I think I got rootkitted, I can't open any anti-malware

[r3cebarnett]

Hey MBAM Forum,

 

I think that I got a really bad virus because my computer got really slow and eventually stopped working. I was eventually able to restore it to a previous point and everything is seemingly working but I can't open any anti-malware programs. My first instinct was to try to get MBAM, but the installer wouldn't open. Then I tried chameleon, I couldn't get that to work. I tried the MBAM cleaner thing, the install still wouldn't work. Then I tried a different anti-malware (AVG), even that wouldn't open. Then I tried to install a different program like iTunes or CCleaner, they both installed fine. I have no idea what to do. Please let me know what I need to do so you guys can help me.

[TwinHeadedEagle]

Hello,

Please follow the instructions from the sticky topic and attach two FRST reports.

[r3cebarnett]

FRST.txt

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-12-2015

Ran by Rick (administrator) on MYCOMPUTER122 (05-12-2015 13:25:54)

Running from C:\Users\Rick\Downloads

Loaded Profiles: Rick (Available Profiles: Rick)

Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

(Coupons.com Inc.) C:\Program Files (x86)\Coupons\CouponPrinterService.exe

(Conexant Systems, Inc.) C:\Program Files\CONEXANT\SA3\CxUtilSvc.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE

(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

(Intel® Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe

(Dell Inc.) C:\Program Files\Dell\DellDataVault\DellDataVaultWiz.exe

(Dell Inc.) C:\Program Files (x86)\Dell Update\DellUpService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

(Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe

(Dell Inc.) C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Dell Inc.) C:\Program Files\Dell\DellDataVault\DellDataVault.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\SeaPort.EXE

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler64.exe

(Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

() C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(Microsoft Corporation) C:\Windows\System32\regsvr32.exe

() C:\ProgramData\igfxCUIService.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

() C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe

(Cisco) C:\Users\Rick\AppData\Local\Charter\Charter TV Player\PCShowServerPMWrapper.exe

(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP ENVY 4500 series\Bin\ScanToPCActivationApp.exe

() C:\ProgramData\RuntimeBroker.exe

() C:\ProgramData\vssadmin_32.exe

(Nero AG) C:\Program Files (x86)\Nero\SyncUP\SyncUP.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

(Dell Inc.) C:\Program Files (x86)\Dell Update\DellUpTray.exe

(Conexant Systems, Inc.) C:\Program Files\CONEXANT\SA3\SmartAudio3.exe

(Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe

() C:\Users\Rick\AppData\Local\Charter\Charter TV Player\NDSPCShowServer.exe

() C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe

(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe

() C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDGesture.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe

(Microsoft Corporation) C:\Windows\System32\GWX\GWXUX.exe

(Nero AG) C:\Program Files (x86)\Nero\SyncUP\Nero.AndroidServer.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\msiexec.exe

(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP ENVY 4500 series\Bin\HPCustPartic.exe

(Microsoft Corporation) C:\Windows\System32\cmd.exe

(Microsoft Corporation) C:\Windows\System32\msiexec.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\msiexec.exe

(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP ENVY 4500 series\Bin\HPNetworkCommunicatorCom.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

 

 

==================== Registry (Whitelisted) ===========================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2895656 2012-01-17] (ELAN Microelectronics Corp.)

HKLM\...\Run: [intelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"

HKLM\...\Run: [smartAudio] => C:\Program Files\CONEXANT\SA3\SACpl.exe [1628288 2011-09-08] (Conexant Systems, Inc.)

HKLM\...\Run: [bTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp

HKLM\...\Run: [stage Remote] => C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe [2034752 2011-08-08] ()

HKLM\...\Run: [DellStage] => C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe [2195824 2012-02-01] ()

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170280 2015-07-11] (Apple Inc.)

HKLM\...\Run: [DellCApp] => C:\Program Files\Dell\Tech Concierge\capp.exe -l

HKLM\...\Run: [PrhbKsp32AC0] => regsvr32.exe /s "C:\PROGRA~3\PrhbKsp32AC0.dll"

HKLM\...\Run: [igfxCUIService] => C:\ProgramData\igfxCUIService.exe [4096 2015-11-03] ()

HKLM-x32\...\Run: [iAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)

HKLM-x32\...\Run: [uSB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-17] (Intel Corporation)

HKLM-x32\...\Run: [Dell Webcam Central] => C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [503942 2011-04-13] (Creative Technology Ltd)

HKLM-x32\...\Run: [NeroLauncher] => C:\Program Files (x86)\Nero\SyncUP\NeroLauncher.exe [67496 2012-08-21] ()

HKLM-x32\...\Run: [AccuWeatherWidget] => C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe [968048 2012-02-01] ()

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-05-15] (Apple Inc.)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-08-06] (Apple Inc.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer: [NoFolderOptions] 0

HKLM\...\Policies\Explorer: [NoControlPanel] 0

HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore: [DisableSR/DisableConfig]  <===== ATTENTION

HKU\S-1-5-21-3143995118-350638234-3666185585-1001\...\Run: [skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)

HKU\S-1-5-21-3143995118-350638234-3666185585-1001\...\Run: [PCShowServerCHARTER] => C:\Users\Rick\AppData\Local\Charter\Charter TV Player\PCShowServerPMWrapper.exe [1718792 2015-05-10] (Cisco)

HKU\S-1-5-21-3143995118-350638234-3666185585-1001\...\Run: [HP ENVY 4500 series (NET)] => C:\Program Files\HP\HP ENVY 4500 series\Bin\ScanToPCActivationApp.exe [3487240 2014-07-21] (Hewlett-Packard Development Company, LP)

HKU\S-1-5-21-3143995118-350638234-3666185585-1001\...\Run: [MipUgpo] => regsvr32.exe "C:\Users\Rick\AppData\Roaming\Oebivl\Aumufl.dll"

HKU\S-1-5-21-3143995118-350638234-3666185585-1001\...\Run: [RuntimeBroker] => C:\ProgramData\RuntimeBroker.exe [4096 2015-11-02] ()

HKU\S-1-5-21-3143995118-350638234-3666185585-1001\...\Run: [vssadmin_32] => C:\ProgramData\vssadmin_32.exe [4096 2015-11-06] ()

HKU\S-1-5-21-3143995118-350638234-3666185585-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8591272 2015-11-16] (Piriform Ltd)

HKU\S-1-5-21-3143995118-350638234-3666185585-1001\...\MountPoints2: {53423448-a860-11e1-b7c6-806e6f6e6963} - D:\Setup.exe

HKU\S-1-5-21-3143995118-350638234-3666185585-1001\...\Winlogon: [shell] - <==== ATTENTION

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

Tcpip\..\Interfaces\{8CDFACCC-3883-4413-AA91-A053C67A4BF5}: [DhcpNameServer] 192.168.0.1

 

Internet Explorer:

==================

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKU\S-1-5-21-3143995118-350638234-3666185585-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.charter.net/

SearchScopes: HKLM -> DefaultScope {E80BECBF-F6DE-4592-97D8-FF7D29D513C8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDR&src=IE-SearchBox

SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM -> {E80BECBF-F6DE-4592-97D8-FF7D29D513C8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDR&src=IE-SearchBox

SearchScopes: HKLM-x32 -> DefaultScope {E80BECBF-F6DE-4592-97D8-FF7D29D513C8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDR&src=IE-SearchBox

SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 -> {E80BECBF-F6DE-4592-97D8-FF7D29D513C8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDR&src=IE-SearchBox

SearchScopes: HKU\S-1-5-21-3143995118-350638234-3666185585-1001 -> DefaultScope {4CDA4E45-E014-4AC0-B0FD-4A3B9D884EB4} URL = hxxps://search.yahoo.com/search?fr=mcafee&type=C011US0D20140525&p={searchTerms}

SearchScopes: HKU\S-1-5-21-3143995118-350638234-3666185585-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=U079DF&PC=U079&q={searchTerms}&src=IE-SearchBox

SearchScopes: HKU\S-1-5-21-3143995118-350638234-3666185585-1001 -> {4CDA4E45-E014-4AC0-B0FD-4A3B9D884EB4} URL = hxxps://search.yahoo.com/search?fr=mcafee&type=C011US0D20140525&p={searchTerms}

SearchScopes: HKU\S-1-5-21-3143995118-350638234-3666185585-1001 -> {E80BECBF-F6DE-4592-97D8-FF7D29D513C8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDR&src=IE-SearchBox

BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin64.dll => No File

BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-07-14] (Microsoft Corporation)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-23] (Google Inc.)

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-10-12] (Microsoft Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-07-14] (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-07-14] (Microsoft Corporation)

BHO: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll [2013-12-16] (Microsoft Corporation.)

BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll => No File

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)

BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-23] (Google Inc.)

BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-07-14] (Microsoft Corporation)

BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll [2013-12-16] (Microsoft Corporation.)

BHO-x32: TBSB07898 Class -> {FCBCCB87-9224-4B8D-B117-F56D924BEB18} -> C:\Program Files (x86)\Coupons.com CouponBar\tbcore3.dll => No File

Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll [2013-12-16] (Microsoft Corporation.)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-23] (Google Inc.)

Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll [2013-12-16] (Microsoft Corporation.)

Toolbar: HKLM-x32 - Coupons.com CouponBar - {8660E5B3-6C41-44DE-8503-98D99BBECD41} - C:\Program Files (x86)\Coupons.com CouponBar\tbcore3.dll No File

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-23] (Google Inc.)

Toolbar: HKU\S-1-5-21-3143995118-350638234-3666185585-1001 -> No Name - {8660E5B3-6C41-44DE-8503-98D99BBECD41} -  No File

Handler-x32: cozi - {5356518D-FE9C-4E08-9C1F-1E872ECD367F} - c:\Program Files (x86)\Cozi Express\CoziProtocolHandler.dll [2011-05-05] (Cozi Group, Inc.)

Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2015-11-06] (McAfee, Inc.)

Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2015-11-06] (McAfee, Inc.)

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)

Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2015-11-06] (McAfee, Inc.)

Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2015-11-06] (McAfee, Inc.)

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-10-12] (Microsoft Corporation)

Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)

Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl64.dll [2015-09-28] (McAfee, Inc.)

Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\MSC\McSnIePl.dll [2015-09-28] (McAfee, Inc.)

 

FireFox:

========

FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2015-09-28] ()

FF Plugin: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-01-06] ()

FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-20] (Google)

FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2015-09-28] ()

FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-05-06] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)

FF Plugin-x32: @real.com/nppl3260;version=17.0.9.17 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll [No File]

FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=17.0.9 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [No File]

FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=17.0.9 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [No File]

FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=17.0.9 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll [No File]

FF Plugin-x32: @real.com/nprpplugin;version=17.0.9.17 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll [No File]

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-04] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-04] (Google Inc.)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\6\NP_wtapp.dll [2013-11-08] ()

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-3143995118-350638234-3666185585-1001: @citrixonline.com/appdetectorplugin -> C:\Users\Rick\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2015-09-14] (Citrix Online)

FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi

FF Extension: McAfee WebAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi [2015-11-03]

FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext => not found

FF HKLM-x32\...\Firefox\Extensions: [{53D8DD28-1C83-41F3-B171-C2ED5B3E5DE8}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext => not found

FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi

FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2015-10-06] [not signed]

 

Chrome: 

=======

CHR StartupUrls: Default -> "hxxp://www.charter.net/"

CHR Profile: C:\Users\Rick\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (SiteAdvisor) - C:\Users\Rick\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2015-07-14]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Rick\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-16]

CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-11-16]

CHR HKU\S-1-5-21-3143995118-350638234-3666185585-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bmkckgpgekmanipelfidlhmkfcjicion] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-11-16]

CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx <not found>

 

==================== Services (Whitelisted) ========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2015-10-12] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2015-10-12] (Microsoft Corporation)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2765496 2015-07-14] (Microsoft Corporation)

R2 CouponPrinterService; C:\Program Files (x86)\Coupons\CouponPrinterService.exe [179184 2014-10-15] (Coupons.com Inc.)

R2 CxUtilSvc; C:\Program Files\Conexant\SA3\CxUtilSvc.exe [109184 2011-10-11] (Conexant Systems, Inc.)

R2 DellDataVault; C:\Program Files\Dell\DellDataVault\DellDataVault.exe [2574168 2015-09-11] (Dell Inc.)

R2 DellDataVaultWiz; C:\Program Files\Dell\DellDataVault\DellDataVaultWiz.exe [201560 2015-09-11] (Dell Inc.)

R2 DellUpdate; C:\Program Files (x86)\Dell Update\DellUpService.exe [237272 2015-08-27] (Dell Inc.)

S4 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [255040 2014-10-01] (WildTangent)

S2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [368584 2015-09-01] (McAfee, Inc.)

S2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [157928 2015-11-06] (McAfee, Inc.)

S2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [783120 2015-09-28] (McAfee, Inc.)

S2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.6.1180.0\McCSPServiceHost.exe [1694152 2015-09-01] (McAfee, Inc.)

S2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [368584 2015-09-01] (McAfee, Inc.)

S2 McNaiAnn; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [368584 2015-09-01] (McAfee, Inc.)

S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [639456 2015-08-11] (McAfee, Inc.)

S2 mcpltsvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [368584 2015-09-01] (McAfee, Inc.)

S2 McProxy; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [368584 2015-09-01] (McAfee, Inc.)

S3 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [232656 2015-07-31] (McAfee, Inc.)

S2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\\mfemms.exe [376264 2015-08-10] (McAfee, Inc.)

S2 mfevtp; C:\Windows\system32\mfevtps.exe [254792 2015-07-31] (McAfee, Inc.)

S2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [368584 2015-09-01] (McAfee, Inc.)

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2011-12-08] ()

R2 SupportAssistAgent; C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe [21160 2015-09-30] (Dell Inc.)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [594704 2011-12-08] (Intel® Corporation)

S2 Dell Tech Concierge; C:\Program Files\Dell\Tech Concierge\srvc.exe [X]

S2 RealNetworks Downloader Resolver Service; "C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe" [X]

S2 RealPlayer Cloud Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [X]

S2 RealPlayerUpdateSvc; "C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe" [X]

 

===================== Drivers (Whitelisted) ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [80768 2015-08-10] (McAfee, Inc.)

