Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected by Win32.Yonton.sze etc and don't know how to get rid of - plz help


  • This topic is locked This topic is locked
2 replies to this topic

#1 Rapanui

Rapanui

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:07:06 PM

Posted 29 April 2015 - 04:23 AM

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-04-2015
Ran by Victoria (administrator) on VICTORIA on 29-04-2015 07:44:51
Running from C:\Users\Victoria\Desktop
Loaded Profiles: Victoria (Available profiles: Victoria)
Platform: Windows 8.1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Softex Inc.) C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Fuyu LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(Just Develop It) C:\Program Files (x86)\MyPC Backup\BackupStack.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Reimage®) C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe
() C:\Program Files\Reimage\Reimage Protector\ReiSystem.exe
() C:\Program Files (x86)\Solution Real\updateSolutionReal.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\wmi64.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe
(Google Inc.) C:\Users\Victoria\AppData\Local\Google\Update\GoogleUpdate.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(© 2015 Microsoft Corporation) C:\Users\Victoria\AppData\Local\Microsoft\BingSvc\BingSvc.exe
(Pay By Ads LTD) C:\Users\Victoria\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.25.0\dsrlte.exe
(MyPCBackup.com) C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(APN LLC.) C:\Users\Victoria\AppData\Local\AskPartnerNetwork\Toolbar\Updater\IDC\IdcLdr.exe
(APN LLC.) C:\Users\Victoria\AppData\Local\AskPartnerNetwork\Toolbar\Updater\IDC\IdcLdr_x64.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
() C:\Program Files (x86)\Solution Real\bin\utilSolutionReal.exe
() C:\Program Files (x86)\Solution Real\bin\SolutionReal.BrowserAdapter64.exe
() C:\Program Files (x86)\Solution Real\bin\SolutionReal.expext.exe
() C:\Program Files (x86)\Solution Real\bin\SolutionReal.BOASHelper.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\Youcam_webcam_camera_video.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7510896 2014-01-14] (Realtek Semiconductor)
HKLM\...\Run: [SimplePass] => C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe [3962936 2014-03-29] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBroker] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe [415288 2014-03-29] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBrokerDesktop] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe [415288 2014-03-29] (Hewlett-Packard)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2803440 2013-12-13] (Synaptics Incorporated)
HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [1045304 2013-10-09] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [ApnTBMon] => C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [2004360 2015-04-28] (APN)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1039196443-4011642949-4200754541-1001\...\Run: [Google Update] => C:\Users\Victoria\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2014-12-30] (Google Inc.)
HKU\S-1-5-21-1039196443-4011642949-4200754541-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31280256 2015-04-17] (Skype Technologies S.A.)
HKU\S-1-5-21-1039196443-4011642949-4200754541-1001\...\Run: [BingSvc] => C:\Users\Victoria\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-04-07] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-1039196443-4011642949-4200754541-1001\...\Run: [Yahoo! Search] => C:\Users\Victoria\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.25.0\dsrlte.exe [644352 2015-04-28] (Pay By Ads LTD)
Startup: C:\Users\Victoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk [2014-12-30]
ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://isearch.omiga-plus.com/?type=hp&ts=1419933563&from=cor&uid=ST750LM022XHN-M750MBB_S31PJ9BF600370
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://isearch.omiga-plus.com/?type=hp&ts=1419933563&from=cor&uid=ST750LM022XHN-M750MBB_S31PJ9BF600370
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1419933563&from=cor&uid=ST750LM022XHN-M750MBB_S31PJ9BF600370&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1419933563&from=cor&uid=ST750LM022XHN-M750MBB_S31PJ9BF600370&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://isearch.omiga-plus.com/?type=hp&ts=1419933563&from=cor&uid=ST750LM022XHN-M750MBB_S31PJ9BF600370
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://isearch.omiga-plus.com/?type=hp&ts=1419933563&from=cor&uid=ST750LM022XHN-M750MBB_S31PJ9BF600370
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1419933563&from=cor&uid=ST750LM022XHN-M750MBB_S31PJ9BF600370&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1419933563&from=cor&uid=ST750LM022XHN-M750MBB_S31PJ9BF600370&q={searchTerms}
HKU\S-1-5-21-1039196443-4011642949-4200754541-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.yahoo.com/?fr=hp-ddc-bd&type=pr__alt__ddc_dsssyc_bd_com
HKU\S-1-5-21-1039196443-4011642949-4200754541-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://isearch.omiga-plus.com/?type=hp&ts=1419933563&from=cor&uid=ST750LM022XHN-M750MBB_S31PJ9BF600370
