Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Internet Explorer application running in task manager but shouldn't be


  • This topic is locked This topic is locked
7 replies to this topic

#1 Flyguyca

Flyguyca

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:01:58 PM

Posted 03 February 2015 - 07:31 PM

Hello,

 

I have internet explorer running in my applications tab in the task manager, however I do not have internet explorer open and rarely ever use it.  I have run numerous scans from Malware bytes, bitdefender, kaspersky etc and they all come back clean, however a scan I ran with roguekiller did indeed identify IE as malicious and when I deleted them they went away for a couple minutes only to return again.  That's when I decided to seek more help.  I have pasted the FRST file and have the addition file attached. 

 

Thank you

 

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2015
Ran by Lucich (administrator) on LUCICH-PC on 03-02-2015 14:07:15
Running from C:\Users\Lucich\Downloads
Loaded Profiles: Lucich (Available profiles: Lucich)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Bitdefender) C:\Program Files\Bitdefender\Antivirus Free Edition\gzserv.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe
(Bitdefender) C:\Program Files\Bitdefender\Antivirus Free Edition\gziface.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
(NETGEAR Inc.) C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenie.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr.exe
(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr_im.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Raptr Inc.) C:\Program Files (x86)\Raptr\raptr_ep64.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
() C:\Program Files (x86)\NETGEAR Genie\bin\genie2_tray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Blizzard Entertainment) C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe
(Blizzard Entertainment) C:\Program Files (x86)\Battle.net\Battle.net.5383\Battle.net.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_16_0_0_235_ActiveX.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13653208 2013-09-13] (Realtek Semiconductor)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-01-27] (Apple Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3084288 2012-07-31] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-01-20] (Apple Inc.)
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [55568 2015-01-30] (Raptr, Inc)
HKU\S-1-5-21-1986158769-1579731180-1314620784-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-10-17] (Apple Inc.)
HKU\S-1-5-21-1986158769-1579731180-1314620784-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-1986158769-1579731180-1314620784-1000\...\Run: [AppleIEDAV] => C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe [1080104 2014-08-04] (Apple Inc.)
HKU\S-1-5-21-1986158769-1579731180-1314620784-1000\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2014-10-20] (Apple Inc.)
HKU\S-1-5-21-1986158769-1579731180-1314620784-1000\...\Run: [NETGEARGenie] => C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenie.exe [602880 2014-11-06] (NETGEAR Inc.)
HKU\S-1-5-21-1986158769-1579731180-1314620784-1000\...\Run: [Battle.net] => C:\Program Files (x86)\Battle.net\Battle.net Launcher.exe [2864688 2014-12-10] (Blizzard Entertainment)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1986158769-1579731180-1314620784-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1986158769-1579731180-1314620784-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1986158769-1579731180-1314620784-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.facebook.com/
HKU\S-1-5-21-1986158769-1579731180-1314620784-1000\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.cdata.ca
HKU\S-1-5-21-1986158769-1579731180-1314620784-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/en-ca/?ocid=iehp
SearchScopes: HKLM -> {C601CF5B-ABE3-4398-8840-7CA6187BAB0C} URL = http://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {C601CF5B-ABE3-4398-8840-7CA6187BAB0C} URL = http://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBox
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Lucich\AppData\Roaming\Mozilla\Firefox\Profiles\cgidff08.default
FF DefaultSearchEngine: Google
FF Homepage: google.com
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1986158769-1579731180-1314620784-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Lucich\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-1986158769-1579731180-1314620784-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Lucich\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Extension: WOT - C:\Users\Lucich\AppData\Roaming\Mozilla\Firefox\Profiles\cgidff08.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2015-01-07]
FF Extension: Gmail Notifier (restartless) - C:\Users\Lucich\AppData\Roaming\Mozilla\Firefox\Profiles\cgidff08.default\Extensions\jid0-GjwrPchS3Ugt7xydvqVK4DQk8Ls@jetpack.xpi [2015-01-07]
FF Extension: The Fox, Only Better - C:\Users\Lucich\AppData\Roaming\Mozilla\Firefox\Profiles\cgidff08.default\Extensions\thefoxonlybetter@quicksaver.xpi [2015-01-07]
FF Extension: Twitter App - C:\Users\Lucich\AppData\Roaming\Mozilla\Firefox\Profiles\cgidff08.default\Extensions\{12b6fdcd-4423-4276-82a3-73fdbff5f7e4}.xpi [2015-01-10]
FF Extension: Adblock Plus - C:\Users\Lucich\AppData\Roaming\Mozilla\Firefox\Profiles\cgidff08.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-01-07]