R3 DDDriver; C:\Windows\System32\drivers\DDDriver64Dcsa.sys [32464 2015-09-11] (Dell Computer Corporation)

R3 DellProf; C:\Windows\System32\drivers\DellProf.sys [24240 2015-09-11] (Dell Computer Corporation)

S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)

S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [207208 2015-05-19] (McAfee, Inc.)

R2 McPvDrv; C:\Windows\system32\drivers\McPvDrv.sys [76064 2015-09-03] (McAfee, Inc.)

R3 mfeaack; C:\Windows\System32\drivers\mfeaack.sys [413432 2015-08-10] (McAfee, Inc.)

R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [349096 2015-08-10] (McAfee, Inc.)

R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [495856 2015-08-10] (McAfee, Inc.)

R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [839376 2015-08-10] (McAfee, Inc.)

R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [537408 2015-08-12] (McAfee, Inc.)

S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [111256 2015-08-12] (McAfee, Inc.)

S3 mfesapsn; C:\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys [37960 2015-11-06] (McAfee, Inc.)

R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [244024 2015-08-10] (McAfee, Inc.)

U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [34808 2014-11-07] ()

S3 BS2832487234; \??\C:\Users\Rick\AppData\Local\Temp\NTFS.sys [X]

S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]

S3 PCDSRVC{3B54B31B-D06B6431-06020200}_0; \??\c:\program files\dell\supportassist\pcdsrvc_x64.pkms [X]

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One Month Created files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-12-05 13:25 - 2015-12-05 13:25 - 02369024 _____ (Farbar) C:\Users\Rick\Downloads\FRST64.exe

2015-12-05 13:25 - 2015-12-05 13:25 - 00029819 _____ C:\Users\Rick\Downloads\FRST.txt

2015-12-05 13:25 - 2015-12-05 13:25 - 00000000 ____D C:\FRST

2015-12-02 17:47 - 2015-12-02 17:47 - 00284560 _____ C:\Windows\Minidump\120215-61199-01.dmp

2015-12-02 17:43 - 2015-12-02 17:43 - 00285048 _____ C:\Windows\Minidump\120215-61760-01.dmp

2015-12-02 09:55 - 2015-12-02 16:03 - 00000000 ___HD C:\Windows\AxInstSV

2015-12-01 21:25 - 2015-12-02 17:47 - 557865551 _____ C:\Windows\MEMORY.DMP

2015-12-01 21:25 - 2015-12-01 21:25 - 00288288 _____ C:\Windows\Minidump\120115-21340-01.dmp

2015-12-01 21:23 - 2015-12-01 21:40 - 00000000 ____D C:\Program Files (x86)\Dell Update

2015-12-01 21:12 - 2015-12-01 21:12 - 00000000 __HDC C:\ProgramData\{AA6BF06E-316C-487A-9BC2-5F06A43C56B1}

2015-12-01 21:11 - 2015-12-01 21:58 - 00000000 ____D C:\ProgramData\SupportAssistAgent

2015-12-01 21:11 - 2015-12-01 21:11 - 00003820 _____ C:\Windows\System32\Tasks\Dell SupportAssistAgent AutoUpdate

2015-12-01 21:06 - 2015-12-01 21:12 - 00003484 _____ C:\Windows\System32\Tasks\PCDEventLauncherTask

2015-12-01 21:06 - 2015-12-01 21:06 - 00004036 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask

2015-12-01 21:06 - 2015-12-01 21:06 - 00003226 _____ C:\Windows\System32\Tasks\SystemToolsDailyTest

2015-12-01 21:06 - 2015-12-01 21:06 - 00000000 ____D C:\ProgramData\PC-Doctor for Windows

2015-12-01 21:06 - 2015-12-01 21:06 - 00000000 ____D C:\Program Files\Dell Support Center

2015-12-01 20:57 - 2015-12-01 21:01 - 107983188 _____ (Symantec Corporation) C:\Users\Rick\Downloads\Unconfirmed 239075.crdownload

2015-12-01 20:40 - 2015-12-01 20:40 - 02012464 _____ C:\Users\Rick\Downloads\Adaware_Installer.exe

2015-12-01 20:18 - 2015-12-01 20:19 - 20826184 _____ C:\Users\Rick\Downloads\RogueKiller.exe

2015-12-01 20:17 - 2015-12-01 20:17 - 02019656 _____ (Bleeping Computer, LLC) C:\Users\Rick\Downloads\iExplore.exe

2015-12-01 20:17 - 2015-12-01 20:17 - 02019656 _____ (Bleeping Computer, LLC) C:\Users\Rick\Downloads\eXplorer.exe

2015-12-01 20:16 - 2015-12-01 20:16 - 02019656 _____ (Bleeping Computer, LLC) C:\Users\Rick\Downloads\rkill.com

2015-12-01 20:07 - 2015-12-01 20:07 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Rick\Downloads\mbar-1.09.3.1001.exe

2015-12-01 20:05 - 2015-12-01 20:05 - 04896104 _____ (Oleg N. Scherbakov) C:\Users\Rick\Downloads\Malwarebytes_2.1.8_SSE2_Hotfix.exe

2015-12-01 20:04 - 2015-12-01 20:04 - 06392130 _____ C:\Users\Rick\Downloads\mbam-chameleon-3.1.28.0.zip

2015-12-01 20:04 - 2015-12-01 20:04 - 00000000 ____D C:\Users\Rick\Desktop\Chameleon

2015-12-01 20:02 - 2015-12-01 20:02 - 00000000 ____D C:\Users\Rick\Desktop\mbar

2015-12-01 20:01 - 2015-12-01 20:02 - 19044562 _____ C:\Users\Rick\Downloads\mbar-1.09.3.1001.zip

2015-12-01 19:59 - 2015-12-01 19:59 - 22908888 _____ (Malwarebytes ) C:\Users\Rick\Downloads\mbam-setup-2.2.0.1024 (1).exe

2015-12-01 19:52 - 2015-12-01 19:53 - 00099266 _____ C:\Windows\ntbtlog.txt

2015-12-01 19:50 - 2015-12-01 19:51 - 01599336 _____ (Malwarebytes) C:\Users\Rick\Downloads\JRT.exe

2015-12-01 19:49 - 2015-12-01 19:49 - 22908888 _____ (Malwarebytes ) C:\Users\Rick\Downloads\mbam-setup-2.2.0.1024.exe

2015-12-01 19:43 - 2015-12-01 19:43 - 06801752 _____ (Piriform Ltd) C:\Users\Rick\Downloads\ccsetup512.exe

2015-12-01 19:43 - 2015-12-01 19:43 - 00002798 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC

2015-12-01 19:43 - 2015-12-01 19:43 - 00000784 _____ C:\Users\Public\Desktop\CCleaner.lnk

2015-12-01 19:43 - 2015-12-01 19:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

2015-12-01 19:43 - 2015-12-01 19:43 - 00000000 ____D C:\Program Files\CCleaner

2015-12-01 19:19 - 2015-12-01 19:19 - 02970984 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Rick\Downloads\AVG_Protection_Free_698.exe

2015-12-01 18:39 - 2015-12-01 18:39 - 00004096 _____ C:\ProgramData\igfxEM_86.dll

2015-12-01 18:38 - 2015-12-01 18:38 - 00000000 _____ C:\Windows\SysWOW64\j99s57u291E338R285

2015-11-19 16:06 - 2015-11-19 20:03 - 00000000 ____D C:\Users\Rick\AppData\Roaming\tor

2015-11-17 01:34 - 2015-11-17 01:34 - 00000000 ____D C:\Users\Rick\AppData\LocalLow\Hewlett-Packard

2015-11-15 20:10 - 2015-11-15 20:10 - 00000000 _____ C:\Windows\SysWOW64\shoA1CB.tmp

2015-11-14 17:33 - 2015-10-20 13:42 - 03168768 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2015-11-14 17:33 - 2015-10-20 13:42 - 02608128 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2015-11-14 17:33 - 2015-10-20 13:42 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2015-11-14 17:33 - 2015-10-20 13:42 - 00192512 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2015-11-14 17:33 - 2015-10-20 13:42 - 00098816 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2015-11-14 17:33 - 2015-10-20 13:42 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2015-11-14 17:33 - 2015-10-20 13:42 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2015-11-14 17:33 - 2015-10-20 13:41 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2015-11-14 17:33 - 2015-10-20 13:41 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll

2015-11-14 17:33 - 2015-10-20 13:41 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2015-11-14 17:33 - 2015-10-20 13:41 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll

2015-11-14 17:33 - 2015-10-20 12:46 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2015-11-14 17:33 - 2015-10-20 12:46 - 00174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2015-11-14 17:33 - 2015-10-20 12:46 - 00093696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2015-11-14 17:33 - 2015-10-20 12:46 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll

2015-11-14 17:33 - 2015-10-20 12:45 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2015-11-14 17:33 - 2015-10-17 13:15 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2015-11-14 17:33 - 2015-10-17 13:15 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2015-11-14 17:33 - 2015-10-17 13:10 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2015-11-14 17:33 - 2015-10-17 13:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2015-11-14 17:33 - 2015-10-17 13:09 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2015-11-14 17:33 - 2015-10-17 13:09 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2015-11-14 17:33 - 2015-10-17 13:09 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2015-11-14 17:33 - 2015-10-17 13:09 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2015-11-14 17:33 - 2015-10-17 13:09 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2015-11-14 17:33 - 2015-10-17 13:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2015-11-14 17:33 - 2015-10-17 13:09 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2015-11-14 17:33 - 2015-10-17 13:09 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll

2015-11-14 17:33 - 2015-10-17 13:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2015-11-14 17:33 - 2015-10-17 13:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2015-11-14 17:33 - 2015-10-17 13:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2015-11-14 17:33 - 2015-10-17 13:09 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2015-11-14 17:33 - 2015-10-17 13:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe

2015-11-14 17:33 - 2015-10-17 13:04 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll

2015-11-14 17:33 - 2015-10-17 13:04 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll

2015-11-14 17:33 - 2015-10-17 12:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll

2015-11-14 17:33 - 2015-10-17 12:48 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2015-11-14 17:33 - 2015-10-17 12:48 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2015-11-14 17:33 - 2015-10-17 12:48 - 00251392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2015-11-14 17:33 - 2015-10-17 12:48 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2015-11-14 17:33 - 2015-10-17 12:48 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2015-11-14 17:33 - 2015-10-17 12:48 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2015-11-14 17:33 - 2015-10-17 12:48 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll

2015-11-14 17:33 - 2015-10-17 12:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2015-11-14 17:33 - 2015-10-17 12:48 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2015-11-14 17:33 - 2015-10-17 12:47 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe

2015-11-14 17:33 - 2015-10-17 12:46 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

2015-11-14 17:33 - 2015-10-17 12:46 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2015-11-14 17:33 - 2015-10-17 12:43 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll

2015-11-14 17:33 - 2015-10-17 12:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll

2015-11-14 17:33 - 2015-10-17 12:38 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll

2015-11-14 17:33 - 2015-10-17 11:46 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys

2015-11-14 17:33 - 2015-10-17 11:45 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys

2015-11-14 17:33 - 2015-10-17 11:45 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys

2015-11-14 17:32 - 2015-09-23 08:15 - 00460776 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys

2015-11-14 17:32 - 2015-09-23 08:15 - 00299632 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll

2015-11-14 17:32 - 2015-09-23 08:09 - 00251000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcryptprimitives.dll

2015-11-14 17:31 - 2015-11-03 17:10 - 00390344 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2015-11-14 17:31 - 2015-11-03 16:51 - 00342728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2015-11-14 17:31 - 2015-10-30 18:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2015-11-14 17:31 - 2015-10-30 18:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2015-11-14 17:31 - 2015-10-30 18:25 - 02886656 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2015-11-14 17:31 - 2015-10-30 18:25 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec

2015-11-14 17:31 - 2015-10-30 18:25 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2015-11-14 17:31 - 2015-10-30 18:25 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2015-11-14 17:31 - 2015-10-30 18:24 - 00585728 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2015-11-14 17:31 - 2015-10-30 18:24 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2015-11-14 17:31 - 2015-10-30 18:17 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2015-11-14 17:31 - 2015-10-30 18:16 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2015-11-14 17:31 - 2015-10-30 18:13 - 00616960 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2015-11-14 17:31 - 2015-10-30 18:12 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2015-11-14 17:31 - 2015-10-30 18:12 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2015-11-14 17:31 - 2015-10-30 18:11 - 05990912 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2015-11-14 17:31 - 2015-10-30 18:11 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2015-11-14 17:31 - 2015-10-30 18:11 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2015-11-14 17:31 - 2015-10-30 18:04 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2015-11-14 17:31 - 2015-10-30 18:01 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2015-11-14 17:31 - 2015-10-30 17:58 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2015-11-14 17:31 - 2015-10-30 17:53 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2015-11-14 17:31 - 2015-10-30 17:52 - 20331520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2015-11-14 17:31 - 2015-10-30 17:49 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2015-11-14 17:31 - 2015-10-30 17:49 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2015-11-14 17:31 - 2015-10-30 17:47 - 00504832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2015-11-14 17:31 - 2015-10-30 17:46 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2015-11-14 17:31 - 2015-10-30 17:46 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2015-11-14 17:31 - 2015-10-30 17:45 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec

2015-11-14 17:31 - 2015-10-30 17:45 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2015-11-14 17:31 - 2015-10-30 17:44 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll