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1419933563&from=cor&uid=ST750LM022XHN-M750MBB_S31PJ9BF600370&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1419933563&from=cor&uid=ST750LM022XHN-M750MBB_S31PJ9BF600370&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1419933563&from=cor&uid=ST750LM022XHN-M750MBB_S31PJ9BF600370&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1419933563&from=cor&uid=ST750LM022XHN-M750MBB_S31PJ9BF600370&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1039196443-4011642949-4200754541-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://q.search-simple.com/?affID=pr_44d3f3e8-f796-4fdf-8d59-c9a83078543d&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1039196443-4011642949-4200754541-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://q.search-simple.com/?affID=pr_44d3f3e8-f796-4fdf-8d59-c9a83078543d&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1039196443-4011642949-4200754541-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1419933563&from=cor&uid=ST750LM022XHN-M750MBB_S31PJ9BF600370&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1039196443-4011642949-4200754541-1001 -> {DAC94A86-2CDA-45C4-A05E-AEACEB93F608} URL = http://q.search-simple.com/?affID=na&q={searchTerms}&r=257
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2015-04-28] (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2015-04-28] (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll [2015-04-28] (Kaspersky Lab ZAO)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2015-04-28] (Kaspersky Lab ZAO)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: Solution Real 1.0.0.6 -> {1bb456da-878f-44a5-b013-4bfe0ae02fce} -> C:\Program Files (x86)\Solution Real\SolutionRealbho.dll [2014-12-30] (Solution Real)
BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\SupTab\SupTab.dll [2014-12-30] (Thinknice Co. Limited)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2015-04-28] (Kaspersky Lab ZAO)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-03-09] (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2015-04-28] (Kaspersky Lab ZAO)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-04-26] (Oracle Corporation)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2015-04-28] (Kaspersky Lab ZAO)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-26] (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2015-04-28] (Kaspersky Lab ZAO)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://isearch.omiga-plus.com/?type=sc&ts=1419933563&from=cor&uid=ST750LM022XHN-M750MBB_S31PJ9BF600370

FireFox:
========
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll [2013-09-05] (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-26] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-06] (Microsoft Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2012-10-13] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1039196443-4011642949-4200754541-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Victoria\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-04-26] (Google Inc.)
FF Plugin HKU\S-1-5-21-1039196443-4011642949-4200754541-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Victoria\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-04-26] (Google Inc.)
FF HKLM-x32\...\Firefox\Extensions: [url_advisor@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2015-04-28]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2015-04-28]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2015-04-28]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2015-04-28]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2015-04-28]

Chrome:
=======
CHR DefaultSuggestURL: Default -> http://ssmsp.ask.com/query?sstype=prefix&li=ff&q={searchTerms}
CHR Profile: C:\Users\Victoria\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Shopping App by Ask) - C:\Users\Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaahaeginbdcckocjkhbciadcafnep [2015-04-26]
CHR Extension: (Ask Search) - C:\Users\Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaahlfahldnilidgnlikdckbfehhca [2015-04-26]
CHR Extension: (Ask Search) - C:\Users\Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaaiabcopkplhgaedhbloeejhhankf [2014-12-30]
CHR Extension: (Google Slides) - C:\Users\Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-12-30]
CHR Extension: (Google Docs) - C:\Users\Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-12-30]
CHR Extension: (Google Drive) - C:\Users\Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-30]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-12-30]
CHR Extension: (Kaspersky Protection) - C:\Users\Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\blbkdnmdcafmfhinpmnlhhddbepgkeaa [2015-04-28]
CHR Extension: (YouTube) - C:\Users\Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-12-30]
CHR Extension: (Google Search) - C:\Users\Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-12-30]
CHR Extension: (Kaspersky URL Advisor) - C:\Users\Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2015-04-28]
CHR Extension: (MSN Homepage & Bing Search Engine) - C:\Users\Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcfenmboojpjinhpgggodefccipikbpd [2015-04-26]