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Lucich\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Xmarks Bookmark Sync) - C:\Users\Lucich\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajpgkpeckebdhofmmjfgcjjiiejpodla [2012-04-07]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Lucich\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-20]
CHR Extension: (WOT) - C:\Users\Lucich\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp [2012-04-07]
CHR Extension: (YouTube) - C:\Users\Lucich\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-04-07]
CHR Extension: (Adblock Plus) - C:\Users\Lucich\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2012-04-07]
CHR Extension: (Google Search) - C:\Users\Lucich\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-04-07]
CHR Extension: (Silver Bird) - C:\Users\Lucich\AppData\Local\Google\Chrome\User Data\Default\Extensions\encaiiljifbdbjlphpgpiimidegddhic [2012-04-07]
CHR Extension: (FlashBlock) - C:\Users\Lucich\AppData\Local\Google\Chrome\User Data\Default\Extensions\gofhjkjmkpinhpoiabjplobcaignabnl [2012-04-07]
CHR Extension: (LastPass: Free Password Manager) - C:\Users\Lucich\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2012-04-08]
CHR Extension: (Google Mail Checker) - C:\Users\Lucich\AppData\Local\Google\Chrome\User Data\Default\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff [2012-04-08]
CHR Extension: (Google Wallet) - C:\Users\Lucich\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21]
CHR Extension: (Gmail) - C:\Users\Lucich\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-04-07]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2013-10-09]
StartMenuInternet: Google Chrome - C:\Users\Lucich\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S4 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
R2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173192 2013-06-27] (Microsoft Corp.)
S4 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [270336 2012-07-13] (Brother Industries, Ltd.) [File not signed]
R2 gzserv; C:\Program Files\Bitdefender\Antivirus Free Edition\gzserv.exe [69368 2013-10-23] (Bitdefender)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
S4 LeapFrog Connect Device Service; C:\Program Files (x86)\LeapFrog\LeapFrog Connect\CommandService.exe [7391232 2013-07-23] (LeapFrog Enterprises, Inc.) [File not signed]
S4 NETGEARGenieDaemon; C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenieDaemon64.exe [232192 2014-11-06] (NETGEAR)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 A2DDA; C:\EEK\BIN\a2ddax64.sys [26176 2015-01-20] (Emsisoft GmbH)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [718840 2013-04-17] (BitDefender)
U5 avchv; C:\Windows\System32\Drivers\avchv.sys [261056 2015-01-08] (BitDefender)
R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [593144 2013-04-17] (BitDefender)
R1 bdfwfpf; C:\Program Files\Bitdefender\Antivirus Free Edition\bdfwfpf.sys [121928 2013-07-02] (Bitdefender SRL)
S3 cleanhlp; C:\EEK\bin\cleanhlp64.sys [57024 2015-01-20] (Emsisoft GmbH)
R1 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [148696 2013-04-22] (BitDefender LLC)
S3 MEMSWEEP2; C:\windows\system32\190C.tmp [6144 2010-05-26] (Sophos Plc) [File not signed]
R1 RawDisk3; C:\windows\system32\drivers\rawdsk3.sys [32912 2014-08-12] (EldoS Corporation)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [35064 2015-02-03] ()
R0 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [382536 2015-01-08] (BitDefender S.R.L.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-03 14:07 - 2015-02-03 14:07 - 00017795 _____ () C:\Users\Lucich\Downloads\FRST.txt
2015-02-03 14:06 - 2015-02-03 14:07 - 00000000 ____D () C:\FRST
2015-02-03 14:06 - 2015-02-03 14:06 - 02131456 _____ (Farbar) C:\Users\Lucich\Downloads\FRST64.exe
2015-02-03 12:17 - 2015-02-03 12:17 - 01943800 _____ (Bleeping Computer, LLC) C:\Users\Lucich\Downloads\rkill.exe
2015-02-03 12:14 - 2015-02-03 12:14 - 00033240 _____ () C:\ComboFix.txt
2015-02-03 11:39 - 2011-06-25 22:45 - 00256000 _____ () C:\windows\PEV.exe
2015-02-03 11:39 - 2010-11-07 09:20 - 00208896 _____ () C:\windows\MBR.exe
2015-02-03 11:39 - 2009-04-19 20:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2015-02-03 11:39 - 2000-08-30 16:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2015-02-03 11:39 - 2000-08-30 16:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2015-02-03 11:39 - 2000-08-30 16:00 - 00098816 _____ () C:\windows\sed.exe
2015-02-03 11:39 - 2000-08-30 16:00 - 00080412 _____ () C:\windows\grep.exe
2015-02-03 11:39 - 2000-08-30 16:00 - 00068096 _____ () C:\windows\zip.exe
2015-02-03 11:38 - 2015-02-03 12:14 - 00000000 ____D () C:\Qoobox
2015-02-03 11:37 - 2015-02-03 12:12 - 00000000 ____D () C:\windows\erdnt
2015-02-03 08:19 - 2015-02-03 13:49 - 00000000 ____D () C:\Program Files\FreeFixer
2015-02-03 08:19 - 2015-02-03 08:34 - 00000000 ____D () C:\Users\Lucich\AppData\Roaming\FreeFixer
2015-02-03 08:19 - 2015-02-03 08:25 - 00000000 ____D () C:\Users\Lucich\AppData\Local\FreeFixer
2015-02-03 08:18 - 2015-02-03 08:18 - 02666167 _____ (Kephyr) C:\Users\Lucich\Downloads\freefixersetup.exe
2015-02-03 07:52 - 2015-02-03 07:52 - 05198336 _____ (AVAST Software) C:\Users\Lucich\Downloads\aswMBR.exe
2015-02-03 06:18 - 2015-02-03 07:59 - 00035064 _____ () C:\windows\system32\Drivers\TrueSight.sys
2015-02-03 06:18 - 2015-02-03 06:18 - 15431256 _____ () C:\Users\Lucich\Downloads\RogueKiller.exe
2015-02-03 06:18 - 2015-02-03 06:18 - 00000000 ____D () C:\ProgramData\RogueKiller
2015-02-02 21:48 - 2015-02-02 21:50 - 37987520 _____ (Microsoft Corporation) C:\Users\Lucich\Downloads\Windows-KB890830-x64-V5.20.exe
2015-02-02 21:18 - 2015-02-02 21:18 - 01048576 _____ () C:\Users\Lucich\Downloads\msert(2).exe
2015-01-30 07:38 - 2015-01-30 07:38 - 00001755 _____ () C:\Users\Public\Desktop\iTunes.lnk
2015-01-30 07:38 - 2015-01-30 07:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-01-30 07:38 - 2015-01-30 07:38 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-01-30 07:38 - 2015-01-30 07:38 - 00000000 ____D () C:\Program Files\iTunes
2015-01-30 07:38 - 2015-01-30 07:38 - 00000000 ____D () C:\Program Files\iPod
2015-01-30 07:38 - 2015-01-30 07:38 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-01-28 20:04 - 2015-02-03 13:46 - 00000000 ____D () C:\Users\Lucich\AppData\Roaming\Raptr
2015-01-28 20:04 - 2015-01-28 20:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved
2015-01-28 19:59 - 2015-01-28 19:59 - 00192816 _____ () C:\Users\Lucich\Downloads\raptr_installer(2).exe
2015-01-27 14:09 - 2015-01-27 14:09 - 00002054 _____ () C:\Users\Lucich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FileHippo App Manager.lnk
2015-01-27 14:08 - 2015-01-27 14:08 - 00849352 _____ () C:\Users\Lucich\Downloads\AppManagerSetup_1.47.exe
2015-01-27 13:51 - 2015-01-27 13:51 - 00001596 _____ () C:\Users\Lucich\Downloads\sg_backup_2015-01-27-1351.spg
2015-01-22 22:18 - 2015-01-22 22:18 - 05227019 _____ () C:\Users\Lucich\Downloads\namebench-1.3.1-Windows(3).exe
2015-01-22 20:59 - 2015-01-22 20:59 - 05227019 _____ () C:\Users\Lucich\Downloads\namebench-1.3.1-Windows(2).exe
2015-01-22 11:28 - 2015-01-22 11:28 - 00001595 _____ () C:\Users\Lucich\Downloads\sg_backup_2015-01-22-1128.spg
