Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

apologies in advance - another 'MBR Whistler-C [Rtk] issue'


  • This topic is locked This topic is locked
26 replies to this topic

#1 NTstateOFmind

NTstateOFmind

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:04 PM

Posted 19 January 2014 - 11:22 PM

Apologies in advance for being yet another PC user to join this forum asking for help on remedying this MBR Whister-C [Rtk] problem.  In trying not to bother the experts with another one of these issues, I tried looking for the solution myself but could not find a standard method to remove this malware.  Each thread I had read varied slightly, either in steps to diagnose or steps to fix.  Rather than take my chances following repro steps that were not specific to my machine, i thought it best to take the safe route and create my own thread.

 

notes: 

 - new PC build running 8.1 (via upgrade from Windows 8)

 - running Avast antivirus (basic)

 - Avast warning communicates threat info

   > File name: Disk 0 Master Boot Record

   > High

   > Status: Threat: MBR:Whister-C [Rtk]

 - this virus is only detected when running a FULL scan

 

The most recent thread I found closely resembling my issue was: http://www.bleepingcomputer.com/forums/t/497139/mbrwhistler-c-rtk/

 - At the very least, I ran the first step and saved the scan log from using the aswMBR.exe tool.  the log is as follows:

 

aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software
Run date: 2014-01-19 22:00:20
-----------------------------
22:00:20.061    OS Version: Windows x64 6.2.9200 
22:00:20.061    Number of processors: 8 586 0x3A09
22:00:20.061    ComputerName: COOLS-HOMEBASE  UserName: Cools
22:00:20.064    Initialze error 1 
22:00:22.863    AVAST engine defs: 14011801
22:00:42.115    Disk 0  \Device\Harddisk0\DR0 -> \Device\00000033
22:00:42.117    Disk 0 Vendor: SAMSUNG_HD204UI 1AQ10001 Size: 1907729MB BusType: 11
22:00:42.118    Disk 1 (boot) \Device\Harddisk1\DR1 -> \Device\00000034
22:00:42.119    Disk 1 Vendor: Samsung_SSD_840_Series DXT08B0Q Size: 114473MB BusType: 11
22:00:42.121    Disk 2  \Device\Harddisk2\DR2 -> \Device\00000035
22:00:42.123    Disk 2 Vendor: WDC_WD10EZEX-00KUWA0 15.01H15 Size: 953869MB BusType: 11
22:00:42.125    Disk 3  \Device\Harddisk3\DR3 -> \Device\00000054
22:00:42.126    Disk 3 Vendor:   Size: 953869MB BusType: 0
22:00:42.128    Disk 1 MBR read successfully
22:00:42.130    Disk 1 MBR scan
22:00:42.133    Disk 1 Windows 7 default MBR code
22:00:42.135    Disk 1 Partition 1 00     EE          GPT           2097151 MB offset 1
22:00:42.138    Disk 1 scanning C:\WINDOWS\system32\drivers
22:00:42.142    Service scanning
22:00:42.677    Modules scanning
22:00:42.683    Disk 1 trace - called modules:
22:00:42.692    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll iaStorA.sys 
22:00:42.699    1 nt!IofCallDriver -> \Device\Harddisk1\DR1[0xffffe000059f7060]
22:00:42.705    3 CLASSPNP.SYS[fffff80000b65abb] -> nt!IofCallDriver -> [0xffffe00001202c40]
22:00:42.711    5 ACPI.sys[fffff800003625f1] -> nt!IofCallDriver -> \Device\00000034[0xffffe000011fe060]
22:00:42.714    AVAST engine scan C:\WINDOWS
22:00:42.716    AVAST engine scan C:\WINDOWS\system32
22:00:42.719    AVAST engine scan C:\WINDOWS\system32\drivers
22:00:42.721    AVAST engine scan C:\Users\Cools
22:00:42.724    AVAST engine scan C:\ProgramData
22:00:42.726    Scan finished successfully
22:02:09.999    Disk 1 MBR has been saved successfully to "C:\Users\Cools\Desktop\MBR.dat"
22:02:10.002    The log file has been saved successfully to "C:\Users\Cools\Desktop\aswMBR_2014_01_19.txt"
 
the aswMBR scan was set to "QuickScan". 
 
 
If theres any other info needed at this juncture, please let me know.  
 
Thank you in advance for you help. 

 

 

 



BC AdBot (Login to Remove)

 


#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:02:04 PM

Posted 21 January 2014 - 02:08 AM



Hello NTstateOFmind

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.


Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

  • Please do not run any tools unless instructed to do so.
    • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
  • Please do not attach logs or use code boxes, just copy and paste the text.
    • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
  • Please read every post completely before doing anything.
    • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
  • Please provide feedback about your experience as we go.
    • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.
NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.





I need to get some reports to get a base to start from so I need you to run these programs first.



-Download DDS-
  • Please download DDS from one of the links below and save it to your desktop:

    dds_scr.gif
    Download DDS and save it to your desktop

    Link1
    Link2
    Link3
    • Double-Click on dds.scr and a command window will appear. This is normal.
    • Shortly after two logs will appear:
      • DDS.txt
      • Attach.txt
    • A window will open instructing you save & post the logs
    • Save the logs to a convenient place such as your desktop
    • Copy the contents of both logs & post in your next reply
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 NTstateOFmind

NTstateOFmind
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:04 PM

Posted 21 January 2014 - 10:22 AM

I downloaded DDS from the first link (http://download.bleepingcomputer.com/sUBs/dds.scr), and saved it to my desktop

 

I attempted to run it, but it resulted in only a confirmation message box

"DDS is not meant to run in 'Compatibility Mode'.  The program shall now exit."

 

I then downloaded the files from Link2 and Link3 (file 'dds.com', and another 'dd.scr' file), but am awaiting your response before trying anything else

 

currently, my machine appears functioning as normal;  no noticeable impact to performance.

 

please advise.



#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:02:04 PM

Posted 21 January 2014 - 04:13 PM


Hello NTstateOFmind



Please download Farbar Recovery Scan Tool and save it to your desktop.


Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#5 NTstateOFmind

NTstateOFmind
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:04 PM

Posted 21 January 2014 - 05:26 PM

as requested....

 

---------------------------------------------------------------------------------------------------------------------------------------------
 
FRST.txt
 
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-01-2014
Ran by Cools (administrator) on COOLS-HOMEBASE on 21-01-2014 16:17:15
Running from C:\Users\Cools\Desktop
Windows 8.1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal
 
The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(WIBU-SYSTEMS AG) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(WIBU-SYSTEMS AG) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeterCC.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) D:\Program Files (x86)\iTunes\iTunesHelper.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Apple Inc.) D:\Program Files (x86)\iTunes\iTunes.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\mstsc.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
 
==================== Registry (Whitelisted) ==================
 
HKLM\...\Run: [IAStorIcon] - C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)
HKLM\...\Run: [Acronis Scheduler2 Service] - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [518424 2013-07-18] (Acronis)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3764024 2013-12-23] (AVAST Software)
HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5263504 2012-08-09] (VIA)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [685048 2012-08-03] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - D:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM-x32\...\Run: [TrueImageMonitor.exe] - C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [7805824 2013-10-24] (Acronis)
HKLM-x32\...\Run: [AcronisTibMounterMonitor] - C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [1102192 2013-10-10] (Acronis International GmbH)
HKLM-x32\...\RunOnce: [20131224] - C:\Program Files\AVAST Software\Avast\setup\emupdate\2a6206cd-ddc3-4e3b-99ab-5836a19e74fa.exe /check [181136 2014-01-21] (AVAST Software)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
 
==================== Internet (Whitelisted) ====================
 
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://t.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x3BEE6EBB2000CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\Snagit 10\DLLx64\SnagitBHO64.dll (TechSmith Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\Snagit 10\SnagitBHO.dll (TechSmith Corporation)
BHO-x32: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\Snagit 10\DLLx64\SnagitIEAddin64.dll (TechSmith Corporation)
Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM-x32 - Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\Snagit 10\SnagitIEAddin.dll (TechSmith Corporation)
DPF: HKLM-x32 {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} http://download.gigabyte.com.tw/object/Dldrv.ocx
Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{2D663677-F2C9-4E90-8326-EF4840674AFA}: [NameServer]10.22.60.11,10.22.60.12
 
FireFox:
========
FF ProfilePath: C:\Users\Cools\AppData\Roaming\Mozilla\Firefox\Profiles\da7ppijd.default
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-12-23]
 
Chrome: 
=======
CHR HomePage: hxxp://gmail.com/
CHR Extension: (Google Docs) - C:\Users\Cools\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-12-23]
CHR Extension: (Google Drive) - C:\Users\Cools\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-23]
CHR Extension: (YouTube) - C:\Users\Cools\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-23]
CHR Extension: (Google Search) - C:\Users\Cools\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-23]
CHR Extension: (avast! Online Security) - C:\Users\Cools\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-12-23]
CHR Extension: (Google Wallet) - C:\Users\Cools\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-23]
CHR Extension: (Gmail) - C:\Users\Cools\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-23]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2013-12-23]
 
==================== Services (Whitelisted) =================
 
U2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-12-23] (AVAST Software)
U2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)
U3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel® Corporation)
U2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
U2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27792 2012-08-02] (VIA Technologies, Inc.)
U3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
U3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)
 
==================== Drivers (Whitelisted) ====================
 
U0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
U2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2013-12-23] (AVAST Software)
U1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-12-23] (AVAST Software)
U0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-12-23] ()
U1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1034464 2013-12-23] (AVAST Software)
U1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422216 2013-12-23] (AVAST Software)
U3 aswStm; C:\Windows\system32\drivers\aswStm.sys [79672 2013-12-23] (AVAST Software)
U0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2013-12-23] ()
U3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-12] (Windows ® Win 7 DDK provider)
U3 ffusb2audio; C:\Windows\system32\DRIVERS\ffusb2audio.sys [127280 2013-09-25] (Focusrite Audio Engineering Limited.)
U3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
U3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
U0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-09] (Intel Corporation)
U0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2014-01-08] (Microsoft Corporation)
U0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
U3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
U3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
U3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
U3 NIWinCDEmu; C:\Windows\System32\drivers\NIWinCDEmu.sys [112408 2013-12-22] ()
U3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)
U3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2014-01-08] (Microsoft Corporation)
U0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-11-14] (Microsoft Corporation)
U0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2013-12-28] (Acronis International GmbH)
U0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [198432 2013-12-28] (Acronis International GmbH)
U3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
U3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
U3 aswMBR; \??\C:\Users\Cools\AppData\Local\Temp\aswMBR.sys [x]
 