CHR Extension: (Google Sheets) - C:\Users\Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-12-30]
CHR Extension: (Safe Money) - C:\Users\Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2015-04-28]
CHR Extension: (Dangerous Websites Blocker) - C:\Users\Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2015-04-28]
CHR Extension: (Virtual Keyboard) - C:\Users\Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2015-04-28]
CHR Extension: (Solution Real) - C:\Users\Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlgcookighdffbceabehaijcollmjloe [2015-01-29]
CHR Extension: (Google Wallet) - C:\Users\Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-12-30]
CHR Extension: (Gmail) - C:\Users\Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-12-30]
CHR Extension: (Anti-Banner) - C:\Users\Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2015-04-28]
CHR HKLM\...\Chrome\Extension: [aaaaahaeginbdcckocjkhbciadcafnep] - C:\ProgramData\AskPartnerNetwork\Toolbar\Shared\CRX\aaaaahaeginbdcckocjkhbciadcafnep.crx [2015-04-29]
CHR HKLM\...\Chrome\Extension: [aaaaahlfahldnilidgnlikdckbfehhca] - C:\ProgramData\AskPartnerNetwork\Toolbar\Shared\CRX\aaaaahlfahldnilidgnlikdckbfehhca.crx [2015-04-29]
CHR HKLM\...\Chrome\Extension: [aaaaaiabcopkplhgaedhbloeejhhankf] - C:\ProgramData\AskPartnerNetwork\Toolbar\Shared\CRX\aaaaaiabcopkplhgaedhbloeejhhankf.crx [2015-04-29]
CHR HKLM\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa
CHR HKLM\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-10-15]
CHR HKU\S-1-5-21-1039196443-4011642949-4200754541-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [aaaaahaeginbdcckocjkhbciadcafnep] - C:\ProgramData\AskPartnerNetwork\Toolbar\Shared\CRX\aaaaahaeginbdcckocjkhbciadcafnep.crx [2015-04-29]
CHR HKLM-x32\...\Chrome\Extension: [aaaaahlfahldnilidgnlikdckbfehhca] - C:\ProgramData\AskPartnerNetwork\Toolbar\Shared\CRX\aaaaahlfahldnilidgnlikdckbfehhca.crx [2015-04-29]
CHR HKLM-x32\...\Chrome\Extension: [aaaaaiabcopkplhgaedhbloeejhhankf] - C:\ProgramData\AskPartnerNetwork\Toolbar\Shared\CRX\aaaaaiabcopkplhgaedhbloeejhhankf.crx [2015-04-29]
CHR HKLM-x32\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-10-15]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-10-15]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-10-15]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-10-15]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-10-15]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 7a094844; c:\Program Files (x86)\SectionAppend\SectionAppend.dll [2271232 2015-04-26] () [File not signed]
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [178568 2015-04-28] (APN LLC.)
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-15] (Kaspersky Lab ZAO)
R2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [53832 2014-11-26] (Just Develop It) <==== ATTENTION
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2014-01-14] (Hewlett-Packard Company) [File not signed]
R2 HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [1039160 2013-10-09] (Hewlett-Packard Development Company, L.P.)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-11-09] (Intel Corporation)
R2 omniserv; C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe [88064 2014-03-29] (Softex Inc.) [File not signed]
R2 ReimageRealTimeProtector; C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe [7410024 2015-01-14] (Reimage®)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [290520 2014-01-09] (Realtek Semiconductor)
R2 Update Solution Real; C:\Program Files (x86)\Solution Real\updateSolutionReal.exe [410352 2015-04-29] ()
R2 Util Solution Real; C:\Program Files (x86)\Solution Real\bin\utilSolutionReal.exe [414960 2015-04-28] ()
S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2014-04-02] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [473088 2014-12-30] (Fuyu LIMITED) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-06] (CyberLink)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2015-04-28] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29792 2015-04-28] (Kaspersky Lab)
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [115296 2015-04-28] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625760 2015-04-28] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30304 2013-10-15] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [29280 2015-04-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2013-10-15] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [65120 2015-04-28] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [178272 2015-04-28] (Kaspersky Lab ZAO)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [100312 2013-12-10] (Intel Corporation)
S3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [291544 2014-01-04] (Realtek Semiconductor Corp.)
R3 rtbth; C:\Windows\System32\drivers\rtbth.sys [1204424 2013-12-25] (Ralink Technology, Corp.)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [29936 2013-12-13] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31472 2013-12-13] (Synaptics Incorporated)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2013-07-23] (Hewlett-Packard Development Company, L.P.)