2015-01-21 18:10 - 2015-01-21 18:10 - 00001595 _____ () C:\Users\Lucich\Downloads\sg_backup_2015-01-21-1810.spg
2015-01-21 05:20 - 2015-01-21 05:23 - 05227019 _____ () C:\Users\Lucich\Downloads\namebench-1.3.1-Windows(1).exe
2015-01-20 23:04 - 2015-01-20 23:04 - 1964355291 _____ () C:\windows\MEMORY.DMP
2015-01-20 23:04 - 2015-01-20 23:04 - 00283360 _____ () C:\windows\Minidump\012015-23758-01.dmp
2015-01-20 21:44 - 2015-01-20 21:44 - 04188824 _____ (Kaspersky Lab ZAO) C:\Users\Lucich\Downloads\tdsskiller.exe
2015-01-20 21:04 - 2015-01-20 21:06 - 05227019 _____ () C:\Users\Lucich\Downloads\namebench-1.3.1-Windows.exe
2015-01-20 16:32 - 2015-02-03 00:35 - 02186752 _____ () C:\Users\Lucich\Downloads\AdwCleaner.exe
2015-01-20 16:32 - 2015-01-20 17:18 - 00000000 ____D () C:\AdwCleaner
2015-01-20 16:09 - 2015-01-20 16:09 - 05451464 _____ (Advanced Micro Devices, Inc.) C:\Users\Lucich\Downloads\autodetectutility.exe
2015-01-20 14:25 - 2015-01-20 14:25 - 00000000 ____D () C:\Users\Lucich\AppData\Roaming\EurekaLab s.a.s
2015-01-20 13:03 - 2015-01-20 13:34 - 160418440 _____ () C:\Users\Lucich\Downloads\k36ngs3m.exe
2015-01-20 12:08 - 2015-01-20 12:39 - 80985941 _____ () C:\Users\Lucich\Downloads\5fkra6dn.exe
2015-01-20 11:22 - 2015-01-20 11:45 - 121036661 _____ () C:\Users\Lucich\Downloads\j40llulf.exe
2015-01-20 08:27 - 2015-01-20 08:27 - 00000000 ____D () C:\ProgramData\Doctor Web
2015-01-20 08:13 - 2015-01-20 08:27 - 00000000 ____D () C:\Users\Lucich\Doctor Web
2015-01-20 07:55 - 2015-01-20 08:13 - 157576056 _____ () C:\Users\Lucich\Downloads\cureit.exe
2015-01-20 06:22 - 2015-01-20 06:41 - 19879101 _____ () C:\Users\Lucich\Downloads\nf80p6r5.exe
2015-01-19 22:02 - 2015-01-19 22:02 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-01-19 21:34 - 2015-01-19 21:49 - 169655840 _____ () C:\Users\Lucich\Downloads\setup_11.0.3.8.x01_2015_01_20_05_38.exe
2015-01-19 20:37 - 2015-02-03 12:19 - 00000000 ____D () C:\EEK
2015-01-19 20:10 - 2015-01-19 20:36 - 167314528 _____ () C:\Users\Lucich\Downloads\EmsisoftEmergencyKit.exe
2015-01-19 18:06 - 2015-01-19 18:27 - 173590680 _____ (Emsisoft Ltd. ) C:\Users\Lucich\Downloads\EmsisoftAntiMalwareSetup.exe
2015-01-19 16:22 - 2015-01-19 17:32 - 160381424 _____ () C:\Users\Lucich\Downloads\th7yahu2.exe
2015-01-17 20:38 - 2015-01-17 20:38 - 00000000 ____D () C:\Users\Lucich\Downloads\Leatrix_Latency_Fix_3.00
2015-01-17 20:37 - 2015-01-17 20:38 - 04956875 _____ () C:\Users\Lucich\Downloads\Leatrix_Latency_Fix_3.00.zip
2015-01-16 21:57 - 2015-01-16 21:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Simulationcraft(x64)
2015-01-16 21:43 - 2015-01-16 21:52 - 33176874 _____ (Simulationcraft ) C:\Users\Lucich\Downloads\SimcSetup-603-24-Win64.exe
2015-01-16 21:31 - 2015-01-16 21:31 - 00000000 ____D () C:\Users\Lucich\Downloads\Simulationcraft
2015-01-16 21:23 - 2015-01-16 21:31 - 30609337 _____ (Oleg N. Scherbakov) C:\Users\Lucich\Downloads\simc-603-24-win64.exe
2015-01-15 20:08 - 2015-01-15 20:11 - 20750360 _____ (NETGEAR) C:\Users\Lucich\Downloads\ReadySHAREVault-install.exe
2015-01-15 17:57 - 2015-01-21 19:09 - 00000000 ____D () C:\Users\Lucich\AppData\Local\NETGEARGenie
2015-01-15 15:22 - 2015-01-15 15:22 - 00369168 _____ (CACE Technologies, Inc.) C:\windows\system32\wpcap.dll
2015-01-15 15:22 - 2015-01-15 15:22 - 00106000 _____ (CACE Technologies, Inc.) C:\windows\system32\packet.dll
2015-01-15 15:22 - 2015-01-15 15:22 - 00035344 _____ (CACE Technologies, Inc.) C:\windows\system32\Drivers\npf.sys
2015-01-15 15:22 - 2015-01-15 15:22 - 00002068 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NETGEAR Genie.lnk
2015-01-15 15:21 - 2015-01-15 15:22 - 00000000 ____D () C:\Program Files (x86)\NETGEAR Genie
2015-01-15 15:17 - 2015-01-15 15:21 - 39256872 _____ (NETGEAR Inc.) C:\Users\Lucich\Downloads\NETGEARGenie-install.exe
2015-01-15 10:40 - 2015-01-15 10:40 - 00071576 _____ () C:\Users\Lucich\Downloads\raptr_installer(1).exe
2015-01-13 21:39 - 2015-01-13 21:39 - 00192816 _____ () C:\Users\Lucich\Downloads\raptr_installer.exe
2015-01-13 17:46 - 2014-12-18 17:46 - 00141312 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxdav.sys
2015-01-13 17:46 - 2014-12-11 21:35 - 05553592 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-01-13 17:46 - 2014-12-11 21:31 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-01-13 17:46 - 2014-12-11 21:31 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-01-13 17:46 - 2014-12-11 21:31 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-01-13 17:46 - 2014-12-11 21:11 - 03971512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2015-01-13 17:46 - 2014-12-11 21:11 - 03916728 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2015-01-13 17:46 - 2014-12-11 21:07 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2015-01-13 17:45 - 2014-12-18 19:06 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\profsvc.dll
2015-01-13 17:45 - 2014-12-11 09:47 - 00087040 _____ (Microsoft Corporation) C:\windows\system32\TSWbPrxy.exe
2015-01-13 17:45 - 2014-12-05 20:17 - 00303616 _____ (Microsoft Corporation) C:\windows\system32\nlasvc.dll
2015-01-13 17:45 - 2014-12-05 19:50 - 00156672 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncsi.dll
2015-01-13 17:45 - 2014-12-05 19:50 - 00052224 _____ (Microsoft Corporation) C:\windows\SysWOW64\nlaapi.dll
2015-01-13 08:24 - 2015-01-26 11:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-13 06:09 - 2015-01-13 06:09 - 00001596 _____ () C:\Users\Lucich\Downloads\sg_backup_2015-01-13-0609.spg
2015-01-13 06:05 - 2015-01-13 06:05 - 00000000 ____D () C:\Program Files (x86)\Badosoft
2015-01-13 06:00 - 2015-01-13 06:01 - 08166912 _____ () C:\Users\Lucich\Downloads\Latency Optimizer.msi
2015-01-13 05:55 - 2015-01-13 05:55 - 00001596 _____ () C:\Users\Lucich\Downloads\sg_backup_2015-01-13-0555.spg
2015-01-12 22:09 - 2015-01-12 22:09 - 00000406 _____ () C:\windows\system32\ioloBootDefrag.cfg
2015-01-12 22:07 - 2015-01-12 22:07 - 00003148 _____ () C:\windows\System32\Tasks\SidebarExecute
2015-01-12 22:06 - 2015-01-12 22:06 - 00000000 ____D () C:\iolo
2015-01-12 22:06 - 2014-08-13 18:39 - 43462256 _____ (iolo technologies, LLC ) C:\Users\Lucich\Downloads\SystemMechanic.exe
2015-01-12 22:06 - 2014-08-12 23:38 - 00032912 _____ (EldoS Corporation) C:\windows\system32\Drivers\rawdsk3.sys
2015-01-12 22:01 - 2015-01-12 22:01 - 00585912 _____ () C:\Users\Lucich\Downloads\smfree_dm.exe
2015-01-12 21:33 - 2015-01-12 21:33 - 00001596 _____ () C:\Users\Lucich\Downloads\sg_backup_2015-01-12-2133.spg
2015-01-12 21:32 - 2015-01-12 21:32 - 00001611 _____ () C:\Users\Lucich\Downloads\sg_backup_2015-01-12-2132.spg
2015-01-12 21:32 - 2015-01-12 21:32 - 00001611 _____ () C:\Users\Lucich\Downloads\FirstBackup.spg
2015-01-12 21:29 - 2015-01-12 21:29 - 00001611 _____ () C:\Users\Lucich\Downloads\current.spg
2015-01-12 21:28 - 2015-01-12 21:28 - 00659456 _____ (Speed Guide Inc.) C:\Users\Lucich\Downloads\TCPOptimizer.exe
2015-01-12 21:19 - 2010-05-26 10:39 - 00006144 ____N (Sophos Plc) C:\windows\system32\190C.tmp
2015-01-12 21:16 - 2015-01-15 12:11 - 00000000 ____D () C:\Program Files (x86)\Sophos
2015-01-12 21:16 - 2015-01-12 21:16 - 01376832 _____ () C:\Users\Lucich\Downloads\sar_15_sfx.exe
2015-01-12 21:16 - 2010-05-26 10:39 - 00006144 ____N (Sophos Plc) C:\windows\system32\4578.tmp