==================== NetSvcs (Whitelisted) ===================
 
 
==================== One Month Created Files and Folders ========
 
2014-01-21 16:17 - 2014-01-21 16:17 - 00015901 _____ C:\Users\Cools\Desktop\FRST.txt
2014-01-21 16:17 - 2014-01-21 16:17 - 00000000 ____D C:\FRST
2014-01-21 16:13 - 2014-01-21 16:13 - 02077184 _____ (Farbar) C:\Users\Cools\Desktop\FRST64.exe
2014-01-21 09:16 - 2014-01-21 09:15 - 00688992 _____ (Swearware) C:\Users\Cools\Desktop\dds.com
2014-01-21 09:13 - 2014-01-21 09:13 - 00688992 _____ (Swearware) C:\Users\Cools\Desktop\dds.scr
2014-01-19 22:02 - 2014-01-19 22:02 - 00002251 _____ C:\Users\Cools\Desktop\aswMBR_2014_01_19.txt
2014-01-19 22:02 - 2014-01-19 22:02 - 00000512 _____ C:\Users\Cools\Desktop\MBR.dat
2014-01-19 21:59 - 2014-01-19 21:30 - 04745728 _____ (AVAST Software) C:\Users\Cools\Desktop\aswMBR.exe
2014-01-19 00:10 - 2014-01-19 00:10 - 00000000 ____H C:\ProgramData\cm-lock
2014-01-15 16:21 - 2014-01-15 16:21 - 00000000 ____D C:\Users\Cools\AppData\Local\Macromedia
2014-01-15 08:08 - 2013-11-27 09:36 - 03395920 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSService.dll
2014-01-15 08:08 - 2013-11-27 05:41 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSCollect.exe
2014-01-15 08:08 - 2013-11-27 04:34 - 00138240 _____ C:\WINDOWS\system32\OEMLicense.dll
2014-01-15 08:08 - 2013-11-27 03:54 - 00103936 _____ C:\WINDOWS\SysWOW64\OEMLicense.dll
2014-01-15 08:08 - 2013-11-27 02:48 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-15 08:08 - 2013-11-27 02:45 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll
2014-01-15 08:08 - 2013-11-27 02:40 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-15 08:08 - 2013-11-27 02:38 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll
2014-01-15 08:08 - 2013-11-27 02:17 - 00695808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2014-01-15 08:08 - 2013-11-27 02:12 - 00848384 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2014-01-15 08:07 - 2013-12-08 18:15 - 00787968 _____ (Microsoft Corporation) C:\WINDOWS\system32\uDWM.dll
2014-01-12 20:57 - 2014-01-12 20:57 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf
2014-01-12 20:40 - 2014-01-12 20:40 - 01024776 _____ C:\WINDOWS\Minidump\011214-9156-01.dmp
2014-01-12 20:40 - 2014-01-12 20:40 - 00000000 ____D C:\WINDOWS\Minidump
2014-01-08 16:06 - 2014-01-21 09:15 - 00000310 _____ C:\Users\Cools\Desktop\New Text Document.txt
2014-01-08 14:51 - 2014-01-08 14:51 - 23183360 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 17112576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 13177344 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 12996608 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 11674624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 11221504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 07399256 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2014-01-08 14:51 - 2014-01-08 14:51 - 05769216 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 04243968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 04191744 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2014-01-08 14:51 - 2014-01-08 14:51 - 04105728 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncEngine.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 02896896 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 02764288 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 02570240 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 02334208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 02266624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 02166784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 02143744 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 02140888 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 01995264 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-01-08 14:51 - 2014-01-08 14:51 - 01928192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-01-08 14:51 - 2014-01-08 14:51 - 01843712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Display.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 01816576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Display.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 01765384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 01765376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 01756160 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPDMC.exe
2014-01-08 14:51 - 2014-01-08 14:51 - 01642016 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2014-01-08 14:51 - 2014-01-08 14:51 - 01530200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2014-01-08 14:51 - 2014-01-08 14:51 - 01506680 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2014-01-08 14:51 - 2014-01-08 14:51 - 01476184 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2014-01-08 14:51 - 2014-01-08 14:51 - 01395200 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 01391104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPDMC.exe
2014-01-08 14:51 - 2014-01-08 14:51 - 01345536 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2014-01-08 14:51 - 2014-01-08 14:51 - 01302528 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 01157632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00922624 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00747008 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidcli.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00744448 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00637952 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2014-01-08 14:51 - 2014-01-08 14:51 - 00615936 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAgent.exe
2014-01-08 14:51 - 2014-01-08 14:51 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00568832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDrive.exe
2014-01-08 14:51 - 2014-01-08 14:51 - 00566784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpncore.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00544768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlidcli.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00516496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00479744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2014-01-08 14:51 - 2014-01-08 14:51 - 00406400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00393216 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPhoto.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00382808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2014-01-08 14:51 - 2014-01-08 14:51 - 00372568 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2014-01-08 14:51 - 2014-01-08 14:51 - 00358896 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcomp.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00348160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPhoto.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00325464 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS
2014-01-08 14:51 - 2014-01-08 14:51 - 00287744 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00254464 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00240128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mdmregistration.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00225792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dcomp.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-01-08 14:51 - 2014-01-08 14:51 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00197120 _____ (Microsoft Corporation) C:\WINDOWS\system32\scrrun.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scrrun.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00146776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\SerCx2.sys
2014-01-08 14:51 - 2014-01-08 14:51 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbici.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00086872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2014-01-08 14:51 - 2014-01-08 14:51 - 00075360 _____ (Microsoft Corporation) C:\WINDOWS\system32\imagehlp.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00070680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imagehlp.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00039768 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys
2014-01-08 14:51 - 2014-01-08 14:51 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredentialMigrationHandler.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredentialMigrationHandler.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00000000 __SHD C:\Recovery
2014-01-08 14:51 - 2014-01-08 13:02 - 00000000 ___DC C:\WINDOWS\Panther
2014-01-08 14:50 - 2014-01-08 14:50 - 00262144 _____ C:\WINDOWS\system32\config\userdiff
2014-01-08 14:50 - 2014-01-08 14:50 - 00000000 ____D C:\Program Files\Reference Assemblies
2014-01-08 14:50 - 2014-01-08 14:50 - 00000000 ____D C:\Program Files\MSBuild
2014-01-08 14:50 - 2014-01-08 14:50 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies
2014-01-08 14:50 - 2014-01-08 14:50 - 00000000 ____D C:\Program Files (x86)\MSBuild
2014-01-08 14:49 - 2013-08-02 22:48 - 01166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2014-01-08 14:49 - 2013-08-02 22:48 - 00124112 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2014-01-08 14:49 - 2013-08-02 22:48 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2014-01-08 14:49 - 2013-08-02 22:41 - 00778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2014-01-08 14:49 - 2013-08-02 22:41 - 00102608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2014-01-08 14:49 - 2013-08-02 22:41 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2014-01-08 13:23 - 2014-01-21 15:56 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-01-08 13:23 - 2014-01-08 13:23 - 00003718 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2014-01-08 13:21 - 2014-01-08 13:23 - 00000000 ____D C:\Users\Cools\AppData\Local\Adobe
2014-01-08 13:02 - 2014-01-08 13:02 - 00001446 _____ C:\Users\Cools\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-01-08 13:02 - 2014-01-08 13:02 - 00000020 ___SH C:\Users\Cools\ntuser.ini
2014-01-08 12:57 - 2014-01-21 10:49 - 01578101 _____ C:\WINDOWS\WindowsUpdate.log
2014-01-08 12:56 - 2014-01-08 12:56 - 00022744 _____ C:\WINDOWS\system32\emptyregdb.dat
2014-01-08 12:54 - 2014-01-08 13:02 - 00000000 ____D C:\Users\Cools
2014-01-08 12:54 - 2014-01-08 12:57 - 00020958 _____ C:\WINDOWS\diagwrn.xml
2014-01-08 12:54 - 2014-01-08 12:57 - 00020958 _____ C:\WINDOWS\diagerr.xml
2014-01-08 12:54 - 2014-01-08 12:54 - 00000000 ___RD C:\Users\Cools\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-01-08 12:54 - 2014-01-08 12:54 - 00000000 ____D C:\WINDOWS\system32\config\bbimigrate
2014-01-08 12:54 - 2013-08-22 09:36 - 00000000 ___RD C:\Users\Cools\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-01-08 12:54 - 2013-08-22 09:36 - 00000000 ___RD C:\Users\Cools\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-01-08 12:54 - 2013-08-22 09:36 - 00000000 ____D C:\Users\Cools\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-01-08 12:53 - 2014-01-08 12:55 - 00000000 ____D C:\Program Files (x86)\Intel
