Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Multiple Malware Programs Removal from Win 8 System


  • This topic is locked This topic is locked
6 replies to this topic

#1 vfem

vfem

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:02:21 AM

Posted 24 September 2014 - 12:00 PM

I've used your site in the past and I've been really happy keeping my computer clean and running with advice and tutorials.

 

However, my mother, who is older and lets the grandkids play on her computer, has multiple issues and her computer is running slow, and I've found multiple problems on her system. However, I am NOT good with Win 8. So I keep having a hard time finding my way around her mess of a system.

 

The biggest deal right now is her virus protection is up to date, but I can NOT get it to stay up. Also I can't put her firewall back up, I'm denied access. So far I've run Malware Bytes and cleaned out about 24 maleware related files.

 

I've run Farbar and I'm here to post the logs to see what still needs to be done:

 

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-09-2014
Ran by Cathy (administrator) on GRAMMYPC on 24-09-2014 12:51:38
Running from C:\Users\Cathy\Downloads
Platform: Windows 8.1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

() C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe
(Softex Inc.) C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
() C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe
(EnTech Taiwan) C:\Program Files (x86)\Dell\Dell Display Manager\ddm.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SimplePass] => C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe [2793016 2013-09-05] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBroker] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe [154680 2013-09-05] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBrokerDesktop] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe [154680 2013-09-05] (Hewlett-Packard)
HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-09-11] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\RunOnce: [NCPluginUpdater] => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe [21720 2014-08-19] (Hewlett-Packard)
HKU\S-1-5-21-1614091358-1205644983-2003651797-1001\...\MountPoints2: {5b9e51a6-cd8b-11e3-8257-28e3478c076c} - "F:\VZW_Software_upgrade_assistant.exe"
HKU\S-1-5-21-1614091358-1205644983-2003651797-1001\...\MountPoints2: {fcf206f0-a4d8-11e3-8254-806e6f6e6963} - "E:\autorun.exe"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Dell Display Manager.lnk
ShortcutTarget: Dell Display Manager.lnk -> C:\Program Files (x86)\Dell\Dell Display Manager\ddm.exe (EnTech Taiwan)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
BootExecute: autocheck autochk * bootdelete

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK14/1
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK14/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPDTDFJS
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPDTDFJS
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL =
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKCU - DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL =
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL =
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Tcpip\Parameters: [DhcpNameServer] 209.18.47.61 209.18.47.62

FireFox:
========
FF ProfilePath: C:\Users\Cathy\AppData\Roaming\Mozilla\Firefox\Profiles\acs6nu6c.default
FF NewTab: hxxp://www.better-search.net/?barid=1605756688601503850&src=97&i=998&did=10874&crg=&ppd=,,,,,,,,,www.smilebox.com&st=23
FF DefaultSearchEngine: Powered by Bing
FF SelectedSearchEngine: Powered by Bing
FF Homepage: google.com
FF Keyword.URL: hxxp://www.better-search.net/?src=6&barid=1605756688601503850&i=998&did=10874&crg=&ppd=,,,,,,,,,www.smilebox.com&st=23&q=
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Cathy\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Users\Cathy\AppData\Roaming\Mozilla\Firefox\Profiles\acs6nu6c.default\searchplugins\Powered by Bing.xml
FF HKLM-x32\...\Firefox\Extensions: [url_advisor@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: 卡巴斯基網址顧問 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-04-28]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: 虛擬鍵盤 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-04-28]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: 惡意網站攔截器 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-04-28]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-04-28]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-04-28]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]