2015-11-14 17:31 - 2015-10-30 17:44 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2015-11-14 17:31 - 2015-10-30 17:42 - 02279936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2015-11-14 17:31 - 2015-10-30 17:39 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2015-11-14 17:31 - 2015-10-30 17:39 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2015-11-14 17:31 - 2015-10-30 17:37 - 00480256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2015-11-14 17:31 - 2015-10-30 17:36 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2015-11-14 17:31 - 2015-10-30 17:36 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2015-11-14 17:31 - 2015-10-30 17:36 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2015-11-14 17:31 - 2015-10-30 17:34 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll

2015-11-14 17:31 - 2015-10-30 17:32 - 00720896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2015-11-14 17:31 - 2015-10-30 17:31 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2015-11-14 17:31 - 2015-10-30 17:29 - 02126336 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2015-11-14 17:31 - 2015-10-30 17:29 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2015-11-14 17:31 - 2015-10-30 17:28 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2015-11-14 17:31 - 2015-10-30 17:23 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2015-11-14 17:31 - 2015-10-30 17:22 - 14457856 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2015-11-14 17:31 - 2015-10-30 17:21 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2015-11-14 17:31 - 2015-10-30 17:19 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2015-11-14 17:31 - 2015-10-30 17:18 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2015-11-14 17:31 - 2015-10-30 17:17 - 02487808 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2015-11-14 17:31 - 2015-10-30 17:17 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll

2015-11-14 17:31 - 2015-10-30 17:16 - 04527616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2015-11-14 17:31 - 2015-10-30 17:11 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll

2015-11-14 17:31 - 2015-10-30 17:10 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2015-11-14 17:31 - 2015-10-30 17:09 - 12854272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2015-11-14 17:31 - 2015-10-30 17:09 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2015-11-14 17:31 - 2015-10-30 17:09 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2015-11-14 17:31 - 2015-10-30 17:04 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2015-11-14 17:31 - 2015-10-30 16:53 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2015-11-14 17:31 - 2015-10-30 16:51 - 02011136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2015-11-14 17:31 - 2015-10-30 16:48 - 01311744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2015-11-14 17:31 - 2015-10-30 16:46 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2015-11-14 17:30 - 2015-10-30 18:46 - 25818624 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2015-11-14 17:30 - 2015-10-19 20:12 - 05570496 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-11-14 17:30 - 2015-10-19 20:09 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2015-11-14 17:30 - 2015-10-19 20:06 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll

2015-11-14 17:30 - 2015-10-19 20:06 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2015-11-14 17:30 - 2015-10-19 20:06 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll

2015-11-14 17:30 - 2015-10-19 20:06 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2015-11-14 17:30 - 2015-10-19 20:05 - 01164800 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2015-11-14 17:30 - 2015-10-19 20:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll

2015-11-14 17:30 - 2015-10-19 20:05 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2015-11-14 17:30 - 2015-10-19 20:05 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe

2015-11-14 17:30 - 2015-10-19 20:05 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe

2015-11-14 17:30 - 2015-10-19 20:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll

2015-11-14 17:30 - 2015-10-19 20:05 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll

2015-11-14 17:30 - 2015-10-19 20:05 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2015-11-14 17:30 - 2015-10-19 20:04 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe

2015-11-14 17:30 - 2015-10-19 19:53 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:52 - 03991488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2015-11-14 17:30 - 2015-10-19 19:52 - 03935680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2015-11-14 17:30 - 2015-10-19 19:48 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2015-11-14 17:30 - 2015-10-19 19:45 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll

2015-11-14 17:30 - 2015-10-19 19:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2015-11-14 17:30 - 2015-10-19 19:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2015-11-14 17:30 - 2015-10-19 19:44 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2015-11-14 17:30 - 2015-10-19 19:44 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2015-11-14 17:30 - 2015-10-19 19:35 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll

2015-11-14 17:30 - 2015-10-19 19:35 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:35 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 19:35 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 18:29 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2015-11-14 17:30 - 2015-10-19 18:29 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2015-11-14 17:30 - 2015-10-19 18:27 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 18:27 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 18:27 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll

2015-11-14 17:30 - 2015-10-19 18:27 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll

2015-11-14 17:30 - 2015-10-13 11:41 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys

2015-11-14 17:30 - 2015-10-13 11:40 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys

2015-11-14 17:29 - 2015-11-03 12:55 - 03211264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2015-11-14 17:29 - 2015-10-29 12:50 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll

2015-11-14 17:29 - 2015-10-29 12:50 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll

2015-11-14 17:29 - 2015-10-29 12:50 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe

2015-11-14 17:29 - 2015-10-29 12:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll

2015-11-14 17:29 - 2015-10-29 12:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll

2015-11-14 17:29 - 2015-10-29 12:49 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll

2015-11-14 17:17 - 2015-10-12 23:57 - 00950720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys

2015-11-14 17:17 - 2015-10-01 13:00 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll

2015-11-14 17:17 - 2015-10-01 13:00 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll

2015-11-14 17:17 - 2015-10-01 12:50 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll

2015-11-10 14:35 - 2015-10-29 12:49 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe

2015-11-10 14:35 - 2015-10-19 19:44 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2015-11-10 14:35 - 2015-10-19 19:35 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll

2015-11-10 14:35 - 2015-10-19 19:35 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2015-11-08 17:27 - 2015-11-08 17:27 - 00000000 _____ C:\Windows\SysWOW64\shoFF55.tmp

2015-11-08 02:10 - 2015-11-08 02:10 - 00000000 _____ C:\Windows\SysWOW64\shoC82F.tmp

2015-11-07 00:23 - 2015-11-07 00:23 - 00000000 _____ C:\Windows\SysWOW64\shoCF21.tmp

2015-11-06 14:36 - 2015-11-06 14:36 - 00004096 _____ C:\ProgramData\vssadmin_32.exe

2015-11-06 14:36 - 2015-11-06 14:36 - 00004096 _____ C:\ProgramData\AuthHost_32.dll

2015-11-06 14:35 - 2015-11-06 14:35 - 00090112 _____ C:\ProgramData\7B571D05.EX

 

==================== One Month Modified files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-12-05 13:25 - 2009-07-13 22:20 - 00000000 ____D C:\Windows

2015-12-05 13:20 - 2013-01-05 21:51 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-12-05 13:05 - 2015-09-17 13:27 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA1d0f17672a64b8c.job

2015-12-05 13:03 - 2009-07-13 23:45 - 00028352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-12-05 13:03 - 2009-07-13 23:45 - 00028352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-12-05 13:01 - 2015-09-17 13:27 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0f176716e633b.job

2015-12-05 12:59 - 2009-07-14 00:13 - 00800820 _____ C:\Windows\system32\PerfStringBackup.INI

2015-12-05 12:59 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\inf

2015-12-05 12:58 - 2012-12-01 15:28 - 00000000 ____D C:\Users\Rick\AppData\Local\Nero

2015-12-05 12:58 - 2012-05-27 18:35 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks

2015-12-05 12:58 - 2012-05-27 18:35 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks

2015-12-05 12:58 - 2012-05-27 18:26 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup

2015-12-04 02:00 - 2015-09-17 13:27 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA1d0f17672a64b8c

2015-12-04 02:00 - 2015-09-17 13:27 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore1d0f176716e633b

2015-12-02 22:51 - 2013-10-22 14:25 - 00000000 ____D C:\ProgramData\boost_interprocess

2015-12-02 22:48 - 2009-07-14 00:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-12-02 22:47 - 2015-10-30 04:42 - 00000000 ___HD C:\$WINDOWS.~BT

2015-12-02 22:47 - 2011-02-10 09:02 - 00000000 ____D C:\Windows\panther

2015-12-02 22:45 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\registration

2015-12-02 22:43 - 2015-09-07 19:59 - 00018929 _____ C:\Windows\diagerr.xml

2015-12-02 22:43 - 2015-09-07 19:59 - 00015243 _____ C:\Windows\diagwrn.xml

2015-12-02 18:41 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\rescache

2015-12-02 17:47 - 2015-03-20 16:27 - 00000000 ____D C:\Windows\Minidump

2015-12-02 07:28 - 2014-11-08 21:38 - 00002185 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2015-12-01 21:40 - 2012-05-27 18:23 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell

2015-12-01 21:37 - 2014-11-15 16:32 - 00000000 ____D C:\Users\Rick\AppData\Local\CrashDumps

2015-12-01 21:23 - 2012-05-27 19:51 - 00000000 ____D C:\ProgramData\Dell

2015-12-01 21:21 - 2015-04-04 16:59 - 00000000 ___SD C:\Windows\system32\GWX

2015-12-01 21:21 - 2012-05-27 18:22 - 00000000 ___HD C:\Windows\system32\WLANProfiles

2015-12-01 21:11 - 2013-01-23 14:00 - 00000000 ____D C:\ProgramData\PCDr

2015-12-01 21:11 - 2012-05-27 18:32 - 00000000 ____D C:\Program Files (x86)\Dell

2015-12-01 21:11 - 2012-05-27 18:18 - 00000000 ____D C:\Program Files\Dell

2015-12-01 21:10 - 2013-02-27 14:01 - 00000000 ____D C:\Users\Rick\AppData\Roaming\PCDr

2015-12-01 21:05 - 2015-04-10 19:01 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk

2015-12-01 19:27 - 2014-06-01 18:35 - 00000000 ____D C:\Users\Rick\AppData\Roaming\Skype

2015-12-01 18:52 - 2014-04-01 19:44 - 00000000 ____D C:\Users\Rick\AppData\Local\ElevatedDiagnostics

2015-12-01 18:44 - 2015-10-28 22:19 - 02676988 _____ C:\Windows\system32\CFG2832487234

2015-12-01 18:25 - 2012-12-01 15:18 - 00000000 ____D C:\Users\Rick

2015-11-18 10:59 - 2009-07-14 00:08 - 00032656 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2015-11-16 19:12 - 2012-05-27 18:06 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-11-16 19:12 - 2012-05-27 18:06 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-11-16 18:58 - 2012-05-27 18:41 - 00000000 ____D C:\ProgramData\McAfee

2015-11-16 18:56 - 2014-05-24 23:21 - 00000000 ____D C:\Program Files (x86)\McAfee

2015-11-16 18:54 - 2014-05-24 23:22 - 00000000 __RSD C:\Users\Rick\Documents\McAfee Vaults

2015-11-16 16:55 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\system32\NDF

2015-11-14 21:37 - 2013-08-14 00:42 - 00000000 ____D C:\Windows\system32\MRT

2015-11-14 21:32 - 2013-01-07 02:16 - 145617392 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-11-14 19:16 - 2014-11-07 20:23 - 00438688 _____ C:\Windows\system32\FNTCACHE.DAT

2015-11-14 19:09 - 2011-02-10 11:10 - 00776038 _____ C:\Windows\SysWOW64\PerfStringBackup.INI

2015-11-14 19:07 - 2010-11-21 02:17 - 00000000 ____D C:\Program Files\Windows Journal

2015-11-14 16:49 - 2014-11-08 21:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2015-11-14 16:49 - 2009-07-13 22:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared

 

==================== Files in the root of some directories =======

 

2015-11-02 19:42 - 2015-11-02 19:42 - 0381952 _____ (Microsoft Corporation) C:\Users\Rick\AppData\Roaming\clyfmbg.exe

2015-10-28 22:06 - 2015-10-28 22:06 - 0381952 _____ (Microsoft Corporation) C:\Users\Rick\AppData\Roaming\mrebmf.exe

2015-11-02 19:43 - 2015-11-02 19:43 - 0005120 _____ () C:\ProgramData\1F3670CC.EX

2015-11-06 14:35 - 2015-11-06 14:35 - 0090112 _____ () C:\ProgramData\7B571D05.EX

2015-10-02 15:23 - 2015-10-02 15:23 - 0000057 _____ () C:\ProgramData\Ament.ini

2015-11-06 14:36 - 2015-11-06 14:36 - 0004096 _____ () C:\ProgramData\AuthHost_32.dll

2014-06-30 08:33 - 2014-06-30 08:33 - 0000000 _____ () C:\ProgramData\ccsetup414_slim.exe

2012-12-01 15:48 - 2012-12-01 15:48 - 0000000 _____ () C:\ProgramData\cmn_upld.log

2013-01-16 17:39 - 2015-10-02 15:17 - 0001817 _____ () C:\ProgramData\dleb.log

2014-09-13 16:04 - 2015-09-14 09:35 - 0000309 _____ () C:\ProgramData\dlebDiagnostics.log

2012-12-01 15:55 - 2015-09-20 16:23 - 0658576 _____ () C:\ProgramData\dlebJSW.log

2012-12-01 15:51 - 2015-10-02 15:16 - 0438880 _____ () C:\ProgramData\dlebscan.log

2012-12-01 16:07 - 2013-04-08 16:00 - 0000756 _____ () C:\ProgramData\FastPics.log

2015-10-28 22:06 - 2015-10-28 22:06 - 0004096 _____ () C:\ProgramData\Gt2f4Uyc9323.dll

2015-11-03 18:25 - 2015-11-03 18:25 - 0004096 _____ () C:\ProgramData\igfxCUIService.exe

2015-12-01 18:39 - 2015-12-01 18:39 - 0004096 _____ () C:\ProgramData\igfxEM_86.dll

2012-12-01 15:48 - 2012-12-01 15:48 - 0000000 _____ () C:\ProgramData\LxWbGwLog.log

2015-11-02 19:43 - 2015-11-02 19:43 - 0004096 _____ () C:\ProgramData\netsh.dll

2015-10-29 13:20 - 2015-10-29 13:20 - 0004096 _____ () C:\ProgramData\p2hbAwRM2AC0.dll

2015-11-03 18:25 - 2015-11-03 18:25 - 0004096 _____ () C:\ProgramData\perfhost.dll

2015-10-29 13:21 - 2015-10-29 13:21 - 0004096 _____ () C:\ProgramData\PrhbKsp32AC0.dll

2014-08-23 05:42 - 2014-08-23 05:42 - 1063160 _____ (Bleeping Computer, LLC) C:\ProgramData\rkill64-20982.exe