2014-01-08 12:53 - 2014-01-08 12:53 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2014-01-08 12:53 - 2014-01-08 12:53 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_TeeDriverx64_01011.Wdf
2014-01-08 12:53 - 2013-12-21 00:02 - 00064000 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.DLL
2014-01-08 12:53 - 2013-12-21 00:02 - 00060416 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.DLL
2014-01-08 12:33 - 2014-01-08 12:57 - 00006693 _____ C:\WINDOWS\comsetup.log
2013-12-28 02:01 - 2013-12-28 02:01 - 00000000 ____D C:\Users\Cools\AppData\Roaming\Acronis
2013-12-28 01:47 - 2013-12-28 03:38 - 00000000 ____D C:\ProgramData\Acronis
2013-12-28 01:47 - 2013-12-28 01:47 - 01464096 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\tdrpman.sys
2013-12-28 01:47 - 2013-12-28 01:47 - 01120032 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\tib.sys
2013-12-28 01:47 - 2013-12-28 01:47 - 00367200 _____ (Acronis) C:\WINDOWS\system32\Drivers\afcdp.sys
2013-12-28 01:47 - 2013-12-28 01:47 - 00269600 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\snapman.sys
2013-12-28 01:47 - 2013-12-28 01:47 - 00198432 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\tib_mounter.sys
2013-12-28 01:47 - 2013-12-28 01:47 - 00116000 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\fltsrv.sys
2013-12-28 01:47 - 2013-12-28 01:47 - 00000000 ____D C:\Program Files (x86)\Acronis
2013-12-27 00:54 - 2013-12-27 00:54 - 00729632 _____ (Acronis) C:\WINDOWS\system32\Drivers\timntr.sys
2013-12-27 00:54 - 2013-12-27 00:54 - 00078880 _____ (Acronis) C:\WINDOWS\system32\Drivers\tifsfilt.sys
2013-12-27 00:46 - 2013-12-27 00:46 - 00003044 _____ C:\WINDOWS\System32\Tasks\{1CA7EF57-F05A-4468-9FF0-BCBC25D389DC}
2013-12-27 00:45 - 2013-12-27 00:45 - 00000000 ____D C:\WINDOWS\System32\Tasks\Leader Technologies
2013-12-27 00:43 - 2013-12-27 00:43 - 00000000 ____D C:\Users\Cools\AppData\Roaming\Leadertech
2013-12-26 23:50 - 2013-12-26 23:50 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2013-12-26 18:45 - 2013-12-28 02:03 - 00000000 ____D C:\Users\Cools\Desktop\desktop icons
2013-12-26 15:58 - 2013-12-26 16:06 - 00000000 ____D C:\Users\Cools\AppData\Local\Spotify
2013-12-26 15:58 - 2013-12-26 15:58 - 00001797 _____ C:\Users\Cools\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2013-12-26 15:57 - 2014-01-01 13:01 - 00000000 ____D C:\Users\Cools\AppData\Roaming\Spotify
2013-12-26 10:13 - 2013-12-26 10:13 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-12-26 10:13 - 2013-12-26 10:13 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-12-26 10:05 - 2004-01-15 14:14 - 00233472 _____ (Propellerhead Software AB) C:\WINDOWS\SysWOW64\REX Shared Library.dll
2013-12-26 10:00 - 2004-02-07 01:48 - 00331263 _____ C:\WINDOWS\LOOP.exe
2013-12-26 09:34 - 2014-01-12 21:03 - 00000000 ____D C:\Users\Cools\AppData\Roaming\NCH Software
2013-12-26 09:34 - 2014-01-12 21:03 - 00000000 ____D C:\Program Files (x86)\NCH Software
2013-12-26 09:28 - 2014-01-19 21:03 - 00000000 ____D C:\WINDOWS\System32\Tasks\NCH Software
2013-12-26 09:28 - 2013-12-26 10:06 - 00000000 ____D C:\ProgramData\NCH Software
2013-12-23 15:20 - 2014-01-05 19:35 - 00016186 _____ C:\WINDOWS\DPINST.LOG
2013-12-23 15:20 - 2014-01-05 19:32 - 00000000 ____D C:\Program Files\Focusrite
2013-12-23 15:20 - 2013-12-23 15:20 - 00000000 ____D C:\Program Files\DIFX
2013-12-23 15:20 - 2013-09-25 16:40 - 00127280 _____ (Focusrite Audio Engineering Limited.) C:\WINDOWS\system32\Drivers\ffusb2audio.sys
2013-12-23 15:20 - 2013-09-25 14:41 - 00022832 _____ (Focusrite Audio Engineering Limited.) C:\WINDOWS\system32\ffusb2audio_coinst.dll
2013-12-23 14:54 - 2014-01-21 16:04 - 00000926 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-23 14:54 - 2014-01-21 13:04 - 00000922 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-23 14:54 - 2014-01-12 20:41 - 00004182 _____ C:\WINDOWS\System32\Tasks\avast! Emergency Update
2013-12-23 14:54 - 2013-12-23 14:59 - 00003898 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2013-12-23 14:54 - 2013-12-23 14:59 - 00003662 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2013-12-23 14:54 - 2013-12-23 14:54 - 01034464 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
2013-12-23 14:54 - 2013-12-23 14:54 - 00422216 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2013-12-23 14:54 - 2013-12-23 14:54 - 00334136 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2013-12-23 14:54 - 2013-12-23 14:54 - 00207904 _____ C:\WINDOWS\system32\Drivers\aswVmm.sys
2013-12-23 14:54 - 2013-12-23 14:54 - 00092544 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2013-12-23 14:54 - 2013-12-23 14:54 - 00079672 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswstm.sys
2013-12-23 14:54 - 2013-12-23 14:54 - 00078648 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2013-12-23 14:54 - 2013-12-23 14:54 - 00065776 _____ C:\WINDOWS\system32\Drivers\aswRvrt.sys
2013-12-23 14:54 - 2013-12-23 14:54 - 00043152 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2013-12-23 14:54 - 2013-12-23 14:54 - 00000000 ____D C:\Users\Cools\AppData\Roaming\AVAST Software
2013-12-23 14:54 - 2013-12-23 14:54 - 00000000 ____D C:\Users\Cools\AppData\Local\Google
2013-12-23 14:54 - 2013-12-23 14:54 - 00000000 ____D C:\Program Files (x86)\Google
2013-12-23 14:53 - 2013-12-23 14:53 - 00000000 ____D C:\ProgramData\AVAST Software
2013-12-23 14:53 - 2013-12-23 14:53 - 00000000 ____D C:\Program Files\AVAST Software
2013-12-23 14:51 - 2013-12-23 14:51 - 00000000 ____D C:\Users\Cools\AppData\Roaming\Macromedia
2013-12-23 14:49 - 2013-12-23 14:49 - 00000117 _____ C:\WINDOWS\system32\netcfg-531156.txt
2013-12-23 14:49 - 2013-12-23 14:49 - 00000117 _____ C:\WINDOWS\system32\netcfg-531125.txt
2013-12-23 14:41 - 2013-12-23 14:41 - 00000117 _____ C:\WINDOWS\system32\netcfg-12609.txt
2013-12-23 14:40 - 2013-12-23 14:40 - 00000117 _____ C:\WINDOWS\system32\netcfg-1723656.txt
2013-12-23 14:33 - 2014-01-21 13:34 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3061577256-1683689243-3653438943-1001
2013-12-23 14:30 - 2013-12-23 14:30 - 00000000 ____D C:\Intel
2013-12-23 14:28 - 2014-01-08 13:02 - 00000000 ___RD C:\Users\Cools\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-23 14:28 - 2014-01-08 13:02 - 00000000 ___RD C:\Users\Cools\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-12-23 14:28 - 2014-01-08 13:02 - 00000000 ____D C:\WINDOWS\System32\Tasks\WPD
2013-12-23 14:28 - 2013-12-23 14:28 - 00000000 ____D C:\Users\Cools\AppData\Roaming\Adobe
2013-12-23 14:27 - 2014-01-08 13:02 - 00000000 ____D C:\Users\Cools\AppData\Local\Packages
2013-12-23 14:27 - 2014-01-08 12:55 - 00000000 ____D C:\ProgramData\PRICache
2013-12-23 14:27 - 2014-01-08 12:47 - 01522578 _____ C:\WINDOWS\WindowsUpdate (1).log
2013-12-23 14:27 - 2013-12-22 12:34 - 00000000 ____D C:\Users\Cools\AppData\Local\VirtualStore
2013-12-23 14:22 - 2013-12-23 14:22 - 00000117 _____ C:\WINDOWS\system32\netcfg-614359.txt
2013-12-23 14:22 - 2013-12-23 14:22 - 00000117 _____ C:\WINDOWS\system32\netcfg-611328.txt
2013-12-23 14:22 - 2013-12-23 14:22 - 00000117 _____ C:\WINDOWS\system32\netcfg-611296.txt
2013-12-23 14:21 - 2013-12-23 14:21 - 00000117 _____ C:\WINDOWS\system32\netcfg-610265.txt
2013-12-23 14:20 - 2013-12-23 14:20 - 00001139 _____ C:\WINDOWS\system32\netcfg-514359.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00001136 _____ C:\WINDOWS\system32\netcfg-18859.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00001134 _____ C:\WINDOWS\system32\netcfg-19515.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00000197 _____ C:\WINDOWS\system32\netcfg-19218.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00000185 _____ C:\WINDOWS\system32\netcfg-17687.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00000164 _____ C:\WINDOWS\system32\netcfg-14640.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00000161 _____ C:\WINDOWS\system32\netcfg-17546.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00000160 _____ C:\WINDOWS\system32\netcfg-17406.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00000160 _____ C:\WINDOWS\system32\netcfg-16625.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00000160 _____ C:\WINDOWS\system32\netcfg-16234.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00000159 _____ C:\WINDOWS\system32\netcfg-16828.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00000157 _____ C:\WINDOWS\system32\netcfg-17265.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00000157 _____ C:\WINDOWS\system32\netcfg-14843.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00000150 _____ C:\WINDOWS\system32\netcfg-16078.txt
2013-12-23 10:44 - 2013-12-23 10:49 - 00006734 _____ C:\Users\Cools\Maschine2.log
2013-12-23 10:44 - 2013-12-23 10:44 - 00000000 ____D C:\Users\Public\Documents\NI Resources
2013-12-23 10:44 - 2013-12-23 10:44 - 00000000 ____D C:\Users\Cools\AppData\Local\Native Instruments
2013-12-23 10:43 - 2013-12-23 10:43 - 00000000 __HDC C:\ProgramData\{1406CED2-9A2C-427C-9985-C9D766994EA3}
2013-12-23 10:14 - 2013-12-23 10:44 - 00000000 ____D C:\Users\Cools\Documents\Native Instruments
2013-12-23 10:14 - 2013-12-23 10:14 - 00000000 __HDC C:\ProgramData\{CF94F91C-2252-4F20-8603-3735C706F33F}
2013-12-23 10:14 - 2013-12-23 10:14 - 00000000 __HDC C:\ProgramData\{B30E15D4-C78A-49C1-8297-800AE0224436}
2013-12-23 10:14 - 2013-12-23 10:14 - 00000000 __HDC C:\ProgramData\{5308BF3B-B4EF-47BE-A637-CB011D7BE147}
2013-12-23 10:13 - 2013-12-23 10:13 - 00000000 __HDC C:\ProgramData\{C5A9D49F-FB00-46E2-BB29-AC4E9A6B75F6}
2013-12-23 10:13 - 2013-12-23 10:13 - 00000000 __HDC C:\ProgramData\{BBC1A9AD-CA48-4B3E-83AB-BBC5D60562B7}
2013-12-23 10:13 - 2013-12-23 10:13 - 00000000 __HDC C:\ProgramData\{4F1011FE-3478-4D2B-8F9F-7EA7C144DFC2}
2013-12-23 10:12 - 2013-12-23 10:12 - 00000000 __HDC C:\ProgramData\{51219C66-4A99-4FA4-9EE9-2ACA1ED441D1}
2013-12-23 05:15 - 2014-01-08 13:03 - 00056832 ___SH C:\Users\Cools\Desktop\Thumbs.db
2013-12-23 05:15 - 2013-12-31 11:02 - 00000000 ____D C:\Users\Cools\AppData\Roaming\Apple Computer
2013-12-23 05:15 - 2013-12-23 05:15 - 00000000 ____D C:\Users\Cools\AppData\Local\Apple Computer
2013-12-23 05:15 - 2013-12-23 05:15 - 00000000 ____D C:\ProgramData\Apple Computer
2013-12-23 05:15 - 2013-12-23 05:15 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-12-23 05:15 - 2013-12-23 05:15 - 00000000 ____D C:\Program Files\iTunes
2013-12-23 05:15 - 2013-12-23 05:15 - 00000000 ____D C:\Program Files\iPod
2013-12-23 05:15 - 2012-08-21 13:01 - 00033240 _____ (GEAR Software Inc.) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
2013-12-23 05:14 - 2013-12-23 05:14 - 00000000 ____D C:\WINDOWS\System32\Tasks\Apple
2013-12-23 05:14 - 2013-12-23 05:14 - 00000000 ____D C:\Users\Cools\AppData\Local\Apple
2013-12-23 05:14 - 2013-12-23 05:14 - 00000000 ____D C:\ProgramData\Apple
2013-12-23 05:14 - 2013-12-23 05:14 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-12-23 05:14 - 2013-12-23 05:14 - 00000000 ____D C:\Program Files\Bonjour
2013-12-23 05:14 - 2013-12-23 05:14 - 00000000 ____D C:\Program Files (x86)\Bonjour