S1 {31c21995-b861-4864-ab50-4a53fbca73d4}Gw64; C:\Windows\System32\drivers\{31c21995-b861-4864-ab50-4a53fbca73d4}Gw64.sys [48784 2015-04-27] () [File not signed]
U3 McMPFSvc; No ImagePath
U3 McNaiAnn; No ImagePath
U3 mfecore; No ImagePath
U3 MSK80Service; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-29 07:44 - 2015-04-29 07:45 - 00029953 _____ () C:\Users\Victoria\Desktop\FRST.txt
2015-04-29 07:44 - 2015-04-29 07:45 - 00000000 ____D () C:\FRST
2015-04-29 07:43 - 2015-04-29 20:38 - 02101248 _____ (Farbar) C:\Users\Victoria\Desktop\FRST64.exe
2015-04-29 07:43 - 2015-04-27 17:03 - 00048784 _____ () C:\Windows\system32\Drivers\{31c21995-b861-4864-ab50-4a53fbca73d4}Gw64.sys
2015-04-28 08:24 - 2015-04-28 08:24 - 00000000 __SHD () C:\Users\Victoria\AppData\Local\EmieBrowserModeList
2015-04-28 05:43 - 2015-04-14 11:24 - 00792056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-04-28 05:43 - 2015-04-14 11:24 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-28 05:37 - 2015-04-28 05:43 - 00000000 ___SD () C:\Windows\system32\GWX
2015-04-28 05:37 - 2015-04-28 05:38 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-04-28 05:13 - 2015-04-28 05:43 - 00002357 _____ () C:\Users\Victoria\Desktop\Safe Money.lnk
2015-04-28 05:13 - 2015-04-28 05:13 - 00003506 _____ () C:\Windows\System32\Tasks\Yahoo! Search Updater
2015-04-28 05:13 - 2015-04-28 05:13 - 00003502 _____ () C:\Windows\System32\Tasks\Yahoo! Search
2015-04-28 05:13 - 2015-04-28 05:13 - 00001352 _____ () C:\Users\Victoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security.lnk
2015-04-28 05:13 - 2015-01-27 15:44 - 00933888 _____ (Microsoft Corporation) C:\Windows\system32\calc.exe
2015-04-28 05:13 - 2015-01-24 13:51 - 00816128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\calc.exe
2015-04-28 05:12 - 2015-02-04 11:58 - 00264000 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2015-04-28 05:12 - 2015-02-04 11:58 - 00114496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdNisDrv.sys
2015-04-28 05:12 - 2015-02-04 11:58 - 00044024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2015-04-28 05:12 - 2015-02-03 11:53 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\winshfhc.dll
2015-04-28 05:12 - 2015-02-03 11:53 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winshfhc.dll
2015-04-28 05:11 - 2014-11-10 14:29 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\DeviceSetupStatusProvider.dll
2015-04-28 05:11 - 2014-11-10 13:51 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DeviceSetupStatusProvider.dll
2015-04-28 05:11 - 2014-10-31 11:39 - 01970432 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-04-28 05:11 - 2014-10-31 11:38 - 01612992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-04-28 05:11 - 2013-05-06 09:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll
2015-04-28 05:10 - 2015-04-29 07:39 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-04-28 05:10 - 2015-04-28 05:28 - 00625760 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2015-04-28 05:10 - 2015-04-28 05:28 - 00115296 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2015-04-28 05:10 - 2015-04-28 05:10 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2015-04-28 05:05 - 2015-04-28 05:08 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-28 05:04 - 2015-04-01 11:16 - 128913832 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-04-28 05:00 - 2015-01-29 13:58 - 00347136 _____ (Microsoft Corporation) C:\Windows\system32\photowiz.dll
2015-04-28 05:00 - 2015-01-29 13:29 - 00290816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\photowiz.dll
2015-04-28 04:59 - 2015-01-31 11:42 - 03097600 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2015-04-28 04:59 - 2015-01-31 11:29 - 02484224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2015-04-28 04:59 - 2014-12-14 09:28 - 00513488 _____ () C:\Windows\SysWOW64\locale.nls
2015-04-28 04:59 - 2014-12-14 09:28 - 00513488 _____ () C:\Windows\system32\locale.nls
2015-04-28 04:59 - 2014-10-29 13:27 - 01200128 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Globalization.dll
2015-04-28 04:59 - 2014-10-29 13:27 - 00323072 _____ (Microsoft Corporation) C:\Windows\system32\GlobCollationHost.dll
2015-04-28 04:59 - 2014-10-29 13:04 - 00868352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Globalization.dll
2015-04-28 04:59 - 2014-10-29 13:04 - 00200704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GlobCollationHost.dll
2015-04-28 04:56 - 2015-01-29 13:04 - 01091072 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2015-04-28 04:56 - 2015-01-29 13:04 - 00864256 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2015-04-28 04:56 - 2014-10-29 14:43 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\printui.exe
2015-04-28 04:56 - 2014-10-29 14:34 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\compstui.dll
2015-04-28 04:56 - 2014-10-29 14:04 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\findnetprinters.dll
2015-04-28 04:56 - 2014-10-29 13:58 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\printui.exe
2015-04-28 04:56 - 2014-10-29 13:52 - 00289280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\compstui.dll
2015-04-28 04:56 - 2014-10-29 13:51 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\puiobj.dll
2015-04-28 04:56 - 2014-10-29 13:45 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\prnntfy.dll