2014-09-20 19:37 - 2014-09-20 19:37 - 1063160 _____ (Bleeping Computer, LLC) C:\ProgramData\rkill64-23883.exe

2014-09-17 11:15 - 2014-09-17 11:15 - 1063160 _____ (Bleeping Computer, LLC) C:\ProgramData\rkill64-29318.exe

2014-06-30 08:31 - 2014-06-30 08:31 - 1062136 _____ (Bleeping Computer, LLC) C:\ProgramData\rkill64.exe

2015-11-02 19:44 - 2015-11-02 19:44 - 0004096 _____ () C:\ProgramData\RuntimeBroker.exe

2014-02-12 20:16 - 2014-02-12 20:16 - 0000095 _____ () C:\ProgramData\SAH_Install.ini

2014-08-23 19:11 - 2014-08-23 19:11 - 0353190 _____ () C:\ProgramData\SPL1026.tmp

2014-05-05 08:59 - 2014-05-05 08:59 - 0327077 _____ () C:\ProgramData\SPL10F1.tmp

2014-02-02 22:52 - 2014-02-02 22:52 - 0884721 _____ () C:\ProgramData\SPL118D.tmp

2014-07-20 22:56 - 2014-07-20 22:56 - 5476877 _____ () C:\ProgramData\SPL1278.tmp

2015-07-28 12:00 - 2015-07-28 12:00 - 0133656 _____ () C:\ProgramData\SPL12A6.tmp

2015-08-16 19:15 - 2015-08-16 19:15 - 1582408 _____ () C:\ProgramData\SPL1555.tmp

2013-12-12 09:50 - 2013-12-12 09:50 - 0596851 _____ () C:\ProgramData\SPL1A91.tmp

2015-01-17 23:45 - 2015-01-17 23:45 - 0688145 _____ () C:\ProgramData\SPL1BD9.tmp

2014-07-25 22:29 - 2014-07-25 22:29 - 0481215 _____ () C:\ProgramData\SPL1D13.tmp

2015-05-28 20:59 - 2015-05-28 20:59 - 0533054 _____ () C:\ProgramData\SPL1D5F.tmp

2014-04-01 00:12 - 2014-04-01 00:12 - 0486756 _____ () C:\ProgramData\SPL1E97.tmp

2013-12-07 23:45 - 2013-12-07 23:45 - 1325357 _____ () C:\ProgramData\SPL204C.tmp

2015-01-24 20:04 - 2015-01-24 20:04 - 0881873 _____ () C:\ProgramData\SPL206B.tmp

2014-08-17 16:09 - 2014-08-17 16:09 - 0349145 _____ () C:\ProgramData\SPL21D2.tmp

2014-09-21 15:13 - 2014-09-21 15:13 - 3234744 _____ () C:\ProgramData\SPL24CF.tmp

2014-10-26 22:29 - 2014-10-26 22:29 - 1041833 _____ () C:\ProgramData\SPL2647.tmp

2014-12-12 00:08 - 2014-12-12 00:08 - 14004763 _____ () C:\ProgramData\SPL29AE.tmp

2015-08-11 15:17 - 2015-08-11 15:17 - 1873347 _____ () C:\ProgramData\SPL2B75.tmp

2014-12-28 22:20 - 2014-12-28 22:20 - 0307346 _____ () C:\ProgramData\SPL2C7C.tmp

2014-06-15 21:31 - 2014-06-15 21:31 - 1602385 _____ () C:\ProgramData\SPL2CE9.tmp

2014-03-23 21:06 - 2014-03-23 21:06 - 0541647 _____ () C:\ProgramData\SPL2E60.tmp

2014-07-11 23:58 - 2014-07-11 23:58 - 1307346 _____ () C:\ProgramData\SPL3005.tmp

2013-12-28 22:22 - 2013-12-28 22:22 - 1057284 _____ () C:\ProgramData\SPL310E.tmp

2014-07-02 22:37 - 2014-07-02 22:37 - 1034642 _____ () C:\ProgramData\SPL342B.tmp

2014-01-22 21:27 - 2014-01-22 21:27 - 2395690 _____ () C:\ProgramData\SPL34F4.tmp

2014-01-23 20:18 - 2014-01-23 20:18 - 2973584 _____ () C:\ProgramData\SPL37A2.tmp

2014-09-05 19:29 - 2014-09-05 19:29 - 0794691 _____ () C:\ProgramData\SPL37A4.tmp

2014-05-04 16:46 - 2014-05-04 16:46 - 0362842 _____ () C:\ProgramData\SPL3A51.tmp

2014-04-29 17:39 - 2014-04-29 17:39 - 0955185 _____ () C:\ProgramData\SPL3CE1.tmp

2014-03-29 20:15 - 2014-03-29 20:15 - 0729099 _____ () C:\ProgramData\SPL3E.tmp

2014-07-09 00:33 - 2014-07-09 00:33 - 3447984 _____ () C:\ProgramData\SPL4366.tmp

2015-08-04 23:25 - 2015-08-04 23:25 - 2096956 _____ () C:\ProgramData\SPL44FD.tmp

2014-01-29 01:51 - 2014-01-29 01:51 - 0735377 _____ () C:\ProgramData\SPL4692.tmp

2015-09-22 20:19 - 2015-09-22 20:19 - 0424443 _____ () C:\ProgramData\SPL476C.tmp

2014-05-01 21:57 - 2014-05-01 21:57 - 18262223 _____ () C:\ProgramData\SPL4896.tmp

2015-07-25 16:15 - 2015-07-25 16:15 - 0539934 _____ () C:\ProgramData\SPL48C2.tmp

2014-05-29 09:46 - 2014-05-29 09:46 - 2556234 _____ () C:\ProgramData\SPL4A49.tmp

2014-01-11 21:17 - 2014-01-11 21:17 - 0885074 _____ () C:\ProgramData\SPL4A97.tmp

2013-03-20 22:18 - 2013-03-20 22:18 - 0866467 _____ () C:\ProgramData\SPL4B44.tmp

2014-01-07 02:12 - 2014-01-07 02:12 - 1400513 _____ () C:\ProgramData\SPL4B90.tmp

2015-01-30 16:39 - 2015-01-30 16:39 - 1341693 _____ () C:\ProgramData\SPL4EF9.tmp

2014-08-26 20:51 - 2014-08-26 20:51 - 0775959 _____ () C:\ProgramData\SPL5051.tmp

2014-07-27 20:04 - 2014-07-27 20:04 - 0889661 _____ () C:\ProgramData\SPL510D.tmp

2015-04-22 22:25 - 2015-04-22 22:25 - 0885119 _____ () C:\ProgramData\SPL5295.tmp

2014-12-01 04:54 - 2014-12-01 04:54 - 0570744 _____ () C:\ProgramData\SPL538C.tmp

2014-12-21 01:15 - 2014-12-21 01:15 - 0353914 _____ () C:\ProgramData\SPL5428.tmp

2015-08-14 00:31 - 2015-08-14 00:31 - 0796167 _____ () C:\ProgramData\SPL5FBE.tmp

2015-01-27 16:52 - 2015-01-27 16:52 - 1064820 _____ () C:\ProgramData\SPL60B5.tmp

2015-09-14 12:04 - 2015-09-14 12:04 - 0003538 _____ () C:\ProgramData\SPL6171.tmp

2015-08-08 17:27 - 2015-08-08 17:27 - 6366230 _____ () C:\ProgramData\SPL64EC.tmp

2014-05-09 21:23 - 2014-05-09 21:23 - 0810614 _____ () C:\ProgramData\SPL6557.tmp

2014-05-01 22:25 - 2014-05-01 22:25 - 1174753 _____ () C:\ProgramData\SPL65F3.tmp

2014-02-08 18:52 - 2014-02-08 18:52 - 10972436 _____ () C:\ProgramData\SPL6788.tmp

2014-01-23 20:12 - 2014-01-23 20:12 - 0448152 _____ () C:\ProgramData\SPL6AB4.tmp

2015-06-24 22:51 - 2015-06-24 22:51 - 0424730 _____ () C:\ProgramData\SPL6B13.tmp

2014-11-06 19:46 - 2014-11-06 19:46 - 0926879 _____ () C:\ProgramData\SPL6BDC.tmp

2014-01-28 21:25 - 2014-01-28 21:25 - 0336526 _____ () C:\ProgramData\SPL6CF5.tmp

2014-01-06 21:53 - 2014-01-06 21:53 - 0898902 _____ () C:\ProgramData\SPL6F93.tmp

2014-03-30 21:36 - 2014-03-30 21:36 - 0882156 _____ () C:\ProgramData\SPL6FC3.tmp

2014-09-27 16:24 - 2014-09-27 16:24 - 0782663 _____ () C:\ProgramData\SPL711.tmp

2014-01-10 21:39 - 2014-01-10 21:39 - 1437135 _____ () C:\ProgramData\SPL7416.tmp

2014-06-25 23:10 - 2014-06-25 23:10 - 2454128 _____ () C:\ProgramData\SPL7500.tmp

2014-03-23 20:36 - 2014-03-23 20:36 - 0539865 _____ () C:\ProgramData\SPL75DB.tmp

2015-02-12 00:42 - 2015-02-12 00:42 - 0457068 _____ () C:\ProgramData\SPL7609.tmp

2014-01-06 21:43 - 2014-01-06 21:43 - 1390666 _____ () C:\ProgramData\SPL7678.tmp

2013-12-07 23:14 - 2013-12-07 23:14 - 1904710 _____ () C:\ProgramData\SPL78C8.tmp

2015-01-01 22:42 - 2015-01-01 22:42 - 0727479 _____ () C:\ProgramData\SPL79F0.tmp

2013-01-20 00:42 - 2013-01-20 00:42 - 1767987 _____ () C:\ProgramData\SPL7A6E.tmp

2014-04-27 20:51 - 2014-04-27 20:51 - 0335509 _____ () C:\ProgramData\SPL7D4A.tmp

2015-04-29 19:56 - 2015-04-29 19:56 - 0779694 _____ () C:\ProgramData\SPL7EE0.tmp

2015-04-28 11:58 - 2015-04-28 11:58 - 0133051 _____ () C:\ProgramData\SPL89F6.tmp

2014-12-19 15:48 - 2014-12-19 15:48 - 1002506 _____ () C:\ProgramData\SPL8A16.tmp

2015-02-12 20:15 - 2015-02-12 20:15 - 0457068 _____ () C:\ProgramData\SPL8B5D.tmp

2014-07-08 20:54 - 2014-07-08 20:54 - 0545161 _____ () C:\ProgramData\SPL8B5E.tmp

2015-05-29 21:53 - 2015-05-29 21:53 - 0368432 _____ () C:\ProgramData\SPL8C18.tmp

2014-03-24 20:57 - 2014-03-24 20:57 - 2613289 _____ () C:\ProgramData\SPL8EB8.tmp

2014-01-19 22:55 - 2014-01-19 22:55 - 0638100 _____ () C:\ProgramData\SPL8FC2.tmp

2015-01-26 01:22 - 2015-01-26 01:22 - 0133260 _____ () C:\ProgramData\SPL906D.tmp

2014-04-01 17:46 - 2014-04-01 17:46 - 5557070 _____ () C:\ProgramData\SPL90F8.tmp

2014-07-15 00:43 - 2014-07-15 00:43 - 0518911 _____ () C:\ProgramData\SPL94C0.tmp

2014-07-21 00:03 - 2014-07-21 00:03 - 0564731 _____ () C:\ProgramData\SPL96D2.tmp

2015-08-16 22:07 - 2015-08-16 22:07 - 1587348 _____ () C:\ProgramData\SPL97CB.tmp

2014-05-24 15:18 - 2014-05-24 15:18 - 1077368 _____ () C:\ProgramData\SPL9DB5.tmp

2015-07-21 19:05 - 2015-07-21 19:05 - 1279089 _____ () C:\ProgramData\SPL9DC4.tmp

2015-07-12 01:10 - 2015-07-12 01:10 - 0461729 _____ () C:\ProgramData\SPL9E24.tmp

2015-02-04 01:45 - 2015-02-04 01:45 - 0878208 _____ () C:\ProgramData\SPL9FD7.tmp

2014-07-09 20:24 - 2014-07-09 20:24 - 1234444 _____ () C:\ProgramData\SPLA035.tmp

2014-11-08 13:53 - 2014-11-08 13:53 - 0574479 _____ () C:\ProgramData\SPLA11F.tmp

2014-05-12 13:47 - 2014-05-12 13:47 - 5094883 _____ () C:\ProgramData\SPLA3BD.tmp

2015-06-10 19:33 - 2015-06-10 19:33 - 1017231 _____ () C:\ProgramData\SPLA4E5.tmp

2014-01-04 21:25 - 2014-01-04 21:25 - 2764649 _____ () C:\ProgramData\SPLA737.tmp

2015-07-22 21:11 - 2015-07-22 21:11 - 0458288 _____ () C:\ProgramData\SPLAAFE.tmp

2015-04-16 19:14 - 2015-04-16 19:14 - 1344493 _____ () C:\ProgramData\SPLAB0D.tmp

2015-09-29 20:42 - 2015-09-29 20:42 - 0133667 _____ () C:\ProgramData\SPLAE0A.tmp

2014-01-15 21:33 - 2014-01-15 21:33 - 1126191 _____ () C:\ProgramData\SPLAF71.tmp

2014-05-05 21:01 - 2014-05-05 21:01 - 0530354 _____ () C:\ProgramData\SPLAFBE.tmp

2014-11-08 01:26 - 2014-11-08 01:26 - 0939450 _____ () C:\ProgramData\SPLB03D.tmp

2015-01-17 23:41 - 2015-01-17 23:41 - 0688145 _____ () C:\ProgramData\SPLB26E.tmp

2015-07-11 13:53 - 2015-07-11 13:53 - 12951035 _____ () C:\ProgramData\SPLB2CA.tmp

2014-12-19 01:56 - 2014-12-19 01:56 - 1549257 _____ () C:\ProgramData\SPLB71E.tmp