Chrome:
=======
CHR HomePage: Default -> D47DFED792D6BF4D532FC2030EF21E47EAF186954ECE19964639BE96ED4D4549
CHR StartupUrls: Default -> "hxxp://google.com/"
CHR DefaultSearchKeyword: Default -> astromenda.com
CHR DefaultSearchProvider: Default -> Astromenda
CHR DefaultSearchURL: Default -> http://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_app_14_49_ch&cd=2XzuyEtN2Y1L1Qzu0AtDyEzztC0C0AyC0AtCtD0FtAtAtByDtN0D0Tzu0SzyyDtCtN1L2XzutBtFtBtCtFtCzztFyBtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDzz0AtCtA0C0A0CtGyD0F0ByCtG0FyByCtBtGtByDzzyDtGyC0Czz0D0CyB0EtBtBzy0EyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCtCzyzytA0E0E0DtGyB0F0BzztGyD0FtDyBtGyBzy0B0DtGtDyCtC0FyEyCtBtAtCyB0CyD2Q&cr=1976650300&ir=
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR Profile: C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-26]
CHR Extension: (Google Drive) - C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-26]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-22]
CHR Extension: (Kaspersky URL Advisor) - C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2014-04-28]
CHR Extension: (Safe Money) - C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2014-04-28]
CHR Extension: (Dangerous Websites Blocker) - C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2014-04-28]
CHR Extension: (Virtual Keyboard) - C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2014-04-28]
CHR Extension: (Anti-Banner) - C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2014-04-28]
CHR HKLM-x32\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa []
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2014-01-21]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2014-01-21]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2014-01-21]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2014-01-21]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2014-01-21]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2014-01-21] (Kaspersky Lab ZAO)
R2 Cachedrv server; C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe [109568 2013-09-05] () [File not signed]
R2 CyberLink PowerDVD 12 Media Server Monitor Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [77576 2013-08-12] (CyberLink)
R2 CyberLink PowerDVD 12 Media Server Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [298760 2013-08-12] (CyberLink)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-21] (Microsoft Corporation)
S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-14] (Microsoft Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-03-06] (Microsoft Corporation)
R2 omniserv; C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe [87552 2013-09-05] (Softex Inc.) [File not signed]
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [246488 2013-06-18] (Realtek Semiconductor)
S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-21] (Microsoft Corporation)
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-21] (Microsoft Corporation)
S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2013-08-24] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-23] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-23] (Microsoft Corporation)
S2 GamesAppIntegrationService; "C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe" [X]
S3 GamesAppService; "C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36096 2013-05-22] (Advanced Micro Devices, Inc.)
R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3859968 2013-08-16] (Qualcomm Atheros Communications, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [222720 2014-04-28] (Advanced Micro Devices)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
R3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows ® Win 7 DDK provider)
R3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows ® Win 7 DDK provider)
S3 hitmanpro37; C:\windows\system32\drivers\hitmanpro37.sys [32512 2014-04-28] ()
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-01-21] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29792 2014-01-21] (Kaspersky Lab)
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [115296 2014-04-28] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625760 2014-04-28] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30304 2014-01-21] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [29280 2014-04-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2014-01-21] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [65120 2014-04-28] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [178272 2014-01-21] (Kaspersky Lab ZAO)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-23] (Microsoft Corporation)
U3 McAPExe; No ImagePath
U3 McMPFSvc; No ImagePath
U3 McNaiAnn; No ImagePath
U3 mcpltsvc; No ImagePath
U3 McProxy; No ImagePath
U3 mfecore; No ImagePath
U3 MSK80Service; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-24 12:51 - 2014-09-24 12:52 - 00020472 _____ () C:\Users\Cathy\Downloads\FRST.txt
2014-09-24 12:51 - 2014-09-24 12:51 - 00000000 ____D () C:\FRST
2014-09-24 12:50 - 2014-09-24 12:50 - 02106880 _____ (Farbar) C:\Users\Cathy\Downloads\FRST64.exe
2014-09-24 12:21 - 2014-09-24 12:21 - 05579290 _____ (Swearware) C:\Users\Cathy\Downloads\ComboFix.exe
2014-09-23 16:53 - 2014-09-23 16:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-17 13:15 - 2014-09-24 11:56 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-17 13:15 - 2014-09-17 13:15 - 00001125 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-09-17 13:15 - 2014-09-17 13:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-09-17 13:15 - 2014-09-17 13:15 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-17 13:15 - 2014-09-17 13:15 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-09-17 13:15 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-09-17 13:15 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-09-17 13:15 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-09-17 13:14 - 2014-09-17 13:14 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Cathy\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-17 12:38 - 2014-09-24 12:37 - 00000000 ____D () C:\Users\Cathy\Downloads\backups
2014-09-17 12:36 - 2014-09-24 12:48 - 00010770 _____ () C:\Users\Cathy\Downloads\hijackthis.log
2014-09-17 12:24 - 2014-09-17 12:24 - 00388608 _____ (Trend Micro Inc.) C:\Users\Cathy\Downloads\HijackThis.exe
2014-09-17 12:16 - 2014-09-17 12:16 - 00000000 ____D () C:\Users\Cathy\AppData\Local\pinger.com
2014-09-14 11:07 - 2014-08-23 03:48 - 02374784 _____ (Microsoft Corporation) C:\windows\explorer.exe
2014-09-14 11:07 - 2014-08-23 03:13 - 02084520 _____ (Microsoft Corporation) C:\windows\SysWOW64\explorer.exe
2014-09-14 11:07 - 2014-08-23 02:10 - 00068096 _____ (Microsoft Corporation) C:\windows\system32\UXInit.dll
2014-09-14 11:07 - 2014-08-23 01:32 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\UXInit.dll
2014-09-14 11:07 - 2014-08-23 00:44 - 02860032 _____ (Microsoft Corporation) C:\windows\system32\actxprxy.dll
2014-09-14 11:07 - 2014-08-23 00:34 - 13423104 _____ (Microsoft Corporation) C:\windows\system32\twinui.dll
2014-09-14 11:07 - 2014-08-23 00:33 - 00796672 _____ (Microsoft Corporation) C:\windows\system32\uDWM.dll
2014-09-14 11:07 - 2014-08-23 00:31 - 01038336 _____ (Microsoft Corporation) C:\windows\SysWOW64\actxprxy.dll
2014-09-14 11:07 - 2014-08-23 00:20 - 11818496 _____ (Microsoft Corporation) C:\windows\SysWOW64\twinui.dll
2014-09-14 11:07 - 2014-07-29 21:56 - 00299520 _____ (Microsoft Corporation) C:\windows\system32\WSDMon.dll
2014-09-14 11:07 - 2014-07-29 01:22 - 00205824 _____ (Microsoft Corporation) C:\windows\system32\tcpmon.dll
2014-09-14 11:07 - 2014-07-24 11:20 - 21266336 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2014-09-14 11:07 - 2014-07-24 11:07 - 07424320 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2014-09-14 11:07 - 2014-07-24 11:03 - 02141920 _____ (Microsoft Corporation) C:\windows\system32\mfcore.dll
2014-09-14 11:07 - 2014-07-24 10:57 - 02515264 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2014-09-14 11:07 - 2014-07-24 09:46 - 18760328 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2014-09-14 11:07 - 2014-07-24 09:36 - 02145472 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfcore.dll
2014-09-14 11:07 - 2014-07-24 05:44 - 16874496 _____ (Microsoft Corporation) C:\windows\system32\Windows.UI.Xaml.dll
2014-09-14 11:07 - 2014-07-24 05:16 - 12730880 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.UI.Xaml.dll
2014-09-14 11:07 - 2014-07-24 04:53 - 01261056 _____ (Microsoft Corporation) C:\windows\system32\gpsvc.dll
2014-09-14 11:07 - 2014-07-24 04:32 - 01532416 _____ (Microsoft Corporation) C:\windows\system32\wlansvc.dll
2014-09-14 11:07 - 2014-07-24 04:21 - 01231872 _____ (Microsoft Corporation) C:\windows\system32\Windows.Media.dll
2014-09-14 11:07 - 2014-07-24 03:46 - 08652800 _____ (Microsoft Corporation) C:\windows\system32\Windows.UI.Search.dll
2014-09-14 11:07 - 2014-07-24 03:43 - 02696704 _____ (Microsoft Corporation) C:\windows\system32\SettingsHandlers.dll
2014-09-14 11:07 - 2014-07-24 03:39 - 02642944 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2014-09-14 11:07 - 2014-07-24 03:38 - 06649344 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll
2014-09-14 11:07 - 2014-07-24 03:38 - 05777408 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstscax.dll
2014-09-14 11:07 - 2014-07-24 03:30 - 02318336 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2014-09-14 11:07 - 2014-07-24 03:28 - 01600000 _____ (Microsoft Corporation) C:\windows\system32\workfolderssvc.dll
2014-09-14 11:07 - 2014-06-14 02:03 - 02389504 _____ (Microsoft Corporation) C:\windows\system32\d3d10warp.dll
2014-09-14 11:07 - 2014-06-14 01:46 - 02071552 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3d10warp.dll
2014-09-14 11:06 - 2014-07-24 11:28 - 00468288 _____ (Microsoft Corporation) C:\windows\system32\Drivers\USBHUB3.SYS
2014-09-14 11:06 - 2014-07-24 11:28 - 00419648 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys
2014-09-14 11:06 - 2014-07-24 11:28 - 00412992 _____ (Microsoft Corporation) C:\windows\system32\Drivers\spaceport.sys
2014-09-14 11:06 - 2014-07-24 11:28 - 00280384 _____ (Microsoft Corporation) C:\windows\system32\Drivers\pci.sys
2014-09-14 11:06 - 2014-07-24 11:28 - 00143680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys
2014-09-14 11:06 - 2014-07-24 11:25 - 00054752 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2014-09-14 11:06 - 2014-07-24 11:23 - 01519488 _____ (Microsoft Corporation) C:\windows\system32\user32.dll
2014-09-14 11:06 - 2014-07-24 11:23 - 00125472 _____ (Microsoft Corporation) C:\windows\system32\dwmapi.dll
2014-09-14 11:06 - 2014-07-24 11:20 - 00645592 _____ (Microsoft Corporation) C:\windows\system32\SHCore.dll
2014-09-14 11:06 - 2014-07-24 11:20 - 00263400 _____ (Microsoft Corporation) C:\windows\system32\SystemSettingsAdminFlows.exe
2014-09-14 11:06 - 2014-07-24 11:16 - 02574208 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
2014-09-14 11:06 - 2014-07-24 11:16 - 00211216 _____ (Microsoft Corporation) C:\windows\system32\SndVol.exe
2014-09-14 11:06 - 2014-07-24 11:07 - 02009920 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ntfs.sys
2014-09-14 11:06 - 2014-07-24 11:05 - 01660048 _____ (Microsoft Corporation) C:\windows\system32\winload.efi
2014-09-14 11:06 - 2014-07-24 11:05 - 01519560 _____ (Microsoft Corporation) C:\windows\system32\winload.exe
2014-09-14 11:06 - 2014-07-24 11:05 - 01488008 _____ (Microsoft Corporation) C:\windows\system32\winresume.efi
2014-09-14 11:06 - 2014-07-24 11:05 - 01356840 _____ (Microsoft Corporation) C:\windows\system32\winresume.exe
2014-09-14 11:06 - 2014-07-24 11:03 - 00882136 _____ (Microsoft Corporation) C:\windows\system32\mfplat.dll
2014-09-14 11:06 - 2014-07-24 11:03 - 00818624 _____ (Microsoft Corporation) C:\windows\system32\mfmp4srcsnk.dll
2014-09-14 11:06 - 2014-07-24 11:03 - 00360480 _____ (Microsoft Corporation) C:\windows\system32\mfreadwrite.dll
2014-09-14 11:06 - 2014-07-24 11:03 - 00233888 _____ (Microsoft Corporation) C:\windows\system32\mfps.dll
2014-09-14 11:06 - 2014-07-24 11:03 - 00205512 _____ (Microsoft Corporation) C:\windows\system32\mftranscode.dll
2014-09-14 11:06 - 2014-07-24 10:57 - 00475968 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
2014-09-14 11:06 - 2014-07-24 09:50 - 00098048 _____ (Microsoft Corporation) C:\windows\SysWOW64\dwmapi.dll
2014-09-14 11:06 - 2014-07-24 09:48 - 02410976 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
2014-09-14 11:06 - 2014-07-24 09:48 - 00180208 _____ (Microsoft Corporation) C:\windows\SysWOW64\SndVol.exe
2014-09-14 11:06 - 2014-07-24 09:46 - 00477200 _____ (Microsoft Corporation) C:\windows\SysWOW64\SHCore.dll
2014-09-14 11:06 - 2014-07-24 09:36 - 00707536 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfplat.dll
2014-09-14 11:06 - 2014-07-24 09:36 - 00674512 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfmp4srcsnk.dll
2014-09-14 11:06 - 2014-07-24 09:36 - 00355800 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfreadwrite.dll
2014-09-14 11:06 - 2014-07-24 09:36 - 00180720 _____ (Microsoft Corporation) C:\windows\SysWOW64\mftranscode.dll
2014-09-14 11:06 - 2014-07-24 07:51 - 00008192 _____ (Microsoft Corporation) C:\windows\system32\KBDRUM.DLL
2014-09-14 11:06 - 2014-07-24 07:51 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDYAK.DLL
2014-09-14 11:06 - 2014-07-24 07:51 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDTT102.DLL
2014-09-14 11:06 - 2014-07-24 07:51 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDTAT.DLL
2014-09-14 11:06 - 2014-07-24 07:51 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDRU1.DLL
2014-09-14 11:06 - 2014-07-24 07:51 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDBASH.DLL
2014-09-14 11:06 - 2014-07-24 07:51 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\KBDRU.DLL
2014-09-14 11:06 - 2014-07-24 07:47 - 00132608 _____ (Microsoft Corporation) C:\windows\system32\rdpudd.dll
2014-09-14 11:06 - 2014-07-24 07:46 - 00079872 _____ (Microsoft Corporation) C:\windows\system32\Drivers\IPMIDrv.sys
2014-09-14 11:06 - 2014-07-24 07:45 - 00076800 _____ (Microsoft Corporation) C:\windows\system32\Drivers\hdaudbus.sys
2014-09-14 11:06 - 2014-07-24 07:44 - 00674816 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv2.sys
2014-09-14 11:06 - 2014-07-24 07:43 - 00412160 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv.sys
2014-09-14 11:06 - 2014-07-24 07:42 - 00446976 _____ (Microsoft Corporation) C:\windows\system32\Drivers\nwifi.sys
2014-09-14 11:06 - 2014-07-24 07:42 - 00126464 _____ (Microsoft Corporation) C:\windows\system32\Drivers\NdisImPlatform.sys
2014-09-14 11:06 - 2014-07-24 07:41 - 00115712 _____ (Microsoft Corporation) C:\windows\system32\Drivers\bridge.sys
2014-09-14 11:06 - 2014-07-24 07:33 - 00059392 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
2014-09-14 11:06 - 2014-07-24 07:33 - 00050688 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2014-09-14 11:06 - 2014-07-24 07:22 - 00308736 _____ (Microsoft Corporation) C:\windows\system32\compstui.dll
2014-09-14 11:06 - 2014-07-24 07:06 - 00220160 _____ (Microsoft Corporation) C:\windows\system32\iasnap.dll
2014-09-14 11:06 - 2014-07-24 07:05 - 00287232 _____ (Microsoft Corporation) C:\windows\system32\usbmon.dll
2014-09-14 11:06 - 2014-07-24 07:05 - 00226816 _____ (Microsoft Corporation) C:\windows\system32\WebClnt.dll
2014-09-14 11:06 - 2014-07-24 06:52 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDYAK.DLL
2014-09-14 11:06 - 2014-07-24 06:52 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDTT102.DLL
2014-09-14 11:06 - 2014-07-24 06:52 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDTAT.DLL
2014-09-14 11:06 - 2014-07-24 06:51 - 00008192 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDRUM.DLL
2014-09-14 11:06 - 2014-07-24 06:51 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDRU1.DLL
2014-09-14 11:06 - 2014-07-24 06:51 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDBASH.DLL
2014-09-14 11:06 - 2014-07-24 06:51 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDRU.DLL
2014-09-14 11:06 - 2014-07-24 06:49 - 00065536 _____ (Microsoft Corporation) C:\windows\system32\WorkFoldersGPExt.dll
2014-09-14 11:06 - 2014-07-24 06:33 - 00026112 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll
2014-09-14 11:06 - 2014-07-24 06:32 - 00207360 _____ (Microsoft Corporation) C:\windows\system32\powercfg.cpl
2014-09-14 11:06 - 2014-07-24 06:20 - 02050560 _____ (Microsoft Corporation) C:\windows\system32\SRH.dll
2014-09-14 11:06 - 2014-07-24 06:18 - 01089024 _____ (Microsoft Corporation) C:\windows\system32\gpedit.dll
2014-09-14 11:06 - 2014-07-24 06:12 - 00878592 _____ (Microsoft Corporation) C:\windows\system32\ActionCenter.dll
2014-09-14 11:06 - 2014-07-24 06:10 - 01844224 _____ (Microsoft Corporation) C:\windows\system32\Display.dll
2014-09-14 11:06 - 2014-07-24 06:10 - 00834560 _____ (Microsoft Corporation) C:\windows\system32\osk.exe
2014-09-14 11:06 - 2014-07-24 06:10 - 00198656 _____ (Microsoft Corporation) C:\windows\SysWOW64\WebClnt.dll
2014-09-14 11:06 - 2014-07-24 06:10 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\iasnap.dll
2014-09-14 11:06 - 2014-07-24 06:09 - 01057280 _____ (Microsoft Corporation) C:\windows\system32\rdvidcrl.dll
2014-09-14 11:06 - 2014-07-24 06:06 - 00438272 _____ (Microsoft Corporation) C:\windows\system32\puiobj.dll
2014-09-14 11:06 - 2014-07-24 06:05 - 00187392 _____ (Microsoft Corporation) C:\windows\system32\WorkFoldersShell.dll
2014-09-14 11:06 - 2014-07-24 05:53 - 00215552 _____ (Microsoft Corporation) C:\windows\system32\prnntfy.dll
2014-09-14 11:06 - 2014-07-24 05:52 - 00621056 _____ (Microsoft Corporation) C:\windows\system32\comdlg32.dll
2014-09-14 11:06 - 2014-07-24 05:42 - 00206336 _____ (Microsoft Corporation) C:\windows\SysWOW64\powercfg.cpl
2014-09-14 11:06 - 2014-07-24 05:40 - 00557056 _____ (Microsoft Corporation) C:\windows\system32\PrintDialogs.dll
2014-09-14 11:06 - 2014-07-24 05:39 - 00770048 _____ (Microsoft Corporation) C:\windows\system32\WorkfoldersControl.dll
2014-09-14 11:06 - 2014-07-24 05:33 - 01741824 _____ (Microsoft Corporation) C:\windows\SysWOW64\SRH.dll
2014-09-14 11:06 - 2014-07-24 05:32 - 01048064 _____ (Microsoft Corporation) C:\windows\SysWOW64\gpedit.dll
2014-09-14 11:06 - 2014-07-24 05:27 - 00855552 _____ (Microsoft Corporation) C:\windows\SysWOW64\rdvidcrl.dll
2014-09-14 11:06 - 2014-07-24 05:27 - 00779264 _____ (Microsoft Corporation) C:\windows\SysWOW64\osk.exe
2014-09-14 11:06 - 2014-07-24 05:25 - 00832512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ActionCenter.dll
2014-09-14 11:06 - 2014-07-24 05:24 - 01817088 _____ (Microsoft Corporation) C:\windows\SysWOW64\Display.dll
2014-09-14 11:06 - 2014-07-24 05:23 - 00328704 _____ (Microsoft Corporation) C:\windows\SysWOW64\puiobj.dll
2014-09-14 11:06 - 2014-07-24 05:21 - 00134144 _____ (Microsoft Corporation) C:\windows\system32\browser.dll
2014-09-14 11:06 - 2014-07-24 05:18 - 00018432 _____ (Microsoft Corporation) C:\windows\system32\wlansvcpal.dll
2014-09-14 11:06 - 2014-07-24 05:14 - 00443904 _____ (Microsoft Corporation) C:\windows\system32\wlansec.dll
2014-09-14 11:06 - 2014-07-24 05:13 - 00195584 _____ (Microsoft Corporation) C:\windows\SysWOW64\prnntfy.dll
2014-09-14 11:06 - 2014-07-24 05:12 - 00127488 _____ (Microsoft Corporation) C:\windows\system32\WiFiDisplay.dll
2014-09-14 11:06 - 2014-07-24 05:11 - 00356864 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
2014-09-14 11:06 - 2014-07-24 05:11 - 00063488 _____ (Microsoft Corporation) C:\windows\system32\wshbth.dll
2014-09-14 11:06 - 2014-07-24 05:10 - 00540672 _____ (Microsoft Corporation) C:\windows\SysWOW64\comdlg32.dll
2014-09-14 11:06 - 2014-07-24 05:09 - 00116736 _____ (Microsoft Corporation) C:\windows\system32\httpprxm.dll
2014-09-14 11:06 - 2014-07-24 05:04 - 00492032 _____ (Microsoft Corporation) C:\windows\SysWOW64\PrintDialogs.dll
2014-09-14 11:06 - 2014-07-24 05:04 - 00183808 _____ (Microsoft Corp.) C:\windows\system32\Defrag.exe
2014-09-14 11:06 - 2014-07-24 05:03 - 00324096 _____ (Microsoft Corporation) C:\windows\system32\srvsvc.dll
2014-09-14 11:06 - 2014-07-24 05:02 - 00220160 _____ (Microsoft Corporation) C:\windows\system32\profsvc.dll
2014-09-14 11:06 - 2014-07-24 04:58 - 00105472 _____ (Microsoft Corporation) C:\windows\system32\BluetoothApis.dll
2014-09-14 11:06 - 2014-07-24 04:53 - 00449536 _____ (Microsoft Corporation) C:\windows\system32\defragsvc.dll
2014-09-14 11:06 - 2014-07-24 04:49 - 01361408 _____ (Microsoft Corporation) C:\windows\SysWOW64\user32.dll
2014-09-14 11:06 - 2014-07-24 04:49 - 01287680 _____ (Microsoft Corporation) C:\windows\system32\mispace.dll
2014-09-14 11:06 - 2014-07-24 04:49 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\wlanapi.dll
2014-09-14 11:06 - 2014-07-24 04:49 - 00075776 _____ (Microsoft Corporation) C:\windows\system32\adhsvc.dll
2014-09-14 11:06 - 2014-07-24 04:48 - 00659968 _____ (Microsoft Corporation) C:\windows\system32\Windows.Devices.Bluetooth.dll
2014-09-14 11:06 - 2014-07-24 04:47 - 00102912 _____ (Microsoft Corporation) C:\windows\system32\wcmcsp.dll
2014-09-14 11:06 - 2014-07-24 04:43 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\wshbth.dll
2014-09-14 11:06 - 2014-07-24 04:39 - 02397184 _____ (Microsoft Corporation) C:\windows\system32\storagewmi.dll
2014-09-14 11:06 - 2014-07-24 04:38 - 00371200 _____ (Microsoft Corporation) C:\windows\system32\wlanmsm.dll
2014-09-14 11:06 - 2014-07-24 04:36 - 00079872 _____ (Microsoft Corporation) C:\windows\SysWOW64\BluetoothApis.dll
2014-09-14 11:06 - 2014-07-24 04:30 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\wlanapi.dll
2014-09-14 11:06 - 2014-07-24 04:29 - 00439296 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.Devices.Bluetooth.dll
2014-09-14 11:06 - 2014-07-24 04:28 - 00595456 _____ (Microsoft Corporation) C:\windows\system32\Windows.Networking.dll
2014-09-14 11:06 - 2014-07-24 04:27 - 00907776 _____ (Microsoft Corporation) C:\windows\system32\iphlpsvc.dll
2014-09-14 11:06 - 2014-07-24 04:24 - 00249344 _____ (Microsoft Corporation) C:\windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-09-14 11:06 - 2014-07-24 04:23 - 01404416 _____ (Microsoft Corporation) C:\windows\SysWOW64\storagewmi.dll
2014-09-14 11:06 - 2014-07-24 04:22 - 00487936 _____ (Microsoft Corporation) C:\windows\system32\winspool.drv
2014-09-14 11:06 - 2014-07-24 04:21 - 00302080 _____ (Microsoft Corporation) C:\windows\SysWOW64\wlanmsm.dll
2014-09-14 11:06 - 2014-07-24 04:20 - 00187392 _____ (Microsoft Corporation) C:\windows\system32\puiapi.dll
2014-09-14 11:06 - 2014-07-24 04:19 - 00388608 _____ (Microsoft Corporation) C:\windows\system32\WUSettingsProvider.dll
2014-09-14 11:06 - 2014-07-24 04:18 - 01144320 _____ (Microsoft Corporation) C:\windows\system32\wwanmm.dll
2014-09-14 11:06 - 2014-07-24 04:18 - 00795136 _____ (Microsoft Corporation) C:\windows\system32\spoolsv.exe
2014-09-14 11:06 - 2014-07-24 04:18 - 00093696 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2014-09-14 11:06 - 2014-07-24 04:16 - 00505344 _____ (Microsoft Corporation) C:\windows\system32\VAN.dll
2014-09-14 11:06 - 2014-07-24 04:16 - 00084480 _____ (Microsoft Corporation) C:\windows\system32\wpdbusenum.dll
2014-09-14 11:06 - 2014-07-24 04:15 - 00828416 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2014-09-14 11:06 - 2014-07-24 04:15 - 00721408 _____ (Microsoft Corporation) C:\windows\system32\twinapi.dll
2014-09-14 11:06 - 2014-07-24 04:15 - 00432128 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.Networking.dll
2014-09-14 11:06 - 2014-07-24 04:13 - 00226304 _____ (Microsoft Corporation) C:\windows\system32\SndVolSSO.dll
2014-09-14 11:06 - 2014-07-24 04:12 - 00189952 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-09-14 11:06 - 2014-07-24 04:10 - 01029632 _____ (Microsoft Corporation) C:\windows\system32\localspl.dll
2014-09-14 11:06 - 2014-07-24 04:10 - 00889344 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.Media.dll
2014-09-14 11:06 - 2014-07-24 04:10 - 00806400 _____ (Microsoft Corporation) C:\windows\system32\win32spl.dll
2014-09-14 11:06 - 2014-07-24 04:10 - 00371712 _____ (Microsoft Corporation) C:\windows\SysWOW64\winspool.drv
2014-09-14 11:06 - 2014-07-24 04:08 - 00321536 _____ (Microsoft Corporation) C:\windows\system32\stobject.dll
2014-09-14 11:06 - 2014-07-24 04:08 - 00162816 _____ (Microsoft Corporation) C:\windows\SysWOW64\puiapi.dll
2014-09-14 11:06 - 2014-07-24 04:07 - 01705472 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2014-09-14 11:06 - 2014-07-24 04:06 - 00080896 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2014-09-14 11:06 - 2014-07-24 04:05 - 00448000 _____ (Microsoft Corporation) C:\windows\SysWOW64\VAN.dll
2014-09-14 11:06 - 2014-07-24 04:04 - 00667136 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2014-09-14 11:06 - 2014-07-24 04:02 - 03465216 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2014-09-14 11:06 - 2014-07-24 04:01 - 05833216 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.UI.Search.dll
2014-09-14 11:06 - 2014-07-24 04:01 - 01992192 _____ (Microsoft Corporation) C:\windows\system32\XpsPrint.dll
2014-09-14 11:06 - 2014-07-24 04:01 - 01126912 _____ (Microsoft Corporation) C:\windows\system32\SearchFolder.dll
2014-09-14 11:06 - 2014-07-24 04:00 - 02100736 _____ (Microsoft Corporation) C:\windows\system32\SystemSettingsAdminFlowUI.dll
2014-09-14 11:06 - 2014-07-24 03:58 - 00432640 _____ (Microsoft Corporation) C:\windows\system32\wwanconn.dll
2014-09-14 11:06 - 2014-07-24 03:58 - 00288768 _____ (Microsoft Corporation) C:\windows\SysWOW64\stobject.dll
2014-09-14 11:06 - 2014-07-24 03:54 - 01290752 _____ (Microsoft Corporation) C:\windows\SysWOW64\XpsPrint.dll
2014-09-14 11:06 - 2014-07-24 03:50 - 01182208 _____ (Microsoft Corporation) C:\windows\system32\printui.dll
2014-09-14 11:06 - 2014-07-24 03:50 - 00923136 _____ (Microsoft Corporation) C:\windows\system32\WSShared.dll
2014-09-14 11:06 - 2014-07-24 03:49 - 00263680 _____ (Microsoft Corporation) C:\windows\system32\DafPrintProvider.dll
2014-09-14 11:06 - 2014-07-24 03:47 - 00576512 _____ (Microsoft Corporation) C:\windows\system32\SettingSync.dll
2014-09-14 11:06 - 2014-07-24 03:44 - 01057792 _____ (Microsoft Corporation) C:\windows\SysWOW64\printui.dll
2014-09-14 11:06 - 2014-07-24 03:43 - 00756224 _____ (Microsoft Corporation) C:\windows\SysWOW64\WSShared.dll
2014-09-14 11:06 - 2014-07-24 03:43 - 00200192 _____ (Microsoft Corporation) C:\windows\SysWOW64\DafPrintProvider.dll
2014-09-14 11:06 - 2014-07-24 03:41 - 00459264 _____ (Microsoft Corporation) C:\windows\SysWOW64\SettingSync.dll
2014-09-14 11:06 - 2014-07-24 03:33 - 03360768 _____ (Microsoft Corporation) C:\windows\system32\rdpcorets.dll
2014-09-14 11:06 - 2014-07-24 00:11 - 00513544 _____ () C:\windows\SysWOW64\locale.nls
2014-09-14 11:06 - 2014-07-24 00:11 - 00513544 _____ () C:\windows\system32\locale.nls
2014-09-14 11:06 - 2014-07-12 01:55 - 00268288 _____ (Microsoft Corporation) C:\windows\system32\wisp.dll
2014-09-14 11:06 - 2014-07-12 01:23 - 00436224 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll
2014-09-14 11:06 - 2014-07-12 00:58 - 00210944 _____ (Microsoft Corporation) C:\windows\SysWOW64\wisp.dll
2014-09-14 11:06 - 2014-07-12 00:33 - 00318976 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll
2014-09-14 11:06 - 2014-07-12 00:13 - 01417216 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2014-09-14 11:06 - 2014-07-09 19:19 - 00387391 _____ () C:\windows\system32\ApnDatabase.xml
2014-09-14 11:06 - 2014-07-04 08:59 - 00295424 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ks.sys
2014-09-14 11:06 - 2014-07-04 06:29 - 00117248 _____ (Microsoft Corporation) C:\windows\system32\AppxSip.dll
2014-09-14 11:06 - 2014-07-04 06:20 - 01656832 _____ (Microsoft Corporation) C:\windows\system32\GdiPlus.dll
2014-09-14 11:06 - 2014-07-04 06:06 - 00095232 _____ (Microsoft Corporation) C:\windows\SysWOW64\AppxSip.dll
2014-09-14 11:06 - 2014-07-04 06:00 - 01351168 _____ (Microsoft Corporation) C:\windows\SysWOW64\GdiPlus.dll
2014-09-14 11:06 - 2014-07-04 05:30 - 00544768 _____ (Microsoft Corporation) C:\windows\system32\AppxPackaging.dll
2014-09-14 11:06 - 2014-07-04 05:27 - 00474112 _____ (Microsoft Corporation) C:\windows\SysWOW64\AppxPackaging.dll
2014-09-14 11:06 - 2014-06-27 02:22 - 00246272 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srvnet.sys
2014-09-14 11:06 - 2014-06-25 20:32 - 01029632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mispace.dll
2014-09-14 11:06 - 2014-06-25 20:29 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\dab.dll
2014-09-14 11:06 - 2014-06-19 19:37 - 00206848 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
2014-09-14 11:06 - 2014-06-18 22:13 - 00310080 _____ (Microsoft Corporation) C:\windows\system32\Drivers\volsnap.sys
2014-09-14 11:06 - 2014-06-07 08:46 - 00216368 _____ (Microsoft Corporation) C:\windows\system32\rsaenh.dll
2014-09-14 11:06 - 2014-06-07 06:20 - 00189016 _____ (Microsoft Corporation) C:\windows\SysWOW64\rsaenh.dll
2014-09-14 11:06 - 2014-06-05 10:00 - 01118040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ndis.sys
2014-09-14 11:06 - 2014-06-05 06:18 - 01018368 _____ (Microsoft Corporation) C:\windows\system32\aclui.dll
2014-09-14 11:06 - 2014-06-05 05:42 - 00889856 _____ (Microsoft Corporation) C:\windows\SysWOW64\aclui.dll
2014-09-14 11:06 - 2014-05-31 01:00 - 01463808 _____ (Microsoft Corporation) C:\windows\system32\wsecedit.dll
2014-09-14 11:06 - 2014-05-31 00:18 - 01319936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wsecedit.dll
2014-09-14 11:06 - 2014-05-29 02:23 - 00427008 _____ (Microsoft Corporation) C:\windows\system32\clusapi.dll
2014-09-14 11:06 - 2014-05-29 01:25 - 00313856 _____ (Microsoft Corporation) C:\windows\SysWOW64\clusapi.dll
2014-09-14 11:06 - 2014-05-29 01:20 - 00427520 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2014-09-14 11:06 - 2014-05-29 00:36 - 00344576 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2014-09-14 11:06 - 2014-05-26 03:26 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\AppxSysprep.dll
2014-09-14 11:06 - 2014-05-10 06:12 - 00387896 _____ (Microsoft Corporation) C:\windows\system32\bcryptprimitives.dll
2014-09-14 11:06 - 2014-05-10 04:46 - 00335680 _____ (Microsoft Corporation) C:\windows\SysWOW64\bcryptprimitives.dll
2014-09-14 11:06 - 2014-05-06 00:41 - 00486744 _____ (Microsoft Corporation) C:\windows\system32\netcfgx.dll
2014-09-14 11:06 - 2014-05-05 20:55 - 00391000 _____ (Microsoft Corporation) C:\windows\SysWOW64\netcfgx.dll
2014-09-14 11:06 - 2014-03-24 22:27 - 00160600 _____ (Microsoft Corporation) C:\windows\system32\winmmbase.dll
2014-09-14 11:06 - 2014-03-24 22:27 - 00123920 _____ (Microsoft Corporation) C:\windows\system32\winmm.dll
2014-09-14 11:06 - 2014-03-24 21:20 - 00128568 _____ (Microsoft Corporation) C:\windows\SysWOW64\winmm.dll
2014-09-14 11:06 - 2014-03-24 21:20 - 00127544 _____ (Microsoft Corporation) C:\windows\SysWOW64\winmmbase.dll
2014-09-14 11:00 - 2014-08-14 20:36 - 00146752 _____ (Microsoft Corporation) C:\windows\system32\Drivers\msgpioclx.sys
2014-09-12 19:04 - 2014-09-24 12:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-12 19:04 - 2014-09-12 19:04 - 00001182 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-09-12 19:04 - 2014-09-12 19:04 - 00001170 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-09-12 19:04 - 2014-09-12 19:04 - 00000000 ____D () C:\Users\Cathy\AppData\Roaming\Mozilla
2014-09-12 19:04 - 2014-09-12 19:04 - 00000000 ____D () C:\Users\Cathy\AppData\Local\Mozilla
2014-09-12 19:04 - 2014-09-12 19:04 - 00000000 ____D () C:\ProgramData\Mozilla
2014-09-12 13:25 - 2014-08-15 22:40 - 23591424 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-09-12 13:25 - 2014-08-15 22:04 - 17455104 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-09-12 13:25 - 2014-08-15 22:00 - 05833728 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-09-12 13:25 - 2014-08-15 22:00 - 02793984 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-09-12 13:25 - 2014-08-15 21:56 - 00547328 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-09-12 13:25 - 2014-08-15 21:54 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2014-09-12 13:25 - 2014-08-15 21:45 - 04232704 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-09-12 13:25 - 2014-08-15 21:43 - 00758272 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-09-12 13:25 - 2014-08-15 21:32 - 00446464 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-09-12 13:25 - 2014-08-15 21:25 - 00072704 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-09-12 13:25 - 2014-08-15 21:22 - 00454656 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2014-09-12 13:25 - 2014-08-15 21:20 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2014-09-12 13:25 - 2014-08-15 21:19 - 00085504 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-09-12 13:25 - 2014-08-15 21:18 - 02185728 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-09-12 13:25 - 2014-08-15 21:18 - 00289280 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-09-12 13:25 - 2014-08-15 21:11 - 00597504 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2014-09-12 13:25 - 2014-08-15 21:06 - 00359424 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2014-09-12 13:25 - 2014-08-15 21:05 - 00727040 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-09-12 13:25 - 2014-08-15 21:05 - 00707072 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-09-12 13:25 - 2014-08-15 21:03 - 02104832 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-09-12 13:25 - 2014-08-15 21:03 - 00365056 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-09-12 13:25 - 2014-08-15 20:58 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-12 13:25 - 2014-08-15 20:56 - 02310656 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-09-12 13:25 - 2014-08-15 20:53 - 13588480 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-09-12 13:25 - 2014-08-15 20:53 - 00243200 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-09-12 13:25 - 2014-08-15 20:53 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-09-12 13:25 - 2014-08-15 20:51 - 11769856 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-09-12 13:25 - 2014-08-15 20:45 - 00603136 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-09-12 13:25 - 2014-08-15 20:44 - 02014208 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-09-12 13:25 - 2014-08-15 20:44 - 00312320 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2014-09-12 13:25 - 2014-08-15 20:34 - 01447424 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-09-12 13:25 - 2014-08-15 20:20 - 01812992 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-09-12 13:25 - 2014-08-15 20:18 - 00775168 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-09-12 13:25 - 2014-08-15 20:14 - 01190400 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-09-12 13:25 - 2014-08-15 20:12 - 00678400 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2014-09-12 13:10 - 2014-09-04 22:36 - 00097280 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2014-09-12 13:10 - 2014-09-04 22:31 - 00527360 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-09-12 13:10 - 2014-09-04 20:48 - 00738816 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-09-12 13:10 - 2014-08-01 20:18 - 01212928 _____ (Microsoft Corporation) C:\windows\system32\schedsvc.dll
2014-09-12 13:09 - 2014-07-23 23:20 - 00875688 _____ (Microsoft Corporation) C:\windows\SysWOW64\msvcr120_clr0400.dll
2014-09-12 13:09 - 2014-07-23 23:20 - 00869544 _____ (Microsoft Corporation) C:\windows\system32\msvcr120_clr0400.dll
2014-09-11 17:11 - 2014-09-11 17:11 - 00000000 _____ () C:\windows\SysWOW64\jupdate-1.7.0_67-b01.log
2014-09-09 11:51 - 2014-09-09 11:51 - 01050105 _____ () C:\Users\Cathy\Downloads\Terraria.zip
2014-08-28 05:59 - 2014-08-22 20:42 - 04148224 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-24 12:52 - 2014-09-24 12:51 - 00020472 _____ () C:\Users\Cathy\Downloads\FRST.txt
2014-09-24 12:51 - 2014-09-24 12:51 - 00000000 ____D () C:\FRST
2014-09-24 12:50 - 2014-09-24 12:50 - 02106880 _____ (Farbar) C:\Users\Cathy\Downloads\FRST64.exe
2014-09-24 12:48 - 2014-09-17 12:36 - 00010770 _____ () C:\Users\Cathy\Downloads\hijackthis.log
2014-09-24 12:37 - 2014-09-17 12:38 - 00000000 ____D () C:\Users\Cathy\Downloads\backups
2014-09-24 12:31 - 2014-04-27 09:09 - 01970892 _____ () C:\windows\WindowsUpdate.log
2014-09-24 12:22 - 2013-08-24 17:38 - 00891920 _____ () C:\windows\system32\PerfStringBackup.INI
2014-09-24 12:21 - 2014-09-24 12:21 - 05579290 _____ (Swearware) C:\Users\Cathy\Downloads\ComboFix.exe
2014-09-24 12:18 - 2014-08-10 20:35 - 00000000 _____ () C:\windows\system32\Drivers\lvuvc.hs
2014-09-24 12:18 - 2014-04-28 21:19 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-09-24 12:18 - 2014-04-26 17:48 - 00000910 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-24 12:18 - 2013-08-22 10:45 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-09-24 12:18 - 2013-08-22 10:44 - 00373600 _____ () C:\windows\system32\FNTCACHE.DAT
2014-09-24 12:17 - 2014-09-12 19:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-24 12:17 - 2013-08-24 17:32 - 00018222 _____ () C:\windows\PFRO.log
2014-09-24 12:17 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\registration
2014-09-24 12:17 - 2013-08-22 09:25 - 00262144 ___SH () C:\windows\system32\config\BBI
2014-09-24 12:11 - 2014-04-26 17:49 - 00000914 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-24 12:00 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\system32\sru
2014-09-24 11:56 - 2014-09-17 13:15 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-24 09:50 - 2014-02-22 12:43 - 00065536 _____ () C:\windows\system32\spu_storage.bin
2014-09-24 07:10 - 2014-04-27 09:10 - 00003926 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{0F78AD86-2C7C-4677-BC7A-ECD593326FBA}
2014-09-23 17:24 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\rescache
2014-09-23 16:53 - 2014-09-23 16:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-23 16:38 - 2014-04-28 19:55 - 00000052 _____ () C:\windows\SysWOW64\DOErrors.log
2014-09-23 16:37 - 2014-04-28 19:55 - 00000000 _____ () C:\windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-09-23 16:34 - 2013-08-22 11:20 - 00000000 ____D () C:\windows\CbsTemp
2014-09-23 16:33 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\AppReadiness
2014-09-22 01:57 - 2014-04-27 09:15 - 00003600 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1614091358-1205644983-2003651797-1001
2014-09-19 08:45 - 2013-08-22 15:12 - 00000000 ____D () C:\Program Files\Windows Journal
2014-09-19 08:45 - 2013-08-22 11:36 - 00000000 ___RD () C:\windows\ToastData
2014-09-19 08:45 - 2013-08-22 11:36 - 00000000 ___RD () C:\windows\ImmersiveControlPanel
2014-09-19 08:45 - 2013-08-22 11:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-09-19 08:45 - 2013-08-22 11:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-09-19 08:45 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\WinStore
2014-09-19 08:45 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\SysWOW64\setup
2014-09-19 08:45 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\SysWOW64\InputMethod
2014-09-19 08:45 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\system32\setup
2014-09-19 08:45 - 2013-08-22 09:36 - 00000000 ____D () C:\windows\system32\oobe
2014-09-17 13:15 - 2014-09-17 13:15 - 00001125 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-09-17 13:15 - 2014-09-17 13:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-09-17 13:15 - 2014-09-17 13:15 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-17 13:15 - 2014-09-17 13:15 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-09-17 13:14 - 2014-09-17 13:14 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Cathy\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-17 12:35 - 2014-04-27 09:10 - 00000000 ____D () C:\Users\Cathy\AppData\Local\VirtualStore
2014-09-17 12:24 - 2014-09-17 12:24 - 00388608 _____ (Trend Micro Inc.) C:\Users\Cathy\Downloads\HijackThis.exe
2014-09-17 12:20 - 2014-04-26 17:48 - 00000000 ____D () C:\Program Files (x86)\Google
2014-09-17 12:16 - 2014-09-17 12:16 - 00000000 ____D () C:\Users\Cathy\AppData\Local\pinger.com
2014-09-17 12:16 - 2014-02-22 13:49 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Communication and Chat
2014-09-17 12:08 - 2014-08-10 19:52 - 00022590 _____ () C:\windows\system32\lvcoinst.log
2014-09-15 08:50 - 2014-07-09 09:06 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-09-13 16:30 - 2014-04-28 20:26 - 00003164 _____ () C:\windows\System32\Tasks\HPCeeScheduleForCathy
2014-09-13 16:30 - 2014-04-28 20:26 - 00000350 _____ () C:\windows\Tasks\HPCeeScheduleForCathy.job
2014-09-12 19:04 - 2014-09-12 19:04 - 00001182 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-09-12 19:04 - 2014-09-12 19:04 - 00001170 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-09-12 19:04 - 2014-09-12 19:04 - 00000000 ____D () C:\Users\Cathy\AppData\Roaming\Mozilla
2014-09-12 19:04 - 2014-09-12 19:04 - 00000000 ____D () C:\Users\Cathy\AppData\Local\Mozilla
2014-09-12 19:04 - 2014-09-12 19:04 - 00000000 ____D () C:\ProgramData\Mozilla
2014-09-12 13:26 - 2014-06-11 07:28 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-09-12 13:25 - 2014-06-11 07:29 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-09-12 13:25 - 2014-06-11 07:29 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-09-12 13:25 - 2014-06-11 07:28 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-09-12 13:25 - 2014-06-11 07:28 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2014-09-12 13:25 - 2014-06-11 07:28 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-09-12 13:25 - 2014-06-11 07:28 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-09-12 13:25 - 2014-06-11 07:28 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2014-09-12 13:25 - 2014-06-11 07:28 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-09-12 13:25 - 2014-06-11 07:28 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-09-12 13:25 - 2014-06-11 07:28 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-09-12 13:25 - 2014-06-11 07:28 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-09-12 13:25 - 2014-06-11 07:28 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-09-12 13:25 - 2014-06-11 07:27 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-09-12 13:25 - 2014-04-29 20:55 - 00000000 ____D () C:\windows\system32\MRT
2014-09-12 13:25 - 2014-04-28 17:40 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-09-12 13:25 - 2014-04-28 17:40 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-09-12 13:20 - 2014-04-29 20:55 - 101694776 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-09-11 18:27 - 2014-04-27 09:10 - 00000000 ____D () C:\Users\Cathy
2014-09-11 18:25 - 2014-05-25 10:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-09-11 18:25 - 2014-05-22 00:16 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-09-11 18:19 - 2014-08-10 21:17 - 00000000 ____D () C:\Users\Cathy\AppData\Roaming\Skype
2014-09-11 18:19 - 2014-05-25 10:34 - 00000000 ____D () C:\Program Files (x86)\Java
2014-09-11 17:11 - 2014-09-11 17:11 - 00000000 _____ () C:\windows\SysWOW64\jupdate-1.7.0_67-b01.log
2014-09-09 11:51 - 2014-09-09 11:51 - 01050105 _____ () C:\Users\Cathy\Downloads\Terraria.zip
2014-09-09 06:43 - 2014-05-22 00:14 - 00000000 ____D () C:\Users\Cathy\AppData\Local\Adobe
2014-09-09 06:43 - 2014-04-27 09:10 - 00000000 ____D () C:\Users\Cathy\AppData\Roaming\Adobe
2014-09-04 22:36 - 2014-09-12 13:10 - 00097280 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2014-09-04 22:31 - 2014-09-12 13:10 - 00527360 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-09-04 20:48 - 2014-09-12 13:10 - 00738816 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-09-02 16:06 - 2014-04-29 19:55 - 00706016 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-09-02 16:06 - 2014-04-29 19:55 - 00105440 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