2015-01-12 15:46 - 2015-01-12 15:49 - 00116736 _____ () C:\Users\Lucich\Downloads\OpenDNSDiagnostic-1.4.1.exe
2015-01-11 13:09 - 2015-01-11 13:10 - 00180226 _____ () C:\Users\Lucich\Downloads\gateway_settings.gws
2015-01-11 13:02 - 2015-01-11 13:03 - 01395521 _____ () C:\Users\Lucich\Downloads\DIR-655_REVA_FIRMWARE_1.37.ZIP
2015-01-11 13:00 - 2015-01-16 21:57 - 00000000 ____D () C:\Simulationcraft(x64)
2015-01-11 13:00 - 2015-01-11 13:00 - 00000000 ____D () C:\Users\Lucich\AppData\Local\SimulationCraft
2015-01-11 12:39 - 2015-01-11 12:57 - 40478168 _____ (Simulationcraft ) C:\Users\Lucich\Downloads\SimcSetup-603-22-Win64.exe
2015-01-08 20:59 - 2015-01-15 21:57 - 00000000 ____D () C:\ProgramData\Malwarebytes Anti-Exploit
2015-01-08 20:58 - 2015-01-08 20:59 - 02967032 _____ (Malwarebytes ) C:\Users\Lucich\Downloads\mbae-setup-1.05.1.1016.exe
2015-01-08 20:40 - 2015-02-03 12:21 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-08 20:40 - 2015-01-08 20:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-01-08 20:40 - 2015-01-08 20:40 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-01-08 20:40 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-01-08 20:40 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-01-08 20:40 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2015-01-08 09:22 - 2015-01-08 09:24 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Lucich\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-08 06:46 - 2015-01-08 06:46 - 00382536 _____ (BitDefender S.R.L.) C:\windows\system32\Drivers\trufos.sys
2015-01-08 06:46 - 2015-01-08 06:46 - 00261056 _____ (BitDefender) C:\windows\system32\Drivers\avchv.sys
2015-01-08 06:27 - 2015-01-08 06:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antivirus Free Edition
2015-01-08 06:27 - 2013-04-17 14:59 - 00718840 _____ (BitDefender) C:\windows\system32\Drivers\avc3.sys
2015-01-08 06:27 - 2013-04-17 14:59 - 00593144 _____ (BitDefender) C:\windows\system32\Drivers\avckf.sys
2015-01-08 06:27 - 2012-11-02 14:17 - 00261056 _____ (BitDefender) C:\windows\system32\Drivers\SETD0F5.tmp
2015-01-08 06:27 - 2009-07-15 01:21 - 01721576 _____ (Microsoft Corporation) C:\windows\system32\WdfCoInstaller01009.dll
2015-01-08 06:23 - 2015-01-08 06:27 - 00000000 ____D () C:\Program Files\Bitdefender
2015-01-08 06:23 - 2013-04-22 13:21 - 00148696 _____ (BitDefender LLC) C:\windows\system32\Drivers\gzflt.sys
2015-01-07 20:21 - 2015-01-07 20:21 - 00010471 _____ () C:\Users\Lucich\Downloads\hijackthis.log
2015-01-07 20:20 - 2015-01-07 20:21 - 00388608 _____ (Trend Micro Inc.) C:\Users\Lucich\Downloads\HijackThis.exe
2015-01-07 13:31 - 2015-01-07 13:31 - 00000000 ____D () C:\Users\Lucich\AppData\Roaming\LavasoftStatistics
2015-01-07 13:27 - 2015-01-08 06:23 - 00000000 ____D () C:\Users\Lucich\AppData\Roaming\QuickScan
2015-01-07 13:26 - 2015-01-08 06:23 - 10447328 _____ () C:\Users\Lucich\Downloads\Antivirus_Free_Edition_x64.exe
2015-01-07 13:26 - 2015-01-07 13:26 - 00162208 _____ () C:\Users\Lucich\Downloads\Antivirus_Free_Edition.exe
2015-01-07 13:14 - 2015-01-07 13:14 - 01924232 _____ () C:\Users\Lucich\Downloads\Adaware_Installer.exe
2015-01-07 12:51 - 2015-01-07 12:59 - 36904648 _____ (Microsoft Corporation) C:\Users\Lucich\Downloads\Windows-KB890830-x64-V5.19.exe
2015-01-07 12:45 - 2015-01-07 12:58 - 90445839 _____ () C:\Users\Lucich\Downloads\msert(1).exe
2015-01-07 11:39 - 2015-01-07 11:39 - 00000000 ____D () C:\Users\Lucich\AppData\Local\Macromedia
2015-01-07 08:57 - 2015-01-27 14:01 - 00001153 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-01-07 08:57 - 2015-01-27 08:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-07 08:57 - 2015-01-07 08:57 - 00001165 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-01-07 08:57 - 2015-01-07 08:57 - 00000000 ____D () C:\Users\Lucich\AppData\Local\Mozilla
2015-01-07 08:57 - 2015-01-07 08:57 - 00000000 ____D () C:\ProgramData\Mozilla
2015-01-07 08:52 - 2015-01-07 08:52 - 00244104 _____ () C:\Users\Lucich\Downloads\Firefox Setup Stub 34.0.5.exe
2015-01-04 19:17 - 2013-09-13 18:38 - 00646313 _____ () C:\windows\system32\Drivers\RTAIODAT.DAT
2015-01-04 19:17 - 2013-09-13 17:54 - 03641688 _____ (Realtek Semiconductor Corp.) C:\windows\system32\Drivers\RTKVHD64.sys
2015-01-04 19:17 - 2013-09-13 13:23 - 32882688 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RCoRes64.dat
2015-01-04 19:17 - 2013-09-12 18:23 - 00149208 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RCoInstII64.dll
2015-01-04 19:17 - 2013-09-12 17:03 - 02586840 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RtkAPO64.dll
2015-01-04 19:17 - 2013-09-09 14:32 - 05681192 _____ () C:\windows\system32\Drivers\rtvienna.dat
2015-01-04 19:17 - 2013-09-05 16:23 - 04933328 _____ (ASUSTeKcomputer.Inc Inc) C:\windows\system32\RTKSMlfx.dll
2015-01-04 19:17 - 2013-09-05 16:22 - 00848184 _____ (ASUSTeKcomputer.Inc Inc) C:\windows\system32\RTKSMSettingsIPC.dll
2015-01-04 19:17 - 2013-09-03 13:49 - 14151936 _____ (Waves Audio Ltd.) C:\windows\system32\MaxxAudioRealtek64.dll
2015-01-04 19:17 - 2013-09-03 13:49 - 02103040 _____ (Waves Audio Ltd.) C:\windows\system32\WavesGUILib64.dll
2015-01-04 19:17 - 2013-09-03 13:49 - 02036992 _____ (Waves Audio Ltd.) C:\windows\system32\MaxxAudioEQ64.dll
2015-01-04 19:17 - 2013-09-03 13:49 - 01344256 _____ (Waves Audio Ltd.) C:\windows\system32\MaxxAudioAPO5064.dll
2015-01-04 19:17 - 2013-09-03 13:48 - 27643648 _____ (Waves Audio Ltd.) C:\windows\system32\MaxxAudioVnA64.dll
2015-01-04 19:17 - 2013-09-03 13:48 - 03713280 _____ (Waves Audio Ltd.) C:\windows\system32\MaxxAudioVnN64.dll
2015-01-04 19:17 - 2013-09-03 13:48 - 01921792 _____ (Waves Audio Ltd.) C:\windows\system32\MaxxAudioRealtek264.dll
2015-01-04 19:17 - 2013-09-03 13:47 - 01011968 _____ (Waves Audio Ltd.) C:\windows\system32\MaxxAudioAPOShell64.dll
2015-01-04 19:17 - 2013-08-24 02:14 - 01014016 _____ (SRS Labs, Inc.) C:\windows\system32\slcnt64.dll
2015-01-04 19:17 - 2013-08-24 02:14 - 00897792 _____ (DTS, Inc.) C:\windows\system32\sl3apo64.dll
2015-01-04 19:17 - 2013-08-24 02:14 - 00722688 _____ (DTS, Inc.) C:\windows\system32\sltech64.dll
2015-01-04 19:17 - 2013-08-24 02:14 - 00244480 _____ (TODO: <Company name>) C:\windows\system32\slprp64.dll
2015-01-04 19:17 - 2013-08-20 19:17 - 02809048 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RtPgEx64.dll
2015-01-04 19:17 - 2013-08-20 16:37 - 00605496 _____ () C:\windows\system32\audioLibVc.dll
2015-01-04 19:17 - 2013-08-14 15:35 - 01084160 _____ (Waves Audio Ltd.) C:\windows\system32\MaxxAudioAPO4064.dll
2015-01-04 19:17 - 2013-08-14 15:35 - 00907008 _____ (Waves Audio Ltd.) C:\windows\system32\MaxxVoiceAPO2064.dll
2015-01-04 19:17 - 2013-08-07 16:41 - 00113576 _____ (Real Sound Lab SIA) C:\windows\system32\CONEQMSAPOGUILibrary.dll
2015-01-04 19:17 - 2013-08-07 16:34 - 00765184 _____ (Waves Audio Ltd.) C:\windows\system32\MaxxSpeechAPO64.dll
2015-01-04 19:17 - 2013-08-06 08:47 - 00947248 _____ (Sony Corporation) C:\windows\system32\SFSS_APO.dll
2015-01-04 19:17 - 2013-08-06 03:56 - 06219096 _____ (Dolby Laboratories) C:\windows\system32\DDPP64A.dll
2015-01-04 19:17 - 2013-08-06 03:56 - 01908568 _____ (Dolby Laboratories) C:\windows\system32\DDPD64A.dll
2015-01-04 19:17 - 2013-08-06 03:56 - 00312152 _____ (Dolby Laboratories) C:\windows\system32\DDPO64A.dll