2013-12-23 05:14 - 2013-12-23 05:14 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2013-12-23 04:46 - 2013-12-23 04:46 - 00000682 _____ C:\Users\Cools\Desktop\Downloads.lnk
2013-12-23 03:38 - 2013-12-23 10:13 - 00000000 ____D C:\Program Files\Common Files\Native Instruments
2013-12-23 03:38 - 2013-12-23 03:38 - 00000000 __HDC C:\ProgramData\{F57C376F-E7ED-4527-9EE2-4D50799418BC}
2013-12-23 03:38 - 2013-12-23 03:38 - 00000000 __HDC C:\ProgramData\{C6A355F5-168B-4EEC-AB7C-75594F783EDB}
2013-12-23 03:38 - 2013-12-23 03:38 - 00000000 __HDC C:\ProgramData\{A2012EEF-6DBF-4B4B-B8A6-03EAAF108CAE}
2013-12-23 03:38 - 2013-12-23 03:38 - 00000000 __HDC C:\ProgramData\{12FE44EF-1D1E-4CB1-BEC8-B5A61C3ACA42}
2013-12-23 03:38 - 2013-12-23 03:38 - 00000000 ____D C:\ProgramData\Native Instruments
2013-12-23 03:38 - 2013-12-23 03:38 - 00000000 ____D C:\Program Files\Native Instruments
2013-12-23 03:38 - 2013-12-23 03:38 - 00000000 ____D C:\Program Files\Common Files\Avid
2013-12-23 01:35 - 2013-12-23 01:35 - 00000000 ____D C:\Program Files\WIBU-SYSTEMS
2013-12-23 01:35 - 2013-12-23 01:35 - 00000000 ____D C:\Program Files\CodeMeter
2013-12-22 23:26 - 2013-12-22 23:26 - 00112408 _____ C:\WINDOWS\system32\Drivers\NIWinCDEmu.sys
2013-12-22 23:26 - 2013-12-22 23:26 - 00000000 ____D C:\Program Files (x86)\Native Instruments
2013-12-22 21:40 - 2013-12-23 01:35 - 00000000 ____D C:\ProgramData\CodeMeter
2013-12-22 21:10 - 2014-01-02 23:19 - 00000000 ____D C:\Program Files (x86)\CodeMeter
2013-12-22 21:10 - 2014-01-01 16:27 - 00000000 ____D C:\Users\Cools\AppData\Roaming\Propellerhead Software
2013-12-22 21:10 - 2014-01-01 16:27 - 00000000 ____D C:\ProgramData\Propellerhead Software
2013-12-22 21:10 - 2013-12-22 21:27 - 00000000 ____D C:\Users\Cools\AppData\Roaming\Line 6
2013-12-22 21:10 - 2013-12-22 21:10 - 00000000 ____D C:\ProgramData\Line 6
2013-12-22 21:10 - 2013-12-22 21:10 - 00000000 ____D C:\Program Files\Common Files\Propellerhead Software
2013-12-22 21:01 - 2013-12-23 03:40 - 00000000 ____D C:\Program Files\Propellerhead
2013-12-22 20:36 - 2013-12-23 10:57 - 00000000 ____D C:\Users\Cools\Desktop\CSG
2013-12-22 20:30 - 2013-12-22 20:30 - 00000000 ____D C:\Program Files (x86)\TechSmith
2013-12-22 20:21 - 2013-12-23 03:06 - 00000000 ____D C:\Users\Cools\Documents\Snagit
2013-12-22 20:20 - 2013-12-22 20:30 - 00000000 ____D C:\ProgramData\TechSmith
2013-12-22 20:20 - 2013-12-22 20:20 - 00000000 ____D C:\Users\Cools\AppData\Local\TechSmith
2013-12-22 20:03 - 2013-12-22 20:03 - 00000117 _____ C:\WINDOWS\system32\netcfg-24485734.txt
2013-12-22 19:44 - 2014-01-15 12:34 - 86054176 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2013-12-22 19:44 - 2014-01-15 12:34 - 00000000 ____D C:\WINDOWS\system32\MRT
2013-12-22 19:33 - 2013-05-03 22:51 - 00014848 ____N (Microsoft) C:\WINDOWS\system32\rars.rs
2013-12-22 19:33 - 2013-05-03 22:10 - 00014848 ____N (Microsoft) C:\WINDOWS\SysWOW64\rars.rs
2013-12-22 19:29 - 2013-12-22 19:29 - 00000117 _____ C:\WINDOWS\system32\netcfg-22419031.txt
2013-12-22 19:29 - 2013-12-22 19:29 - 00000117 _____ C:\WINDOWS\system32\netcfg-22418625.txt
2013-12-22 13:36 - 2013-12-22 13:36 - 00000117 _____ C:\WINDOWS\system32\netcfg-1286265.txt
2013-12-22 13:35 - 2013-12-22 13:35 - 00000117 _____ C:\WINDOWS\system32\netcfg-1174828.txt
2013-12-22 13:33 - 2013-12-22 13:33 - 00000117 _____ C:\WINDOWS\system32\netcfg-1091171.txt
2013-12-22 13:22 - 2014-01-20 23:40 - 00002276 ____H C:\Users\Cools\Documents\Default.rdp
2013-12-22 13:22 - 2013-12-22 13:22 - 00000117 _____ C:\WINDOWS\system32\netcfg-401093.txt
2013-12-22 13:21 - 2013-12-22 13:21 - 00264616 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2013-12-22 13:21 - 2013-12-22 13:21 - 00175016 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2013-12-22 13:21 - 2013-12-22 13:21 - 00174504 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2013-12-22 13:21 - 2013-12-22 13:21 - 00096168 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2013-12-22 13:21 - 2013-12-22 13:21 - 00000000 ____D C:\ProgramData\Sun
2013-12-22 13:21 - 2013-12-22 13:21 - 00000000 ____D C:\ProgramData\Oracle
2013-12-22 13:21 - 2013-12-22 13:21 - 00000000 ____D C:\Program Files (x86)\Java
2013-12-22 13:16 - 2013-12-22 13:19 - 00000000 ____D C:\Users\Cools\AppData\Roaming\FreeFileViewer
2013-12-22 13:15 - 2013-12-22 13:15 - 00000117 _____ C:\WINDOWS\system32\netcfg-2531812.txt
2013-12-22 13:15 - 2013-12-22 13:15 - 00000117 _____ C:\WINDOWS\system32\netcfg-12593.txt
2013-12-22 13:02 - 2013-12-22 13:02 - 00000355 _____ C:\Users\Cools\Desktop\Computer.lnk
2013-12-22 12:51 - 2013-12-22 12:51 - 00001165 _____ C:\WINDOWS\system32\netcfg-1098750.txt
2013-12-22 12:51 - 2013-12-22 12:51 - 00000000 ____D C:\Users\Cools\AppData\Local\Cisco
2013-12-22 12:51 - 2013-12-22 12:51 - 00000000 ____D C:\ProgramData\Cisco
2013-12-22 12:51 - 2013-12-22 12:51 - 00000000 ____D C:\Program Files (x86)\Cisco
2013-12-22 12:51 - 2012-08-03 13:38 - 00107432 ____R (Cisco Systems, Inc.) C:\WINDOWS\system32\Drivers\acsock64.sys
2013-12-22 12:47 - 2013-12-22 12:47 - 00000000 ____D C:\Users\Cools\AppData\Roaming\Mozilla
2013-12-22 12:47 - 2013-12-22 12:47 - 00000000 ____D C:\Users\Cools\AppData\Local\Mozilla
2013-12-22 12:47 - 2013-12-22 12:47 - 00000000 ____D C:\ProgramData\Mozilla
2013-12-22 12:47 - 2013-12-22 12:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-22 12:47 - 2013-12-22 12:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-22 12:42 - 2013-12-22 12:42 - 00000000 ____D C:\WINDOWS\A7091E1D36A447F1A739173CC341414F.TMP
2013-12-22 12:41 - 2013-12-22 12:41 - 00000000 ____D C:\Users\Cools\AppData\Local\FreeFileViewer
2013-12-22 12:40 - 2014-01-21 12:40 - 00000402 _____ C:\WINDOWS\Tasks\FreeFileViewerUpdateChecker.job
2013-12-22 12:40 - 2013-12-22 12:40 - 00003078 _____ C:\WINDOWS\System32\Tasks\FreeFileViewerUpdateChecker
2013-12-22 12:40 - 2013-12-22 12:40 - 00000000 ____D C:\Program Files (x86)\FreeFileViewer
2013-12-22 12:33 - 2013-12-22 12:33 - 00000117 _____ C:\WINDOWS\system32\netcfg-12093.txt
2013-12-22 12:32 - 2013-12-22 12:33 - 00000592 _____ C:\WINDOWS\backend.log
2013-12-22 12:32 - 2013-12-22 12:32 - 00000117 _____ C:\WINDOWS\system32\netcfg-1180687.txt
2013-12-22 12:27 - 2014-01-08 12:54 - 00000000 ____D C:\Users\Cools\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Marvell
2013-12-22 12:27 - 2013-12-22 12:34 - 00000000 ____D C:\Program Files (x86)\Marvell
2013-12-22 12:23 - 2013-12-22 12:23 - 00820120 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2013-12-22 12:23 - 2013-12-22 12:23 - 00000305 _____ C:\WINDOWS\system32\netcfg-593531.txt
2013-12-22 12:23 - 2013-12-22 12:23 - 00000000 ____D C:\Users\Cools\Intel
2013-12-22 12:23 - 2013-12-22 12:23 - 00000000 ____D C:\Users\Cools\AppData\Roaming\Intel Corporation
2013-12-22 12:22 - 2014-01-08 12:55 - 00000000 ____D C:\WINDOWS\SysWOW64\Atheros_L1e
2013-12-22 12:22 - 2013-07-17 23:55 - 00130248 _____ (Qualcomm Atheros Co., Ltd.) C:\WINDOWS\system32\Drivers\L1C63x64.sys
2013-12-22 12:21 - 2013-12-22 12:23 - 00000000 ____D C:\ProgramData\Intel
2013-12-22 12:21 - 2013-12-22 12:23 - 00000000 ____D C:\Program Files\Intel
2013-12-22 12:21 - 2013-12-22 12:21 - 00000000 ____D C:\Users\Cools\AppData\Roaming\InstallShield
2013-12-22 12:21 - 2013-09-16 12:17 - 01795952 _____ (Microsoft Corporation) C:\WINDOWS\system32\WdfCoInstaller01011.dll
2013-12-22 12:21 - 2013-09-16 12:17 - 00099288 _____ (Intel Corporation) C:\WINDOWS\system32\Drivers\TeeDriverx64.sys
2013-12-22 12:21 - 2013-09-16 12:17 - 00016344 _____ (Intel Corporation) C:\WINDOWS\system32\Drivers\IntelMEFWVer.dll
2013-12-22 12:13 - 2013-12-22 12:13 - 00000117 _____ C:\WINDOWS\system32\netcfg-11000.txt
2013-12-22 12:12 - 2013-12-22 12:12 - 00000117 _____ C:\WINDOWS\system32\netcfg-148734.txt
2013-12-22 12:12 - 2013-08-21 01:16 - 00053248 _____ (Windows XP Bundled build C-Centric Single User) C:\WINDOWS\SysWOW64\CSVer.dll
2013-12-22 12:10 - 2014-01-12 20:40 - 816906428 _____ C:\WINDOWS\MEMORY.DMP
2013-12-22 12:10 - 2013-12-22 12:10 - 00000117 _____ C:\WINDOWS\system32\netcfg-6984.txt
2013-12-22 12:10 - 2013-12-22 12:10 - 00000117 _____ C:\WINDOWS\system32\netcfg-12640.txt
2013-12-22 12:09 - 2013-12-22 12:09 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_xhcdrv_01011.Wdf
2013-12-22 12:09 - 2013-12-22 12:09 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_ViaHub3_01011.Wdf
2013-12-22 12:09 - 2013-01-17 13:11 - 00086064 _____ (VIA Technologies, Inc.) C:\WINDOWS\system32\Drivers\vusbstor.sys
2013-12-22 12:08 - 2013-12-22 12:08 - 00000117 _____ C:\WINDOWS\system32\netcfg-12484.txt
2013-12-22 12:07 - 2013-12-22 12:22 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-22 12:07 - 2013-12-22 12:07 - 00000117 _____ C:\WINDOWS\system32\netcfg-522140.txt
2013-12-22 12:07 - 2013-12-22 12:07 - 00000000 ____D C:\Program Files (x86)\VIA
2013-12-22 12:07 - 2007-04-11 01:35 - 00414632 _____ (Microsoft Corporation) C:\WINDOWS\difxapi.dll
2013-12-22 11:59 - 2013-12-22 11:59 - 00000117 _____ C:\WINDOWS\system32\netcfg-12468.txt
2013-12-22 11:58 - 2013-12-22 11:58 - 00000117 _____ C:\WINDOWS\system32\netcfg-1550890.txt
2013-12-22 11:58 - 2012-08-02 23:29 - 02993296 _____ (VIA Technologies, Inc.) C:\WINDOWS\system32\VIAPropPageExt.dll
2013-12-22 11:58 - 2012-08-02 23:29 - 01119376 _____ (VIA Technologies, Inc.) C:\WINDOWS\system32\ViaMicArrayAPO.dll
2013-12-22 11:58 - 2012-08-02 23:29 - 00681104 _____ (VIA Technologies, Inc.) C:\WINDOWS\system32\VIASysFx.dll
2013-12-22 11:58 - 2012-08-02 23:29 - 00123536 _____ (VIA Technologies,Inc.) C:\WINDOWS\system32\ViaKaraokePropPageExt.dll
2013-12-22 11:58 - 2012-08-02 23:29 - 00095376 _____ (VIA Technologies,Inc.) C:\WINDOWS\system32\ViaMicArrayPropPageExt.dll
2013-12-22 11:58 - 2012-08-02 23:29 - 00070800 _____ (Windows ® Codename Longhorn DDK provider) C:\WINDOWS\system32\VtSrdAPO.dll
2013-12-22 11:58 - 2012-08-02 23:29 - 00027792 _____ (VIA Technologies, Inc.) C:\WINDOWS\system32\ViakaraokeSrv.exe
2013-12-22 11:58 - 2012-08-02 23:28 - 02206352 _____ (VIA Technologies, Inc.) C:\WINDOWS\system32\Drivers\viahduaa.sys
2013-12-22 11:58 - 2012-08-02 23:28 - 01161360 _____ (VIA Technologies, Inc.) C:\WINDOWS\system32\ViaKaraokeApo.dll
2013-12-22 11:58 - 2012-08-02 23:28 - 00248976 _____ (Windows ® Codename Longhorn DDK provider) C:\WINDOWS\system32\Dts2APO.dll
2013-12-22 11:58 - 2012-08-02 23:28 - 00092304 _____ (VIA Technologies, Inc.) C:\WINDOWS\system32\Dts2PropPageExt.dll
2013-12-22 11:58 - 2012-08-02 23:28 - 00055440 _____ (TODO: <Company name>) C:\WINDOWS\system32\PropPageExt.dll
2013-12-22 11:58 - 2012-06-28 02:54 - 00086016 _____ (QSound Labs, Inc.) C:\WINDOWS\system32\nQPropPageExt.dll
2013-12-22 11:58 - 2011-06-08 04:19 - 00083968 _____ (QSound Labs, Inc.) C:\WINDOWS\system32\nQAPO.dll
2013-12-22 11:49 - 2013-12-22 11:49 - 00000000 ____D C:\WINDOWS\GBD
2013-12-22 11:47 - 2013-12-22 11:47 - 00000010 _____ C:\WINDOWS\GSetup.ini
2013-12-22 11:47 - 2009-08-27 01:04 - 00207400 ____R () C:\WINDOWS\GSetup.exe
2013-12-22 11:33 - 2013-12-22 11:33 - 00000117 _____ C:\WINDOWS\system32\netcfg-14000.txt
2013-12-22 11:32 - 2013-12-22 11:32 - 00000117 _____ C:\WINDOWS\system32\netcfg-2837000.txt
 