Some content of TEMP:
====================
C:\Users\Cathy\AppData\Local\Temp\Extract.exe
C:\Users\Cathy\AppData\Local\Temp\fp_pl_pfs_installer-1.exe
C:\Users\Cathy\AppData\Local\Temp\fp_pl_pfs_installer-2.exe
C:\Users\Cathy\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Cathy\AppData\Local\Temp\OptimizerPro.exe
C:\Users\Cathy\AppData\Local\Temp\Quarantine.exe
C:\Users\Cathy\AppData\Local\Temp\Shortcut_bundlesweetimsetup.exe
C:\Users\Cathy\AppData\Local\Temp\sp64126.exe
C:\Users\Cathy\AppData\Local\Temp\SP65005.exe
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite13061.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite13132.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite15188.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite18219.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite20871.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite30357.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite34005.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite35781.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite44492.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite49691.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite52159.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite67838.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite78429.dll
C:\Users\Cathy\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\Cathy\AppData\Local\Temp\WSSetup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-22 13:24

==================== End Of Log ============================



BC AdBot (Login to Remove)

 


#2 vfem

vfem
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:02:21 AM

Posted 24 September 2014 - 12:01 PM

Here is the Addition.txt log as well. I've run no 'fixes' with this.