2015-01-04 19:17 - 2013-08-06 03:56 - 00261464 _____ (Dolby Laboratories) C:\windows\system32\DDPA64.dll
2015-01-04 19:17 - 2013-08-05 17:11 - 02743328 _____ (Fortemedia Corporation) C:\windows\system32\FMAPO64.dll
2015-01-04 19:17 - 2013-08-02 19:16 - 01005784 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RtkApi64.dll
2015-01-04 19:17 - 2013-07-26 13:05 - 00617176 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RtDataProc64.dll
2015-01-04 19:17 - 2013-07-23 14:39 - 00790272 _____ (Waves Audio Ltd.) C:\windows\SysWOW64\MaxxAudioAPOShell.dll
2015-01-04 19:17 - 2013-06-05 20:42 - 00208072 _____ (Andrea Electronics Corporation) C:\windows\system32\AERTAC64.dll
2015-01-04 19:17 - 2013-04-24 16:16 - 01662024 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RTSnMg64.cpl
2015-01-04 19:17 - 2013-02-20 18:55 - 01284680 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RTCOM64.dll
2015-01-04 19:17 - 2012-10-02 13:41 - 00501192 _____ (DTS) C:\windows\system32\DTSU2PLFX64.dll
2015-01-04 19:17 - 2012-10-02 13:41 - 00487368 _____ (DTS) C:\windows\system32\DTSU2PGFX64.dll
2015-01-04 19:17 - 2012-10-02 13:41 - 00415688 _____ (DTS) C:\windows\system32\DTSU2PREC64.dll
2015-01-04 19:17 - 2012-01-30 11:43 - 00836544 _____ (TOSHIBA Corporation) C:\windows\system32\tadefxapo264.dll
2015-01-04 17:58 - 2015-01-04 19:18 - 00000000 ____D () C:\windows\SysWOW64\RTCOM
2015-01-04 17:58 - 2015-01-04 17:58 - 00000000 ____D () C:\Program Files\Realtek
2015-01-04 17:58 - 1999-12-31 16:00 - 02162992 _____ (Yamaha Corporation) C:\windows\system32\YamahaAE.dll
2015-01-04 17:58 - 1999-12-31 16:00 - 01411096 _____ (Synopsys, Inc.) C:\windows\system32\SRRPTR64.dll
2015-01-04 17:58 - 1999-12-31 16:00 - 01361336 _____ (TOSHIBA Corporation) C:\windows\system32\tosade.dll
2015-01-04 17:58 - 1999-12-31 16:00 - 00871856 _____ (TOSHIBA Corporation) C:\windows\system32\tossaeapo64.dll
2015-01-04 17:58 - 1999-12-31 16:00 - 00582056 _____ (TOSHIBA Corporation) C:\windows\system32\tosasfapo64.dll
2015-01-04 17:58 - 1999-12-31 16:00 - 00518896 _____ (SRS Labs, Inc.) C:\windows\system32\SRSTSX64.dll
2015-01-04 17:58 - 1999-12-31 16:00 - 00451096 _____ (Synopsys, Inc.) C:\windows\system32\SRAPO64.dll
2015-01-04 17:58 - 1999-12-31 16:00 - 00366104 _____ (Synopsys, Inc.) C:\windows\system32\SRCOM64.dll
2015-01-04 17:58 - 1999-12-31 16:00 - 00326680 _____ (Synopsys, Inc.) C:\windows\SysWOW64\SRCOM.dll
2015-01-04 17:58 - 1999-12-31 16:00 - 00326680 _____ (Synopsys, Inc.) C:\windows\system32\SRCOM.dll
2015-01-04 17:58 - 1999-12-31 16:00 - 00211184 _____ (SRS Labs, Inc.) C:\windows\system32\SRSTSH64.dll
2015-01-04 17:58 - 1999-12-31 16:00 - 00198896 _____ (SRS Labs, Inc.) C:\windows\system32\SRSHP64.dll
2015-01-04 17:58 - 1999-12-31 16:00 - 00162224 _____ (TOSHIBA Corporation) C:\windows\system32\toseaeapo64.dll
2015-01-04 17:58 - 1999-12-31 16:00 - 00155888 _____ (SRS Labs, Inc.) C:\windows\system32\SRSWOW64.dll
2015-01-04 17:58 - 1999-12-31 16:00 - 00148416 _____ (TOSHIBA Corporation) C:\windows\system32\tadefxapo.dll
2015-01-04 17:58 - 1999-12-31 16:00 - 00065944 _____ (TOSHIBA CORPORATION.) C:\windows\system32\tepeqapo64.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 12967680 _____ (Waves Audio Ltd.) C:\windows\system32\MaxxVoiceAPO3064.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 07164176 _____ (Dolby Laboratories) C:\windows\system32\R4EEP64A.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 05234952 _____ (Nahimic Inc) C:\windows\system32\NAHIMICAPOlfx.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 02827120 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RltkAPO64.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 01756264 _____ (DTS) C:\windows\system32\DTSS2SpeakerDLL64.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 01568360 _____ (DTS) C:\windows\system32\DTSS2HeadphoneDLL64.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 01486952 _____ (DTS) C:\windows\system32\DTSBoostDLL64.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 01353472 _____ (Waves Audio Ltd.) C:\windows\system32\MaxxAudioAPO6064.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00995120 _____ (Nahimic Inc) C:\windows\system32\NahimicAPONSControl.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00906800 _____ (Sony Corporation) C:\windows\system32\MISS_APO.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00728680 _____ (DTS) C:\windows\system32\DTSBassEnhancementDLL64.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00712296 _____ (DTS) C:\windows\system32\DTSSymmetryDLL64.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00693352 _____ (DTS) C:\windows\system32\DTSVoiceClarityDLL64.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00663296 _____ (Waves Audio Ltd.) C:\windows\system32\MaxxAudioAPO30.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00662784 _____ (Waves Audio Ltd.) C:\windows\system32\MaxxVolumeSDAPO.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00603984 _____ (Knowles Acoustics ) C:\windows\system32\KAAPORT64.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00491112 _____ (DTS) C:\windows\system32\DTSNeoPCDLL64.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00434960 _____ (Dolby Laboratories) C:\windows\system32\R4EED64A.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00432744 _____ (DTS) C:\windows\system32\DTSLimiterDLL64.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00428648 _____ (DTS) C:\windows\system32\DTSGainCompensatorDLL64.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00375128 _____ (Dolby Laboratories, Inc.) C:\windows\system32\RTEEP64A.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00331880 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RtlCPAPI64.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00318808 _____ (Waves Audio Ltd.) C:\windows\system32\MaxxAudioAPO20.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00310104 _____ (Dolby Laboratories, Inc.) C:\windows\system32\RP3DHT64.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00310104 _____ (Dolby Laboratories, Inc.) C:\windows\system32\RP3DAA64.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00303776 _____ (ICEpower a/s) C:\windows\system32\ICEsoundAPO64.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00242792 _____ (DTS) C:\windows\system32\DTSLFXAPO64.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00242792 _____ (DTS) C:\windows\system32\DTSGFXAPO64.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00241768 _____ (DTS) C:\windows\system32\DTSGFXAPONS64.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00221024 _____ (Synopsys, Inc.) C:\windows\system32\SFNHK64.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00204120 _____ (Dolby Laboratories, Inc.) C:\windows\system32\RTEED64A.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00149608 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RtkCfg64.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00141584 _____ (Dolby Laboratories) C:\windows\system32\R4EEL64A.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00124176 _____ (Dolby Laboratories) C:\windows\system32\R4EEA64A.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00101208 _____ (Dolby Laboratories, Inc.) C:\windows\system32\RTEEL64A.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00081248 _____ (Synopsys, Inc.) C:\windows\system32\SFCOM64.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00078688 _____ (Synopsys, Inc.) C:\windows\system32\SFAPO64.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00078680 _____ (Dolby Laboratories, Inc.) C:\windows\system32\RTEEG64A.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00075024 _____ (Dolby Laboratories) C:\windows\system32\R4EEG64A.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00074064 _____ (Virage Logic Corporation / Sonic Focus) C:\windows\SysWOW64\SFCOM.dll