==================== One Month Modified Files and Folders =======
 
2014-01-21 16:17 - 2014-01-21 16:17 - 00015901 _____ C:\Users\Cools\Desktop\FRST.txt
2014-01-21 16:17 - 2014-01-21 16:17 - 00000000 ____D C:\FRST
2014-01-21 16:13 - 2014-01-21 16:13 - 02077184 _____ (Farbar) C:\Users\Cools\Desktop\FRST64.exe
2014-01-21 16:04 - 2013-12-23 14:54 - 00000926 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-21 16:00 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\system32\sru
2014-01-21 15:56 - 2014-01-08 13:23 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-01-21 13:34 - 2013-12-23 14:33 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3061577256-1683689243-3653438943-1001
2014-01-21 13:04 - 2013-12-23 14:54 - 00000922 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-21 12:40 - 2013-12-22 12:40 - 00000402 _____ C:\WINDOWS\Tasks\FreeFileViewerUpdateChecker.job
2014-01-21 10:49 - 2014-01-08 12:57 - 01578101 _____ C:\WINDOWS\WindowsUpdate.log
2014-01-21 09:15 - 2014-01-21 09:16 - 00688992 _____ (Swearware) C:\Users\Cools\Desktop\dds.com
2014-01-21 09:15 - 2014-01-08 16:06 - 00000310 _____ C:\Users\Cools\Desktop\New Text Document.txt
2014-01-21 09:13 - 2014-01-21 09:13 - 00688992 _____ (Swearware) C:\Users\Cools\Desktop\dds.scr
2014-01-21 08:43 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\system32\FxsTmp
2014-01-20 23:40 - 2013-12-22 13:22 - 00002276 ____H C:\Users\Cools\Documents\Default.rdp
2014-01-19 22:02 - 2014-01-19 22:02 - 00002251 _____ C:\Users\Cools\Desktop\aswMBR_2014_01_19.txt
2014-01-19 22:02 - 2014-01-19 22:02 - 00000512 _____ C:\Users\Cools\Desktop\MBR.dat
2014-01-19 21:30 - 2014-01-19 21:59 - 04745728 _____ (AVAST Software) C:\Users\Cools\Desktop\aswMBR.exe
2014-01-19 21:03 - 2013-12-26 09:28 - 00000000 ____D C:\WINDOWS\System32\Tasks\NCH Software
2014-01-19 00:14 - 2013-11-14 01:28 - 00865408 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2014-01-19 00:10 - 2014-01-19 00:10 - 00000000 ____H C:\ProgramData\cm-lock
2014-01-19 00:10 - 2013-08-22 08:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2014-01-16 00:00 - 2013-08-22 07:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2014-01-15 16:21 - 2014-01-15 16:21 - 00000000 ____D C:\Users\Cools\AppData\Local\Macromedia
2014-01-15 12:44 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2014-01-15 12:34 - 2013-12-22 19:44 - 86054176 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-01-15 12:34 - 2013-12-22 19:44 - 00000000 ____D C:\WINDOWS\system32\MRT
2014-01-15 12:34 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\WinStore
2014-01-12 23:12 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\rescache
2014-01-12 21:03 - 2013-12-26 09:34 - 00000000 ____D C:\Users\Cools\AppData\Roaming\NCH Software
2014-01-12 21:03 - 2013-12-26 09:34 - 00000000 ____D C:\Program Files (x86)\NCH Software
2014-01-12 20:57 - 2014-01-12 20:57 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf
2014-01-12 20:57 - 2013-08-22 08:46 - 00296943 _____ C:\WINDOWS\setupact.log
2014-01-12 20:41 - 2013-12-23 14:54 - 00004182 _____ C:\WINDOWS\System32\Tasks\avast! Emergency Update
2014-01-12 20:40 - 2014-01-12 20:40 - 01024776 _____ C:\WINDOWS\Minidump\011214-9156-01.dmp
2014-01-12 20:40 - 2014-01-12 20:40 - 00000000 ____D C:\WINDOWS\Minidump
2014-01-12 20:40 - 2013-12-22 12:10 - 816906428 _____ C:\WINDOWS\MEMORY.DMP
2014-01-08 14:51 - 2014-01-08 14:51 - 23183360 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 17112576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 13177344 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 12996608 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 11674624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 11221504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 07399256 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2014-01-08 14:51 - 2014-01-08 14:51 - 05769216 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 04243968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 04191744 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2014-01-08 14:51 - 2014-01-08 14:51 - 04105728 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncEngine.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 02896896 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 02764288 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 02570240 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 02334208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 02266624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 02166784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 02143744 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 02140888 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 01995264 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-01-08 14:51 - 2014-01-08 14:51 - 01928192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-01-08 14:51 - 2014-01-08 14:51 - 01843712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Display.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 01816576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Display.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 01765384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 01765376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 01756160 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPDMC.exe
2014-01-08 14:51 - 2014-01-08 14:51 - 01642016 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2014-01-08 14:51 - 2014-01-08 14:51 - 01530200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2014-01-08 14:51 - 2014-01-08 14:51 - 01506680 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2014-01-08 14:51 - 2014-01-08 14:51 - 01476184 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2014-01-08 14:51 - 2014-01-08 14:51 - 01395200 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 01391104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPDMC.exe
2014-01-08 14:51 - 2014-01-08 14:51 - 01345536 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2014-01-08 14:51 - 2014-01-08 14:51 - 01302528 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 01157632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00922624 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00747008 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidcli.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00744448 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00637952 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2014-01-08 14:51 - 2014-01-08 14:51 - 00615936 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAgent.exe
2014-01-08 14:51 - 2014-01-08 14:51 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00568832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDrive.exe
2014-01-08 14:51 - 2014-01-08 14:51 - 00566784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpncore.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00544768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlidcli.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00516496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00479744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2014-01-08 14:51 - 2014-01-08 14:51 - 00406400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00393216 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPhoto.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00382808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2014-01-08 14:51 - 2014-01-08 14:51 - 00372568 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2014-01-08 14:51 - 2014-01-08 14:51 - 00358896 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcomp.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00348160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPhoto.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00325464 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS
2014-01-08 14:51 - 2014-01-08 14:51 - 00287744 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00254464 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00240128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mdmregistration.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00225792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dcomp.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-01-08 14:51 - 2014-01-08 14:51 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00197120 _____ (Microsoft Corporation) C:\WINDOWS\system32\scrrun.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scrrun.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00146776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\SerCx2.sys
2014-01-08 14:51 - 2014-01-08 14:51 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbici.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00086872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2014-01-08 14:51 - 2014-01-08 14:51 - 00075360 _____ (Microsoft Corporation) C:\WINDOWS\system32\imagehlp.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00070680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imagehlp.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00039768 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys
2014-01-08 14:51 - 2014-01-08 14:51 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredentialMigrationHandler.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredentialMigrationHandler.dll
2014-01-08 14:51 - 2014-01-08 14:51 - 00000000 __SHD C:\Recovery
2014-01-08 14:51 - 2013-08-22 09:36 - 00262144 _____ C:\WINDOWS\system32\config\BCD-Template
2014-01-08 14:51 - 2013-08-22 09:36 - 00000000 ___RD C:\WINDOWS\ToastData
2014-01-08 14:51 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\MediaViewer
2014-01-08 14:51 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\FileManager
2014-01-08 14:51 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\Camera
2014-01-08 14:50 - 2014-01-08 14:50 - 00262144 _____ C:\WINDOWS\system32\config\userdiff
2014-01-08 14:50 - 2014-01-08 14:50 - 00000000 ____D C:\Program Files\Reference Assemblies
2014-01-08 14:50 - 2014-01-08 14:50 - 00000000 ____D C:\Program Files\MSBuild
2014-01-08 14:50 - 2014-01-08 14:50 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies
2014-01-08 14:50 - 2014-01-08 14:50 - 00000000 ____D C:\Program Files (x86)\MSBuild
2014-01-08 13:23 - 2014-01-08 13:23 - 00003718 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2014-01-08 13:23 - 2014-01-08 13:21 - 00000000 ____D C:\Users\Cools\AppData\Local\Adobe