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-09-2014
Ran by Cathy at 2014-09-24 12:52:54
Running from C:\Users\Cathy\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)


==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

4 Elements II (x32 Version: 2.2.0.98 - WildTangent) Hidden
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Reader XI (11.0.07) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Airport Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
Alcor Micro USB Card Reader Driver  (HKLM-x32\...\AmUStor) (Version: 20.21.3317.03861 - Alcor Micro Corp.)
Alcor Micro USB Card Reader Driver  (x32 Version: 20.21.3317.03861 - Alcor Micro Corp.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.0911.2154.37488 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{7288D4D9-90E0-2B03-43D0-0BB6D4496577}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
Azkend 2: The World Beneath (x32 Version: 2.2.0.98 - WildTangent) Hidden
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden
Build-a-lot (x32 Version: 2.2.0.98 - WildTangent) Hidden
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0911.2154.37488 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.0911.2154.37488 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.0911.2154.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.0911.2154.37488 - Advanced Micro Devices, Inc.) Hidden
Cradle Of Egypt Collector's Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Curse at Twilight (x32 Version: 3.0.2.32 - WildTangent) Hidden
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.5.6805 - CyberLink Corp.)
CyberLink LabelPrint (x32 Version: 2.5.5.6805 - CyberLink Corp.) Hidden
CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.5.3103 - CyberLink Corp.)
CyberLink Media Suite 10 (x32 Version: 10.0.5.3103 - CyberLink Corp.) Hidden
Cyberlink PhotoDirector (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.3.4323 - CyberLink Corp.)
Cyberlink PhotoDirector (x32 Version: 3.0.3.4323 - CyberLink Corp.) Hidden
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.5.3215 - CyberLink Corp.)
CyberLink Power2Go 8 (x32 Version: 8.0.5.3215 - CyberLink Corp.) Hidden
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.5.3215 - CyberLink Corp.)
CyberLink PowerDirector 10 (x32 Version: 10.0.5.3215 - CyberLink Corp.) Hidden
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.2.3212 - CyberLink Corp.)
CyberLink PowerDVD 12 (x32 Version: 12.0.2.3212 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Delicious: Emily's Childhood Memories Premium Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden
Dell Display Manager (HKLM-x32\...\{AC50C05D-9D57-40F5-B2EF-AC402F14312B}_is1) (Version:  - EnTech Taiwan)
Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Fishdom 3: Collector's Edition (x32 Version: 3.0.2.38 - WildTangent) Hidden
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
House of 1000 Doors: Family Secrets (x32 Version: 2.2.0.98 - WildTangent) Hidden
HP Connected Music (Meridian - installer) (HKLM-x32\...\StartHPConnectedMusic) (Version: 1.0 - Meridian Audio Ltd)
HP Connected Music (Meridian - player) (HKCU\...\HPConnectedMusic) (Version: 1.1 (build 112) hp - Meridian Audio Ltd)
HP Customer Experience Enhancements (x32 Version: 6.0.1.8 - Hewlett-Packard) Hidden
HP Documentation (HKLM-x32\...\{06600E94-1C34-40E2-AB09-D30AECF78172}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Postscript Converter (Version: 4.5.12202 - Hewlett-Packard) Hidden
HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.7127.4628 - Hewlett-Packard)
HP SimplePass (HKLM-x32\...\InstallShield_{314FAD12-F785-4471-BCE8-AB506642B9A1}) (Version: 8.00.51 - Hewlett-Packard)
HP SimplePass (Version: 8.00.51 - Hewlett-Packard) Hidden
HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 13.00.0000 - Hewlett-Packard)
Inst5675 (Version: 8.00.51 - Softex Inc.) Hidden
Inst5676 (Version: 8.00.51 - Softex Inc.) Hidden
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{6F6873E3-5C92-4049-B511-231A138DD090}) (Version: 14.0.0.4651 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 14.0.0.4651 - Kaspersky Lab) Hidden
King Oddball (x32 Version: 3.0.2.48 - WildTangent) Hidden
Luxor Evolved (x32 Version: 2.2.0.98 - WildTangent) Hidden
Mahjongg Dimensions Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 32.0.2 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 32.0.2 (x86 en-US)) (Version: 32.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 32.0.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
Mystery P.I. - Curious Case of Counterfeit Cove (x32 Version: 2.2.0.98 - WildTangent) Hidden
OpenOffice 4.1.0 (HKLM-x32\...\{C87EF11D-36E9-479D-9898-7541EA1E8A6A}) (Version: 4.10.9764 - Apache Software Foundation)
Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden
Photo Gallery (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Qualcomm Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.30164 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.0.7001 - CyberLink Corp.) Hidden
Roads of Rome 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
Tales of Lagoona (x32 Version: 2.2.0.110 - WildTangent) Hidden
Unity Web Player (HKCU\...\UnityWebPlayer) (Version: 4.5.1f3 - Unity Technologies ApS)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Vacation Quest™ - Australia (x32 Version: 3.0.2.32 - WildTangent) Hidden
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App (HP Games) (x32 Version: 4.0.10.15 - WildTangent) Hidden
Windows Live Communications Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Youda Jewel Shop (x32 Version: 3.0.2.32 - WildTangent) Hidden
Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

09-09-2014 11:12:49 Scheduled Checkpoint
11-09-2014 21:11:08 Installed Java 7 Update 67
11-09-2014 21:29:52 Restore Operation
15-09-2014 12:47:04 Windows Update
17-09-2014 16:15:47 Removed Pinger
23-09-2014 20:46:36 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 09:25 - 2013-08-22 09:25 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {150FD1B6-9DC9-4E32-8B43-963A54C889B7} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-09-03] (Hewlett-Packard)
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {225C359E-1B58-4461-A111-B1C67AEF702D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-26] (Google Inc.)
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {2EC01758-50F3-4D4B-9BE6-B97C97B25289} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-02-22] (Microsoft Corporation)
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {45941B7B-2FC8-488E-ADED-DB5280B0BB27} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {60E65BB6-3498-4A1F-B0FB-E578A4EC4725} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {66F3D055-4694-495B-AFCA-5CC76737300B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-26] (Google Inc.)
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6BE3025F-169C-4431-A147-29FD21550EBC} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {82BD6256-FC84-47C2-A58A-7B79CEBD915C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_CN84PDG0M90557 => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-09-03] (Hewlett-Packard)
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {89633FE5-869C-41DE-86F2-EA5C8E82A139} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {8980B224-5D8A-4DE2-850A-4650311CE08E} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {AFC17004-0F48-404C-B573-2E4E34E1C8BB} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\windows\system32\MRT.exe [2014-09-12] (Microsoft Corporation)
Task: {BECF2E5E-DC93-4F74-9773-4EE529932609} - System32\Tasks\HPCeeScheduleForCathy => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {C6CB203E-B5DF-4ED6-BFB4-8B295FFAF123} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {CBEE797A-00A3-4F83-8CCF-FE4727713EFD} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {DECE5B70-B654-426B-8FA3-6C7E655C28C7} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics
Task: {E019AF72-605D-4DD2-BFA7-46244D8B436F} - System32\Tasks\CLVDLauncher => c:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2013-03-12] (CyberLink Corp.)
Task: {E15E2CD0-666E-42E6-B44C-AD4141843288} - System32\Tasks\CLMLSvc_P2G8 => c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2013-08-05] (CyberLink)
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: {F1C0FA4B-3BDE-422E-91D5-2E0613D06B1E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-09-03] (Hewlett-Packard)
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HPCeeScheduleForCathy.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) =============

2013-09-05 07:22 - 2013-09-05 07:22 - 00109568 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe
2013-09-05 07:24 - 2013-09-05 07:24 - 00627200 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cachedrv.dll
2013-09-05 07:24 - 2013-09-05 07:24 - 02540544 _____ () C:\Program Files\Hewlett-Packard\SimplePass\autheng.dll
2013-09-05 07:21 - 2013-09-05 07:21 - 00035328 _____ () C:\Program Files\Hewlett-Packard\SimplePass\ssplogon.dll
2013-09-05 07:21 - 2013-09-05 07:21 - 00055296 _____ () C:\Program Files\Hewlett-Packard\SimplePass\RandomPass.dll
2013-09-05 07:21 - 2013-09-05 07:21 - 00021504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cryptodll.dll
2013-09-05 07:36 - 2013-09-05 07:36 - 00306064 _____ () C:\Program Files\Hewlett-Packard\SimplePass\mstrpwd.dll
2013-09-05 07:36 - 2013-09-05 07:36 - 01298832 _____ () C:\Program Files\Hewlett-Packard\SimplePass\GraphicalPwd.dll
2013-09-05 07:31 - 2013-09-05 07:31 - 00064000 _____ () C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
2013-06-05 15:51 - 2013-06-05 15:51 - 00098304 _____ () c:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingNet4.dll
2013-06-17 12:35 - 2013-06-17 12:35 - 00478400 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\dblite.dll
2013-05-08 14:52 - 2013-05-08 14:52 - 01270464 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\kpcengine.2.3.dll
2014-02-22 13:10 - 2013-08-05 03:49 - 00627672 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2013-08-05 19:48 - 2013-08-05 19:48 - 00016856 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2014-09-23 16:53 - 2014-09-23 16:53 - 03734640 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/24/2014 09:25:16 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: GrammyPC)
Description: Activation of app microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Calendar failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (09/24/2014 09:25:16 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: GrammyPC)
Description: Activation of app microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1 failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (09/23/2014 04:46:37 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll8

Error: (09/22/2014 01:57:42 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll8

Error: (09/19/2014 09:00:59 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll8

Error: (09/18/2014 03:12:52 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6250

Error: (09/18/2014 03:12:52 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6250

Error: (09/18/2014 03:12:52 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/18/2014 03:12:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4656

Error: (09/18/2014 03:12:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4656


System errors:
=============
Error: (09/24/2014 00:20:24 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The GamesAppIntegrationService service failed to start due to the following error:
%%2

Error: (09/24/2014 09:50:06 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly.  It has done this 6 time(s).

Error: (09/24/2014 09:25:15 AM) (Source: DCOM) (EventID: 10010) (User: GrammyPC)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}

Error: (09/24/2014 09:25:15 AM) (Source: DCOM) (EventID: 10010) (User: GrammyPC)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}

Error: (09/24/2014 09:25:11 AM) (Source: DCOM) (EventID: 10010) (User: GrammyPC)
Description: Windows.Networking.BackgroundTransfer.Internal.NetworkChangeTask.ClassId.2

Error: (09/24/2014 09:25:11 AM) (Source: DCOM) (EventID: 10010) (User: GrammyPC)
Description: Windows.Networking.BackgroundTransfer.Internal.NetworkChangeTask.ClassId.4

Error: (09/24/2014 09:25:09 AM) (Source: DCOM) (EventID: 10010) (User: GrammyPC)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}

Error: (09/24/2014 09:25:09 AM) (Source: DCOM) (EventID: 10010) (User: GrammyPC)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}

Error: (09/24/2014 08:29:01 AM) (Source: DCOM) (EventID: 10010) (User: GrammyPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (09/24/2014 08:28:30 AM) (Source: DCOM) (EventID: 10010) (User: GrammyPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}


Microsoft Office Sessions:
=========================
Error: (09/24/2014 09:25:16 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: GrammyPC)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Calendar-2144927141

Error: (09/24/2014 09:25:16 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: GrammyPC)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1-2144927141

Error: (09/23/2014 04:46:37 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll8

Error: (09/22/2014 01:57:42 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll8

Error: (09/19/2014 09:00:59 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll8

Error: (09/18/2014 03:12:52 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6250

Error: (09/18/2014 03:12:52 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6250

Error: (09/18/2014 03:12:52 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/18/2014 03:12:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4656

Error: (09/18/2014 03:12:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4656


==================== Memory info ===========================

Processor: AMD A4-5000 APU with Radeon™ HD Graphics
Percentage of memory in use: 28%
Total physical RAM: 5581.1 MB
Available physical RAM: 4018.13 MB
Total Pagefile: 6477.1 MB
Available Pagefile: 4570.85 MB
Total Virtual: 131072 MB
Available Virtual: 131071.79 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:914.39 GB) (Free:870.71 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery Image) (Fixed) (Total:15.64 GB) (Free:1.94 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (KIS - MD) (CDROM) (Total:0.52 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 2672BCF0)

Partition: GPT Partition Type.

==================== End Of Log ============================



#3 vfem

vfem
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:02:21 AM

Posted 27 September 2014 - 09:00 AM

I'm sorry to post this again, but this is not my system. It's my mother's computer and I have to come and go from her house once or twice a week only. I posted 4 days ago and still haven't gotten what more info is needed. I'm hoping to get over there today, and would love to know what additional logs may be needed. 
 
This is what I got the other day and I specifically told her to NOT use her system or log onto anything until I'm done with it. (problem is, I think she has. lol)
 
I've run Farbar and I'm here to post the logs to see what still needs to be done:
 
 
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-09-2014
Ran by Cathy (administrator) on GRAMMYPC on 24-09-2014 12:51:38
Running from C:\Users\Cathy\Downloads
Platform: Windows 8.1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

() C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe
(Softex Inc.) C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
() C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe
(EnTech Taiwan) C:\Program Files (x86)\Dell\Dell Display Manager\ddm.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SimplePass] => C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe [2793016 2013-09-05] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBroker] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe [154680 2013-09-05] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBrokerDesktop] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe [154680 2013-09-05] (Hewlett-Packard)
HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-09-11] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\RunOnce: [NCPluginUpdater] => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe [21720 2014-08-19] (Hewlett-Packard)
HKU\S-1-5-21-1614091358-1205644983-2003651797-1001\...\MountPoints2: {5b9e51a6-cd8b-11e3-8257-28e3478c076c} - "F:\VZW_Software_upgrade_assistant.exe"
HKU\S-1-5-21-1614091358-1205644983-2003651797-1001\...\MountPoints2: {fcf206f0-a4d8-11e3-8254-806e6f6e6963} - "E:\autorun.exe"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Dell Display Manager.lnk
ShortcutTarget: Dell Display Manager.lnk -> C:\Program Files (x86)\Dell\Dell Display Manager\ddm.exe (EnTech Taiwan)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
BootExecute: autocheck autochk * bootdelete

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK14/1
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK14/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPDTDFJS
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPDTDFJS
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL =
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKCU - DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL =
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL =
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Tcpip\Parameters: [DhcpNameServer] 209.18.47.61 209.18.47.62

FireFox:
========
FF ProfilePath: C:\Users\Cathy\AppData\Roaming\Mozilla\Firefox\Profiles\acs6nu6c.default
FF NewTab: hxxp://www.better-search.net/?barid=1605756688601503850&src=97&i=998&did=10874&crg=&ppd=,,,,,,,,,www.smilebox.com&st=23
FF DefaultSearchEngine: Powered by Bing
FF SelectedSearchEngine: Powered by Bing
FF Homepage: google.com
FF Keyword.URL: hxxp://www.better-search.net/?src=6&barid=1605756688601503850&i=998&did=10874&crg=&ppd=,,,,,,,,,www.smilebox.com&st=23&q=
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Cathy\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Users\Cathy\AppData\Roaming\Mozilla\Firefox\Profiles\acs6nu6c.default\searchplugins\Powered by Bing.xml
FF HKLM-x32\...\Firefox\Extensions: [url_advisor@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: 卡巴斯基網址顧問 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-04-28]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: 虛擬鍵盤 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-04-28]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: 惡意網站攔截器 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-04-28]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-04-28]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-04-28]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]