2014-12-21 02:54 - 2014-12-21 02:54 - 0133231 _____ () C:\ProgramData\SPLB8E2.tmp

2014-06-26 00:08 - 2014-06-26 00:08 - 0288823 _____ () C:\ProgramData\SPLB98F.tmp

2014-01-09 20:42 - 2014-01-09 20:42 - 0892043 _____ () C:\ProgramData\SPLBA1B.tmp

2015-08-27 21:05 - 2015-08-27 21:05 - 0133766 _____ () C:\ProgramData\SPLBA79.tmp

2015-02-21 17:41 - 2015-02-21 17:41 - 1765544 _____ () C:\ProgramData\SPLBD84.tmp

2013-12-23 00:04 - 2013-12-23 00:04 - 2711005 _____ () C:\ProgramData\SPLBE40.tmp

2014-11-03 15:09 - 2014-11-03 15:09 - 0304735 _____ () C:\ProgramData\SPLBFC5.tmp

2014-01-23 20:27 - 2014-01-23 20:27 - 0840817 _____ () C:\ProgramData\SPLBFE4.tmp

2014-02-20 21:17 - 2014-02-20 21:17 - 46130780 _____ () C:\ProgramData\SPLC20.tmp

2013-12-16 20:59 - 2013-12-16 20:59 - 0607801 _____ () C:\ProgramData\SPLC32F.tmp

2013-12-29 20:06 - 2013-12-29 20:06 - 2170514 _____ () C:\ProgramData\SPLC41A.tmp

2014-07-21 00:13 - 2014-07-21 00:13 - 0889126 _____ () C:\ProgramData\SPLC486.tmp

2014-10-24 15:29 - 2014-10-24 15:29 - 10969364 _____ () C:\ProgramData\SPLC87C.tmp

2014-07-15 12:54 - 2014-07-15 12:54 - 2944718 _____ () C:\ProgramData\SPLC976.tmp

2015-07-11 13:47 - 2015-07-11 13:48 - 12951035 _____ () C:\ProgramData\SPLC9D4.tmp

2014-03-01 01:03 - 2014-03-01 01:03 - 0486705 _____ () C:\ProgramData\SPLCA9E.tmp

2014-11-22 17:57 - 2014-11-22 17:57 - 0114180 _____ () C:\ProgramData\SPLCB4A.tmp

2014-08-30 19:33 - 2014-08-30 19:33 - 0897104 _____ () C:\ProgramData\SPLCBC.tmp

2014-11-28 20:47 - 2014-11-28 20:47 - 0285106 _____ () C:\ProgramData\SPLCE18.tmp

2014-06-26 20:38 - 2014-06-26 20:38 - 1536906 _____ () C:\ProgramData\SPLCE47.tmp

2014-12-28 21:41 - 2014-12-28 21:41 - 0709368 _____ () C:\ProgramData\SPLCEC3.tmp

2014-02-19 13:47 - 2014-02-19 13:47 - 5310873 _____ () C:\ProgramData\SPLCF7E.tmp

2014-08-05 18:47 - 2014-08-05 18:47 - 0567243 _____ () C:\ProgramData\SPLD01A.tmp

2014-05-03 22:20 - 2014-05-03 22:20 - 0889600 _____ () C:\ProgramData\SPLD143.tmp

2015-07-11 13:50 - 2015-07-11 13:50 - 12951035 _____ () C:\ProgramData\SPLD161.tmp

2015-08-11 15:59 - 2015-08-11 15:59 - 0999208 _____ () C:\ProgramData\SPLD1C.tmp

2014-01-01 20:12 - 2014-01-01 20:12 - 0294303 _____ () C:\ProgramData\SPLD355.tmp

2014-10-21 16:08 - 2014-10-21 16:08 - 9123681 _____ () C:\ProgramData\SPLD681.tmp

2014-09-11 22:43 - 2014-09-11 22:43 - 0403104 _____ () C:\ProgramData\SPLD7C9.tmp

2014-01-13 22:04 - 2014-01-13 22:04 - 0696751 _____ () C:\ProgramData\SPLD825.tmp

2014-11-13 22:23 - 2014-11-13 22:23 - 0796460 _____ () C:\ProgramData\SPLDA0A.tmp

2015-08-15 22:46 - 2015-08-15 22:46 - 0737686 _____ () C:\ProgramData\SPLDC7A.tmp

2014-04-18 18:34 - 2014-04-18 18:34 - 0710637 _____ () C:\ProgramData\SPLDFC3.tmp

2014-07-15 20:41 - 2014-07-15 20:41 - 1104065 _____ () C:\ProgramData\SPLE10C.tmp

2014-07-02 22:29 - 2014-07-02 22:29 - 0548067 _____ () C:\ProgramData\SPLE447.tmp

2014-10-25 23:53 - 2014-10-25 23:53 - 0940907 _____ () C:\ProgramData\SPLE6A6.tmp

2015-04-16 18:50 - 2015-04-16 18:50 - 0203824 _____ () C:\ProgramData\SPLE89A.tmp

2015-08-06 19:28 - 2015-08-06 19:28 - 4309644 _____ () C:\ProgramData\SPLE8D8.tmp

2014-11-13 18:23 - 2014-11-13 18:23 - 5136370 _____ () C:\ProgramData\SPLE9A3.tmp

2014-03-12 22:38 - 2014-03-12 22:38 - 0605897 _____ () C:\ProgramData\SPLE9D1.tmp

2014-12-12 18:46 - 2014-12-12 18:46 - 0539715 _____ () C:\ProgramData\SPLEE92.tmp

2014-06-25 22:43 - 2014-06-25 22:43 - 0548067 _____ () C:\ProgramData\SPLF21D.tmp

2013-12-13 12:57 - 2013-12-13 12:57 - 0559665 _____ () C:\ProgramData\SPLF24B.tmp

2014-06-11 12:57 - 2014-06-11 12:57 - 1197262 _____ () C:\ProgramData\SPLF372.tmp

2015-02-12 23:52 - 2015-02-12 23:52 - 0457068 _____ () C:\ProgramData\SPLF611.tmp

2014-05-05 22:32 - 2014-05-05 22:32 - 20732242 _____ () C:\ProgramData\SPLF6AD.tmp

2014-12-14 22:25 - 2014-12-14 22:25 - 0690902 _____ () C:\ProgramData\SPLF72A.tmp

2014-05-20 09:29 - 2014-05-20 09:29 - 8310755 _____ () C:\ProgramData\SPLF7A.tmp

2014-08-28 14:25 - 2014-08-28 14:25 - 0505989 _____ () C:\ProgramData\SPLF9E8.tmp

2014-12-15 21:48 - 2014-12-15 21:48 - 0984557 _____ () C:\ProgramData\SPLFA9.tmp

2014-04-02 07:52 - 2014-04-02 07:52 - 0494773 _____ () C:\ProgramData\SPLFF09.tmp

2012-12-01 15:47 - 2012-12-01 15:47 - 0000000 _____ () C:\ProgramData\UpdaterLog.txt

2015-11-06 14:36 - 2015-11-06 14:36 - 0004096 _____ () C:\ProgramData\vssadmin_32.exe

 

Files to move or delete:

====================

C:\ProgramData\AuthHost_32.dll

C:\ProgramData\ccsetup414_slim.exe

C:\ProgramData\Gt2f4Uyc9323.dll

C:\ProgramData\igfxCUIService.exe

C:\ProgramData\igfxEM_86.dll

C:\ProgramData\netsh.dll

C:\ProgramData\p2hbAwRM2AC0.dll

C:\ProgramData\perfhost.dll

C:\ProgramData\PrhbKsp32AC0.dll

C:\ProgramData\rkill64-20982.exe

C:\ProgramData\rkill64-23883.exe

C:\ProgramData\rkill64-29318.exe

C:\ProgramData\rkill64.exe

C:\ProgramData\RuntimeBroker.exe

C:\ProgramData\vssadmin_32.exe

 

 

==================== Bamital & volsnap =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\dnsapi.dll => File is digitally signed

C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2015-12-01 23:07

 

==================== End of FRST.txt ============================

[r3cebarnett]

Addition.txt

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version:05-12-2015

Ran by Rick (2015-12-05 13:28:13)

Running from C:\Users\Rick\Downloads

Windows 7 Home Premium Service Pack 1 (X64) (2012-12-01 20:18:07)

Boot Mode: Normal

==========================================================

 

 

==================== Accounts: =============================

 

Administrator (S-1-5-21-3143995118-350638234-3666185585-500 - Administrator - Disabled)

Guest (S-1-5-21-3143995118-350638234-3666185585-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-3143995118-350638234-3666185585-1002 - Limited - Enabled)

Rick (S-1-5-21-3143995118-350638234-3666185585-1001 - Administrator - Enabled) => C:\Users\Rick

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AV: McAfee Anti-Virus and Anti-Spyware (Disabled - Up to date) {DA9F8ED0-D0DE-39CC-F55A-51AB4CC1B556}

AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: McAfee Anti-Virus and Anti-Spyware (Disabled - Up to date) {61FE6F34-F6E4-3642-CFEA-6AD93746FFEB}

FW: McAfee Firewall (Disabled) {E2A40FF5-9AB1-3894-DE05-F89EB212F22D}

 

==================== Installed Programs ======================

 

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

ABBYY FineReader 6.0 Sprint (HKLM-x32\...\{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}) (Version: 6.00.2146.41621 - ABBYY Software House)

Accidental Damage Services Agreement (HKLM-x32\...\{EF85FEF4-EB92-4075-A6D2-5F519BB30A2C}) (Version: 2.0.0 - Dell Inc.)

Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.009.20079 - Adobe Systems Incorporated)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.6.0.19120 - Adobe Systems Incorporated)

Adobe Flash Player 19 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 19.0.0.185 - Adobe Systems Incorporated)

Advanced Audio FX Engine (HKLM-x32\...\Advanced Audio FX Engine) (Version: 1.12.05 - Creative Technology Ltd)

Apple Application Support (32-bit) (HKLM-x32\...\{7FE25256-B7C1-480D-B736-10A67A833AEA}) (Version: 3.2 - Apple Inc.)

Apple Application Support (64-bit) (HKLM\...\{B255D495-4734-4E9B-B4F5-96702FD4A7B9}) (Version: 3.2 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{5D61F006-168C-4B8B-B7FD-F113C10AE0E4}) (Version: 8.2.1.3 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Banctec Service Agreement (HKLM-x32\...\{42D68A86-DB1C-4256-B8C9-5D0D92919AF5}) (Version: 2.0.0 - Dell Inc.)

Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

Bing Bar (HKLM-x32\...\{FF6DD716-7B10-4269-9F19-FFB07AC4CD95}) (Version: 7.3.124.0 - Microsoft Corporation)

Blackhawk Striker 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden

Blio (HKLM-x32\...\{431E2654-B0A4-4140-82A2-DD55B028B626}) (Version: 3.2.9594 - K-NFB Reading Technology, Inc.)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Bounce Symphony (x32 Version: 2.2.0.95 - WildTangent) Hidden

Build-a-lot 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden

Cake Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden

CCleaner (HKLM\...\CCleaner) (Version: 5.12 - Piriform)

Charter TV Player (HKLM-x32\...\{fe4e0e1c-6db8-4a70-9272-235cf34aa2c1}) (Version: 5.11 - Charter)

Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

Citrix Online Launcher (HKLM-x32\...\{DB014C85-A264-4BCA-A66F-6DD1FCF8EC36}) (Version: 1.0.335 - Citrix)

Complete Care Business Service Agreement (HKLM-x32\...\{0ECFCB07-9BFE-4970-ACA1-D568D982760B}) (Version: 2.0.0 - Dell Inc.)

Conexant SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.54.29.0 - Conexant)

Consumer In-Home Service Agreement (HKLM-x32\...\{F47C37A4-7189-430A-B81D-739FF8A7A554}) (Version: 2.0.0 - Dell Inc.)

Cozi (HKLM-x32\...\{EA1F3D6C-A6F5-4CDC-B0D3-9C56C06B4D29}) (Version: 1.0.6505.38692 - Cozi Group, Inc.)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Dell Data Vault (Version: 4.3.5.1 - Dell Inc.) Hidden

Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 9.4.67 - Dell Inc.)

Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.67 - Dell Inc.)

Dell DataSafe Online (HKLM-x32\...\{C53BCCBE-9268-4C09-82E9-611444A73B3F}) (Version: 2.10.1.3 - Dell)

Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)

Dell Getting Started Guide (HKLM-x32\...\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.)

Dell Home Systems Service Agreement (HKLM-x32\...\{AB2FDE4F-6BED-4E9E-B676-3DCCEBB1FBFE}) (Version: 2.0.0 - Dell Inc.)

Dell MusicStage (HKLM-x32\...\{3BD7DD08-991B-4A2F-A165-614ED14EAADD}) (Version: 1.6.225.0 - Fingertapps)

Dell PhotoStage (HKLM-x32\...\{E4335E82-17B3-460F-9E70-39D9BC269DB3}) (Version: 1.5.0.130 - ArcSoft)

Dell Product Registration (HKLM-x32\...\{2A0F2CC5-3065-492C-8380-B03AA7106B1A}) (Version: 1.1.3 - Dell Inc.)

Dell Stage (HKLM-x32\...\{FE182796-F6BA-486A-8590-89B7E8D1D60F}) (Version: 1.7.209.0 - Fingertapps)

Dell Stage Remote (HKLM-x32\...\{2299EEBD-0A83-4B26-AA4A-057AE9E5BAE8}) (Version: 2.0.0.50 - ArcSoft)

Dell Stage Remote (HKLM-x32\...\{AF4D3C63-009B-4A17-B02E-D395065DD3F0}) (Version: 2.0.0.50 - ArcSoft)

Dell SupportAssist (HKLM\...\PC-Doctor for Windows) (Version: 1.1.6664.93 - Dell)

Dell SupportAssistAgent (HKLM-x32\...\{287348C8-8B47-4C36-AF28-441A3B7D8722}) (Version: 1.1.1.14 - Dell)

Dell Tech Concierge (HKLM\...\Dell Tech Concierge_is1) (Version: 2.004.032.2555.01 - Dell)

Dell Touchpad (HKLM\...\Elantech) (Version: 10.3.0.49 - ELAN Microelectronic Corp.)