2014-01-08 13:14 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\system32\restore
2014-01-08 13:03 - 2013-12-23 05:15 - 00056832 ___SH C:\Users\Cools\Desktop\Thumbs.db
2014-01-08 13:02 - 2014-01-08 14:51 - 00000000 ___DC C:\WINDOWS\Panther
2014-01-08 13:02 - 2014-01-08 13:02 - 00001446 _____ C:\Users\Cools\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-01-08 13:02 - 2014-01-08 13:02 - 00000020 ___SH C:\Users\Cools\ntuser.ini
2014-01-08 13:02 - 2014-01-08 12:54 - 00000000 ____D C:\Users\Cools
2014-01-08 13:02 - 2013-12-23 14:28 - 00000000 ___RD C:\Users\Cools\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-08 13:02 - 2013-12-23 14:28 - 00000000 ___RD C:\Users\Cools\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-01-08 13:02 - 2013-12-23 14:28 - 00000000 ____D C:\WINDOWS\System32\Tasks\WPD
2014-01-08 13:02 - 2013-12-23 14:27 - 00000000 ____D C:\Users\Cools\AppData\Local\Packages
2014-01-08 12:57 - 2014-01-08 12:54 - 00020958 _____ C:\WINDOWS\diagwrn.xml
2014-01-08 12:57 - 2014-01-08 12:54 - 00020958 _____ C:\WINDOWS\diagerr.xml
2014-01-08 12:57 - 2014-01-08 12:33 - 00006693 _____ C:\WINDOWS\comsetup.log
2014-01-08 12:57 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\Registration
2014-01-08 12:56 - 2014-01-08 12:56 - 00022744 _____ C:\WINDOWS\system32\emptyregdb.dat
2014-01-08 12:56 - 2013-08-22 09:36 - 00000000 __RSD C:\WINDOWS\Media
2014-01-08 12:56 - 2013-08-22 09:36 - 00000000 __RHD C:\Users\Public\Libraries
2014-01-08 12:55 - 2014-01-08 12:53 - 00000000 ____D C:\Program Files (x86)\Intel
2014-01-08 12:55 - 2013-12-23 14:27 - 00000000 ____D C:\ProgramData\PRICache
2014-01-08 12:55 - 2013-12-22 12:22 - 00000000 ____D C:\WINDOWS\SysWOW64\Atheros_L1e
2014-01-08 12:55 - 2013-11-14 01:14 - 00000000 ____D C:\WINDOWS\SysWOW64\WCN
2014-01-08 12:55 - 2013-11-14 01:14 - 00000000 ____D C:\WINDOWS\SysWOW64\sysprep
2014-01-08 12:55 - 2013-11-14 01:14 - 00000000 ____D C:\WINDOWS\system32\WCN
2014-01-08 12:55 - 2013-08-22 09:43 - 00000000 ____D C:\WINDOWS\DigitalLocker
2014-01-08 12:55 - 2013-08-22 09:37 - 00004893 _____ C:\WINDOWS\DtcInstall.log
2014-01-08 12:55 - 2013-08-22 09:36 - 00000000 __SHD C:\Program Files\Windows Sidebar
2014-01-08 12:55 - 2013-08-22 09:36 - 00000000 __SHD C:\Program Files (x86)\Windows Sidebar
2014-01-08 12:55 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\SysWOW64\MUI
2014-01-08 12:55 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\SysWOW64\migwiz
2014-01-08 12:55 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\SysWOW64\IME
2014-01-08 12:55 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\system32\spool
2014-01-08 12:55 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\system32\MUI
2014-01-08 12:55 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\system32\IME
2014-01-08 12:55 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\Help
2014-01-08 12:55 - 2013-08-22 09:36 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2014-01-08 12:55 - 2013-08-22 08:44 - 00335784 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2014-01-08 12:55 - 2013-08-22 07:36 - 00000000 ____D C:\WINDOWS\SysWOW64\SMI
2014-01-08 12:55 - 2013-08-22 07:25 - 00008192 ___SH C:\WINDOWS\system32\config\ELAM
2014-01-08 12:55 - 2012-07-25 23:37 - 00000000 ____D C:\Users\Default.migrated
2014-01-08 12:54 - 2014-01-08 12:54 - 00000000 ___RD C:\Users\Cools\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-01-08 12:54 - 2014-01-08 12:54 - 00000000 ____D C:\WINDOWS\system32\config\bbimigrate
2014-01-08 12:54 - 2013-12-22 12:27 - 00000000 ____D C:\Users\Cools\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Marvell
2014-01-08 12:54 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\system32\Recovery
2014-01-08 12:53 - 2014-01-08 12:53 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2014-01-08 12:53 - 2014-01-08 12:53 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_TeeDriverx64_01011.Wdf
2014-01-08 12:53 - 2013-08-22 07:36 - 00000000 ____D C:\WINDOWS\system32\Sysprep
2014-01-08 12:52 - 2013-11-14 01:20 - 00000804 _____ C:\WINDOWS\PFRO.log
2014-01-08 12:52 - 2013-08-22 07:36 - 00000000 __RHD C:\Users\Default
2014-01-08 12:47 - 2013-12-23 14:27 - 01522578 _____ C:\WINDOWS\WindowsUpdate (1).log
2014-01-08 12:16 - 2012-07-26 02:12 - 00000000 ____D C:\WINDOWS\AUInstallAgent
2014-01-06 16:31 - 2013-08-22 09:38 - 00693240 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-01-06 16:31 - 2013-08-22 09:38 - 00105464 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-05 19:35 - 2013-12-23 15:20 - 00016186 _____ C:\WINDOWS\DPINST.LOG
2014-01-05 19:32 - 2013-12-23 15:20 - 00000000 ____D C:\Program Files\Focusrite
2014-01-02 23:19 - 2013-12-22 21:10 - 00000000 ____D C:\Program Files (x86)\CodeMeter
2014-01-01 16:27 - 2013-12-22 21:10 - 00000000 ____D C:\Users\Cools\AppData\Roaming\Propellerhead Software
2014-01-01 16:27 - 2013-12-22 21:10 - 00000000 ____D C:\ProgramData\Propellerhead Software
2014-01-01 13:01 - 2013-12-26 15:57 - 00000000 ____D C:\Users\Cools\AppData\Roaming\Spotify
2013-12-31 11:02 - 2013-12-23 05:15 - 00000000 ____D C:\Users\Cools\AppData\Roaming\Apple Computer
2013-12-28 03:38 - 2013-12-28 01:47 - 00000000 ____D C:\ProgramData\Acronis
2013-12-28 02:03 - 2013-12-26 18:45 - 00000000 ____D C:\Users\Cools\Desktop\desktop icons
2013-12-28 02:01 - 2013-12-28 02:01 - 00000000 ____D C:\Users\Cools\AppData\Roaming\Acronis
2013-12-28 01:47 - 2013-12-28 01:47 - 01464096 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\tdrpman.sys
2013-12-28 01:47 - 2013-12-28 01:47 - 01120032 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\tib.sys
2013-12-28 01:47 - 2013-12-28 01:47 - 00367200 _____ (Acronis) C:\WINDOWS\system32\Drivers\afcdp.sys
2013-12-28 01:47 - 2013-12-28 01:47 - 00269600 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\snapman.sys
2013-12-28 01:47 - 2013-12-28 01:47 - 00198432 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\tib_mounter.sys
2013-12-28 01:47 - 2013-12-28 01:47 - 00116000 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\fltsrv.sys
2013-12-28 01:47 - 2013-12-28 01:47 - 00000000 ____D C:\Program Files (x86)\Acronis
2013-12-27 00:54 - 2013-12-27 00:54 - 00729632 _____ (Acronis) C:\WINDOWS\system32\Drivers\timntr.sys
2013-12-27 00:54 - 2013-12-27 00:54 - 00078880 _____ (Acronis) C:\WINDOWS\system32\Drivers\tifsfilt.sys
2013-12-27 00:46 - 2013-12-27 00:46 - 00003044 _____ C:\WINDOWS\System32\Tasks\{1CA7EF57-F05A-4468-9FF0-BCBC25D389DC}
2013-12-27 00:45 - 2013-12-27 00:45 - 00000000 ____D C:\WINDOWS\System32\Tasks\Leader Technologies
2013-12-27 00:43 - 2013-12-27 00:43 - 00000000 ____D C:\Users\Cools\AppData\Roaming\Leadertech
2013-12-26 23:50 - 2013-12-26 23:50 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2013-12-26 16:06 - 2013-12-26 15:58 - 00000000 ____D C:\Users\Cools\AppData\Local\Spotify
2013-12-26 15:58 - 2013-12-26 15:58 - 00001797 _____ C:\Users\Cools\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2013-12-26 10:13 - 2013-12-26 10:13 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-12-26 10:13 - 2013-12-26 10:13 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-12-26 10:06 - 2013-12-26 09:28 - 00000000 ____D C:\ProgramData\NCH Software
2013-12-23 15:20 - 2013-12-23 15:20 - 00000000 ____D C:\Program Files\DIFX
2013-12-23 14:59 - 2013-12-23 14:54 - 00003898 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2013-12-23 14:59 - 2013-12-23 14:54 - 00003662 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2013-12-23 14:54 - 2013-12-23 14:54 - 01034464 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
2013-12-23 14:54 - 2013-12-23 14:54 - 00422216 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2013-12-23 14:54 - 2013-12-23 14:54 - 00334136 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2013-12-23 14:54 - 2013-12-23 14:54 - 00207904 _____ C:\WINDOWS\system32\Drivers\aswVmm.sys
2013-12-23 14:54 - 2013-12-23 14:54 - 00092544 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2013-12-23 14:54 - 2013-12-23 14:54 - 00079672 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswstm.sys
2013-12-23 14:54 - 2013-12-23 14:54 - 00078648 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2013-12-23 14:54 - 2013-12-23 14:54 - 00065776 _____ C:\WINDOWS\system32\Drivers\aswRvrt.sys
2013-12-23 14:54 - 2013-12-23 14:54 - 00043152 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2013-12-23 14:54 - 2013-12-23 14:54 - 00000000 ____D C:\Users\Cools\AppData\Roaming\AVAST Software
2013-12-23 14:54 - 2013-12-23 14:54 - 00000000 ____D C:\Users\Cools\AppData\Local\Google
2013-12-23 14:54 - 2013-12-23 14:54 - 00000000 ____D C:\Program Files (x86)\Google
2013-12-23 14:53 - 2013-12-23 14:53 - 00000000 ____D C:\ProgramData\AVAST Software
2013-12-23 14:53 - 2013-12-23 14:53 - 00000000 ____D C:\Program Files\AVAST Software
2013-12-23 14:51 - 2013-12-23 14:51 - 00000000 ____D C:\Users\Cools\AppData\Roaming\Macromedia
2013-12-23 14:49 - 2013-12-23 14:49 - 00000117 _____ C:\WINDOWS\system32\netcfg-531156.txt
2013-12-23 14:49 - 2013-12-23 14:49 - 00000117 _____ C:\WINDOWS\system32\netcfg-531125.txt
2013-12-23 14:41 - 2013-12-23 14:41 - 00000117 _____ C:\WINDOWS\system32\netcfg-12609.txt
2013-12-23 14:40 - 2013-12-23 14:40 - 00000117 _____ C:\WINDOWS\system32\netcfg-1723656.txt
2013-12-23 14:30 - 2013-12-23 14:30 - 00000000 ____D C:\Intel
2013-12-23 14:28 - 2013-12-23 14:28 - 00000000 ____D C:\Users\Cools\AppData\Roaming\Adobe
2013-12-23 14:22 - 2013-12-23 14:22 - 00000117 _____ C:\WINDOWS\system32\netcfg-614359.txt
2013-12-23 14:22 - 2013-12-23 14:22 - 00000117 _____ C:\WINDOWS\system32\netcfg-611328.txt
2013-12-23 14:22 - 2013-12-23 14:22 - 00000117 _____ C:\WINDOWS\system32\netcfg-611296.txt
2013-12-23 14:21 - 2013-12-23 14:21 - 00000117 _____ C:\WINDOWS\system32\netcfg-610265.txt