2015-04-28 04:56 - 2014-10-29 13:28 - 00055808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\findnetprinters.dll
2015-04-28 04:56 - 2014-10-29 13:20 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\puiobj.dll
2015-04-28 04:56 - 2014-10-29 13:15 - 00199168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\prnntfy.dll
2015-04-28 04:56 - 2014-10-29 12:55 - 00192512 _____ (Microsoft Corporation) C:\Windows\system32\puiapi.dll
2015-04-28 04:56 - 2014-10-29 12:44 - 00167424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\puiapi.dll
2015-04-28 04:56 - 2014-10-29 12:41 - 00269312 _____ (Microsoft Corporation) C:\Windows\system32\DafPrintProvider.dll
2015-04-28 04:56 - 2014-10-29 12:35 - 00203776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DafPrintProvider.dll
2015-04-28 04:55 - 2015-04-28 04:55 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2015-04-28 04:55 - 2015-04-28 04:55 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2015-04-28 04:52 - 2014-05-30 00:02 - 00565576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-04-28 04:52 - 2014-05-29 19:55 - 00735232 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-04-28 04:52 - 2014-05-29 18:40 - 00735232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-04-28 04:52 - 2014-05-29 18:37 - 00436224 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-04-28 04:52 - 2014-05-29 17:34 - 00318976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-04-28 04:52 - 2014-05-29 17:27 - 01417216 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-04-28 04:50 - 2015-01-30 15:01 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidbth.sys
2015-04-28 04:50 - 2015-01-30 15:00 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rfcomm.sys
2015-04-28 04:50 - 2014-10-29 14:46 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BTHUSB.SYS
2015-04-28 04:50 - 2014-10-29 14:46 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthenum.sys
2015-04-28 04:50 - 2014-10-29 14:45 - 01198080 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys
2015-04-28 04:50 - 2014-10-29 14:03 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\fsquirt.exe
2015-04-28 04:48 - 2015-02-06 13:28 - 02257408 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-04-28 04:48 - 2015-02-06 13:08 - 01943040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-04-28 04:46 - 2015-02-03 12:03 - 03551744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_47.dll
2015-04-28 04:46 - 2015-02-03 12:02 - 04298240 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_47.dll
2015-04-28 04:46 - 2015-01-30 14:03 - 01488896 _____ (Microsoft Corporation) C:\Windows\system32\mfc42u.dll
2015-04-28 04:46 - 2015-01-30 14:03 - 01464832 _____ (Microsoft Corporation) C:\Windows\system32\mfc42.dll
2015-04-28 04:46 - 2015-01-30 13:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc42u.dll
2015-04-28 04:46 - 2015-01-30 13:42 - 01204224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc42.dll
2015-04-28 04:46 - 2015-01-30 13:29 - 00035840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\atlthunk.dll
2015-04-28 04:46 - 2014-10-29 13:28 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\atlthunk.dll
2015-04-28 04:43 - 2015-01-29 13:11 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-04-28 04:43 - 2015-01-29 13:00 - 00210944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-04-28 04:43 - 2015-01-29 12:55 - 00971776 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2015-04-28 04:43 - 2015-01-29 12:50 - 00811008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2015-04-28 04:43 - 2014-10-29 14:34 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\WSCollect.exe
2015-04-28 04:43 - 2014-10-29 14:34 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\WSReset.exe
2015-04-28 04:43 - 2014-10-29 13:13 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.dll
2015-04-28 04:43 - 2014-10-29 12:55 - 00223744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.dll
2015-04-28 04:42 - 2015-01-28 14:24 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\StorageContextHandler.dll
2015-04-28 04:42 - 2015-01-28 13:47 - 00060928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StorageContextHandler.dll
2015-04-28 04:38 - 2015-01-30 14:02 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\eappgnui.dll
2015-04-28 04:38 - 2015-01-30 13:40 - 00091648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eappgnui.dll
2015-04-28 04:38 - 2015-01-30 13:37 - 00331776 _____ (Microsoft Corporation) C:\Windows\system32\eapp3hst.dll
2015-04-28 04:38 - 2015-01-30 13:24 - 00339456 _____ (Microsoft Corporation) C:\Windows\system32\eapphost.dll
2015-04-28 04:38 - 2015-01-30 13:24 - 00250880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eapp3hst.dll
2015-04-28 04:38 - 2015-01-30 13:16 - 00266752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eapphost.dll
2015-04-28 04:38 - 2015-01-30 13:08 - 00346112 _____ (Microsoft Corporation) C:\Windows\system32\eappcfg.dll
2015-04-28 04:38 - 2015-01-30 13:06 - 00278016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eappcfg.dll
2015-04-28 04:38 - 2014-10-29 13:19 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\eappprxy.dll
2015-04-28 04:38 - 2014-10-29 12:59 - 00056320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eappprxy.dll