Chrome:
=======
CHR HomePage: Default -> D47DFED792D6BF4D532FC2030EF21E47EAF186954ECE19964639BE96ED4D4549
CHR StartupUrls: Default -> "hxxp://google.com/"
CHR DefaultSearchKeyword: Default -> astromenda.com
CHR DefaultSearchProvider: Default -> Astromenda
CHR DefaultSearchURL: Default -> http://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_app_14_49_ch&cd=2XzuyEtN2Y1L1Qzu0AtDyEzztC0C0AyC0AtCtD0FtAtAtByDtN0D0Tzu0SzyyDtCtN1L2XzutBtFtBtCtFtCzztFyBtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDzz0AtCtA0C0A0CtGyD0F0ByCtG0FyByCtBtGtByDzzyDtGyC0Czz0D0CyB0EtBtBzy0EyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCtCzyzytA0E0E0DtGyB0F0BzztGyD0FtDyBtGyBzy0B0DtGtDyCtC0FyEyCtBtAtCyB0CyD2Q&cr=1976650300&ir=
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR Profile: C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-26]
CHR Extension: (Google Drive) - C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-26]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-22]
CHR Extension: (Kaspersky URL Advisor) - C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2014-04-28]
CHR Extension: (Safe Money) - C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2014-04-28]
CHR Extension: (Dangerous Websites Blocker) - C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2014-04-28]
CHR Extension: (Virtual Keyboard) - C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2014-04-28]
CHR Extension: (Anti-Banner) - C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2014-04-28]
CHR HKLM-x32\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] -https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa []
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2014-01-21]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2014-01-21]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2014-01-21]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2014-01-21]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2014-01-21]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2014-01-21] (Kaspersky Lab ZAO)
R2 Cachedrv server; C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe [109568 2013-09-05] () [File not signed]
R2 CyberLink PowerDVD 12 Media Server Monitor Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [77576 2013-08-12] (CyberLink)
R2 CyberLink PowerDVD 12 Media Server Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [298760 2013-08-12] (CyberLink)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-21] (Microsoft Corporation)
S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-14] (Microsoft Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-03-06] (Microsoft Corporation)
R2 omniserv; C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe [87552 2013-09-05] (Softex Inc.) [File not signed]
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [246488 2013-06-18] (Realtek Semiconductor)
S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-21] (Microsoft Corporation)
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-21] (Microsoft Corporation)
S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2013-08-24] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-23] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-23] (Microsoft Corporation)
S2 GamesAppIntegrationService; "C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe" [X]
S3 GamesAppService; "C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36096 2013-05-22] (Advanced Micro Devices, Inc.)
R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3859968 2013-08-16] (Qualcomm Atheros Communications, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [222720 2014-04-28] (Advanced Micro Devices)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
R3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows ® Win 7 DDK provider)
R3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows ® Win 7 DDK provider)
S3 hitmanpro37; C:\windows\system32\drivers\hitmanpro37.sys [32512 2014-04-28] ()
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-01-21] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29792 2014-01-21] (Kaspersky Lab)
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [115296 2014-04-28] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625760 2014-04-28] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30304 2014-01-21] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [29280 2014-04-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2014-01-21] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [65120 2014-04-28] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [178272 2014-01-21] (Kaspersky Lab ZAO)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-23] (Microsoft Corporation)
U3 McAPExe; No ImagePath
U3 McMPFSvc; No ImagePath
U3 McNaiAnn; No ImagePath
U3 mcpltsvc; No ImagePath
U3 McProxy; No ImagePath
U3 mfecore; No ImagePath
U3 MSK80Service; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-24 12:51 - 2014-09-24 12:52 - 00020472 _____ () C:\Users\Cathy\Downloads\FRST.txt
2014-09-24 12:51 - 2014-09-24 12:51 - 00000000 ____D () C:\FRST
2014-09-24 12:50 - 2014-09-24 12:50 - 02106880 _____ (Farbar) C:\Users\Cathy\Downloads\FRST64.exe
2014-09-24 12:21 - 2014-09-24 12:21 - 05579290 _____ (Swearware) C:\Users\Cathy\Downloads\ComboFix.exe
2014-09-23 16:53 - 2014-09-23 16:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-17 13:15 - 2014-09-24 11:56 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-17 13:15 - 2014-09-17 13:15 - 00001125 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-09-17 13:15 - 2014-09-17 13:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-09-17 13:15 - 2014-09-17 13:15 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-17 13:15 - 2014-09-17 13:15 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-09-17 13:15 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-09-17 13:15 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-09-17 13:15 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-09-17 13:14 - 2014-09-17 13:14 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Cathy\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-17 12:38 - 2014-09-24 12:37 - 00000000 ____D () C:\Users\Cathy\Downloads\backups
2014-09-17 12:36 - 2014-09-24 12:48 - 00010770 _____ () C:\Users\Cathy\Downloads\hijackthis.log
2014-09-17 12:24 - 2014-09-17 12:24 - 00388608 _____ (Trend Micro Inc.) C:\Users\Cathy\Downloads\HijackThis.exe
2014-09-17 12:16 - 2014-09-17 12:16 - 00000000 ____D () C:\Users\Cathy\AppData\Local\pinger.com
2014-09-14 11:07 - 2014-08-23 03:48 - 02374784 _____ (Microsoft Corporation) C:\windows\explorer.exe
2014-09-14 11:07 - 2014-08-23 03:13 - 02084520 _____ (Microsoft Corporation) C:\windows\SysWOW64\explorer.exe
2014-09-14 11:07 - 2014-08-23 02:10 - 00068096 _____ (Microsoft Corporation) C:\windows\system32\UXInit.dll
2014-09-14 11:07 - 2014-08-23 01:32 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\UXInit.dll
2014-09-14 11:07 - 2014-08-23 00:44 - 02860032 _____ (Microsoft Corporation) C:\windows\system32\actxprxy.dll
2014-09-14 11:07 - 2014-08-23 00:34 - 13423104 _____ (Microsoft Corporation) C:\windows\system32\twinui.dll
2014-09-14 11:07 - 2014-08-23 00:33 - 00796672 _____ (Microsoft Corporation) C:\windows\system32\uDWM.dll
2014-09-14 11:07 - 2014-08-23 00:31 - 01038336 _____ (Microsoft Corporation) C:\windows\SysWOW64\actxprxy.dll
2014-09-14 11:07 - 2014-08-23 00:20 - 11818496 _____ (Microsoft Corporation) C:\windows\SysWOW64\twinui.dll
2014-09-14 11:07 - 2014-07-29 21:56 - 00299520 _____ (Microsoft Corporation) C:\windows\system32\WSDMon.dll
2014-09-14 11:07 - 2014-07-29 01:22 - 00205824 _____ (Microsoft Corporation) C:\windows\system32\tcpmon.dll
2014-09-14 11:07 - 2014-07-24 11:20 - 21266336 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2014-09-14 11:07 - 2014-07-24 11:07 - 07424320 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2014-09-14 11:07 - 2014-07-24 11:03 - 02141920 _____ (Microsoft Corporation) C:\windows\system32\mfcore.dll
2014-09-14 11:07 - 2014-07-24 10:57 - 02515264 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2014-09-14 11:07 - 2014-07-24 09:46 - 18760328 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2014-09-14 11:07 - 2014-07-24 09:36 - 02145472 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfcore.dll
2014-09-14 11:07 - 2014-07-24 05:44 - 16874496 _____ (Microsoft Corporation) C:\windows\system32\Windows.UI.Xaml.dll
2014-09-14 11:07 - 2014-07-24 05:16 - 12730880 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.UI.Xaml.dll
2014-09-14 11:07 - 2014-07-24 04:53 - 01261056 _____ (Microsoft Corporation) C:\windows\system32\gpsvc.dll
2014-09-14 11:07 - 2014-07-24 04:32 - 01532416 _____ (Microsoft Corporation) C:\windows\system32\wlansvc.dll
2014-09-14 11:07 - 2014-07-24 04:21 - 01231872 _____ (Microsoft Corporation) C:\windows\system32\Windows.Media.dll
2014-09-14 11:07 - 2014-07-24 03:46 - 08652800 _____ (Microsoft Corporation) C:\windows\system32\Windows.UI.Search.dll
2014-09-14 11:07 - 2014-07-24 03:43 - 02696704 _____ (Microsoft Corporation) C:\windows\system32\SettingsHandlers.dll
2014-09-14 11:07 - 2014-07-24 03:39 - 02642944 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2014-09-14 11:07 - 2014-07-24 03:38 - 06649344 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll
2014-09-14 11:07 - 2014-07-24 03:38 - 05777408 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstscax.dll
2014-09-14 11:07 - 2014-07-24 03:30 - 02318336 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2014-09-14 11:07 - 2014-07-24 03:28 - 01600000 _____ (Microsoft Corporation) C:\windows\system32\workfolderssvc.dll
2014-09-14 11:07 - 2014-06-14 02:03 - 02389504 _____ (Microsoft Corporation) C:\windows\system32\d3d10warp.dll
2014-09-14 11:07 - 2014-06-14 01:46 - 02071552 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3d10warp.dll
2014-09-14 11:06 - 2014-07-24 11:28 - 00468288 _____ (Microsoft Corporation) C:\windows\system32\Drivers\USBHUB3.SYS
2014-09-14 11:06 - 2014-07-24 11:28 - 00419648 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys
2014-09-14 11:06 - 2014-07-24 11:28 - 00412992 _____ (Microsoft Corporation) C:\windows\system32\Drivers\spaceport.sys
2014-09-14 11:06 - 2014-07-24 11:28 - 00280384 _____ (Microsoft Corporation) C:\windows\system32\Drivers\pci.sys
2014-09-14 11:06 - 2014-07-24 11:28 - 00143680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys
2014-09-14 11:06 - 2014-07-24 11:25 - 00054752 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2014-09-14 11:06 - 2014-07-24 11:23 - 01519488 _____ (Microsoft Corporation) C:\windows\system32\user32.dll
2014-09-14 11:06 - 2014-07-24 11:23 - 00125472 _____ (Microsoft Corporation) C:\windows\system32\dwmapi.dll
2014-09-14 11:06 - 2014-07-24 11:20 - 00645592 _____ (Microsoft Corporation) C:\windows\system32\SHCore.dll
2014-09-14 11:06 - 2014-07-24 11:20 - 00263400 _____ (Microsoft Corporation) C:\windows\system32\SystemSettingsAdminFlows.exe
2014-09-14 11:06 - 2014-07-24 11:16 - 02574208 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
2014-09-14 11:06 - 2014-07-24 11:16 - 00211216 _____ (Microsoft Corporation) C:\windows\system32\SndVol.exe
2014-09-14 11:06 - 2014-07-24 11:07 - 02009920 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ntfs.sys
2014-09-14 11:06 - 2014-07-24 11:05 - 01660048 _____ (Microsoft Corporation) C:\windows\system32\winload.efi
2014-09-14 11:06 - 2014-07-24 11:05 - 01519560 _____ (Microsoft Corporation) C:\windows\system32\winload.exe
2014-09-14 11:06 - 2014-07-24 11:05 - 01488008 _____ (Microsoft Corporation) C:\windows\system32\winresume.efi
2014-09-14 11:06 - 2014-07-24 11:05 - 01356840 _____ (Microsoft Corporation) C:\windows\system32\winresume.exe
2014-09-14 11:06 - 2014-07-24 11:03 - 00882136 _____ (Microsoft Corporation) C:\windows\system32\mfplat.dll
2014-09-14 11:06 - 2014-07-24 11:03 - 00818624 _____ (Microsoft Corporation) C:\windows\system32\mfmp4srcsnk.dll
2014-09-14 11:06 - 2014-07-24 11:03 - 00360480 _____ (Microsoft Corporation) C:\windows\system32\mfreadwrite.dll
2014-09-14 11:06 - 2014-07-24 11:03 - 00233888 _____ (Microsoft Corporation) C:\windows\system32\mfps.dll
2014-09-14 11:06 - 2014-07-24 11:03 - 00205512 _____ (Microsoft Corporation) C:\windows\system32\mftranscode.dll
2014-09-14 11:06 - 2014-07-24 10:57 - 00475968 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
2014-09-14 11:06 - 2014-07-24 09:50 - 00098048 _____ (Microsoft Corporation) C:\windows\SysWOW64\dwmapi.dll
2014-09-14 11:06 - 2014-07-24 09:48 - 02410976 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
2014-09-14 11:06 - 2014-07-24 09:48 - 00180208 _____ (Microsoft Corporation) C:\windows\SysWOW64\SndVol.exe
2014-09-14 11:06 - 2014-07-24 09:46 - 00477200 _____ (Microsoft Corporation) C:\windows\SysWOW64\SHCore.dll
2014-09-14 11:06 - 2014-07-24 09:36 - 00707536 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfplat.dll
2014-09-14 11:06 - 2014-07-24 09:36 - 00674512 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfmp4srcsnk.dll
2014-09-14 11:06 - 2014-07-24 09:36 - 00355800 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfreadwrite.dll
2014-09-14 11:06 - 2014-07-24 09:36 - 00180720 _____ (Microsoft Corporation) C:\windows\SysWOW64\mftranscode.dll
2014-09-14 11:06 - 2014-07-24 07:51 - 00008192 _____ (Microsoft Corporation) C:\windows\system32\KBDRUM.DLL
2014-09-14 11:06 - 2014-07-24 07:51 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDYAK.DLL
2014-09-14 11:06 - 2014-07-24 07:51 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDTT102.DLL
2014-09-14 11:06 - 2014-07-24 07:51 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDTAT.DLL
2014-09-14 11:06 - 2014-07-24 07:51 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDRU1.DLL
2014-09-14 11:06 - 2014-07-24 07:51 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDBASH.DLL
2014-09-14 11:06 - 2014-07-24 07:51 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\KBDRU.DLL
2014-09-14 11:06 - 2014-07-24 07:47 - 00132608 _____ (Microsoft Corporation) C:\windows\system32\rdpudd.dll
2014-09-14 11:06 - 2014-07-24 07:46 - 00079872 _____ (Microsoft Corporation) C:\windows\system32\Drivers\IPMIDrv.sys
2014-09-14 11:06 - 2014-07-24 07:45 - 00076800 _____ (Microsoft Corporation) C:\windows\system32\Drivers\hdaudbus.sys
2014-09-14 11:06 - 2014-07-24 07:44 - 00674816 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv2.sys
2014-09-14 11:06 - 2014-07-24 07:43 - 00412160 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv.sys
2014-09-14 11:06 - 2014-07-24 07:42 - 00446976 _____ (Microsoft Corporation) C:\windows\system32\Drivers\nwifi.sys
2014-09-14 11:06 - 2014-07-24 07:42 - 00126464 _____ (Microsoft Corporation) C:\windows\system32\Drivers\NdisImPlatform.sys
2014-09-14 11:06 - 2014-07-24 07:41 - 00115712 _____ (Microsoft Corporation) C:\windows\system32\Drivers\bridge.sys
2014-09-14 11:06 - 2014-07-24 07:33 - 00059392 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
2014-09-14 11:06 - 2014-07-24 07:33 - 00050688 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2014-09-14 11:06 - 2014-07-24 07:22 - 00308736 _____ (Microsoft Corporation) C:\windows\system32\compstui.dll
2014-09-14 11:06 - 2014-07-24 07:06 - 00220160 _____ (Microsoft Corporation) C:\windows\system32\iasnap.dll
2014-09-14 11:06 - 2014-07-24 07:05 - 00287232 _____ (Microsoft Corporation) C:\windows\system32\usbmon.dll
2014-09-14 11:06 - 2014-07-24 07:05 - 00226816 _____ (Microsoft Corporation) C:\windows\system32\WebClnt.dll
2014-09-14 11:06 - 2014-07-24 06:52 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDYAK.DLL
2014-09-14 11:06 - 2014-07-24 06:52 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDTT102.DLL
2014-09-14 11:06 - 2014-07-24 06:52 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDTAT.DLL
2014-09-14 11:06 - 2014-07-24 06:51 - 00008192 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDRUM.DLL
2014-09-14 11:06 - 2014-07-24 06:51 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDRU1.DLL
2014-09-14 11:06 - 2014-07-24 06:51 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDBASH.DLL
2014-09-14 11:06 - 2014-07-24 06:51 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDRU.DLL
2014-09-14 11:06 - 2014-07-24 06:49 - 00065536 _____ (Microsoft Corporation) C:\windows\system32\WorkFoldersGPExt.dll
2014-09-14 11:06 - 2014-07-24 06:33 - 00026112 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll
2014-09-14 11:06 - 2014-07-24 06:32 - 00207360 _____ (Microsoft Corporation) C:\windows\system32\powercfg.cpl
2014-09-14 11:06 - 2014-07-24 06:20 - 02050560 _____ (Microsoft Corporation) C:\windows\system32\SRH.dll
2014-09-14 11:06 - 2014-07-24 06:18 - 01089024 _____ (Microsoft Corporation) C:\windows\system32\gpedit.dll
2014-09-14 11:06 - 2014-07-24 06:12 - 00878592 _____ (Microsoft Corporation) C:\windows\system32\ActionCenter.dll
2014-09-14 11:06 - 2014-07-24 06:10 - 01844224 _____ (Microsoft Corporation) C:\windows\system32\Display.dll
2014-09-14 11:06 - 2014-07-24 06:10 - 00834560 _____ (Microsoft Corporation) C:\windows\system32\osk.exe
2014-09-14 11:06 - 2014-07-24 06:10 - 00198656 _____ (Microsoft Corporation) C:\windows\SysWOW64\WebClnt.dll
2014-09-14 11:06 - 2014-07-24 06:10 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\iasnap.dll
2014-09-14 11:06 - 2014-07-24 06:09 - 01057280 _____ (Microsoft Corporation) C:\windows\system32\rdvidcrl.dll
2014-09-14 11:06 - 2014-07-24 06:06 - 00438272 _____ (Microsoft Corporation) C:\windows\system32\puiobj.dll
2014-09-14 11:06 - 2014-07-24 06:05 - 00187392 _____ (Microsoft Corporation) C:\windows\system32\WorkFoldersShell.dll
2014-09-14 11:06 - 2014-07-24 05:53 - 00215552 _____ (Microsoft Corporation) C:\windows\system32\prnntfy.dll
2014-09-14 11:06 - 2014-07-24 05:52 - 00621056 _____ (Microsoft Corporation) C:\windows\system32\comdlg32.dll
2014-09-14 11:06 - 2014-07-24 05:42 - 00206336 _____ (Microsoft Corporation) C:\windows\SysWOW64\powercfg.cpl
2014-09-14 11:06 - 2014-07-24 05:40 - 00557056 _____ (Microsoft Corporation) C:\windows\system32\PrintDialogs.dll
2014-09-14 11:06 - 2014-07-24 05:39 - 00770048 _____ (Microsoft Corporation) C:\windows\system32\WorkfoldersControl.dll
2014-09-14 11:06 - 2014-07-24 05:33 - 01741824 _____ (Microsoft Corporation) C:\windows\SysWOW64\SRH.dll
2014-09-14 11:06 - 2014-07-24 05:32 - 01048064 _____ (Microsoft Corporation) C:\windows\SysWOW64\gpedit.dll
2014-09-14 11:06 - 2014-07-24 05:27 - 00855552 _____ (Microsoft Corporation) C:\windows\SysWOW64\rdvidcrl.dll
2014-09-14 11:06 - 2014-07-24 05:27 - 00779264 _____ (Microsoft Corporation) C:\windows\SysWOW64\osk.exe
2014-09-14 11:06 - 2014-07-24 05:25 - 00832512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ActionCenter.dll
2014-09-14 11:06 - 2014-07-24 05:24 - 01817088 _____ (Microsoft Corporation) C:\windows\SysWOW64\Display.dll
2014-09-14 11:06 - 2014-07-24 05:23 - 00328704 _____ (Microsoft Corporation) C:\windows\SysWOW64\puiobj.dll
2014-09-14 11:06 - 2014-07-24 05:21 - 00134144 _____ (Microsoft Corporation) C:\windows\system32\browser.dll
2014-09-14 11:06 - 2014-07-24 05:18 - 00018432 _____ (Microsoft Corporation) C:\windows\system32\wlansvcpal.dll
2014-09-14 11:06 - 2014-07-24 05:14 - 00443904 _____ (Microsoft Corporation) C:\windows\system32\wlansec.dll
2014-09-14 11:06 - 2014-07-24 05:13 - 00195584 _____ (Microsoft Corporation) C:\windows\SysWOW64\prnntfy.dll
2014-09-14 11:06 - 2014-07-24 05:12 - 00127488 _____ (Microsoft Corporation) C:\windows\system32\WiFiDisplay.dll
2014-09-14 11:06 - 2014-07-24 05:11 - 00356864 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
2014-09-14 11:06 - 2014-07-24 05:11 - 00063488 _____ (Microsoft Corporation) C:\windows\system32\wshbth.dll
2014-09-14 11:06 - 2014-07-24 05:10 - 00540672 _____ (Microsoft Corporation) C:\windows\SysWOW64\comdlg32.dll
2014-09-14 11:06 - 2014-07-24 05:09 - 00116736 _____ (Microsoft Corporation) C:\windows\system32\httpprxm.dll
2014-09-14 11:06 - 2014-07-24 05:04 - 00492032 _____ (Microsoft Corporation) C:\windows\SysWOW64\PrintDialogs.dll
2014-09-14 11:06 - 2014-07-24 05:04 - 00183808 _____ (Microsoft Corp.) C:\windows\system32\Defrag.exe
2014-09-14 11:06 - 2014-07-24 05:03 - 00324096 _____ (Microsoft Corporation) C:\windows\system32\srvsvc.dll
2014-09-14 11:06 - 2014-07-24 05:02 - 00220160 _____ (Microsoft Corporation) C:\windows\system32\profsvc.dll
2014-09-14 11:06 - 2014-07-24 04:58 - 00105472 _____ (Microsoft Corporation) C:\windows\system32\BluetoothApis.dll
2014-09-14 11:06 - 2014-07-24 04:53 - 00449536 _____ (Microsoft Corporation) C:\windows\system32\defragsvc.dll
2014-09-14 11:06 - 2014-07-24 04:49 - 01361408 _____ (Microsoft Corporation) C:\windows\SysWOW64\user32.dll
2014-09-14 11:06 - 2014-07-24 04:49 - 01287680 _____ (Microsoft Corporation) C:\windows\system32\mispace.dll
2014-09-14 11:06 - 2014-07-24 04:49 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\wlanapi.dll
2014-09-14 11:06 - 2014-07-24 04:49 - 00075776 _____ (Microsoft Corporation) C:\windows\system32\adhsvc.dll
2014-09-14 11:06 - 2014-07-24 04:48 - 00659968 _____ (Microsoft Corporation) C:\windows\system32\Windows.Devices.Bluetooth.dll
2014-09-14 11:06 - 2014-07-24 04:47 - 00102912 _____ (Microsoft Corporation) C:\windows\system32\wcmcsp.dll
2014-09-14 11:06 - 2014-07-24 04:43 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\wshbth.dll
2014-09-14 11:06 - 2014-07-24 04:39 - 02397184 _____ (Microsoft Corporation) C:\windows\system32\storagewmi.dll
2014-09-14 11:06 - 2014-07-24 04:38 - 00371200 _____ (Microsoft Corporation) C:\windows\system32\wlanmsm.dll
2014-09-14 11:06 - 2014-07-24 04:36 - 00079872 _____ (Microsoft Corporation) C:\windows\SysWOW64\BluetoothApis.dll
2014-09-14 11:06 - 2014-07-24 04:30 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\wlanapi.dll
2014-09-14 11:06 - 2014-07-24 04:29 - 00439296 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.Devices.Bluetooth.dll
2014-09-14 11:06 - 2014-07-24 04:28 - 00595456 _____ (Microsoft Corporation) C:\windows\system32\Windows.Networking.dll
2014-09-14 11:06 - 2014-07-24 04:27 - 00907776 _____ (Microsoft Corporation) C:\windows\system32\iphlpsvc.dll
