08:54 - 2014-04-13 17:44 - 00192216 _____ (Malwarebytes) C:\windows\system32\Drivers\MBAMSwissArmy.sys

2015-12-02 01:33 - 2013-12-01 20:28 - 00000000 ____D C:\windows\system32\Drivers\N360x64

2015-12-02 01:32 - 2015-08-25 02:58 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Security Suite

2015-12-02 01:32 - 2015-08-24 11:45 - 00002317 _____ C:\Users\Public\Desktop\Norton Security Suite.LNK

2015-12-02 00:54 - 2015-06-01 09:27 - 00000000 ____D C:\ProgramData\Malwarebytes Anti-Exploit

2015-11-29 22:42 - 2011-11-18 18:33 - 01158990 _____ C:\windows\ntbtlog.txt

2015-11-29 22:38 - 2015-06-01 09:27 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Exploit

2015-11-29 22:37 - 2014-04-13 17:43 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-11-18 20:54 - 2015-05-16 11:02 - 00001077 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-11-18 20:54 - 2014-04-13 17:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-11-18 19:29 - 2011-06-09 18:24 - 00064768 _____ C:\Users\Charlyne Joy\AppData\Local\GDIPFONTCACHEV1.DAT

2015-11-18 19:25 - 2009-07-13 23:08 - 00032600 _____ C:\windows\Tasks\SCHEDLGU.TXT

2015-11-18 19:23 - 2011-06-15 18:49 - 00000000 ____D C:\Users\Charlyne Joy\AppData\Roaming\SoftGrid Client

2015-11-17 18:05 - 2009-12-26 19:22 - 00000000 ____D C:\Users\Charlyne Joy\Documents\Knitting and Crochet notes

2015-11-12 16:51 - 2009-07-13 22:45 - 00297472 _____ C:\windows\system32\FNTCACHE.DAT

2015-11-11 11:36 - 2013-09-02 10:46 - 00000000 ____D C:\windows\system32\MRT

2015-11-11 11:14 - 2011-06-11 17:17 - 145617392 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2015-11-11 10:18 - 2011-06-15 18:48 - 00776078 _____ C:\windows\SysWOW64\PerfStringBackup.INI

2015-11-11 10:16 - 2009-07-14 01:45 - 00000000 ____D C:\Program Files\Windows Journal

2015-11-10 17:19 - 2013-10-01 08:07 - 00003768 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater

2015-11-10 17:19 - 2013-09-04 06:57 - 00780488 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2015-11-10 17:19 - 2011-06-18 13:07 - 00142536 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-11-05 06:57 - 2014-02-03 19:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

 

==================== Files in the root of some directories =======

 

2011-09-30 16:30 - 2011-09-30 16:40 - 0000618 _____ () C:\ProgramData\hpzinstall.log

 

==================== Bamital & volsnap =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\windows\system32\winlogon.exe => File is digitally signed

C:\windows\system32\wininit.exe => File is digitally signed

C:\windows\SysWOW64\wininit.exe => File is digitally signed

C:\windows\explorer.exe => File is digitally signed

C:\windows\SysWOW64\explorer.exe => File is digitally signed

C:\windows\system32\svchost.exe => File is digitally signed

C:\windows\SysWOW64\svchost.exe => File is digitally signed

C:\windows\system32\services.exe => File is digitally signed

C:\windows\system32\User32.dll => File is digitally signed

C:\windows\SysWOW64\User32.dll => File is digitally signed

C:\windows\system32\userinit.exe => File is digitally signed

C:\windows\SysWOW64\userinit.exe => File is digitally signed

C:\windows\system32\rpcss.dll => File is digitally signed

C:\windows\system32\dnsapi.dll => File is digitally signed

C:\windows\SysWOW64\dnsapi.dll => File is digitally signed

C:\windows\system32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2015-12-03 03:59

 

==================== End of FRST.txt ============================

[AdvancedSetup]

Please go into Control Panel, Add/Remove and uninstall ALL versions of Java and then run the following.
 
Please download JavaRa-1.16 and save it to your computer.

• Double click to open the zip file and then select all and choose Copy.
• Create a new folder on your Desktop named RemoveJava and paste the files into this new folder.
• Quit all browsers and other running applications.
• Right-click on JavaRa.exe in RemoveJava folder and choose Run as administrator to start the program.
• From the drop-down menu, choose English and click on Select.
• JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
• Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
• A logfile will pop up. Please save it to a convenient location and post it in your next reply.