Dell Update (HKLM-x32\...\{DB82968B-57A4-4397-81A5-ECAB21B5DFCD}) (Version: 1.7.1015.0 - Dell Inc.)

Dell VideoStage  (HKLM-x32\...\InstallShield_{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}) (Version: 1.3.0.2513 - CyberLink Corp.)

Dell VideoStage  (x32 Version: 1.3.0.2513 - CyberLink Corp.) Hidden

Dell Webcam Central (HKLM-x32\...\Dell Webcam Central) (Version: 2.00.44 - Creative Technology Ltd)

Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95 - WildTangent) Hidden

Dora's World Adventure (x32 Version: 2.2.0.95 - WildTangent) Hidden

eBay (HKLM-x32\...\{A8B88634-7F90-402F-B66A-86429755F6A5}) (Version: 1.4.0 - eBay Inc.)

Escape Whisper Valley (x32 Version: 2.2.0.95 - WildTangent) Hidden

Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden

FATE (x32 Version: 2.2.0.95 - WildTangent) Hidden

Final Drive Fury (x32 Version: 2.2.0.95 - WildTangent) Hidden

Final Drive Nitro (x32 Version: 2.2.0.95 - WildTangent) Hidden

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 47.0.2526.73 - Google Inc.)

Google Earth (HKLM-x32\...\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)

Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6904.2028 - Google Inc.)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) Hidden

HP ENVY 4500 series Basic Device Software (HKLM\...\{6915424E-704F-4F5D-9057-9C7B406B36DB}) (Version: 32.3.198.49673 - Hewlett-Packard Co.)

HP ENVY 4500 series Help (HKLM-x32\...\{95BECC50-22B4-4FCA-8A2E-BF77713E6D3A}) (Version: 30.0.0 - Hewlett Packard)

HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)

HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)

HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)

HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden

Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)

Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.1.1399 - Intel Corporation)

Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2626 - Intel Corporation)

Intel® PROSet/Wireless for Bluetooth® 3.0 + High Speed (HKLM\...\{2C0E6BD4-65B1-4E82-B2AC-43EFFC8F100C}) (Version: 15.0.0.0059 - Intel Corporation)

Intel® PROSet/Wireless Software for Bluetooth® Technology (HKLM\...\{F0932859-AA60-459E-B843-0BDECA34E2C7}) (Version: 2.0.0.0086 - Intel Corporation)

Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)

Intel® Turbo Boost Technology Monitor 2.0 (HKLM\...\{B77EFA0B-9BD3-4122-9F9A-15A963B5EA24}) (Version: 2.1.23.0 - Intel)

Intel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.3.214 - Intel Corporation)

Intel® PROSet/Wireless WiFi Software (HKLM\...\{DF7756DD-656A-45C3-BA71-74673E8259A9}) (Version: 15.00.0000.0642 - Intel Corporation)

Intel® Trusted Connect Service Client (HKLM\...\{538B98C3-773F-4F20-9C66-802D104DCBE2}) (Version: 1.23.219.2 - Intel Corporation)

iTunes (HKLM\...\{6CF1A7E2-8001-4870-9F18-3C6CDD6FE9E3}) (Version: 12.2.1.16 - Apple Inc.)

Jewel Quest (x32 Version: 2.2.0.95 - WildTangent) Hidden

Jewel Quest Solitaire 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden

Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Luxor (x32 Version: 2.2.0.95 - WildTangent) Hidden

McAfee Total Protection (HKLM-x32\...\MSC) (Version: 14.0.5120 - McAfee, Inc.)

McAfee WebAdvisor (HKLM-x32\...\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}) (Version: 4.0.184 - McAfee, Inc.)

Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)

Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 15.0.4745.1002 - Microsoft Corporation)

Microsoft Office Click-to-Run 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office Starter 2010 - English (HKLM-x32\...\{90140011-0066-0409-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft OneDrive (HKU\S-1-5-21-3143995118-350638234-3666185585-1001\...\OneDriveSetup.exe) (Version: 17.0.4035.0328 - Microsoft Corporation)

Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0409-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

Namco All-Stars PAC-MAN (x32 Version: 2.2.0.95 - WildTangent) Hidden

Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4745.1002 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Licensing Component (Version: 15.0.4745.1002 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4745.1002 - Microsoft Corporation) Hidden

Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden

Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden

PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)

PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)

Poker Superstars III (x32 Version: 2.2.0.95 - WildTangent) Hidden

Polar Bowler (x32 Version: 2.2.0.95 - WildTangent) Hidden

Polar Golfer (x32 Version: 2.2.0.95 - WildTangent) Hidden

Premium Service Agreement (HKLM-x32\...\{C33AA6D6-F5EC-48F3-AFDC-8141345D473A}) (Version: 2.0.0 - Dell Inc.)

Product Improvement Study for HP ENVY 4500 series (HKLM\...\{58139103-BACF-4BDC-B71C-955F9164ADA6}) (Version: 32.3.198.49673 - Hewlett-Packard Co.)

QualxServ Service Agreement (HKLM-x32\...\{903679E8-44C8-4C07-9600-05C92654FC50}) (Version: 2.0.0 - Dell Inc.)

Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 10.14.010 - Dell Inc.)

QuickTime 7 (HKLM-x32\...\{80CEEB1E-0A6C-45B9-A312-37A1D25FDEBC}) (Version: 7.78.80.95 - Apple Inc.)

RealDownloader (x32 Version: 17.0.9 - RealNetworks, Inc.) Hidden

RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden

RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden

RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden

RealPlayer Cloud (HKLM-x32\...\RealPlayer 17.0) (Version: 17.0.9 - RealNetworks)

Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7601.39019 - Realtek Semiconductor Corp.)

RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden

Samantha Swift (x32 Version: 2.2.0.95 - WildTangent) Hidden

Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)

Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.5.0.9082 - Microsoft Corporation)

Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)

SyncUP (HKLM-x32\...\{D92C9CCE-E5F0-4125-977A-0590F3225B74}) (Version: 10.2.16100 - Nero AG)

SyncUP (x32 Version: 1.12.12400.17.102 - Nero AG) Hidden

Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden

UpdateService (x32 Version: 1.0.0 - RealNetworks, Inc.) Hidden

Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.95 - WildTangent) Hidden

Wedding Dash - Ready, Aim, Love! (x32 Version: 2.2.0.95 - WildTangent) Hidden

WildTangent Games (HKLM-x32\...\WildTangent dell Master Uninstall) (Version: 1.0.2.5 - WildTangent)

WildTangent Games App (Dell Games) (x32 Version: 4.0.11.14 - WildTangent) Hidden

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)

Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)

Zinio Reader 4 (HKLM-x32\...\ZinioReader4) (Version: 4.2.4164 - Zinio LLC)

Zinio Reader 4 (x32 Version: 4.2.4164 - Zinio LLC) Hidden

Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

 

==================== Custom CLSID (Whitelisted): ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

CustomCLSID: HKU\S-1-5-21-3143995118-350638234-3666185585-1001_Classes\CLSID\{4EA6BBD4-E775-4b7e-80FD-3651749850B0}\localserver32 -> C:\Users\Rick\AppData\Local\Charter\Charter TV Player\CaptureServer64.exe (Cisco)

 

==================== Restore Points =========================

 

01-12-2015 21:08:38 Windows Update

01-12-2015 21:41:43 Dell Update: eDellRoot Removal

01-12-2015 21:42:11 Dell Update: DSD Cert Removal

02-12-2015 03:00:19 Windows Update

05-12-2015 13:08:51 Windows Update

 

==================== Hosts content: ===============================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2009-07-13 21:34 - 2015-06-17 11:06 - 00000732 ____A C:\Windows\system32\Drivers\etc\hosts

 

127.0.0.1       localhost

 

==================== Scheduled Tasks (Whitelisted) =============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

Task: {024A49B8-7C51-4D63-BA1B-15151CEF1B41} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)

Task: {08746F9C-300A-400D-890F-54BD62FB5401} - System32\Tasks\Dell SupportAssistAgent AutoUpdate => C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssist.exe [2015-09-30] (Dell Inc.)

Task: {090ACE5D-EFFA-4281-96F5-F06586C55544} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3143995118-350638234-3666185585-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe

Task: {0A87A82F-94D6-40A0-B562-C0FBCDDD7234} - System32\Tasks\GoogleUpdateTaskMachineUA1d041b2c7ee9019 => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)

Task: {0E7D085D-91F4-4EBE-B80B-BF0480E44425} - \Microsoft\Windows\Windows Activation Technologies\ValidationTask -> No File <==== ATTENTION

Task: {19E9E464-DD15-40C4-859E-F0ECDF7DF978} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe

Task: {2C5877B3-D86A-4DEB-A7B5-75C77FCC3EED} - System32\Tasks\GoogleUpdateTaskMachineUA1d0f17672a64b8c => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)

Task: {2F05C12C-1D43-4AE2-B59C-E56CCBE55260} - System32\Tasks\McAfee Remediation (Prepare) => C:\Program Files\Common Files\AV\McAfee Anti-Virus And Anti-Spyware\upgrade.exe [2015-09-01] (McAfee, Inc.)

Task: {2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C} - \Microsoft\Windows\WindowsBackup\ConfigNotification -> No File <==== ATTENTION

Task: {303A9616-CC6A-4823-8293-BC89C22513AB} - \Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline -> No File <==== ATTENTION

Task: {3390CB38-A725-4707-939E-609C724AC1AD} - System32\Tasks\GoogleUpdateTaskMachineCore1d0f176716e633b => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)

Task: {45C77859-6DDB-4BDF-B64C-8BAE57E035A2} - System32\Tasks\{59075092-9013-4FC6-8AA5-2787580DFBE5} => C:\Program Files\Microsoft Office 15\root\office15\MSOUC.EXE [2015-07-21] (Microsoft Corporation)

Task: {67852207-52CA-4766-8905-C5F2649FB37F} - System32\Tasks\{75A5E33B-5165-4789-A2F4-200C51766223} => pcalua.exe -a C:\ProgramData\SafeMonitor\uninstall.exe -c /kb=y /ic=1

Task: {68B7B3EC-2FE4-4F03-A477-277CCCF48E0A} - System32\Tasks\RNUpgradeHelperResumePrompt_Rick => C:\Users\Rick\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\14.00\agent\rnupgagent.exe [2015-09-07] (RealNetworks, Inc.)

Task: {6B9BEE75-2E4E-4125-AFAE-9EE087CDD8B4} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3143995118-350638234-3666185585-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe

Task: {6ECF3069-99F4-49ED-BA52-784AEA1316EF} - System32\Tasks\{B8C05F57-B189-440D-942F-F9B85345394B} => C:\Program Files\Microsoft Office 15\root\office15\WINWORD.EXE [2015-07-14] (Microsoft Corporation)

Task: {6FB4D4C2-19B6-41AD-AA57-711E79AEECA6} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-14] (Microsoft Corporation)

Task: {74DD00ED-2133-47D1-B055-82C5A338ECC0} - System32\Tasks\{2F476CA7-A476-4232-B5F9-0026B0A4FA3F} => C:\Program Files\Microsoft Office 15\root\office15\WINWORD.EXE [2015-07-14] (Microsoft Corporation)

Task: {7B3047D4-7E20-4E8B-8672-E699434580BF} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {8D2547B8-63A7-4664-AAD4-60E65E1A1B27} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-3143995118-350638234-3666185585-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe

Task: {949D3E9B-33BD-4A3E-825E-1B82F9D9D54B} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell\SupportAssist\uaclauncher.exe [2015-10-29] (PC-Doctor, Inc.)

Task: {9CD19698-7E8F-47CB-A6A0-353BF8B2EDC5} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-14] (Microsoft Corporation)

Task: {A23FFBE1-7DE2-4738-8ADC-B7EF10C8CF88} - System32\Tasks\Microsoft Office 15 Sync Maintenance for mycomputer122-Rick mycomputer122 => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-06-02] (Microsoft Corporation)

Task: {A567F594-2F73-4146-92E2-067C716EA2E0} - System32\Tasks\ReclaimerUpdateXML_Rick => C:\Users\Rick\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\14.00\agent\rnupgagent.exe [2015-09-07] (RealNetworks, Inc.)

Task: {A6A79D56-C841-4513-87C0-9FD648355F5A} - System32\Tasks\{2B29EC04-C8F4-4115-A37E-17E64F4A5788} => C:\Program Files\Microsoft Office 15\root\office15\WINWORD.EXE [2015-07-14] (Microsoft Corporation)

Task: {AB58AE50-F06B-4882-9A60-41D85660265F} - System32\Tasks\Games\UpdateCheck_S-1-5-21-3143995118-350638234-3666185585-1001

Task: {AC4E5ACF-89F7-4220-BA21-81EE183975E2} - \Microsoft\Windows\Application Experience\AitAgent -> No File <==== ATTENTION

Task: {B6E4A263-C910-4893-B7E9-3259AE1AC7B6} - System32\Tasks\{43C61436-9C9C-48B1-B7A9-C2B79655F2E1} => C:\Program Files\Microsoft Office 15\root\office15\MSOUC.EXE [2015-07-21] (Microsoft Corporation)

Task: {B894905A-4AED-4871-A5FE-459A2BBD2AD1} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-07-14] (Microsoft Corporation)

Task: {C473E6C0-BD90-4859-AAA1-9E1577002E6A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-11-16] (Adobe Systems Incorporated)

Task: {C9AB5C29-6788-4B6C-8D9B-C055002D7E5E} - System32\Tasks\{2C5F501D-11E3-4DDF-BC8D-599DF1E5E864} => C:\Program Files\Microsoft Office 15\root\office15\WINWORD.EXE [2015-07-14] (Microsoft Corporation)

Task: {CDB6F143-A92E-4491-BE26-524FA1E23EAC} - System32\Tasks\{EE1FD0D0-76C0-46BE-A0B6-73D32E66C016} => C:\Program Files\Microsoft Office 15\root\office15\MSOUC.EXE [2015-07-21] (Microsoft Corporation)

Task: {CEE64558-E1A7-4D9D-80A7-2001912BE5B5} - \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector -> No File <==== ATTENTION

Task: {CEF8624E-C4DB-4A09-85CF-0F7878FE7267} - System32\Tasks\RNUpgradeHelperLogonPrompt_Rick => C:\Users\Rick\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\14.00\agent\rnupgagent.exe [2015-09-07] (RealNetworks, Inc.)