2014-09-14 11:06 - 2014-07-24 04:24 - 00249344 _____ (Microsoft Corporation) C:\windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-09-14 11:06 - 2014-07-24 04:23 - 01404416 _____ (Microsoft Corporation) C:\windows\SysWOW64\storagewmi.dll
2014-09-14 11:06 - 2014-07-24 04:22 - 00487936 _____ (Microsoft Corporation) C:\windows\system32\winspool.drv
2014-09-14 11:06 - 2014-07-24 04:21 - 00302080 _____ (Microsoft Corporation) C:\windows\SysWOW64\wlanmsm.dll
2014-09-14 11:06 - 2014-07-24 04:20 - 00187392 _____ (Microsoft Corporation) C:\windows\system32\puiapi.dll
2014-09-14 11:06 - 2014-07-24 04:19 - 00388608 _____ (Microsoft Corporation) C:\windows\system32\WUSettingsProvider.dll
2014-09-14 11:06 - 2014-07-24 04:18 - 01144320 _____ (Microsoft Corporation) C:\windows\system32\wwanmm.dll
2014-09-14 11:06 - 2014-07-24 04:18 - 00795136 _____ (Microsoft Corporation) C:\windows\system32\spoolsv.exe
2014-09-14 11:06 - 2014-07-24 04:18 - 00093696 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2014-09-14 11:06 - 2014-07-24 04:16 - 00505344 _____ (Microsoft Corporation) C:\windows\system32\VAN.dll
2014-09-14 11:06 - 2014-07-24 04:16 - 00084480 _____ (Microsoft Corporation) C:\windows\system32\wpdbusenum.dll
2014-09-14 11:06 - 2014-07-24 04:15 - 00828416 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2014-09-14 11:06 - 2014-07-24 04:15 - 00721408 _____ (Microsoft Corporation) C:\windows\system32\twinapi.dll
2014-09-14 11:06 - 2014-07-24 04:15 - 00432128 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.Networking.dll
2014-09-14 11:06 - 2014-07-24 04:13 - 00226304 _____ (Microsoft Corporation) C:\windows\system32\SndVolSSO.dll
2014-09-14 11:06 - 2014-07-24 04:12 - 00189952 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-09-14 11:06 - 2014-07-24 04:10 - 01029632 _____ (Microsoft Corporation) C:\windows\system32\localspl.dll
2014-09-14 11:06 - 2014-07-24 04:10 - 00889344 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.Media.dll
2014-09-14 11:06 - 2014-07-24 04:10 - 00806400 _____ (Microsoft Corporation) C:\windows\system32\win32spl.dll
2014-09-14 11:06 - 2014-07-24 04:10 - 00371712 _____ (Microsoft Corporation) C:\windows\SysWOW64\winspool.drv
2014-09-14 11:06 - 2014-07-24 04:08 - 00321536 _____ (Microsoft Corporation) C:\windows\system32\stobject.dll
2014-09-14 11:06 - 2014-07-24 04:08 - 00162816 _____ (Microsoft Corporation) C:\windows\SysWOW64\puiapi.dll
2014-09-14 11:06 - 2014-07-24 04:07 - 01705472 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2014-09-14 11:06 - 2014-07-24 04:06 - 00080896 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2014-09-14 11:06 - 2014-07-24 04:05 - 00448000 _____ (Microsoft Corporation) C:\windows\SysWOW64\VAN.dll
2014-09-14 11:06 - 2014-07-24 04:04 - 00667136 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2014-09-14 11:06 - 2014-07-24 04:02 - 03465216 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2014-09-14 11:06 - 2014-07-24 04:01 - 05833216 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.UI.Search.dll
2014-09-14 11:06 - 2014-07-24 04:01 - 01992192 _____ (Microsoft Corporation) C:\windows\system32\XpsPrint.dll
2014-09-14 11:06 - 2014-07-24 04:01 - 01126912 _____ (Microsoft Corporation) C:\windows\system32\SearchFolder.dll
2014-09-14 11:06 - 2014-07-24 04:00 - 02100736 _____ (Microsoft Corporation) C:\windows\system32\SystemSettingsAdminFlowUI.dll
2014-09-14 11:06 - 2014-07-24 03:58 - 00432640 _____ (Microsoft Corporation) C:\windows\system32\wwanconn.dll
2014-09-14 11:06 - 2014-07-24 03:58 - 00288768 _____ (Microsoft Corporation) C:\windows\SysWOW64\stobject.dll
2014-09-14 11:06 - 2014-07-24 03:54 - 01290752 _____ (Microsoft Corporation) C:\windows\SysWOW64\XpsPrint.dll
2014-09-14 11:06 - 2014-07-24 03:50 - 01182208 _____ (Microsoft Corporation) C:\windows\system32\printui.dll
2014-09-14 11:06 - 2014-07-24 03:50 - 00923136 _____ (Microsoft Corporation) C:\windows\system32\WSShared.dll
2014-09-14 11:06 - 2014-07-24 03:49 - 00263680 _____ (Microsoft Corporation) C:\windows\system32\DafPrintProvider.dll
2014-09-14 11:06 - 2014-07-24 03:47 - 00576512 _____ (Microsoft Corporation) C:\windows\system32\SettingSync.dll
2014-09-14 11:06 - 2014-07-24 03:44 - 01057792 _____ (Microsoft Corporation) C:\windows\SysWOW64\printui.dll
2014-09-14 11:06 - 2014-07-24 03:43 - 00756224 _____ (Microsoft Corporation) C:\windows\SysWOW64\WSShared.dll
2014-09-14 11:06 - 2014-07-24 03:43 - 00200192 _____ (Microsoft Corporation) C:\windows\SysWOW64\DafPrintProvider.dll
2014-09-14 11:06 - 2014-07-24 03:41 - 00459264 _____ (Microsoft Corporation) C:\windows\SysWOW64\SettingSync.dll
2014-09-14 11:06 - 2014-07-24 03:33 - 03360768 _____ (Microsoft Corporation) C:\windows\system32\rdpcorets.dll
2014-09-14 11:06 - 2014-07-24 00:11 - 00513544 _____ () C:\windows\SysWOW64\locale.nls
2014-09-14 11:06 - 2014-07-24 00:11 - 00513544 _____ () C:\windows\system32\locale.nls
2014-09-14 11:06 - 2014-07-12 01:55 - 00268288 _____ (Microsoft Corporation) C:\windows\system32\wisp.dll
2014-09-14 11:06 - 2014-07-12 01:23 - 00436224 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll
2014-09-14 11:06 - 2014-07-12 00:58 - 00210944 _____ (Microsoft Corporation) C:\windows\SysWOW64\wisp.dll
2014-09-14 11:06 - 2014-07-12 00:33 - 00318976 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll
2014-09-14 11:06 - 2014-07-12 00:13 - 01417216 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2014-09-14 11:06 - 2014-07-09 19:19 - 00387391 _____ () C:\windows\system32\ApnDatabase.xml
2014-09-14 11:06 - 2014-07-04 08:59 - 00295424 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ks.sys
2014-09-14 11:06 - 2014-07-04 06:29 - 00117248 _____ (Microsoft Corporation) C:\windows\system32\AppxSip.dll
2014-09-14 11:06 - 2014-07-04 06:20 - 01656832 _____ (Microsoft Corporation) C:\windows\system32\GdiPlus.dll
2014-09-14 11:06 - 2014-07-04 06:06 - 00095232 _____ (Microsoft Corporation) C:\windows\SysWOW64\AppxSip.dll
2014-09-14 11:06 - 2014-07-04 06:00 - 01351168 _____ (Microsoft Corporation) C:\windows\SysWOW64\GdiPlus.dll
2014-09-14 11:06 - 2014-07-04 05:30 - 00544768 _____ (Microsoft Corporation) C:\windows\system32\AppxPackaging.dll
2014-09-14 11:06 - 2014-07-04 05:27 - 00474112 _____ (Microsoft Corporation) C:\windows\SysWOW64\AppxPackaging.dll
2014-09-14 11:06 - 2014-06-27 02:22 - 00246272 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srvnet.sys
2014-09-14 11:06 - 2014-06-25 20:32 - 01029632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mispace.dll
2014-09-14 11:06 - 2014-06-25 20:29 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\dab.dll
2014-09-14 11:06 - 2014-06-19 19:37 - 00206848 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
2014-09-14 11:06 - 2014-06-18 22:13 - 00310080 _____ (Microsoft Corporation) C:\windows\system32\Drivers\volsnap.sys
2014-09-14 11:06 - 2014-06-07 08:46 - 00216368 _____ (Microsoft Corporation) C:\windows\system32\rsaenh.dll
2014-09-14 11:06 - 2014-06-07 06:20 - 00189016 _____ (Microsoft Corporation) C:\windows\SysWOW64\rsaenh.dll
2014-09-14 11:06 - 2014-06-05 10:00 - 01118040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ndis.sys
2014-09-14 11:06 - 2014-06-05 06:18 - 01018368 _____ (Microsoft Corporation) C:\windows\system32\aclui.dll
2014-09-14 11:06 - 2014-06-05 05:42 - 00889856 _____ (Microsoft Corporation) C:\windows\SysWOW64\aclui.dll
2014-09-14 11:06 - 2014-05-31 01:00 - 01463808 _____ (Microsoft Corporation) C:\windows\system32\wsecedit.dll
2014-09-14 11:06 - 2014-05-31 00:18 - 01319936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wsecedit.dll
2014-09-14 11:06 - 2014-05-29 02:23 - 00427008 _____ (Microsoft Corporation) C:\windows\system32\clusapi.dll
2014-09-14 11:06 - 2014-05-29 01:25 - 00313856 _____ (Microsoft Corporation) C:\windows\SysWOW64\clusapi.dll
2014-09-14 11:06 - 2014-05-29 01:20 - 00427520 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2014-09-14 11:06 - 2014-05-29 00:36 - 00344576 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2014-09-14 11:06 - 2014-05-26 03:26 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\AppxSysprep.dll
2014-09-14 11:06 - 2014-05-10 06:12 - 00387896 _____ (Microsoft Corporation) C:\windows\system32\bcryptprimitives.dll
2014-09-14 11:06 - 2014-05-10 04:46 - 00335680 _____ (Microsoft Corporation) C:\windows\SysWOW64\bcryptprimitives.dll
2014-09-14 11:06 - 2014-05-06 00:41 - 00486744 _____ (Microsoft Corporation) C:\windows\system32\netcfgx.dll
2014-09-14 11:06 - 2014-05-05 20:55 - 00391000 _____ (Microsoft Corporation) C:\windows\SysWOW64\netcfgx.dll
2014-09-14 11:06 - 2014-03-24 22:27 - 00160600 _____ (Microsoft Corporation) C:\windows\system32\winmmbase.dll
2014-09-14 11:06 - 2014-03-24 22:27 - 00123920 _____ (Microsoft Corporation) C:\windows\system32\winmm.dll
2014-09-14 11:06 - 2014-03-24 21:20 - 00128568 _____ (Microsoft Corporation) C:\windows\SysWOW64\winmm.dll
2014-09-14 11:06 - 2014-03-24 21:20 - 00127544 _____ (Microsoft Corporation) C:\windows\SysWOW64\winmmbase.dll
2014-09-14 11:00 - 2014-08-14 20:36 - 00146752 _____ (Microsoft Corporation) C:\windows\system32\Drivers\msgpioclx.sys
2014-09-12 19:04 - 2014-09-24 12:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-12 19:04 - 2014-09-12 19:04 - 00001182 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-09-12 19:04 - 2014-09-12 19:04 - 00001170 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-09-12 19:04 - 2014-09-12 19:04 - 00000000 ____D () C:\Users\Cathy\AppData\Roaming\Mozilla
2014-09-12 19:04 - 2014-09-12 19:04 - 00000000 ____D () C:\Users\Cathy\AppData\Local\Mozilla
2014-09-12 19:04 - 2014-09-12 19:04 - 00000000 ____D () C:\ProgramData\Mozilla
2014-09-12 13:25 - 2014-08-15 22:40 - 23591424 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-09-12 13:25 - 2014-08-15 22:04 - 17455104 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-09-12 13:25 - 2014-08-15 22:00 - 05833728 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-09-12 13:25 - 2014-08-15 22:00 - 02793984 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-09-12 13:25 - 2014-08-15 21:56 - 00547328 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-09-12 13:25 - 2014-08-15 21:54 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2014-09-12 13:25 - 2014-08-15 21:45 - 04232704 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-09-12 13:25 - 2014-08-15 21:43 - 00758272 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-09-12 13:25 - 2014-08-15 21:32 - 00446464 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-09-12 13:25 - 2014-08-15 21:25 - 00072704 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-09-12 13:25 - 2014-08-15 21:22 - 00454656 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2014-09-12 13:25 - 2014-08-15 21:20 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2014-09-12 13:25 - 2014-08-15 21:19 - 00085504 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-09-12 13:25 - 2014-08-15 21:18 - 02185728 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-09-12 13:25 - 2014-08-15 21:18 - 00289280 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-09-12 13:25 - 2014-08-15 21:11 - 00597504 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2014-09-12 13:25 - 2014-08-15 21:06 - 00359424 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2014-09-12 13:25 - 2014-08-15 21:05 - 00727040 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-09-12 13:25 - 2014-08-15 21:05 - 00707072 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-09-12 13:25 - 2014-08-15 21:03 - 02104832 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-09-12 13:25 - 2014-08-15 21:03 - 00365056 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-09-12 13:25 - 2014-08-15 20:58 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-12 13:25 - 2014-08-15 20:56 - 02310656 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-09-12 13:25 - 2014-08-15 20:53 - 13588480 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-09-12 13:25 - 2014-08-15 20:53 - 00243200 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-09-12 13:25 - 2014-08-15 20:53 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-09-12 13:25 - 2014-08-15 20:51 - 11769856 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-09-12 13:25 - 2014-08-15 20:45 - 00603136 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-09-12 13:25 - 2014-08-15 20:44 - 02014208 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-09-12 13:25 - 2014-08-15 20:44 - 00312320 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2014-09-12 13:25 - 2014-08-15 20:34 - 01447424 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-09-12 13:25 - 2014-08-15 20:20 - 01812992 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-09-12 13:25 - 2014-08-15 20:18 - 00775168 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-09-12 13:25 - 2014-08-15 20:14 - 01190400 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-09-12 13:25 - 2014-08-15 20:12 - 00678400 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2014-09-12 13:10 - 2014-09-04 22:36 - 00097280 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2014-09-12 13:10 - 2014-09-04 22:31 - 00527360 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-09-12 13:10 - 2014-09-04 20:48 - 00738816 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-09-12 13:10 - 2014-08-01 20:18 - 01212928 _____ (Microsoft Corporation) C:\windows\system32\schedsvc.dll
2014-09-12 13:09 - 2014-07-23 23:20 - 00875688 _____ (Microsoft Corporation) C:\windows\SysWOW64\msvcr120_clr0400.dll
2014-09-12 13:09 - 2014-07-23 23:20 - 00869544 _____ (Microsoft Corporation) C:\windows\system32\msvcr120_clr0400.dll
2014-09-11 17:11 - 2014-09-11 17:11 - 00000000 _____ () C:\windows\SysWOW64\jupdate-1.7.0_67-b01.log
2014-09-09 11:51 - 2014-09-09 11:51 - 01050105 _____ () C:\Users\Cathy\Downloads\Terraria.zip
2014-08-28 05:59 - 2014-08-22 20:42 - 04148224 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-24 12:52 - 2014-09-24 12:51 - 00020472 _____ () C:\Users\Cathy\Downloads\FRST.txt
2014-09-24 12:51 - 2014-09-24 12:51 - 00000000 ____D () C:\FRST
2014-09-24 12:50 - 2014-09-24 12:50 - 02106880 _____ (Farbar) C:\Users\Cathy\Downloads\FRST64.exe
2014-09-24 12:48 - 2014-09-17 12:36 - 00010770 _____ () C:\Users\Cathy\Downloads\hijackthis.log
2014-09-24 12:37 - 2014-09-17 12:38 - 00000000 ____D () C:\Users\Cathy\Downloads\backups
2014-09-24 12:31 - 2014-04-27 09:09 - 01970892 _____ () C:\windows\WindowsUpdate.log
2014-09-24 12:22 - 2013-08-24 17:38 - 00891920 _____ () C:\windows\system32\PerfStringBackup.INI
2014-09-24 12:21 - 2014-09-24 12:21 - 05579290 _____ (Swearware) C:\Users\Cathy\Downloads\ComboFix.exe
2014-09-24 12:18 - 2014-08-10 20:35 - 00000000 _____ () C:\windows\system32\Drivers\lvuvc.hs
2014-09-24 12:18 - 2014-04-28 21:19 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-09-24 12:18 - 2014-04-26 17:48 - 00000910 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-24 12:18 - 2013-08-22 10:45 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-09-24 12:18 - 2013-08-22 10:44 - 00373600 _____ () C:\windows\system32\FNTCACHE.DAT
2014-09-24 12:17 - 2014-09-12 19:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-24 12:17 - 2013-08-24 17:32 - 00018222 _____ () C:\windows\PFRO.log
2014-09-24 12:17 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\registration
2014-09-24 12:17 - 2013-08-22 09:25 - 00262144 ___SH () C:\windows\system32\config\BBI
2014-09-24 12:11 - 2014-04-26 17:49 - 00000914 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-24 12:00 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\system32\sru
2014-09-24 11:56 - 2014-09-17 13:15 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-24 09:50 - 2014-02-22 12:43 - 00065536 _____ () C:\windows\system32\spu_storage.bin
2014-09-24 07:10 - 2014-04-27 09:10 - 00003926 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{0F78AD86-2C7C-4677-BC7A-ECD593326FBA}
2014-09-23 17:24 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\rescache
2014-09-23 16:53 - 2014-09-23 16:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-23 16:38 - 2014-04-28 19:55 - 00000052 _____ () C:\windows\SysWOW64\DOErrors.log
2014-09-23 16:37 - 2014-04-28 19:55 - 00000000 _____ () C:\windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-09-23 16:34 - 2013-08-22 11:20 - 00000000 ____D () C:\windows\CbsTemp
2014-09-23 16:33 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\AppReadiness
2014-09-22 01:57 - 2014-04-27 09:15 - 00003600 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1614091358-1205644983-2003651797-1001
2014-09-19 08:45 - 2013-08-22 15:12 - 00000000 ____D () C:\Program Files\Windows Journal
2014-09-19 08:45 - 2013-08-22 11:36 - 00000000 ___RD () C:\windows\ToastData
2014-09-19 08:45 - 2013-08-22 11:36 - 00000000 ___RD () C:\windows\ImmersiveControlPanel
2014-09-19 08:45 - 2013-08-22 11:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-09-19 08:45 - 2013-08-22 11:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-09-19 08:45 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\WinStore
2014-09-19 08:45 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\SysWOW64\setup
2014-09-19 08:45 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\SysWOW64\InputMethod
2014-09-19 08:45 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\system32\setup
2014-09-19 08:45 - 2013-08-22 09:36 - 00000000 ____D () C:\windows\system32\oobe
2014-09-17 13:15 - 2014-09-17 13:15 - 00001125 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-09-17 13:15 - 2014-09-17 13:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-09-17 13:15 - 2014-09-17 13:15 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-17 13:15 - 2014-09-17 13:15 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-09-17 13:14 - 2014-09-17 13:14 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Cathy\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-17 12:35 - 2014-04-27 09:10 - 00000000 ____D () C:\Users\Cathy\AppData\Local\VirtualStore
2014-09-17 12:24 - 2014-09-17 12:24 - 00388608 _____ (Trend Micro Inc.) C:\Users\Cathy\Downloads\HijackThis.exe
2014-09-17 12:20 - 2014-04-26 17:48 - 00000000 ____D () C:\Program Files (x86)\Google
2014-09-17 12:16 - 2014-09-17 12:16 - 00000000 ____D () C:\Users\Cathy\AppData\Local\pinger.com
2014-09-17 12:16 - 2014-02-22 13:49 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Communication and Chat
2014-09-17 12:08 - 2014-08-10 19:52 - 00022590 _____ () C:\windows\system32\lvcoinst.log
2014-09-15 08:50 - 2014-07-09 09:06 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-09-13 16:30 - 2014-04-28 20:26 - 00003164 _____ () C:\windows\System32\Tasks\HPCeeScheduleForCathy
2014-09-13 16:30 - 2014-04-28 20:26 - 00000350 _____ () C:\windows\Tasks\HPCeeScheduleForCathy.job
2014-09-12 19:04 - 2014-09-12 19:04 - 00001182 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-09-12 19:04 - 2014-09-12 19:04 - 00001170 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-09-12 19:04 - 2014-09-12 19:04 - 00000000 ____D () C:\Users\Cathy\AppData\Roaming\Mozilla
2014-09-12 19:04 - 2014-09-12 19:04 - 00000000 ____D () C:\Users\Cathy\AppData\Local\Mozilla
2014-09-12 19:04 - 2014-09-12 19:04 - 00000000 ____D () C:\ProgramData\Mozilla
2014-09-12 13:26 - 2014-06-11 07:28 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-09-12 13:25 - 2014-06-11 07:29 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-09-12 13:25 - 2014-06-11 07:29 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-09-12 13:25 - 2014-06-11 07:28 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-09-12 13:25 - 2014-06-11 07:28 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2014-09-12 13:25 - 2014-06-11 07:28 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-09-12 13:25 - 2014-06-11 07:28 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-09-12 13:25 - 2014-06-11 07:28 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2014-09-12 13:25 - 2014-06-11 07:28 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-09-12 13:25 - 2014-06-11 07:28 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-09-12 13:25 - 2014-06-11 07:28 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-09-12 13:25 - 2014-06-11 07:28 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-09-12 13:25 - 2014-06-11 07:28 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-09-12 13:25 - 2014-06-11 07:27 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-09-12 13:25 - 2014-04-29 20:55 - 00000000 ____D () C:\windows\system32\MRT
2014-09-12 13:25 - 2014-04-28 17:40 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-09-12 13:25 - 2014-04-28 17:40 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-09-12 13:20 - 2014-04-29 20:55 - 101694776 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-09-11 18:27 - 2014-04-27 09:10 - 00000000 ____D () C:\Users\Cathy
2014-09-11 18:25 - 2014-05-25 10:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-09-11 18:25 - 2014-05-22 00:16 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-09-11 18:19 - 2014-08-10 21:17 - 00000000 ____D () C:\Users\Cathy\AppData\Roaming\Skype
2014-09-11 18:19 - 2014-05-25 10:34 - 00000000 ____D () C:\Program Files (x86)\Java
2014-09-11 17:11 - 2014-09-11 17:11 - 00000000 _____ () C:\windows\SysWOW64\jupdate-1.7.0_67-b01.log
2014-09-09 11:51 - 2014-09-09 11:51 - 01050105 _____ () C:\Users\Cathy\Downloads\Terraria.zip
2014-09-09 06:43 - 2014-05-22 00:14 - 00000000 ____D () C:\Users\Cathy\AppData\Local\Adobe
2014-09-09 06:43 - 2014-04-27 09:10 - 00000000 ____D () C:\Users\Cathy\AppData\Roaming\Adobe
2014-09-04 22:36 - 2014-09-12 13:10 - 00097280 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2014-09-04 22:31 - 2014-09-12 13:10 - 00527360 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-09-04 20:48 - 2014-09-12 13:10 - 00738816 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-09-02 16:06 - 2014-04-29 19:55 - 00706016 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-09-02 16:06 - 2014-04-29 19:55 - 00105440 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