2013-12-23 14:20 - 2013-12-23 14:20 - 00001139 _____ C:\WINDOWS\system32\netcfg-514359.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00001136 _____ C:\WINDOWS\system32\netcfg-18859.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00001134 _____ C:\WINDOWS\system32\netcfg-19515.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00000197 _____ C:\WINDOWS\system32\netcfg-19218.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00000185 _____ C:\WINDOWS\system32\netcfg-17687.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00000164 _____ C:\WINDOWS\system32\netcfg-14640.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00000161 _____ C:\WINDOWS\system32\netcfg-17546.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00000160 _____ C:\WINDOWS\system32\netcfg-17406.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00000160 _____ C:\WINDOWS\system32\netcfg-16625.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00000160 _____ C:\WINDOWS\system32\netcfg-16234.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00000159 _____ C:\WINDOWS\system32\netcfg-16828.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00000157 _____ C:\WINDOWS\system32\netcfg-17265.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00000157 _____ C:\WINDOWS\system32\netcfg-14843.txt
2013-12-23 14:11 - 2013-12-23 14:11 - 00000150 _____ C:\WINDOWS\system32\netcfg-16078.txt
2013-12-23 10:57 - 2013-12-22 20:36 - 00000000 ____D C:\Users\Cools\Desktop\CSG
2013-12-23 10:49 - 2013-12-23 10:44 - 00006734 _____ C:\Users\Cools\Maschine2.log
2013-12-23 10:44 - 2013-12-23 10:44 - 00000000 ____D C:\Users\Public\Documents\NI Resources
2013-12-23 10:44 - 2013-12-23 10:44 - 00000000 ____D C:\Users\Cools\AppData\Local\Native Instruments
2013-12-23 10:44 - 2013-12-23 10:14 - 00000000 ____D C:\Users\Cools\Documents\Native Instruments
2013-12-23 10:43 - 2013-12-23 10:43 - 00000000 __HDC C:\ProgramData\{1406CED2-9A2C-427C-9985-C9D766994EA3}
2013-12-23 10:14 - 2013-12-23 10:14 - 00000000 __HDC C:\ProgramData\{CF94F91C-2252-4F20-8603-3735C706F33F}
2013-12-23 10:14 - 2013-12-23 10:14 - 00000000 __HDC C:\ProgramData\{B30E15D4-C78A-49C1-8297-800AE0224436}
2013-12-23 10:14 - 2013-12-23 10:14 - 00000000 __HDC C:\ProgramData\{5308BF3B-B4EF-47BE-A637-CB011D7BE147}
2013-12-23 10:13 - 2013-12-23 10:13 - 00000000 __HDC C:\ProgramData\{C5A9D49F-FB00-46E2-BB29-AC4E9A6B75F6}
2013-12-23 10:13 - 2013-12-23 10:13 - 00000000 __HDC C:\ProgramData\{BBC1A9AD-CA48-4B3E-83AB-BBC5D60562B7}
2013-12-23 10:13 - 2013-12-23 10:13 - 00000000 __HDC C:\ProgramData\{4F1011FE-3478-4D2B-8F9F-7EA7C144DFC2}
2013-12-23 10:13 - 2013-12-23 03:38 - 00000000 ____D C:\Program Files\Common Files\Native Instruments
2013-12-23 10:12 - 2013-12-23 10:12 - 00000000 __HDC C:\ProgramData\{51219C66-4A99-4FA4-9EE9-2ACA1ED441D1}
2013-12-23 05:15 - 2013-12-23 05:15 - 00000000 ____D C:\Users\Cools\AppData\Local\Apple Computer
2013-12-23 05:15 - 2013-12-23 05:15 - 00000000 ____D C:\ProgramData\Apple Computer
2013-12-23 05:15 - 2013-12-23 05:15 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-12-23 05:15 - 2013-12-23 05:15 - 00000000 ____D C:\Program Files\iTunes
2013-12-23 05:15 - 2013-12-23 05:15 - 00000000 ____D C:\Program Files\iPod
2013-12-23 05:14 - 2013-12-23 05:14 - 00000000 ____D C:\WINDOWS\System32\Tasks\Apple
2013-12-23 05:14 - 2013-12-23 05:14 - 00000000 ____D C:\Users\Cools\AppData\Local\Apple
2013-12-23 05:14 - 2013-12-23 05:14 - 00000000 ____D C:\ProgramData\Apple
2013-12-23 05:14 - 2013-12-23 05:14 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-12-23 05:14 - 2013-12-23 05:14 - 00000000 ____D C:\Program Files\Bonjour
2013-12-23 05:14 - 2013-12-23 05:14 - 00000000 ____D C:\Program Files (x86)\Bonjour
2013-12-23 05:14 - 2013-12-23 05:14 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2013-12-23 04:46 - 2013-12-23 04:46 - 00000682 _____ C:\Users\Cools\Desktop\Downloads.lnk
2013-12-23 03:40 - 2013-12-22 21:01 - 00000000 ____D C:\Program Files\Propellerhead
2013-12-23 03:38 - 2013-12-23 03:38 - 00000000 __HDC C:\ProgramData\{F57C376F-E7ED-4527-9EE2-4D50799418BC}
2013-12-23 03:38 - 2013-12-23 03:38 - 00000000 __HDC C:\ProgramData\{C6A355F5-168B-4EEC-AB7C-75594F783EDB}
2013-12-23 03:38 - 2013-12-23 03:38 - 00000000 __HDC C:\ProgramData\{A2012EEF-6DBF-4B4B-B8A6-03EAAF108CAE}
2013-12-23 03:38 - 2013-12-23 03:38 - 00000000 __HDC C:\ProgramData\{12FE44EF-1D1E-4CB1-BEC8-B5A61C3ACA42}
2013-12-23 03:38 - 2013-12-23 03:38 - 00000000 ____D C:\ProgramData\Native Instruments
2013-12-23 03:38 - 2013-12-23 03:38 - 00000000 ____D C:\Program Files\Native Instruments
2013-12-23 03:38 - 2013-12-23 03:38 - 00000000 ____D C:\Program Files\Common Files\Avid
2013-12-23 03:06 - 2013-12-22 20:21 - 00000000 ____D C:\Users\Cools\Documents\Snagit
2013-12-23 01:35 - 2013-12-23 01:35 - 00000000 ____D C:\Program Files\WIBU-SYSTEMS
2013-12-23 01:35 - 2013-12-23 01:35 - 00000000 ____D C:\Program Files\CodeMeter
2013-12-23 01:35 - 2013-12-22 21:40 - 00000000 ____D C:\ProgramData\CodeMeter
2013-12-22 23:26 - 2013-12-22 23:26 - 00112408 _____ C:\WINDOWS\system32\Drivers\NIWinCDEmu.sys
2013-12-22 23:26 - 2013-12-22 23:26 - 00000000 ____D C:\Program Files (x86)\Native Instruments
2013-12-22 21:27 - 2013-12-22 21:10 - 00000000 ____D C:\Users\Cools\AppData\Roaming\Line 6
2013-12-22 21:10 - 2013-12-22 21:10 - 00000000 ____D C:\ProgramData\Line 6
2013-12-22 21:10 - 2013-12-22 21:10 - 00000000 ____D C:\Program Files\Common Files\Propellerhead Software
2013-12-22 20:30 - 2013-12-22 20:30 - 00000000 ____D C:\Program Files (x86)\TechSmith
2013-12-22 20:30 - 2013-12-22 20:20 - 00000000 ____D C:\ProgramData\TechSmith
2013-12-22 20:20 - 2013-12-22 20:20 - 00000000 ____D C:\Users\Cools\AppData\Local\TechSmith
2013-12-22 20:03 - 2013-12-22 20:03 - 00000117 _____ C:\WINDOWS\system32\netcfg-24485734.txt
2013-12-22 19:29 - 2013-12-22 19:29 - 00000117 _____ C:\WINDOWS\system32\netcfg-22419031.txt
2013-12-22 19:29 - 2013-12-22 19:29 - 00000117 _____ C:\WINDOWS\system32\netcfg-22418625.txt
2013-12-22 13:36 - 2013-12-22 13:36 - 00000117 _____ C:\WINDOWS\system32\netcfg-1286265.txt
2013-12-22 13:35 - 2013-12-22 13:35 - 00000117 _____ C:\WINDOWS\system32\netcfg-1174828.txt
2013-12-22 13:33 - 2013-12-22 13:33 - 00000117 _____ C:\WINDOWS\system32\netcfg-1091171.txt
2013-12-22 13:22 - 2013-12-22 13:22 - 00000117 _____ C:\WINDOWS\system32\netcfg-401093.txt
2013-12-22 13:21 - 2013-12-22 13:21 - 00264616 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2013-12-22 13:21 - 2013-12-22 13:21 - 00175016 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2013-12-22 13:21 - 2013-12-22 13:21 - 00174504 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2013-12-22 13:21 - 2013-12-22 13:21 - 00096168 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2013-12-22 13:21 - 2013-12-22 13:21 - 00000000 ____D C:\ProgramData\Sun
2013-12-22 13:21 - 2013-12-22 13:21 - 00000000 ____D C:\ProgramData\Oracle
2013-12-22 13:21 - 2013-12-22 13:21 - 00000000 ____D C:\Program Files (x86)\Java
2013-12-22 13:19 - 2013-12-22 13:16 - 00000000 ____D C:\Users\Cools\AppData\Roaming\FreeFileViewer
2013-12-22 13:15 - 2013-12-22 13:15 - 00000117 _____ C:\WINDOWS\system32\netcfg-2531812.txt
2013-12-22 13:15 - 2013-12-22 13:15 - 00000117 _____ C:\WINDOWS\system32\netcfg-12593.txt
2013-12-22 13:02 - 2013-12-22 13:02 - 00000355 _____ C:\Users\Cools\Desktop\Computer.lnk
2013-12-22 12:51 - 2013-12-22 12:51 - 00001165 _____ C:\WINDOWS\system32\netcfg-1098750.txt
2013-12-22 12:51 - 2013-12-22 12:51 - 00000000 ____D C:\Users\Cools\AppData\Local\Cisco
2013-12-22 12:51 - 2013-12-22 12:51 - 00000000 ____D C:\ProgramData\Cisco
2013-12-22 12:51 - 2013-12-22 12:51 - 00000000 ____D C:\Program Files (x86)\Cisco
2013-12-22 12:47 - 2013-12-22 12:47 - 00000000 ____D C:\Users\Cools\AppData\Roaming\Mozilla
2013-12-22 12:47 - 2013-12-22 12:47 - 00000000 ____D C:\Users\Cools\AppData\Local\Mozilla
2013-12-22 12:47 - 2013-12-22 12:47 - 00000000 ____D C:\ProgramData\Mozilla
2013-12-22 12:47 - 2013-12-22 12:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-22 12:47 - 2013-12-22 12:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-22 12:42 - 2013-12-22 12:42 - 00000000 ____D C:\WINDOWS\A7091E1D36A447F1A739173CC341414F.TMP
2013-12-22 12:41 - 2013-12-22 12:41 - 00000000 ____D C:\Users\Cools\AppData\Local\FreeFileViewer
2013-12-22 12:40 - 2013-12-22 12:40 - 00003078 _____ C:\WINDOWS\System32\Tasks\FreeFileViewerUpdateChecker
2013-12-22 12:40 - 2013-12-22 12:40 - 00000000 ____D C:\Program Files (x86)\FreeFileViewer
2013-12-22 12:34 - 2013-12-23 14:27 - 00000000 ____D C:\Users\Cools\AppData\Local\VirtualStore
2013-12-22 12:34 - 2013-12-22 12:27 - 00000000 ____D C:\Program Files (x86)\Marvell
2013-12-22 12:34 - 2011-11-21 21:08 - 00004096 _____ C:\WINDOWS\SysWOW64\freqdb.db
2013-12-22 12:33 - 2013-12-22 12:33 - 00000117 _____ C:\WINDOWS\system32\netcfg-12093.txt
2013-12-22 12:33 - 2013-12-22 12:32 - 00000592 _____ C:\WINDOWS\backend.log
2013-12-22 12:32 - 2013-12-22 12:32 - 00000117 _____ C:\WINDOWS\system32\netcfg-1180687.txt
2013-12-22 12:23 - 2013-12-22 12:23 - 00820120 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2013-12-22 12:23 - 2013-12-22 12:23 - 00000305 _____ C:\WINDOWS\system32\netcfg-593531.txt
2013-12-22 12:23 - 2013-12-22 12:23 - 00000000 ____D C:\Users\Cools\Intel
2013-12-22 12:23 - 2013-12-22 12:23 - 00000000 ____D C:\Users\Cools\AppData\Roaming\Intel Corporation
2013-12-22 12:23 - 2013-12-22 12:21 - 00000000 ____D C:\ProgramData\Intel
2013-12-22 12:23 - 2013-12-22 12:21 - 00000000 ____D C:\Program Files\Intel
2013-12-22 12:22 - 2013-12-22 12:07 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-22 12:21 - 2013-12-22 12:21 - 00000000 ____D C:\Users\Cools\AppData\Roaming\InstallShield
2013-12-22 12:13 - 2013-12-22 12:13 - 00000117 _____ C:\WINDOWS\system32\netcfg-11000.txt
2013-12-22 12:12 - 2013-12-22 12:12 - 00000117 _____ C:\WINDOWS\system32\netcfg-148734.txt
2013-12-22 12:10 - 2013-12-22 12:10 - 00000117 _____ C:\WINDOWS\system32\netcfg-6984.txt
2013-12-22 12:10 - 2013-12-22 12:10 - 00000117 _____ C:\WINDOWS\system32\netcfg-12640.txt
2013-12-22 12:09 - 2013-12-22 12:09 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_xhcdrv_01011.Wdf
2013-12-22 12:09 - 2013-12-22 12:09 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_ViaHub3_01011.Wdf
2013-12-22 12:08 - 2013-12-22 12:08 - 00000117 _____ C:\WINDOWS\system32\netcfg-12484.txt
2013-12-22 12:07 - 2013-12-22 12:07 - 00000117 _____ C:\WINDOWS\system32\netcfg-522140.txt
2013-12-22 12:07 - 2013-12-22 12:07 - 00000000 ____D C:\Program Files (x86)\VIA
2013-12-22 11:59 - 2013-12-22 11:59 - 00000117 _____ C:\WINDOWS\system32\netcfg-12468.txt
2013-12-22 11:58 - 2013-12-22 11:58 - 00000117 _____ C:\WINDOWS\system32\netcfg-1550890.txt
2013-12-22 11:49 - 2013-12-22 11:49 - 00000000 ____D C:\WINDOWS\GBD
2013-12-22 11:47 - 2013-12-22 11:47 - 00000010 _____ C:\WINDOWS\GSetup.ini
2013-12-22 11:33 - 2013-12-22 11:33 - 00000117 _____ C:\WINDOWS\system32\netcfg-14000.txt
2013-12-22 11:32 - 2013-12-22 11:32 - 00000117 _____ C:\WINDOWS\system32\netcfg-2837000.txt
 