Next:
 
Please Run TFC by OldTimer to clear temporary files:

• Download TFC from here and save it to your desktop.
• http://oldtimer.geekstogo.com/TFC.exe
• Close any open programs and Internet browsers.
• Double click TFC.exe to run it on XP (for Vista and Windows 7 right click and choose "Run as administrator") and once it opens click on the Start button on the lower left of the program to allow it to begin cleaning.
• Please be patient as clearing out temp files may take a while.
• Once it completes you may be prompted to restart your computer, please do so.
• Once it's finished you may delete TFC.exe from your desktop or save it for later use for the cleaning of temporary files.

 
 

 

[PrincessVoid]

JavaRa 1.16 Removal Log.

 

Report follows after line.

 

------------------------------------

 

The JavaRa removal process was started on Fri Dec 04 00:31:40 2015

 

Found and removed: C:\Program Files (x86)\Java\jre1.8.0_60

 

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-ABCDEFFDCBA}. The error returned was 124.

 

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0001-ABCDEFFDCBA}. The error returned was 124.

 

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0002-ABCDEFFDCBA}. The error returned was 124.

 

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0003-ABCDEFFDCBA}. The error returned was 124.

 

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0004-ABCDEFFDCBA}. The error returned was 124.

 

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0005-ABCDEFFDCBA}. The error returned was 124.

 

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0006-ABCDEFFDCBA}. The error returned was 124.

 

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0007-ABCDEFFDCBA}. The error returned was 124.

 

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0008-ABCDEFFDCBA}. The error returned was 124.

 

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0009-ABCDEFFDCBA}. The error returned was 124.

 

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0010-ABCDEFFDCBA}. The error returned was 124.

 

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0011-ABCDEFFDCBA}. The error returned was 124.

 

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0012-ABCDEFFDCBA}. The error returned was 124.

 

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0013-ABCDEFFDCBA}. The error returned was 124.

 

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0014-ABCDEFFDCBA}. The error returned was 124.

 

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0015-ABCDEFFDCBA}. The error returned was 124.

 

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0016-ABCDEFFDCBA}. The error returned was 124.

 

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0017-ABCDEFFDCBA}. The error returned was 124.

 

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0018-ABCDEFFDCBA}. The error returned was 124.

 

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0019-ABCDEFFDCBA}. The error returned was 124.

 

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0020-ABCDEFFDCBA}. The error returned was 124.

 

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0021-ABCDEFFDCBA}. The error returned was 124.

 

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0022-ABCDEFFDCBA}. The error returned was 124.

 

Found and removed: JavaPlugin.1000

 

Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.6.0.0

 

Found and removed: SOFTWARE\Classes\CLSID\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}

 

Found and removed: SOFTWARE\Classes\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}

 

Found and removed: SOFTWARE\Classes\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}

 

Found and removed: SOFTWARE\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}

 

Found and removed: SOFTWARE\Classes\Interface\{5852F5EC-8BF4-11D4-A245-0080C6F74284}

 

Found and removed: SOFTWARE\Classes\MIME\Database\Content Type\application/java-deployment-toolkit

 

Found and removed: SOFTWARE\Classes\TypeLib\{5852F5E0-8BF4-11D4-A245-0080C6F74284}

 

Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled

 

Found and removed: SOFTWARE\JreMetrics

 

Found and removed: SOFTWARE\Classes\JavaPlugin.10512

 

------------------------------------

 

Finished reporting.

[PrincessVoid]

Step 10(?), TFC: I didn't see anything about a log for this program, but after running it there was a text box with the proceedings of the file cleanup. I copied and pasted the text into Notepad and saved it. Would you like me to post that here too?

[AdvancedSetup]

No, that's fine.

Let me have you reset your web browsers and then do a clean removal and reinstall of MBAM

Please visit each of the following sites and lets reset all of your browsers back to defaults to prevent unexpected issues.

If you are not using one of the browsers but it is installed then you may want to consider uninstalling it as older versions of some software can pose an increase in the potential for an infection to get in.

Internet Explorer

How to reset Internet Explorer settings

Firefox

Click on Help / Troubleshooting Information then click on the Reset Firefox button.

Chrome

Start by disabling Sync

How To Delete Your Google Chrome Browser Sync Data

Chrome - Reset browser settings

If that fails then Uninstall Google Chrome and do not reinstall until sure the system is clean.

Next,

Please uninstall your current version of MBAM and reinstall the latest version. MBAM Clean Removal Process 2x

Thanks

[PrincessVoid]

Reset all 3 browsers and uninstalled MBAM as instructed. After restarting, I noticed I still had Malwarebytes Anti-Exploit, should I also uninstall that first?