2015-01-04 17:57 - 1999-12-31 16:00 - 00014952 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RtkCoLDR64.dll
2015-01-04 17:56 - 1999-12-31 16:00 - 01550528 _____ (Conexant Systems Inc.) C:\windows\system32\CX64APO.dll
2015-01-04 17:56 - 1999-12-31 16:00 - 00109848 _____ () C:\windows\system32\AcpiServiceVnA64.dll
2015-01-04 17:56 - 1999-12-31 16:00 - 00108640 _____ (Andrea Electronics Corporation) C:\windows\system32\AERTAR64.dll
2015-01-04 17:52 - 2015-01-04 17:52 - 00000000 ____D () C:\ProgramData\Intel
2015-01-04 17:51 - 2015-01-04 17:51 - 00000000 ____D () C:\Driver_allOS
2015-01-04 17:51 - 2012-07-02 15:16 - 00062784 _____ (Intel Corporation) C:\windows\system32\Drivers\HECIx64.sys
2015-01-04 16:40 - 2015-01-04 16:40 - 00000000 ____D () C:\ProgramData\IntelDLM
2015-01-04 15:30 - 2015-01-16 15:18 - 00000000 ____D () C:\Users\Lucich\Downloads\DH67BL
2015-01-04 15:25 - 2015-01-04 17:52 - 00000000 ____D () C:\Program Files\Intel
2015-01-04 15:11 - 2014-05-02 12:02 - 00495376 _____ (Intel Corporation) C:\windows\system32\Drivers\e1c62x64.sys
2015-01-04 15:11 - 2013-07-25 03:08 - 00073480 _____ (Intel Corporation) C:\windows\system32\e1cmsg.dll
2015-01-04 15:11 - 2013-07-11 03:27 - 00089888 _____ (Intel Corporation) C:\windows\system32\NicInstC.dll
2015-01-04 15:10 - 2015-01-04 15:10 - 00000000 ____D () C:\Users\Lucich\AppData\Local\Intel
2015-01-04 15:09 - 2015-01-04 15:09 - 02333416 _____ (Intel) C:\Users\Lucich\Downloads\Intel Driver Update Utility Installer.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-03 14:04 - 2014-07-03 19:49 - 00000000 ____D () C:\Users\Lucich\AppData\Local\Battle.net
2015-02-03 13:52 - 2009-07-13 20:45 - 00031568 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-03 13:52 - 2009-07-13 20:45 - 00031568 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-03 13:48 - 2012-04-07 11:46 - 01744024 _____ () C:\windows\WindowsUpdate.log
2015-02-03 13:44 - 2014-11-08 13:29 - 00000000 ___RD () C:\Users\Lucich\iCloudDrive
2015-02-03 13:43 - 2014-11-09 01:00 - 00015154 _____ () C:\windows\setupact.log
2015-02-03 13:43 - 2012-04-11 08:48 - 00000894 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-03 13:43 - 2009-07-13 21:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-02-03 13:28 - 2012-06-10 15:43 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-02-03 12:14 - 2009-07-13 19:20 - 00000000 __RHD () C:\Users\Default
2015-02-03 12:06 - 2009-07-13 18:34 - 00000215 _____ () C:\windows\system.ini
2015-02-03 12:04 - 2014-11-09 07:04 - 00437724 _____ () C:\windows\PFRO.log
2015-02-03 12:04 - 2009-07-13 18:34 - 82837504 _____ () C:\windows\system32\config\software.bak
2015-02-03 12:04 - 2009-07-13 18:34 - 20185088 _____ () C:\windows\system32\config\system.bak
2015-02-03 12:04 - 2009-07-13 18:34 - 01048576 _____ () C:\windows\system32\config\default.bak
2015-02-03 12:04 - 2009-07-13 18:34 - 00262144 _____ () C:\windows\system32\config\security.bak
2015-02-03 12:04 - 2009-07-13 18:34 - 00262144 _____ () C:\windows\system32\config\sam.bak
2015-02-02 21:15 - 2012-04-07 18:51 - 00000860 _____ () C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1986158769-1579731180-1314620784-1000Core.job
2015-02-02 11:40 - 2012-04-08 06:43 - 00000000 ____D () C:\ProgramData\TEMP
2015-02-02 11:40 - 2012-04-08 06:43 - 00000000 ____D () C:\Program Files (x86)\SpywareBlaster
2015-02-01 22:35 - 2013-07-21 04:38 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft
2015-02-01 11:49 - 2014-03-30 10:57 - 00000000 ____D () C:\Users\Lucich\AppData\Roaming\SimulationCraft
2015-01-31 18:50 - 2012-04-07 18:55 - 00002378 _____ () C:\Users\Lucich\Desktop\Google Chrome.lnk
2015-01-30 20:33 - 2014-05-17 12:23 - 00000000 ____D () C:\Program Files (x86)\Raptr
2015-01-30 07:38 - 2012-04-07 19:05 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-01-29 11:55 - 2012-04-09 08:09 - 00000000 ____D () C:\Users\Lucich\AppData\Roaming\vlc
2015-01-27 20:15 - 2013-10-17 13:10 - 00000000 ____D () C:\ProgramData\Oracle
2015-01-27 20:15 - 2012-04-08 11:12 - 00000000 ____D () C:\Program Files (x86)\Java
2015-01-27 20:14 - 2014-10-16 12:36 - 00272296 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2015-01-27 20:14 - 2014-10-16 12:36 - 00176552 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2015-01-27 20:14 - 2014-10-16 12:36 - 00176552 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2015-01-27 20:14 - 2014-10-16 12:36 - 00098216 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2015-01-27 14:09 - 2012-04-08 06:42 - 00000000 ___RD () C:\Users\Lucich\Desktop\Security
2015-01-27 08:07 - 2012-06-10 15:43 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-01-27 08:07 - 2012-06-10 15:43 - 00003768 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-01-27 08:07 - 2012-06-01 13:16 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-20 23:04 - 2014-05-28 20:33 - 00000000 ____D () C:\windows\Minidump
2015-01-20 22:05 - 2013-09-24 09:23 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-20 21:53 - 2013-11-08 08:47 - 00007607 _____ () C:\Users\Lucich\AppData\Local\resmon.resmoncfg
2015-01-20 21:39 - 2009-07-13 21:08 - 00032562 _____ () C:\windows\Tasks\SCHEDLGU.TXT
2015-01-20 15:43 - 2012-04-07 11:47 - 00000000 ____D () C:\Users\Lucich
2015-01-20 13:20 - 2009-07-13 21:13 - 00782510 _____ () C:\windows\system32\PerfStringBackup.INI
2015-01-18 17:14 - 2009-07-13 19:20 - 00000000 ____D () C:\windows\system32\NDF
2015-01-18 14:06 - 2014-12-29 13:00 - 00000000 ____D () C:\Users\Lucich\AppData\Local\Windows Live
2015-01-16 15:18 - 2011-11-08 13:50 - 00000000 ____D () C:\Program Files (x86)\Intel
2015-01-15 12:09 - 2012-04-13 14:21 - 00000000 ____D () C:\Users\Lucich\AppData\Roaming\mjusbsp
2015-01-13 17:57 - 2012-04-07 17:07 - 00766376 _____ () C:\windows\SysWOW64\PerfStringBackup.INI
2015-01-13 17:55 - 2013-07-10 16:31 - 00000000 ____D () C:\windows\system32\MRT
2015-01-12 22:36 - 2012-04-11 08:49 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-01-12 22:36 - 2009-07-13 21:32 - 00000000 ____D () C:\windows\Offline Web Pages
2015-01-11 12:28 - 2014-12-09 03:03 - 00000000 ____D () C:\Users\Lucich\Downloads\simc-603-16-win64
2015-01-08 06:05 - 2012-04-07 17:07 - 00001945 _____ () C:\windows\epplauncher.mif
2015-01-07 20:21 - 2012-04-07 11:47 - 00000000 ____D () C:\Users\Lucich\AppData\Local\VirtualStore
2015-01-07 12:18 - 2014-09-15 06:23 - 00000000 ____D () C:\Users\Lucich\AppData\Local\Adobe
2015-01-07 08:57 - 2012-08-26 07:33 - 00000000 ____D () C:\Users\Lucich\AppData\Roaming\Mozilla
2015-01-04 19:19 - 2011-11-08 13:52 - 00000000 ___HD () C:\Program Files (x86)\Temp
2015-01-04 17:56 - 2011-11-08 13:52 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-01-04 15:24 - 2014-05-19 11:36 - 00000148 _____ () C:\windows\system32\WmiConf.txt