Task: {D2471822-54B4-4A5E-8E53-5F404FBA9104} - System32\Tasks\HPCustParticipation HP ENVY 4500 series => C:\Program Files\HP\HP ENVY 4500 series\Bin\HPCustPartic.exe [2014-07-21] (Hewlett-Packard Development Company, LP)

Task: {D2B30C7A-D350-4816-938E-90688504F4CC} - System32\Tasks\{9CB67270-6B1B-47A2-8AA0-D54492D802F4} => C:\Program Files\Microsoft Office 15\root\office15\WINWORD.EXE [2015-07-14] (Microsoft Corporation)

Task: {D5B63E51-851E-43C2-8DD6-37257CB63229} - System32\Tasks\{9EA1EBE9-F188-4036-8918-650AC5435BA5} => C:\Program Files\Microsoft Office 15\root\office15\WINWORD.EXE [2015-07-14] (Microsoft Corporation)

Task: {D60FEC54-5B73-4DEB-8B23-EE9F5DEB832B} - System32\Tasks\McAfeeLogon => C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe [2015-09-01] (McAfee, Inc.)

Task: {D6E33B04-54B4-477F-835A-CC52051B5755} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\Dell\SupportAssist\sessionchecker.exe [2015-10-29] (PC-Doctor, Inc.)

Task: {D7DE1FD6-2A55-453C-9324-6EFDA14AB4A1} - \SUPERAntiSpyware Scheduled Task f366d7cd-0a59-4383-91a5-9c900e68341e -> No File <==== ATTENTION

Task: {DF04E885-9D37-423A-BB74-547AAF0A612C} - System32\Tasks\Adobe online update program => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)

Task: {E3AC2565-7B1D-40CE-BAD3-DAC6BD9B345C} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)

Task: {EC09A429-1187-4574-BFFF-7FB60572AD57} - System32\Tasks\ReclaimerUpdateFiles_Rick => C:\Users\Rick\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\14.00\agent\rnupgagent.exe [2015-09-07] (RealNetworks, Inc.)

Task: {ECDA911D-5A7C-4AEB-8D10-85EA63156527} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)

Task: {ED32BCFF-FF21-44AB-941C-225ACF1818EF} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3143995118-350638234-3666185585-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe

Task: {F331C421-2C70-4A33-8F2D-80D60D2E62BB} - \SUPERAntiSpyware Scheduled Task 01b12693-a388-4489-933f-d2ed2c4619c9 -> No File <==== ATTENTION

Task: {F8E42A73-BDF0-474B-9CC4-AFBA75BBB44C} - System32\Tasks\Real Player online update program => c:\program files (x86)\real\realplayer\Update\realsched.exe

Task: {FA2BC0A6-8D4B-458A-85C8-2B8C72487513} - \Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector -> No File <==== ATTENTION

Task: {FE2B0577-8E62-4C50-8FE0-D3433B9EEAA6} - System32\Tasks\{A1138B33-5A28-4A85-8399-D024093B4520} => pcalua.exe -a "C:\Program Files (x86)\The Weather Channel\The Weather Channel App\TheWeatherChannelCustomUninstall.exe"

Task: {FFDA6FF9-4C1B-418F-8203-15F350459155} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-11-16] (Piriform Ltd)

 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

 

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0f176716e633b.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA1d041b2c7ee9019.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA1d0f17672a64b8c.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

 

==================== Shortcuts =============================

 

(The entries could be listed to be restored or removed.)

 

ShortcutWithArgument: C:\Users\Public\Desktop\eBay.lnk -> C:\Program Files (x86)\eBay\Browser Launcher.exe (eBay Inc.) -> hxxp://rover.ebay.com/rover/1/711-86042-13409-1/4?mpre=hxxp://ebay.com <==== ATTENTION

 

==================== Loaded Modules (Whitelisted) ==============

 

2015-05-15 15:26 - 2015-05-15 15:26 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

2015-05-15 15:26 - 2015-05-15 15:26 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

2014-05-06 10:42 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll

2015-03-17 12:05 - 2015-01-27 10:29 - 08898720 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll

2012-05-27 19:39 - 2012-01-19 10:48 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2011-08-08 18:26 - 2011-08-08 18:26 - 02034752 _____ () C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe

2015-10-29 13:21 - 2015-10-29 13:21 - 00004096 _____ () C:\ProgramData\PrhbKsp32AC0.dll

2015-11-03 18:25 - 2015-11-03 18:25 - 00004096 _____ () C:\ProgramData\igfxCUIService.exe

2011-08-08 18:26 - 2011-08-08 18:26 - 00475200 _____ () C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe

2015-11-02 19:44 - 2015-11-02 19:44 - 00004096 _____ () C:\ProgramData\RuntimeBroker.exe

2015-11-06 14:36 - 2015-11-06 14:36 - 00004096 _____ () C:\ProgramData\vssadmin_32.exe

2012-05-27 18:19 - 2012-01-10 15:36 - 00159360 _____ () C:\Program Files\Conexant\SA3\MaxxAudioWrapper.dll

2015-05-10 13:24 - 2015-05-10 13:24 - 01471480 _____ () C:\Users\Rick\AppData\Local\Charter\Charter TV Player\NDSPCShowServer.exe

2012-02-01 11:50 - 2012-02-01 11:50 - 00968048 _____ () C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe

2012-05-27 18:27 - 2012-01-26 21:49 - 02751808 ____N () C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE

2012-05-27 18:20 - 2011-11-29 20:00 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll

2012-05-27 18:20 - 2012-01-21 06:23 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll

2010-03-16 20:28 - 2010-03-16 20:28 - 01926144 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtCore4.dll

2010-03-22 15:52 - 2010-03-22 15:52 - 06776832 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtGui4.dll

2010-03-16 20:28 - 2010-03-16 20:28 - 00635904 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtNetwork4.dll

2010-03-16 20:28 - 2010-03-16 20:28 - 00326144 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtXml4.dll

2011-06-24 23:20 - 2011-06-24 23:20 - 00565968 _____ () C:\Program Files (x86)\Dell\Stage Remote\sqlite3.dll

2011-07-17 10:35 - 2011-07-17 10:35 - 00058944 _____ () C:\Program Files (x86)\Dell\Stage Remote\DataService.dll

2011-07-21 08:36 - 2011-07-21 08:36 - 00327744 _____ () C:\Program Files (x86)\Dell\Stage Remote\en-US\UI\ManagerUI.dll

2010-03-11 19:52 - 2010-03-11 19:52 - 00028160 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qgif4.dll

2010-03-05 15:07 - 2010-03-05 15:07 - 00031744 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qico4.dll

2010-03-05 15:07 - 2010-03-05 15:07 - 00125952 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qjpeg4.dll

2010-03-11 19:52 - 2010-03-11 19:52 - 00225280 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qmng4.dll

2011-12-31 17:04 - 2011-12-31 17:04 - 00251688 _____ () C:\Program Files (x86)\Nero\SyncUP\System.ComponentModel.Composition.dll

2011-12-31 17:04 - 2011-12-31 17:04 - 00891688 _____ () C:\Program Files (x86)\Nero\SyncUP\System.Data.SQLite.dll

2015-05-10 13:24 - 2015-05-10 13:24 - 12583920 _____ () C:\Users\Rick\AppData\Local\Charter\Charter TV Player\PCShowServer.dll

2015-05-10 13:24 - 2015-05-10 13:24 - 03410416 _____ () C:\Users\Rick\AppData\Local\Charter\Charter TV Player\DrmSingleton.dll

2015-05-10 13:25 - 2015-05-10 13:25 - 00338928 _____ () C:\Users\Rick\AppData\Local\Charter\Charter TV Player\ndsLogStore.dll

2015-05-10 13:24 - 2015-05-10 13:24 - 02182136 _____ () C:\Users\Rick\AppData\Local\Charter\Charter TV Player\DiscoveryManager.dll

2015-05-10 13:24 - 2015-05-10 13:24 - 24985064 _____ () C:\Users\Rick\AppData\Local\Charter\Charter TV Player\libcef.dll

2015-05-10 13:24 - 2015-05-10 13:24 - 00742384 _____ () C:\Users\Rick\AppData\Local\Charter\Charter TV Player\libglesv2.dll

2015-05-10 13:24 - 2015-05-10 13:24 - 00136168 _____ () C:\Users\Rick\AppData\Local\Charter\Charter TV Player\libegl.dll

2015-05-10 13:24 - 2015-05-10 13:24 - 02137584 _____ () C:\Users\Rick\AppData\Local\Charter\Charter TV Player\PlayerCore.dll

2015-05-10 13:25 - 2015-05-10 13:25 - 00688640 _____ () C:\Users\Rick\AppData\Local\Charter\Charter TV Player\libgstreamer-0.10.dll

2015-05-10 13:25 - 2015-05-10 13:25 - 01402864 _____ () C:\Users\Rick\AppData\Local\Charter\Charter TV Player\libxml2-2.dll

2015-05-10 13:25 - 2015-05-10 13:25 - 00091616 _____ () C:\Users\Rick\AppData\Local\Charter\Charter TV Player\z.dll

2015-05-10 13:25 - 2015-05-10 13:25 - 00205304 _____ () C:\Users\Rick\AppData\Local\Charter\Charter TV Player\libgstbase-0.10.dll

2015-05-10 13:25 - 2015-05-10 13:25 - 00059912 _____ () C:\Users\Rick\AppData\Local\Charter\Charter TV Player\libgstinterfaces-0.10.dll

2015-05-10 13:25 - 2015-05-10 13:25 - 00043512 _____ () C:\Users\Rick\AppData\Local\Charter\Charter TV Player\libgstvideo-0.10.dll

2015-05-10 13:25 - 2015-05-10 13:25 - 00044536 _____ () C:\Users\Rick\AppData\Local\Charter\Charter TV Player\libgstapp-0.10.dll

2015-05-10 13:24 - 2015-05-10 13:24 - 11356144 _____ () C:\Users\Rick\AppData\Local\Charter\Charter TV Player\gsttspplugin.dll

2012-02-01 11:44 - 2012-02-01 11:44 - 08151040 _____ () C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\QtGui4.dll

2012-02-01 11:44 - 2012-02-01 11:44 - 02278400 _____ () C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\QtCore4.dll

2015-12-02 07:28 - 2015-11-24 03:00 - 01583432 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.73\libglesv2.dll

2015-12-02 07:28 - 2015-11-24 03:00 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.73\libegl.dll

 

==================== Alternate Data Streams (Whitelisted) =========

 

(If an entry is included in the fixlist, only the ADS will be removed.)

 

 

==================== Safe Mode (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\UnsignedThemes => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Dell Tech Concierge => "DisplayName"="Dell"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Dell Tech Concierge => "ErrorControl"="1"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Dell Tech Concierge => "ImagePath"="C:\Program Files\Dell\Tech Concierge\srvc.exe"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Dell Tech Concierge => "ObjectName"="LocalSystem"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Dell Tech Concierge => "Start"="2"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Dell Tech Concierge => "Type"="272"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Dell Tech Concierge\Parameters => "Application"="C:\Program Files\Dell\Tech Concierge\srvc.exe"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Dell Tech Concierge\Parameters => "AppParameters"=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McNaiAnn => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfemms => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSIServer => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SMPCHelper => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\tvnserver => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\UnsignedThemes => ""="Service"

 

==================== EXE Association (Whitelisted) ===============

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

 

 

==================== Internet Explorer trusted/restricted ===============

 

(If an entry is included in the fixlist, it will be removed from the registry.)

 

 

==================== Other Areas ============================

 

(Currently there is no automatic fix for this section.)

 

HKU\S-1-5-21-3143995118-350638234-3666185585-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Rick\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 192.168.0.1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

 

==================== MSCONFIG/TASK MANAGER disabled items ==

 

(Currently there is no automatic fix for this section.)