2015-04-28 04:27 - 2015-04-28 04:27 - 00004280 _____ () C:\Windows\System32\Tasks\ReimageUpdater
2015-04-28 04:27 - 2015-04-28 04:27 - 00000020 _____ () C:\Users\Victoria\AppData\Roaming\appdataFr3.bin
2015-04-28 04:27 - 2015-04-28 04:27 - 00000000 ____D () C:\ProgramData\WildWestCoupon
2015-04-28 04:24 - 2015-04-28 04:38 - 00000000 ____D () C:\Program Files\Reimage
2015-04-28 04:24 - 2015-04-28 04:27 - 00000000 ____D () C:\ProgramData\Reimage Protector
2015-04-28 04:18 - 2015-04-28 04:27 - 00000165 _____ () C:\Windows\Reimage.ini
2015-04-28 04:18 - 2014-12-09 13:50 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-04-28 04:18 - 2014-08-02 12:18 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2015-04-28 04:18 - 2014-05-30 15:03 - 00563200 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2015-04-28 04:17 - 2015-04-28 04:18 - 00764736 _____ (Reimage®) C:\Users\Victoria\Downloads\ReimageRepair.exe
2015-04-28 04:17 - 2015-03-06 14:53 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-04-28 04:17 - 2015-03-06 14:33 - 00358912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-04-28 04:17 - 2015-02-26 11:26 - 04178944 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-04-28 04:17 - 2015-02-08 11:57 - 01090048 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll
2015-04-28 04:17 - 2015-02-08 11:49 - 00791040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll
2015-04-28 04:17 - 2015-02-06 08:24 - 01113920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2015-04-28 04:17 - 2015-01-29 12:59 - 02773504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-04-28 04:17 - 2015-01-29 12:49 - 02459136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-04-28 04:17 - 2015-01-28 11:47 - 02501368 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2015-04-28 04:17 - 2015-01-28 11:41 - 02207488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2015-04-28 04:17 - 2015-01-20 06:42 - 01487976 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2015-04-28 04:17 - 2014-12-19 20:57 - 00788680 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-04-28 04:17 - 2014-12-19 20:25 - 00602776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-04-28 04:17 - 2014-12-12 14:04 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-04-28 04:17 - 2014-12-12 12:51 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ahcache.sys
2015-04-28 04:17 - 2014-12-11 17:36 - 00046456 _____ (Microsoft Corporation) C:\Windows\system32\LockScreenContentServer.exe
2015-04-28 04:17 - 2014-08-07 14:12 - 01336624 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-04-28 04:17 - 2014-08-02 15:56 - 01064448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-04-28 04:17 - 2014-07-10 16:52 - 13292544 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2015-04-28 04:17 - 2014-07-10 16:47 - 11794944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2015-04-28 04:17 - 2014-07-10 16:33 - 00792064 _____ (Microsoft Corporation) C:\Windows\system32\uDWM.dll
2015-04-28 04:17 - 2014-07-10 16:08 - 00321536 _____ (Microsoft Corporation) C:\Windows\system32\lockscreencn.dll
2015-04-28 04:16 - 2015-04-28 04:16 - 04694976 _____ (ReviverSoft ) C:\Users\Victoria\Downloads\SecurityReviverSetup_ppc.exe
2015-04-28 03:05 - 2015-04-28 03:05 - 00000000 ____D () C:\Users\Victoria\AppData\Local\Pay-By-Ads
2015-04-28 00:19 - 2015-02-07 11:09 - 00396419 _____ () C:\Windows\system32\ApnDatabase.xml
2015-04-27 22:54 - 2015-03-24 09:59 - 07476032 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-04-27 22:54 - 2015-03-24 09:59 - 01733952 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-04-27 22:54 - 2015-03-24 09:59 - 00360480 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-04-27 22:54 - 2015-03-24 09:58 - 01498872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-04-27 22:54 - 2015-03-24 09:45 - 00257216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-04-27 22:54 - 2015-03-20 16:12 - 00246272 _____ (Microsoft Corporation) C:\Windows\system32\microsoft-windows-system-events.dll
2015-04-27 22:54 - 2015-03-20 16:10 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-04-27 22:54 - 2015-03-20 16:10 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-04-27 22:54 - 2015-03-20 15:17 - 00411648 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-04-27 22:54 - 2015-03-20 14:41 - 00369152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-04-27 22:54 - 2015-03-20 14:40 - 00950784 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-04-27 22:54 - 2015-03-20 14:16 - 00749568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-04-27 22:54 - 2015-03-13 16:32 - 24980480 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-04-27 22:54 - 2015-03-13 16:08 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-04-27 22:54 - 2015-03-13 16:07 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-04-27 22:54 - 2015-03-13 15:53 - 00816128 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-04-27 22:54 - 2015-03-13 15:50 - 06025216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-04-27 22:54 - 2015-03-13 15:42 - 19695616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-04-27 22:54 - 2015-03-13 15:28 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-04-27 22:54 - 2015-03-13 15:26 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-04-27 22:54 - 2015-03-13 15:22 