==================== Files in the root of some directories =======

2013-11-08 08:47 - 2015-01-20 21:53 - 0007607 _____ () C:\Users\Lucich\AppData\Local\resmon.resmoncfg
2014-05-19 12:13 - 2014-05-19 12:13 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-03 07:20

==================== End Of Log ============================

Attached Files



BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 40,190 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:58 PM

Posted 06 February 2015 - 09:37 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===
Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below.
 
start

CloseProcesses:

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1986158769-1579731180-1314620784-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
CHR Extension: (Google Wallet) - C:\Users\Lucich\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
CustomCLSID: HKU\S-1-5-21-1986158769-1579731180-1314620784-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InprocServer32 -> C:\Users\Lucich\AppData\Roaming\moters\supna.dll () <==== ATTENTION
AlternateDataStreams: C:\ProgramData\TEMP:5C321E34
AlternateDataStreams: C:\ProgramData\TEMP:6B50FDB5
AlternateDataStreams: C:\Users\Lucich\Downloads\5fkra6dn.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\AdwCleaner.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\AppManagerSetup_1.47.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\autodetectutility.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\cureit.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\EmsisoftAntiMalwareSetup.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\EmsisoftEmergencyKit.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\FRST64.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\j40llulf.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\k36ngs3m.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\mbae-setup-1.05.1.1016.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\mbam-setup-2.0.4.1028.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\msert(2).exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\namebench-1.3.1-Windows(1).exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\namebench-1.3.1-Windows(2).exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\namebench-1.3.1-Windows(3).exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\namebench-1.3.1-Windows.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\NETGEARGenie-install.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\nf80p6r5.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\OpenDNSDiagnostic-1.4.1.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\raptr_installer(1).exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\raptr_installer(2).exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\raptr_installer.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\ReadySHAREVault-install.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\rkill.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\sar_15_sfx.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\setup_11.0.3.8.x01_2015_01_20_05_38.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\simc-603-24-win64.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\SimcSetup-603-24-Win64.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\smfree_dm.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\TCPOptimizer.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\tdsskiller.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\th7yahu2.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\Windows-KB890830-x64-V5.20.exe:BDU
C:\Users\Lucich\AppData\Roaming\moters

End
Save the files as fixlist.txt into the same folder as FRST

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

How is the computer running now?

Edited by nasdaq, 06 February 2015 - 09:42 AM.