 

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^RealPlayer Cloud Service UI.lnk => C:\Windows\pss\RealPlayer Cloud Service UI.lnk.CommonStartup

MSCONFIG\startupfolder: C:^Users^Rick^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Intel® Turbo Boost Technology Monitor 2.0.lnk => C:\Windows\pss\Intel® Turbo Boost Technology Monitor 2.0.lnk.Startup

MSCONFIG\startupreg: Dell Registration => C:\Program Files (x86)\System Registration\prodreg.exe /boot

 

==================== FirewallRules (Whitelisted) ===============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

FirewallRules: [{E77163EB-6B2F-4026-9F74-D57018BD8D81}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe

FirewallRules: [{D302A44D-2F6D-4AEB-8D8B-EF19BD80E56C}] => (Allow) c:\Program Files (x86)\Dell\VideoStage\VideoStage.exe

FirewallRules: [{D92A013E-1BC8-4C55-B758-A6B7F03AF48F}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

FirewallRules: [{7DEEB506-016C-4A66-9F72-FE7443873282}] => (Allow) LPort=2869

FirewallRules: [{FA634725-987F-4945-9F40-C861FDC9AA14}] => (Allow) LPort=1900

FirewallRules: [{93836011-5E0B-4B79-93FF-E0E85DC42AF1}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe

FirewallRules: [{8A27CE79-CEED-44D5-A442-8744CCD5EF80}] => (Allow) LPort=9700

FirewallRules: [{CB30298F-4CEB-4719-8FAE-681CADAD6E02}] => (Allow) LPort=9701

FirewallRules: [{2F5C35BB-050D-41AF-85C8-9FFBE0274745}] => (Allow) LPort=9702

FirewallRules: [{1E634D67-B352-4AFE-A9C8-B4C5F1092D7F}] => (Allow) LPort=9700

FirewallRules: [{D67A358D-7E49-4BFB-AE10-ECB913CC5190}] => (Allow) C:\Program Files (x86)\Dell\Stage Remote\Controller.exe

FirewallRules: [{29E4FF75-220B-4ABF-91E3-159DDBC83AFB}] => (Allow) C:\Program Files (x86)\Dell\Stage Remote\DMR.exe

FirewallRules: [{66BB94FD-B898-4548-8DBD-EF35AEDB42B1}] => (Allow) C:\Program Files (x86)\Dell\Stage Remote\InstallerHelp.exe

FirewallRules: [{1A4079CF-22A9-49D2-8501-462E77795F7D}] => (Allow) C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe

FirewallRules: [{401A80A9-FC5D-43AC-9783-25AFD2F19147}] => (Allow) C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe

FirewallRules: [{D940C8C1-BA97-43A0-8DD3-D562D6F2C661}] => (Allow) C:\Program Files (x86)\Dell\Stage Remote\Controller.exe

FirewallRules: [{7E21F1A8-D03D-4026-9CAF-C723CB9A65DE}] => (Allow) C:\Program Files (x86)\Dell\Stage Remote\DMR.exe

FirewallRules: [{8CC129A0-4D02-4CC2-8AC9-DB06F985C468}] => (Allow) C:\Program Files (x86)\Dell\Stage Remote\InstallerHelp.exe

FirewallRules: [{8C6FEA53-58E2-47B6-BAFF-11ED665F5EE2}] => (Allow) C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe

FirewallRules: [{0929A6C5-C4A7-436F-B3AD-FF75291D903C}] => (Allow) C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe

FirewallRules: [{279C9C88-77BB-4FA7-947B-F6572E0077DB}] => (Allow) C:\Program Files (x86)\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe

FirewallRules: [{4DFFC6F2-0AF6-45B2-A780-17EA37144522}] => (Allow) C:\Program Files (x86)\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe

FirewallRules: [TCP Query User{F8B76B08-7D02-40F0-AD16-8F02668D1DE2}C:\program files (x86)\dell\dell datasafe online\nobuclient.exe] => (Allow) C:\program files (x86)\dell\dell datasafe online\nobuclient.exe

FirewallRules: [uDP Query User{37C9D072-782F-4EDB-B3DD-C7E1636D23A4}C:\program files (x86)\dell\dell datasafe online\nobuclient.exe] => (Allow) C:\program files (x86)\dell\dell datasafe online\nobuclient.exe

FirewallRules: [TCP Query User{633081C9-D3E8-40F7-92E2-B186F71DF791}C:\program files (x86)\dell\dell datasafe online\nobuclient.exe] => (Allow) C:\program files (x86)\dell\dell datasafe online\nobuclient.exe

FirewallRules: [uDP Query User{E6E01EC3-64EE-4009-8022-93C70FF2BC0F}C:\program files (x86)\dell\dell datasafe online\nobuclient.exe] => (Allow) C:\program files (x86)\dell\dell datasafe online\nobuclient.exe

FirewallRules: [{9D0285CC-DEA9-4C70-863E-96BA54258D37}] => (Allow) C:\Users\Rick\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe

FirewallRules: [{E7EBCEF6-5C59-4727-895A-54B8DDFDE748}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe

FirewallRules: [{28F367B4-904E-49CD-935D-1A58D9D0E2BB}] => (Allow) c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe

FirewallRules: [{FC58EF90-283C-46DC-B2A5-A4E38ACB4622}] => (Allow) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe

FirewallRules: [{A120EB5F-CEA3-41DB-A99A-5631998BA5DB}] => (Allow) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe

FirewallRules: [{9E9D38B8-8EA4-4829-9F08-BFDA2314E38F}] => (Allow) C:\Program Files (x86)\Nero\Nero Blu-ray Player\Blu-rayPlayer.exe

FirewallRules: [{FD758636-F3D9-47AF-A63D-F2FA6DE512AE}] => (Allow) C:\Program Files (x86)\Nero\Nero Blu-ray Player\Blu-rayPlayer.exe

FirewallRules: [{9D4E2624-51DF-478D-9BBC-B237026EFE43}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{248EDCE3-822E-47BD-8B26-4F47BD1DE854}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{95966F97-87B8-4336-B88F-7CCF7D76EEC3}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{4EAD3A57-1A76-44CB-B417-81CCA031B4FD}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{8A43DD51-FA2F-4FAD-90D6-B4D62EB40F53}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe

FirewallRules: [{5BD43663-994C-4435-984B-454549C8F620}] => (Allow) C:\Program Files\iTunes\iTunes.exe

FirewallRules: [{01CFA20E-5E64-4C77-B160-5EFC3B469866}] => (Allow) C:\Program Files\Dell\Tech Concierge\cust.exe

FirewallRules: [{9514BFA6-7E9C-4551-AC98-DA0BDC7AE9EA}] => (Allow) C:\Program Files\HP\HP ENVY 4500 series\Bin\DeviceSetup.exe

FirewallRules: [{7CBD8391-1BB1-4CB2-A3BB-B896562E278E}] => (Allow) LPort=5357

FirewallRules: [{FECD52CB-50CF-44A6-85EE-057D398C34C9}] => (Allow) C:\Program Files\HP\HP ENVY 4500 series\Bin\HPNetworkCommunicatorCom.exe

FirewallRules: [{FD55BD90-C684-4E2D-969A-6AEA38607AFA}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

 

==================== Faulty Device Manager Devices =============

 

 

==================== Event log errors: =========================

 

Application errors:

==================

Error: (12/02/2015 10:50:44 PM) (Source: CVHSVC) (EventID: 100) (User: )

Description: Information only.

(Stream product id=0x0066): Streaming Failed

 

Error: (12/02/2015 10:50:13 PM) (Source: CVHSVC) (EventID: 100) (User: )

Description: Information only.

Too many failures while downloading ranges: 2

 

Error: (12/02/2015 10:48:53 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

Error: (12/02/2015 09:20:44 PM) (Source: MsiInstaller) (EventID: 11606) (User: NT AUTHORITY)

Description: Product: Adobe AIR -- Error 1606. Could not access network location (computed).

 

Error: (12/02/2015 09:20:44 PM) (Source: MsiInstaller) (EventID: 11606) (User: NT AUTHORITY)

Description: Product: Adobe AIR -- Error 1606. Could not access network location (computed).

 

Error: (12/02/2015 08:55:08 PM) (Source: Microsoft Office 15) (EventID: 2001) (User: )

Description: Microsoft Outlook: Rejected Safe Mode action : Outlook couldn't start last time. Safe mode could help you troubleshoot the problem, but some features might not be available in this mode.

 

Do you want to start in safe mode?.

Rejected Safe Mode action : Microsoft Outlook.

 

Error: (12/02/2015 05:49:29 PM) (Source: CVHSVC) (EventID: 100) (User: )

Description: Information only.

(Stream product id=0x0066): Streaming Failed

 

Error: (12/02/2015 05:48:58 PM) (Source: CVHSVC) (EventID: 100) (User: )

Description: Information only.

Too many failures while downloading ranges: 2

 

Error: (12/02/2015 05:47:36 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

Error: (12/02/2015 05:43:23 PM) (Source: Application Virtualization Client) (EventID: 3008) (User: )

Description: {hap=12:app=OfficeVirt 9014006604090000:tid=EBC}

The client was unable to connect to an Application Virtualization Server (rc 16D1160A-0000E028)

 

 

System errors:

=============

Error: (12/05/2015 01:27:44 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)

Description: The following fatal alert was generated: 10. The internal error state is 10.

 

Error: (12/05/2015 01:27:44 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)

Description: The following fatal alert was generated: 10. The internal error state is 10.

 

Error: (12/05/2015 01:27:14 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)

Description: The following fatal alert was generated: 10. The internal error state is 10.

 

Error: (12/05/2015 01:27:14 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)

Description: The following fatal alert was generated: 10. The internal error state is 10.

 

Error: (12/05/2015 01:07:32 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)

Description: The following fatal alert was generated: 10. The internal error state is 10.

 

Error: (12/05/2015 01:07:32 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)

Description: The following fatal alert was generated: 10. The internal error state is 10.

 

Error: (12/05/2015 01:07:00 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)

Description: The following fatal alert was generated: 10. The internal error state is 10.

 

Error: (12/05/2015 01:07:00 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)

Description: The following fatal alert was generated: 10. The internal error state is 10.

 

Error: (12/05/2015 01:06:30 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)

Description: The following fatal alert was generated: 10. The internal error state is 10.

 

Error: (12/05/2015 01:06:30 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)

Description: The following fatal alert was generated: 10. The internal error state is 10.

 

 

CodeIntegrity:

===================================

  Date: 2014-12-20 23:45:42.197

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\MaxxAudioAPOShell64.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2014-12-20 23:45:42.153

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\MaxxAudioAPOShell64.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2014-12-20 23:45:42.028

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\MaxxAudioAPOShell64.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2014-12-20 23:45:41.985

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\MaxxAudioAPOShell64.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2014-12-20 23:45:41.888

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\MaxxAudioAPOShell64.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2014-12-20 18:37:43.260

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\MaxxAudioAPOShell64.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2014-12-20 18:37:43.219

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\MaxxAudioAPOShell64.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2014-12-20 18:37:43.167

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\MaxxAudioAPOShell64.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2014-12-20 18:37:43.125

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\MaxxAudioAPOShell64.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2014-12-20 18:37:43.057

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\MaxxAudioAPOShell64.dll because the set of per-page image hashes could not be found on the system.

 

 

==================== Memory info =========================== 

 

Processor: Intel® Core i5-3210M CPU @ 2.50GHz

Percentage of memory in use: 73%

Total physical RAM: 8067.35 MB

Available physical RAM: 2145.41 MB

Total Virtual: 16134.7 MB

Available Virtual: 8670.16 MB

 

==================== Drives ================================

 

Drive c: (OS) (Fixed) (Total:917.66 GB) (Free:855.86 GB) NTFS

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 931.5 GB) (Disk ID: 0DCD9F7A)

Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)

Partition 2: (Active) - (Size=13.8 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=917.7 GB) - (Type=07 NTFS)

 

==================== End of Addition.txt ============================

[TwinHeadedEagle]

Please use upload option to attach your reports. Thanks.

[r3cebarnett]

Oops sorry, I thought it said to copy and paste them > <

Addition.txt

FRST.txt

[TwinHeadedEagle]

Yes, there is indeed an infection on your PC.
 
 
Fix with Farbar Recovery Scan Tool
 

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.
 

---

Scan with ComboFix
 
This is a very powerful tool that should be used only if advised by Malware Analyst.
Do not run ComboFix on your own!
 
Referring to this instruction, please download ComboFix by sUBs and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• Accept the disclaimer and agree if prompted to install Recovery Console.
• Do not take any actions while ComboFix goes through your System - it may cause it to stall!
• This scan may take some time!
• When finished - it will display a logfile (located also on your main drive, usually C:\ComboFix.txt).
• Include that log in your next reply.
  If you'll encounter any issues with internet connection after running ComboFix, please visit this link.
  If an error about operation on the key marked for deletion will appear after running the tool, please reboot your machine.

fixlist.txt

[r3cebarnett]

Results

ComboFix.txt

Fixlog.txt

[TwinHeadedEagle]

Very good. How is your PC behaving now?

[r3cebarnett]

Seems to be doing fine, I'll try to get an MBAM install working now.

[r3cebarnett]

So I restarted, it booted up pretty quickly, however the computer is freezing periodically for anywhere from 15 seconds to 3 minutes. When I tried to install MBAM the installer still won't open unfortunately.

[r3cebarnett]

If it matters to you, in task manager there are four processes that are eating my CPU. Two instances of conhost.exe, there's a cmd.exe, and msiexec.exe that are using 15-20 percent of my CPU.

[r3cebarnett]

I think TwinHeadedEagle went to bed for now or something. I'm just gonna take the initiative and do another FRST scan and post the results if anyone else can help.

FRST.txt

Addition.txt

[TwinHeadedEagle]

Scan with TDSSKiller

Please download TDSSKiller by Kaspersky and save it to your desktop.

• Right-click on icon and select Run as Administrator to start the tool.
• Click on Change parameters and put a checkmark beside Loaded modules. A reboot will be needed to apply the changes, allow it to do so.
• Your machine may appear very slow and unusable after that - it's normal.
• TDSSKiller will run automaticaly. Click on Change parameters and click OK.
• Click the Start Scan button and wait patiently.

If anything will be found follow this guidelines:

• If a suspicious object is detected, the default action will be Skip, click on Continue.
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.

  Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.

  If Cure is not available, please choose Skip instead.

• Do not choose Delete unless instructed!

A report will be created in your root directory, (usually C:\ drive) in the form of TDSSKiller.[Version]_[Date]_[Time]_log.txt. Please include the contents of that file in your next post.

[r3cebarnett]

It won't open the same way the MBAM installer won't open. :/

[TwinHeadedEagle]

Can you rename it to something random?

[r3cebarnett]

Yes and that worked. Wow lmao

[r3cebarnett]

Well it had worked, got it to run. When I changed the parameters and rebooted, an error message came up and nothing else happened as it rebooted as normal. I tried opening the program up again, and the program won't open even after renaming it again.

[r3cebarnett]

Got it to run again, upon reboot the error "Windows cannot find '{F58369B0-F807-4DC1-BA89-39CD975A14F8}.exe' Make sure you typed the name correctly, and then try again." popped up.

[r3cebarnett]

Ran the program, tried to scan it without changing the parameters, found a threat. Hopefully I'll be able to do more now.

[r3cebarnett]

Everything's working 100% now. I really appreciate your help!

[TwinHeadedEagle]

Would you be so kind to attach TDSSKiller report?

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!