Some content of TEMP:
====================
C:\Users\Cathy\AppData\Local\Temp\Extract.exe
C:\Users\Cathy\AppData\Local\Temp\fp_pl_pfs_installer-1.exe
C:\Users\Cathy\AppData\Local\Temp\fp_pl_pfs_installer-2.exe
C:\Users\Cathy\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Cathy\AppData\Local\Temp\OptimizerPro.exe
C:\Users\Cathy\AppData\Local\Temp\Quarantine.exe
C:\Users\Cathy\AppData\Local\Temp\Shortcut_bundlesweetimsetup.exe
C:\Users\Cathy\AppData\Local\Temp\sp64126.exe
C:\Users\Cathy\AppData\Local\Temp\SP65005.exe
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite13061.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite13132.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite15188.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite18219.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite20871.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite30357.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite34005.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite35781.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite44492.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite49691.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite52159.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite67838.dll
C:\Users\Cathy\AppData\Local\Temp\System.Data.SQLite78429.dll
C:\Users\Cathy\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\Cathy\AppData\Local\Temp\WSSetup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-22 13:24

==================== End Of Log ============================
 
 
 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-09-2014
Ran by Cathy at 2014-09-24 12:52:54
Running from C:\Users\Cathy\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)