#3 Flyguyca

Flyguyca
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:01:58 PM

Posted 06 February 2015 - 10:42 AM

Thank you for your reply,

 

The computer seems to be running normally, though sometimes this application running in task manager does disappear for a few minutes/hours before returning.  However, at this time all appears well!  Here's the log:

 

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 05-02-2015
Ran by Lucich at 2015-02-06 07:16:30 Run:1
Running from C:\Users\Lucich\Downloads
Loaded Profiles: Lucich (Available profiles: Lucich)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start

CloseProcesses:

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy
restriction <======= ATTENTION
HKU\S-1-5-21-1986158769-1579731180-1314620784-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
FF Plugin: @microsoft.com/GENUINE
 -> disabled No File
FF Plugin-x32: @microsoft.com/GENUINE
 -> disabled No File
CHR Extension: (Google Wallet) - C:\Users\Lucich\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
CustomCLSID: HKU\S-1-5-21-1986158769-1579731180-1314620784-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InprocServer32 -> C:\Users\Lucich\AppData\Roaming\moters\supna.dll () <==== ATTENTION
AlternateDataStreams: C:\ProgramData\TEMP:5C321E34
AlternateDataStreams:
C:\ProgramData\TEMP:6B50FDB5
AlternateDataStreams: C:\Users\Lucich\Downloads\5fkra6dn.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\AdwCleaner.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\AppManagerSetup_1.47.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\autodetectutility.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\cureit.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\EmsisoftAntiMalwareSetup.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\EmsisoftEmergencyKit.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\FRST64.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\j40llulf.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\k36ngs3m.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\mbae-setup-1.05.1.1016.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\mbam-setup-2.0.4.1028.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\msert(2).exe:BDU
AlternateDataStreams:
C:\Users\Lucich\Downloads\namebench-1.3.1-Windows(1).exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\namebench-1.3.1-Windows(2).exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\namebench-1.3.1-Windows(3).exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\namebench-1.3.1-Windows.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\NETGEARGenie-install.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\nf80p6r5.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\OpenDNSDiagnostic-1.4.1.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\raptr_installer(1).exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\raptr_installer(2).exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\raptr_installer.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\ReadySHAREVault-install.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\rkill.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\sar_15_sfx.exe:BDU
AlternateDataStreams:
C:\Users\Lucich\Downloads\setup_11.0.3.8.x01_2015_01_20_05_38.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\simc-603-24-win64.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\SimcSetup-603-24-Win64.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\smfree_dm.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\TCPOptimizer.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\tdsskiller.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\th7yahu2.exe:BDU
AlternateDataStreams: C:\Users\Lucich\Downloads\Windows-KB890830-x64-V5.20.exe:BDU
C:\Users\Lucich\AppData\Roaming\moters

End
*****************

Processes closed successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy => Error: No automatic fix found for this entry.
restriction <======= ATTENTION => Error: No automatic fix found for this entry.
"HKU\S-1-5-21-1986158769-1579731180-1314620784-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKLM\Software\MozillaPlugins\FF Plugin: @microsoft.com/GENUINE => Key not found.
"FF Plugin: @microsoft.com/GENUINE" => not found.
-> disabled No File => Error: No automatic fix found for this entry.
HKLM\Software\Wow6432Node\MozillaPlugins\FF Plugin-x32: @microsoft.com/GENUINE => Key not found.
FF Plugin-x32: @microsoft.com/GENUINE not found.
-> disabled No File => Error: No automatic fix found for this entry.
C:\Users\Lucich\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda => Moved successfully.
catchme => Service deleted successfully.
"HKU\S-1-5-21-1986158769-1579731180-1314620784-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}" => Key deleted successfully.
C:\ProgramData\TEMP => ":5C321E34" ADS removed successfully.
AlternateDataStreams: => Error: No automatic fix found for this entry.
Could not move "C:\ProgramData\TEMP:6B50FDB5" => Scheduled to move on reboot.
C:\Users\Lucich\Downloads\5fkra6dn.exe => ":BDU" ADS removed successfully.
"C:\Users\Lucich\Downloads\AdwCleaner.exe" => ":BDU" ADS not found.
C:\Users\Lucich\Downloads\AppManagerSetup_1.47.exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\autodetectutility.exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\cureit.exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\EmsisoftAntiMalwareSetup.exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\EmsisoftEmergencyKit.exe => ":BDU" ADS removed successfully.
"C:\Users\Lucich\Downloads\FRST64.exe" => ":BDU" ADS not found.
C:\Users\Lucich\Downloads\j40llulf.exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\k36ngs3m.exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\mbae-setup-1.05.1.1016.exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\mbam-setup-2.0.4.1028.exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\msert(2).exe => ":BDU" ADS removed successfully.
AlternateDataStreams: => Error: No automatic fix found for this entry.
Could not move "C:\Users\Lucich\Downloads\namebench-1.3.1-Windows(1).exe:BDU" => Scheduled to move on reboot.
C:\Users\Lucich\Downloads\namebench-1.3.1-Windows(2).exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\namebench-1.3.1-Windows(3).exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\namebench-1.3.1-Windows.exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\NETGEARGenie-install.exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\nf80p6r5.exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\OpenDNSDiagnostic-1.4.1.exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\raptr_installer(1).exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\raptr_installer(2).exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\raptr_installer.exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\ReadySHAREVault-install.exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\rkill.exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\sar_15_sfx.exe => ":BDU" ADS removed successfully.
AlternateDataStreams: => Error: No automatic fix found for this entry.
Could not move "C:\Users\Lucich\Downloads\setup_11.0.3.8.x01_2015_01_20_05_38.exe:BDU" => Scheduled to move on reboot.
C:\Users\Lucich\Downloads\simc-603-24-win64.exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\SimcSetup-603-24-Win64.exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\smfree_dm.exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\TCPOptimizer.exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\tdsskiller.exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\th7yahu2.exe => ":BDU" ADS removed successfully.
C:\Users\Lucich\Downloads\Windows-KB890830-x64-V5.20.exe => ":BDU" ADS removed successfully.
"C:\Users\Lucich\AppData\Roaming\moters" => File/Directory not found.

=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2015-02-06 07:18:37)<=

"C:\ProgramData\TEMP:6B50FDB5" => File could not move.
"C:\Users\Lucich\Downloads\namebench-1.3.1-Windows(1).exe:BDU" => File could not move.
"C:\Users\Lucich\Downloads\setup_11.0.3.8.x01_2015_01_20_05_38.exe:BDU" => File could not move.

==== End of Fixlog 07:18:37 ====



#4 nasdaq

nasdaq

  • Malware Response Team
  • 40,190 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:58 PM

Posted 07 February 2015 - 08:21 AM

Download Security Check by screen317 from here
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
p.s.
If the SecurityCheck program fails to run for any reason, run it as an Administrator.

If the site is busy or not available use this mirror site:
http://www.bleepingcomputer.com/download/securitycheck/

How is the computer running now?

======

#5 Flyguyca

Flyguyca
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:01:58 PM

Posted 07 February 2015 - 09:54 AM

Thanks for the quick reply nasdaq,

 

Here's the results of the securitycheck scan:

 

 Results of screen317's Security Check version 0.99.96  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled!  
Bitdefender Antivirus Free Edition   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:`````````
 SpywareBlaster 5.0    
 Java 8 Update 31  
 Java version 32-bit out of Date!
  Java 64-bit 8 Update 31  
 Adobe Flash Player 16.0.0.305  
 Adobe Reader 9  
 Adobe Reader XI  
 Mozilla Firefox (35.0.1)
 Google Chrome (40.0.2214.111)
 Google Chrome (40.0.2214.94)
````````Process Check: objlist.exe by Laurent````````  
 Bitdefender Antivirus Free Edition gzserv.exe  
 Bitdefender Antivirus Free Edition gziface.exe  
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````



#6 nasdaq

nasdaq

  • Malware Response Team
  • 40,190 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:58 PM

Posted 07 February 2015 - 01:41 PM

You have the latest version of Java for both the 32 and 64 bit programs.

If all is well.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe.
http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/
===

#7 Flyguyca

Flyguyca
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:01:58 PM

Posted 07 February 2015 - 03:08 PM

Hi Nasdaq,
 

Yes the computer seems to be running just fine.  Thank you for the help!



#8 nasdaq

nasdaq

  • Malware Response Team
  • 40,190 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:58 PM

Posted 08 February 2015 - 08:15 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users