Some content of TEMP:
====================
C:\Users\Cools\AppData\Local\Temp\20140108010500644jniverify.dll
C:\Users\Cools\AppData\Local\Temp\2014011508062291jniverify.dll
C:\Users\Cools\AppData\Local\Temp\20140115123740364jniverify.dll
C:\Users\Cools\AppData\Local\Temp\20140120083044294jniverify.dll
 
 
==================== Bamital & volsnap Check =================
 
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 
LastRegBack: 2014-01-19 00:58
 
==================== End Of Log ============================

 

 

 

---------------------------------------------------------------------------------------------------------------------------------------------

 

 

 

Addition.txt (while you said to attach it, I'm just following the rule in your signature "Please Only Copy And Paste Reports Into Topic - Do Not Attach"

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-01-2014

Ran by Cools at 2014-01-21 16:17:45
Running from C:\Users\Cools\Desktop
Boot Mode: Normal
==========================================================
 
 
==================== Security Center ========================
 
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
 
==================== Installed Programs ======================
 
Acronis True Image 2014 (x32 Version: 17.0.6614 - Acronis) Hidden
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Apple Application Support (x32 Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)
Audacity 2.0.5 (x32 Version: 2.0.5 - Audacity Team)
Authorizer 2.5.1 (Version: 2.5.1 - Propellerhead Software AB)
Authorizer Ignition Key Support (Version: 1.0.5.0 - Propellerhead Software AB) Hidden
avast! Free Antivirus (x32 Version: 9.0.2011 - Avast Software)
Bonjour (Version: 3.0.0.10 - Apple Inc.)
Cisco AnyConnect Secure Mobility Client  (x32 Version: 3.1.00495 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.00495 - Cisco Systems, Inc.) Hidden
CodeMeter Runtime Kit v5.10a (Version: 5.10.1224.501 - WIBU-SYSTEMS AG)
Focusrite USB 2.0 Audio Driver 2.5.1 (Version: 2.5.1 - Focusrite Audio Engineering Limited.)
Free File Viewer 2012 (x32 Version: 2012.10.9.0 - Bitberry Software)
Free YouTube To Mp3 Downloader (x32 Version:  - Free YouTube To Mp3 Downloader)
Google Chrome (x32 Version: 32.0.1700.76 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Intel® Management Engine Components (x32 Version: 9.5.15.1730 - Intel Corporation)
Intel® Processor Graphics (x32 Version: 10.18.10.3379 - Intel Corporation)
Intel® Rapid Storage Technology (Version: 12.8.0.1016 - Intel Corporation)
Intel® Rapid Storage Technology (Version: 12.8.0.1016 - Intel Corporation) Hidden
Intel® Trusted Connect Service Client (Version: 1.31.8.1 - Intel Corporation) Hidden
iTunes (Version: 11.1.3.8 - Apple Inc.)
Java 7 Update 45 (x32 Version: 7.0.450 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Line 6 Uninstaller (x32 Version:  - Line 6)
marvell 91xx driver (x32 Version: 1.2.0.1020 - Marvell)
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 26.0 (x86 en-US) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
Native Instruments Controller Editor (Version: 1.6.1.1657 - Native Instruments) Hidden
Native Instruments Controller Editor (x32 Version: 1.6.1.1657 - Native Instruments)
Native Instruments Komplete Selection (Version: 1.0.4.1 - Native Instruments) Hidden
Native Instruments Komplete Selection (x32 Version:  - Native Instruments)
Native Instruments Kontakt 5 (Version: 5.3.0.6464 - Native Instruments) Hidden
Native Instruments Kontakt 5 (x32 Version: 5.3.0.6464 - Native Instruments)
Native Instruments Maschine 2 (Version: 2.0.5.1057 - Native Instruments) Hidden
Native Instruments Maschine 2 (x32 Version: 2.0.5.1057 - Native Instruments)
Native Instruments Maschine 2 Factory Library (Version: 1.1.0.7 - Native Instruments) Hidden
Native Instruments Maschine 2 Factory Library (x32 Version: 1.1.0.7 - Native Instruments)
Native Instruments Maschine Controller MK2 Driver (Version: 3.0.4.719 - Native Instruments) Hidden
Native Instruments Maschine Controller MK2 Driver (x32 Version:  - Native Instruments)
Native Instruments Massive (Version: 1.4.0.292 - Native Instruments) Hidden
Native Instruments Massive (x32 Version: 1.4.0.292 - Native Instruments)
Native Instruments Reaktor 5 (Version: 5.9.0.725 - Native Instruments) Hidden
Native Instruments Reaktor 5 (x32 Version: 5.9.0.725 - Native Instruments)
Native Instruments Reaktor Prism (Version: 1.4.0.10 - Native Instruments) Hidden
Native Instruments Reaktor Prism (x32 Version: 1.4.0.10 - Native Instruments)
Native Instruments Scarbee Mark I (Version: 1.3.0.7 - Native Instruments) Hidden
Native Instruments Scarbee Mark I (x32 Version: 1.3.0.7 - Native Instruments)
Native Instruments Service Center (Version: 2.5.2.1549 - Native Instruments) Hidden
Native Instruments Service Center (x32 Version: 2.5.2.1549 - Native Instruments)
Native Instruments Solid Bus Comp FX (Version: 1.1.0.394 - Native Instruments) Hidden
Native Instruments Solid Bus Comp FX (x32 Version: 1.1.0.394 - Native Instruments)
Platform (x32 Version: 1.39 - VIA Technologies, Inc.) Hidden
Qualcomm Atheros Inc.® AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 2.1.0.21 - Qualcomm Atheros Inc.)
Reason 6.5.3 (Version: 6.5.3 - Propellerhead Software AB)
ReCycle v2.1 (x32 Version:  - )
Snagit 10.0.2 (x32 Version: 10.0.2 - TechSmith Corporation)
Spotify (HKCU Version: 0.9.6.81.gd359a796 - Spotify AB)
Switch Sound File Converter (x32 Version: 4.52 - NCH Software)
VIA Platform Device Manager (x32 Version: 1.39 - VIA Technologies, Inc.)
WavePad Sound Editor (x32 Version: 5.55 - NCH Software)
Windows Driver Package - Focusrite USB 2.0 Audio Driver (09/25/2013 2.5.128.1) (Version: 09/25/2013 2.5.128.1 - Focusrite)
 
==================== Restore Points  =========================
 
08-01-2014 19:14:31 Windows Update
15-01-2014 15:42:48 Windows Update
21-01-2014 09:30:10 Windows Update
 
==================== Hosts content: ==========================
 
2013-08-22 07:25 - 2013-08-22 07:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
 
==================== Scheduled Tasks (whitelisted) =============
 
Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {1D6936AB-EA11-49C6-8C25-B9054753A506} - System32\Tasks\FreeFileViewerUpdateChecker => C:\Program Files (x86)\FreeFileViewer\FFVCheckForUpdates.exe [2013-03-25] (Bitberry Software)
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-21] (Microsoft Corporation)
Task: {395E77D8-E86A-4903-B5D3-661A366BD492} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {4661F16F-D5AA-45D5-BDFE-4D0E027817E8} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-23] (Google Inc.)
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {ACDDE9A8-9991-41BF-A51B-504CC029708C} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-01-08] (Adobe Systems Incorporated)
Task: {B1B6FA8C-2C6C-47D4-91DE-03D2223B4E48} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-01-15] (Microsoft Corporation)
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D145AB8C-EE17-4AF1-89AC-49D24EE40964} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-12-23] (AVAST Software)
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: {F36C2ADA-92EB-4CE2-AE77-B6A005CEF924} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-23] (Google Inc.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\FreeFileViewerUpdateChecker.job => C:\Program Files (x86)\FreeFileViewer\FFVCheckForUpdates.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 
==================== Loaded Modules (whitelisted) =============
 
2013-10-01 10:26 - 2013-10-01 10:26 - 02810968 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll
2013-12-21 00:02 - 2013-12-21 00:02 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-12-22 12:07 - 2012-08-09 04:55 - 00078480 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2013-12-22 12:07 - 2012-08-09 04:55 - 00386192 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2012-08-03 13:53 - 2012-08-03 13:53 - 00062968 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2014-01-15 08:10 - 2014-01-14 11:11 - 02153984 _____ () C:\Program Files\AVAST Software\Avast\defs\14011401\algo.dll
2014-01-21 06:49 - 2014-01-21 03:27 - 02155520 _____ () C:\Program Files\AVAST Software\Avast\defs\14012100\algo.dll
2013-09-13 19:51 - 2013-09-13 19:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2013-09-13 19:51 - 2013-09-13 19:51 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-12-22 12:21 - 2013-09-16 12:17 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll
2013-10-24 17:06 - 2013-10-24 17:06 - 00028992 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\thread_pool.dll
2013-10-24 17:09 - 2013-10-24 17:09 - 00420160 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\ulxmlrpcpp.dll
2013-12-23 14:54 - 2013-12-23 14:54 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-10-24 17:06 - 2013-10-24 17:06 - 00036672 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\qt_icontray_ex.dll
2014-01-19 01:06 - 2014-01-11 04:28 - 00715544 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\libglesv2.dll
2014-01-19 01:06 - 2014-01-11 04:28 - 00100120 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\libegl.dll
2014-01-19 01:06 - 2014-01-11 04:28 - 01634584 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\ffmpegsumo.dll
2014-01-19 01:06 - 2014-01-11 04:29 - 13615896 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\PepperFlash\pepflashplayer.dll
2014-01-19 01:06 - 2014-01-11 04:29 - 04055320 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\pdf.dll
2014-01-19 01:06 - 2014-01-11 04:29 - 00399640 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll
2013-12-22 12:47 - 2013-12-05 13:36 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-12-22 13:21 - 2013-12-22 13:21 - 00016808 _____ () C:\Program Files (x86)\Java\jre7\bin\jp2native.dll
 
==================== Alternate Data Streams (whitelisted) =========
 
 
==================== Safe Mode (whitelisted) ===================
 
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Could not start eventlog service, could not read events.
 
The requested service has already been started.
 
More help is available by typing NET HELPMSG 2182.
 
 
==================== Memory info =========================== 
 
Percentage of memory in use: 26%
Total physical RAM: 16273.51 MB
Available physical RAM: 11899.55 MB
Total Pagefile: 32657.51 MB
Available Pagefile: 27040.28 MB
Total Virtual: 131072 MB
Available Virtual: 131071.79 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:111.27 GB) (Free:47.72 GB) NTFS
Drive d: () (Fixed) (Total:931.51 GB) (Free:868.35 GB) NTFS
Drive e: (CODEMETER) (Fixed) (Total:0.04 GB) (Free:0 GB) FAT32
Drive m: (MEDIA) (Fixed) (Total:210 GB) (Free:139.14 GB) NTFS
Drive z: (PRODUCTION) (Fixed) (Total:1653.01 GB) (Free:1490.63 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: 9951ED27)
Partition 1: (Not Active) - (Size=-198625402368) - (Type=42)
 
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: 00000000)
 
Partition: GPT Partition Type
========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: DD728208)
Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS)
 
==================== End Of Log ============================


#6 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:02:04 PM

Posted 21 January 2014 - 09:26 PM



Hello NTstateOFmind

These are the programs I would like you to run next, if you have any problems with one of these just skip it and move on to the next one.

-AdwCleaner-

Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
-Junkware-Removal-Tool-

Please download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
When they are complete let me have the two reports and let me know how things are running.

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#7 NTstateOFmind

NTstateOFmind
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:04 PM

Posted 24 January 2014 - 11:03 AM

gringo_pr, can I request to leave this thread open a few days more? I've been away from my pc the past couple of days. I still intend to get you those logs. thanks in advance.

#8 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:02:04 PM

Posted 24 January 2014 - 06:50 PM

Yes of course and I will check on you in a couple of days



gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#9 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:02:04 PM

Posted 27 January 2014 - 09:27 PM


Hello

48 Hour bump

It has been more than 48 hours since my last post.
  • do you still need help with this?
  • do you need more time?
  • are you having problems following my instructions?
  • if after 48hrs you have not replied to this thread then it will have to be closed!
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#10 NTstateOFmind

NTstateOFmind
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:04 PM

Posted 28 January 2014 - 01:39 PM

Hi- I still need help with this issue. I'll be able run through your steps and get you those logs sometime tonight.  Thanks for  your patience.

 

-Chris



#11 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:02:04 PM

Posted 28 January 2014 - 04:43 PM

OK I will be looking for you then

gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#12 NTstateOFmind

NTstateOFmind
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:04 PM

Posted 28 January 2014 - 07:58 PM

after the most recent steps, overall pc performance appears unchanged.  system processes appear to be running without any issues.  also, running a full system scan (with Avast) reveals that the malware still remains.

 

 

the logs as requested...

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
AdwCleaner
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
# AdwCleaner v3.010 - Report created 28/01/2014 at 18:25:44
# Updated 20/10/2013 by Xplode
# Operating System : Windows 8.1  (64 bits)
# Username : Cools - COOLS-HOMEBASE
# Running from : C:\Users\Cools\Desktop\AdwCleaner.exe
# Option : Clean
 
***** [ Services ] *****
 
 
***** [ Files / Folders ] *****
 
 
***** [ Shortcuts ] *****
 
 
***** [ Registry ] *****
 
Key Deleted : HKLM\SOFTWARE\Classes\AppID\BHO.DLL
Key Deleted : HKLM\SOFTWARE\Classes\S
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKLM\Software\Conduit
 
***** [ Browsers ] *****
 
-\\ Internet Explorer v11.0.9600.16384
 
 
-\\ Mozilla Firefox v26.0 (en-US)
 
[ File : C:\Users\Cools\AppData\Roaming\Mozilla\Firefox\Profiles\da7ppijd.default\prefs.js ]
 
 
-\\ Google Chrome v32.0.1700.76
 
[ File : C:\Users\Cools\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 
 
*************************
 
AdwCleaner[R0].txt - [1073 octets] - [28/01/2014 18:24:32]
AdwCleaner[S0].txt - [963 octets] - [28/01/2014 18:25:44]
 
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1022 octets] ##########
 
 
 
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
JRT
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 8.1 x64
Ran by Cools on Tue 01/28/2014 at 18:36:10.30
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
~~~ Services
 
 
 
~~~ Registry Values
 
 
 
~~~ Registry Keys
 
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\caphyon
 
 
 
~~~ Files
 
 
 
~~~ Folders
 
 
 
~~~ Event Viewer Logs were cleared
 
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 01/28/2014 at 18:40:01.42
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


#13 NTstateOFmind

NTstateOFmind
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:04 PM

Posted 28 January 2014 - 08:54 PM

<follow-up on performance>

I've been noticing a negative impact to performance in regards to some basic navigating (ie. opening folders from shortcuts, copy/pasting files (mp3), moving files.  on average, opening a folder (via shortcut) is taking maybe 5 seconds; enough for me to re-double click the folder thinking i had not been able to open on my first attempt, then moments later the folder will open up for each time i double-clicked.  prior to this last logs you had me get, performance was not like this.



#14 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:02:04 PM

Posted 28 January 2014 - 08:58 PM


Hello NTstateOFmind

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"
  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#15 NTstateOFmind

NTstateOFmind
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:04 PM

Posted 28 January 2014 - 09:09 PM

ComboFix was unable to run.  double-clicking the executable yielded the following messagebox

 

"ComboFix is not meant to run in 'Compatibility Mode'. The program shall now exit."






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users