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-04-27 22:54 - 2015-03-13 15:17 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-04-27 22:54 - 2015-03-13 15:16 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-04-27 22:54 - 2015-03-13 15:08 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-04-27 22:54 - 2015-03-13 15:07 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-04-27 22:54 - 2015-03-13 15:00 - 14397440 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-04-27 22:54 - 2015-03-13 14:58 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2015-04-27 22:54 - 2015-03-13 14:50 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-04-27 22:54 - 2015-03-13 14:49 - 04305408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-04-27 22:54 - 2015-03-13 14:45 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-04-27 22:54 - 2015-03-13 14:44 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-04-27 22:54 - 2015-03-13 14:37 - 00208896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll
2015-04-27 22:54 - 2015-03-13 14:34 - 12825600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-04-27 22:54 - 2015-03-13 14:33 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-04-27 22:54 - 2015-03-13 14:22 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-04-27 22:54 - 2015-03-13 14:20 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-04-27 22:54 - 2015-03-13 14:16 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-04-27 22:54 - 2015-03-13 14:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-04-27 22:54 - 2015-02-21 12:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-04-27 22:54 - 2015-02-21 12:27 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-04-27 22:54 - 2015-02-21 11:49 - 00780800 _____ (Microsoft Corporation) C:\Windows\system32\lsm.dll
2015-04-27 22:54 - 2015-02-21 11:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-04-27 22:54 - 2015-02-20 14:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-04-27 22:54 - 2015-02-20 14:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-04-27 22:54 - 2015-02-20 14:07 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-04-27 22:54 - 2015-02-20 14:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-04-27 22:54 - 2015-02-20 14:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-04-27 22:54 - 2015-02-20 13:52 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-04-27 22:54 - 2015-02-20 13:49 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-04-27 22:54 - 2015-02-20 13:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-04-27 22:54 - 2015-02-20 13:29 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-04-27 22:54 - 2015-02-20 13:26 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-04-27 22:54 - 2015-02-20 13:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-04-27 22:54 - 2015-01-31 11:20 - 00203264 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-04-27 22:54 - 2015-01-27 16:22 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-04-27 22:54 - 2015-01-27 14:11 - 03547648 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-04-27 22:54 - 2015-01-12 14:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-04-27 22:54 - 2015-01-12 13:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-04-27 22:54 - 2015-01-12 13:23 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-04-27 22:54 - 2014-12-19 18:26 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-04-27 22:54 - 2014-12-06 15:17 - 00360448 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2015-04-27 22:54 - 2014-12-06 13:41 - 00391680 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-04-27 22:54 - 2014-11-22 14:49 - 00417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-04-27 22:54 - 2014-11-22 14:06 - 00340992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-04-27 22:54 - 2014-10-31 17:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2015-04-27 22:54 - 2014-10-31 17:12 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-04-27 22:54 - 2014-10-31 17:10 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2015-04-27 22:54 - 2014-10-31 17:09 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2015-04-27 22:54 - 2014-10-31 17:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-04-27 22:54 - 2014-10-31 17:06 - 00237568 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-04-27 22:54 - 2014-10-31 17:06 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-04-27 22:54 - 2014-10-31 17:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-04-27 22:54 - 2014-10-31 16:57 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-04-27 22:54 - 2014-10-31 16:56 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-04-27 22:54 - 2014-10-31 16:54 - 00132096 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2015-04-27 22:54 - 2014-10-31 16:53 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-04-27 22:54 - 2014-10-31 16:52 - 00108544 _____ (Microsoft Corporation) C:\Windows\system32\hlink.dll