==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

4 Elements II (x32 Version: 2.2.0.98 - WildTangent) Hidden
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Reader XI (11.0.07) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Airport Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
Alcor Micro USB Card Reader Driver  (HKLM-x32\...\AmUStor) (Version: 20.21.3317.03861 - Alcor Micro Corp.)
Alcor Micro USB Card Reader Driver  (x32 Version: 20.21.3317.03861 - Alcor Micro Corp.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.0911.2154.37488 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{7288D4D9-90E0-2B03-43D0-0BB6D4496577}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
Azkend 2: The World Beneath (x32 Version: 2.2.0.98 - WildTangent) Hidden
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden
Build-a-lot (x32 Version: 2.2.0.98 - WildTangent) Hidden
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0911.2154.37488 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.0911.2154.37488 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.0911.2154.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.0911.2153.37488 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.0911.2154.37488 - Advanced Micro Devices, Inc.) Hidden
Cradle Of Egypt Collector's Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Curse at Twilight (x32 Version: 3.0.2.32 - WildTangent) Hidden
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.5.6805 - CyberLink Corp.)
CyberLink LabelPrint (x32 Version: 2.5.5.6805 - CyberLink Corp.) Hidden
CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.5.3103 - CyberLink Corp.)
CyberLink Media Suite 10 (x32 Version: 10.0.5.3103 - CyberLink Corp.) Hidden
Cyberlink PhotoDirector (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.3.4323 - CyberLink Corp.)
Cyberlink PhotoDirector (x32 Version: 3.0.3.4323 - CyberLink Corp.) Hidden
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.5.3215 - CyberLink Corp.)
CyberLink Power2Go 8 (x32 Version: 8.0.5.3215 - CyberLink Corp.) Hidden
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.5.3215 - CyberLink Corp.)
CyberLink PowerDirector 10 (x32 Version: 10.0.5.3215 - CyberLink Corp.) Hidden
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.2.3212 - CyberLink Corp.)
CyberLink PowerDVD 12 (x32 Version: 12.0.2.3212 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Delicious: Emily's Childhood Memories Premium Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden
Dell Display Manager (HKLM-x32\...\{AC50C05D-9D57-40F5-B2EF-AC402F14312B}_is1) (Version:  - EnTech Taiwan)
Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Fishdom 3: Collector's Edition (x32 Version: 3.0.2.38 - WildTangent) Hidden
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
House of 1000 Doors: Family Secrets (x32 Version: 2.2.0.98 - WildTangent) Hidden
HP Connected Music (Meridian - installer) (HKLM-x32\...\StartHPConnectedMusic) (Version: 1.0 - Meridian Audio Ltd)
HP Connected Music (Meridian - player) (HKCU\...\HPConnectedMusic) (Version: 1.1 (build 112) hp - Meridian Audio Ltd)
HP Customer Experience Enhancements (x32 Version: 6.0.1.8 - Hewlett-Packard) Hidden
HP Documentation (HKLM-x32\...\{06600E94-1C34-40E2-AB09-D30AECF78172}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Postscript Converter (Version: 4.5.12202 - Hewlett-Packard) Hidden
HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.7127.4628 - Hewlett-Packard)
HP SimplePass (HKLM-x32\...\InstallShield_{314FAD12-F785-4471-BCE8-AB506642B9A1}) (Version: 8.00.51 - Hewlett-Packard)
HP SimplePass (Version: 8.00.51 - Hewlett-Packard) Hidden
HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 13.00.0000 - Hewlett-Packard)
Inst5675 (Version: 8.00.51 - Softex Inc.) Hidden
Inst5676 (Version: 8.00.51 - Softex Inc.) Hidden
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{6F6873E3-5C92-4049-B511-231A138DD090}) (Version: 14.0.0.4651 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 14.0.0.4651 - Kaspersky Lab) Hidden
King Oddball (x32 Version: 3.0.2.48 - WildTangent) Hidden
Luxor Evolved (x32 Version: 2.2.0.98 - WildTangent) Hidden
Mahjongg Dimensions Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 32.0.2 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 32.0.2 (x86 en-US)) (Version: 32.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 32.0.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
Mystery P.I. - Curious Case of Counterfeit Cove (x32 Version: 2.2.0.98 - WildTangent) Hidden
OpenOffice 4.1.0 (HKLM-x32\...\{C87EF11D-36E9-479D-9898-7541EA1E8A6A}) (Version: 4.10.9764 - Apache Software Foundation)
Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden
Photo Gallery (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Qualcomm Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.30164 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.0.7001 - CyberLink Corp.) Hidden
Roads of Rome 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
Tales of Lagoona (x32 Version: 2.2.0.110 - WildTangent) Hidden
Unity Web Player (HKCU\...\UnityWebPlayer) (Version: 4.5.1f3 - Unity Technologies ApS)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Vacation Quest™ - Australia (x32 Version: 3.0.2.32 - WildTangent) Hidden
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App (HP Games) (x32 Version: 4.0.10.15 - WildTangent) Hidden
Windows Live Communications Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Youda Jewel Shop (x32 Version: 3.0.2.32 - WildTangent) Hidden
Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

09-09-2014 11:12:49 Scheduled Checkpoint
11-09-2014 21:11:08 Installed Java 7 Update 67
11-09-2014 21:29:52 Restore Operation
15-09-2014 12:47:04 Windows Update
17-09-2014 16:15:47 Removed Pinger
23-09-2014 20:46:36 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 09:25 - 2013-08-22 09:25 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {150FD1B6-9DC9-4E32-8B43-963A54C889B7} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-09-03] (Hewlett-Packard)
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {225C359E-1B58-4461-A111-B1C67AEF702D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-26] (Google Inc.)
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {2EC01758-50F3-4D4B-9BE6-B97C97B25289} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-02-22] (Microsoft Corporation)
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {45941B7B-2FC8-488E-ADED-DB5280B0BB27} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {60E65BB6-3498-4A1F-B0FB-E578A4EC4725} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {66F3D055-4694-495B-AFCA-5CC76737300B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-26] (Google Inc.)
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6BE3025F-169C-4431-A147-29FD21550EBC} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {82BD6256-FC84-47C2-A58A-7B79CEBD915C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_CN84PDG0M90557 => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-09-03] (Hewlett-Packard)
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {89633FE5-869C-41DE-86F2-EA5C8E82A139} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {8980B224-5D8A-4DE2-850A-4650311CE08E} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {AFC17004-0F48-404C-B573-2E4E34E1C8BB} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\windows\system32\MRT.exe [2014-09-12] (Microsoft Corporation)
Task: {BECF2E5E-DC93-4F74-9773-4EE529932609} - System32\Tasks\HPCeeScheduleForCathy => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {C6CB203E-B5DF-4ED6-BFB4-8B295FFAF123} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {CBEE797A-00A3-4F83-8CCF-FE4727713EFD} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {DECE5B70-B654-426B-8FA3-6C7E655C28C7} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics
Task: {E019AF72-605D-4DD2-BFA7-46244D8B436F} - System32\Tasks\CLVDLauncher => c:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2013-03-12] (CyberLink Corp.)
Task: {E15E2CD0-666E-42E6-B44C-AD4141843288} - System32\Tasks\CLMLSvc_P2G8 => c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2013-08-05] (CyberLink)
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: {F1C0FA4B-3BDE-422E-91D5-2E0613D06B1E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-09-03] (Hewlett-Packard)
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HPCeeScheduleForCathy.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) =============

2013-09-05 07:22 - 2013-09-05 07:22 - 00109568 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe
2013-09-05 07:24 - 2013-09-05 07:24 - 00627200 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cachedrv.dll
2013-09-05 07:24 - 2013-09-05 07:24 - 02540544 _____ () C:\Program Files\Hewlett-Packard\SimplePass\autheng.dll
2013-09-05 07:21 - 2013-09-05 07:21 - 00035328 _____ () C:\Program Files\Hewlett-Packard\SimplePass\ssplogon.dll
2013-09-05 07:21 - 2013-09-05 07:21 - 00055296 _____ () C:\Program Files\Hewlett-Packard\SimplePass\RandomPass.dll
2013-09-05 07:21 - 2013-09-05 07:21 - 00021504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cryptodll.dll
2013-09-05 07:36 - 2013-09-05 07:36 - 00306064 _____ () C:\Program Files\Hewlett-Packard\SimplePass\mstrpwd.dll
2013-09-05 07:36 - 2013-09-05 07:36 - 01298832 _____ () C:\Program Files\Hewlett-Packard\SimplePass\GraphicalPwd.dll
2013-09-05 07:31 - 2013-09-05 07:31 - 00064000 _____ () C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
2013-06-05 15:51 - 2013-06-05 15:51 - 00098304 _____ () c:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingNet4.dll
2013-06-17 12:35 - 2013-06-17 12:35 - 00478400 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\dblite.dll
2013-05-08 14:52 - 2013-05-08 14:52 - 01270464 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\kpcengine.2.3.dll
2014-02-22 13:10 - 2013-08-05 03:49 - 00627672 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2013-08-05 19:48 - 2013-08-05 19:48 - 00016856 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2014-09-23 16:53 - 2014-09-23 16:53 - 03734640 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/24/2014 09:25:16 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: GrammyPC)
Description: Activation of app microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Calendar failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (09/24/2014 09:25:16 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: GrammyPC)
Description: Activation of app microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1 failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (09/23/2014 04:46:37 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll8

Error: (09/22/2014 01:57:42 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll8

Error: (09/19/2014 09:00:59 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll8

Error: (09/18/2014 03:12:52 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6250

Error: (09/18/2014 03:12:52 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6250

Error: (09/18/2014 03:12:52 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/18/2014 03:12:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4656

Error: (09/18/2014 03:12:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4656


System errors:
=============
Error: (09/24/2014 00:20:24 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The GamesAppIntegrationService service failed to start due to the following error:
%%2

Error: (09/24/2014 09:50:06 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly.  It has done this 6 time(s).

Error: (09/24/2014 09:25:15 AM) (Source: DCOM) (EventID: 10010) (User: GrammyPC)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}

Error: (09/24/2014 09:25:15 AM) (Source: DCOM) (EventID: 10010) (User: GrammyPC)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}

Error: (09/24/2014 09:25:11 AM) (Source: DCOM) (EventID: 10010) (User: GrammyPC)
Description: Windows.Networking.BackgroundTransfer.Internal.NetworkChangeTask.ClassId.2

Error: (09/24/2014 09:25:11 AM) (Source: DCOM) (EventID: 10010) (User: GrammyPC)
Description: Windows.Networking.BackgroundTransfer.Internal.NetworkChangeTask.ClassId.4

Error: (09/24/2014 09:25:09 AM) (Source: DCOM) (EventID: 10010) (User: GrammyPC)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}

Error: (09/24/2014 09:25:09 AM) (Source: DCOM) (EventID: 10010) (User: GrammyPC)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}

Error: (09/24/2014 08:29:01 AM) (Source: DCOM) (EventID: 10010) (User: GrammyPC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (09/24/2014 08:28:30 AM) (Source: DCOM) (EventID: 10010) (User: GrammyPC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}


Microsoft Office Sessions:
=========================
Error: (09/24/2014 09:25:16 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: GrammyPC)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Calendar-2144927141

Error: (09/24/2014 09:25:16 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: GrammyPC)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1-2144927141

Error: (09/23/2014 04:46:37 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll8

Error: (09/22/2014 01:57:42 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll8

Error: (09/19/2014 09:00:59 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll8

Error: (09/18/2014 03:12:52 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6250

Error: (09/18/2014 03:12:52 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6250

Error: (09/18/2014 03:12:52 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/18/2014 03:12:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4656

Error: (09/18/2014 03:12:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4656


==================== Memory info ===========================

Processor: AMD A4-5000 APU with Radeon™ HD Graphics
Percentage of memory in use: 28%
Total physical RAM: 5581.1 MB
Available physical RAM: 4018.13 MB
Total Pagefile: 6477.1 MB
Available Pagefile: 4570.85 MB
Total Virtual: 131072 MB
Available Virtual: 131071.79 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:914.39 GB) (Free:870.71 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery Image) (Fixed) (Total:15.64 GB) (Free:1.94 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (KIS - MD) (CDROM) (Total:0.52 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 2672BCF0)

Partition: GPT Partition Type.

==================== End Of Log ============================

Edited by Orange Blossom, 28 September 2014 - 07:38 PM.
Merged topics. ~ OB


#4 nasdaq

nasdaq

  • Malware Response Team
  • 39,955 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:02:21 AM

Posted 29 September 2014 - 07:47 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Clean your Temporary files/Folders.

Download TFC to your desktop
  • Close any open windows.
  • Double click the TFC icon to run the program.
  • TFC will close all open programs itself in order to run.
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted, it should not take long to finish.
  • Once it's finished, click OK to reboot.
  • If it does not reboot, reboot your system manually.
  • ===

    Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below.

    In Windows 7 and 8.
    Press the [Windows Icon + R] and enter "notepad" in the box to open Notepad

    start
    
    SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPDTDFJS
    SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPDTDFJS
    FF NewTab: hxxp://www.better-search.net/?barid=1605756688601503850&src=97&i=998&did=10874&crg=&ppd=,,,,,,,,,www.smilebox.com&st=23
    FF Keyword.URL: hxxp://www.better-search.net/?src=6&barid=1605756688601503850&i=998&did=10874&crg=&ppd=,,,,,,,,,www.smilebox.com&st=23&q=
    FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll No File
    CHR DefaultSearchKeyword: Default -> astromenda.com
    CHR DefaultSearchProvider: Default -> Astromenda
    CHR DefaultSearchURL: Default -> http://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_app_14_49_ch&cd=2XzuyEtN2Y1L1Qzu0AtDyEzztC0C0AyC0AtCtD0FtAtAtByDtN0D0Tzu0SzyyDtCtN1L2XzutBtFtBtCtFtCzztFyBtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDzz0AtCtA0C0A0CtGyD0F0ByCtG0FyByCtBtGtByDzzyDtGyC0Czz0D0CyB0EtBtBzy0EyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCtCzyzytA0E0E0DtGyB0F0BzztGyD0FtDyBtGyBzy0B0DtGtDyCtC0FyEyCtBtAtCyB0CyD2Q&cr=1976650300&ir=
    S2 GamesAppIntegrationService; "C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe" [X]
    S3 GamesAppService; "C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe" [X]
    U3 McAPExe; No ImagePath
    U3 McMPFSvc; No ImagePath
    U3 McNaiAnn; No ImagePath
    U3 mcpltsvc; No ImagePath
    U3 McProxy; No ImagePath
    U3 mfecore; No ImagePath
    U3 MSK80Service; No ImagePath
    
    end
    

    Save the files as fixlist.txt in to the same folder as FRST

    Run FRST and click Fix only once and wait.

    Restart the computer to reset the registry.

    The tool will create a log (Fixlog.txt) please post it to your reply.
    ===

    Please download AdwCleaner by Xplode onto your Desktop.
    • Close all open programs and internet browsers.
    • Double click on AdwCleaner.exe to run the tool.
    • Click the Scan button and wait for the process to complete.
    • Click the Report button and the report will open in Notepad.
    IMPORTANT
    • If you click the Clean button all items listed in the report will be removed.
    If you find some false positive items or programs that you wish to keep, Close the AdwCleaner windows.
    • Close all open programs and internet browsers.
    • Double click on AdwCleaner.exe to run the tool.
    • Click the Scan button and wait for the process to complete.
    • Uncheck the element(s) you wish to keep.
    • Click on the Clean button follow the prompts.
    • A log file will automatically open after the scan has finished.
    • Please post the content of that log file with your next answer.
    • You can find the log file at C:\AdwCleaner[Sn].txt (n is a number).
    ===

    Download Security Check by screen317 from here.
    • Save it to your Desktop.
    • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
    p.s.
    If the SecurityCheck program fails to run for any reason, run it as an Administrator.

    If the site is busy or not available use this mirror site:
    http://www.bleepingcomputer.com/download/securitycheck/

    Post the logs and let me know what problem persists.


#5 vfem

vfem
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:02:21 AM

Posted 01 October 2014 - 12:19 PM

# AdwCleaner v3.311 - Report created 01/10/2014 at 13:01:00
# Updated 30/09/2014 by Xplode
# Operating System : Windows 8.1  (64 bits)
# Username : Cathy - GRAMMYPC
# Running from : C:\Users\Cathy\Downloads\adwcleaner_3.311.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

File Deleted : C:\Users\Cathy\AppData\LocalLow\SkwConfig.bin

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\ImInstaller
Key Deleted : [x64] HKLM\SOFTWARE\SweetIM

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17278


-\\ Mozilla Firefox v32.0.2 (x86 en-US)

[ File : C:\Users\Cathy\AppData\Roaming\Mozilla\Firefox\Profiles\acs6nu6c.default\prefs.js ]


-\\ Google Chrome v

[ File : C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [Extension] : bopakagnckmlgajfccecajhnimjiiedh
Deleted [Extension] : ogccgbmabaphcakpiclgcnmcnimhokcj

*************************

AdwCleaner[R0].txt - [1147 octets] - [30/04/2014 10:24:41]
AdwCleaner[R1].txt - [1475 octets] - [01/10/2014 12:57:20]
AdwCleaner[S0].txt - [1216 octets] - [30/04/2014 10:26:17]
AdwCleaner[S1].txt - [1325 octets] - [01/10/2014 13:01:00]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1385 octets] ##########

 

 

Results of screen317's Security Check version 0.99.87  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled!  
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 Java 7 Update 55  
 Java version out of Date!
 Adobe Reader XI  
 Mozilla Firefox (32.0.3)
````````Process Check: objlist.exe by Laurent````````  
 Kaspersky Lab Kaspersky Internet Security 14.0.0 avp.exe  
 Kaspersky Lab Kaspersky Internet Security 14.0.0 avpui.exe  
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C:  %
````````````````````End of Log``````````````````````
 

 

I have to wait to ask my mom how its running for her now. But we're going to reinstall chrome because this all happened when Chrome stopped working and I couldn't get the firewall up. It appears that has been fixed!

 

Thank you so much.

 

Let me know if there is anything else I need to do to clean this up or any files that may need to be repaired.



#6 nasdaq

nasdaq

  • Malware Response Team
  • 39,955 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:02:21 AM

Posted 01 October 2014 - 12:35 PM

Your version of Java is outdated and needs to be updated to take advantage of fixes that have eliminated security vulnerabilities.
Latest version is Java JRE 7u67.

You can manually check your present version and update as recommended.
https://www.java.com/en/download/installed.jsp

Be careful not to install malware posing as Java update!
Important read this blog.
http://blog.trendmicro.com/trendlabs-security-intelligence/malware-poses-as-an-update-for-java-0-day-fix/

Quoted from the page.
"In light of the recent events surrounding Java, users must seriously consider their use of Java. Do they really need it? If yes, make sure that users follow the steps we recommended and get the security update directly from the official oracle website." at:
http://www.oracle.com/technetwork/java/javase/downloads/index.html

How to disable Java in your browsers
http://www.infoworld.com/t/web-browsers/how-disable-java-in-your-browsers-210882


If present remove the old version(s) of Java using the Add/Remove Programs applet.

Java 7 Update 55

===

If all is well.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe.
http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/
===

#7 nasdaq

nasdaq

  • Malware Response Team
  • 39,955 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:02:21 AM

Posted 07 October 2014 - 09:04 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users