2015-04-27 22:54 - 2014-10-31 16:51 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-04-27 22:54 - 2014-10-31 16:51 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-04-27 22:54 - 2014-10-31 16:40 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2015-04-27 22:54 - 2014-10-31 16:30 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-04-27 22:54 - 2014-10-31 16:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2015-04-27 22:54 - 2014-10-31 16:29 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2015-04-27 22:54 - 2014-10-31 16:28 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2015-04-27 22:54 - 2014-10-31 16:25 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-04-27 22:54 - 2014-10-31 16:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-04-27 22:54 - 2014-10-31 16:19 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-04-27 22:54 - 2014-10-31 15:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2015-04-27 22:54 - 2014-10-31 15:28 - 00137728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2015-04-27 22:54 - 2014-10-31 15:28 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2015-04-27 22:54 - 2014-10-31 15:27 - 00152064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2015-04-27 22:54 - 2014-10-31 15:26 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2015-04-27 22:54 - 2014-10-31 15:25 - 00011264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2015-04-27 22:54 - 2014-10-31 15:24 - 00235520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2015-04-27 22:54 - 2014-10-31 15:24 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-04-27 22:54 - 2014-10-31 15:23 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-04-27 22:54 - 2014-10-31 15:16 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-04-27 22:54 - 2014-10-31 15:15 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-04-27 22:54 - 2014-10-31 15:14 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2015-04-27 22:54 - 2014-10-31 15:13 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-04-27 22:54 - 2014-10-31 15:13 - 00099328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hlink.dll
2015-04-27 22:54 - 2014-10-31 15:12 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-04-27 22:54 - 2014-10-31 15:11 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-04-27 22:54 - 2014-10-31 15:03 - 00027136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2015-04-27 22:54 - 2014-10-31 14:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-04-27 22:54 - 2014-10-31 14:56 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2015-04-27 22:54 - 2014-10-31 14:56 - 00090624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2015-04-27 22:54 - 2014-10-31 14:56 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2015-04-27 22:54 - 2014-10-31 14:53 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-04-27 22:54 - 2014-10-31 14:53 - 00052736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2015-04-27 22:54 - 2014-10-31 14:48 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2015-04-27 22:54 - 2014-10-31 14:26 - 01042944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2015-04-27 22:54 - 2014-10-31 14:24 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2015-04-27 22:54 - 2014-10-29 15:56 - 00027456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2015-04-27 22:54 - 2014-10-29 14:48 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\workerdd.dll
2015-04-27 22:54 - 2014-10-29 14:43 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-04-27 22:54 - 2014-10-29 14:37 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\rfxvmt.dll
2015-04-27 22:54 - 2014-10-29 14:17 - 00110592 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-04-27 22:54 - 2014-10-29 13:58 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-04-27 22:54 - 2014-10-29 13:57 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-04-27 22:54 - 2014-10-29 13:38 - 00087552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-04-27 22:54 - 2014-10-29 13:26 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-04-27 22:54 - 2014-10-29 13:26 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-04-27 22:54 - 2014-10-29 13:24 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2015-04-27 22:54 - 2014-10-29 13:15 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-04-27 22:54 - 2014-10-29 13:15 - 00005632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-04-27 22:54 - 2014-10-29 13:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-04-27 22:54 - 2014-10-29 13:13 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-04-27 22:54 - 2014-10-29 13:13 - 00008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-04-27 22:54 - 2014-10-29 13:04 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-04-27 22:54 - 2014-10-29 13:04 - 00038400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-04-27 22:54 - 2014-10-29 13:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-04-27 22:54 - 2014-10-23 17:48 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2015-04-27 22:54 - 2014-10-23 17:05 - 00072192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2015-04-27 22:54 - 2014-10-13 14:43 - 00238912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2015-04-27 22:54 - 2014-10-13 14:43 - 00153920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2015-04-27 22:54 - 2014-10-13 14:43 - 00086336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pdc.sys
2015-04-27 22:54 - 2014-10-13 14:43 - 00039744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\intelpep.sys
2015-04-27 22:54 - 2014-09-04 12:12 - 00590336 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2015-04-27 22:54 - 2014-09-04 12:01 - 00514048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2015-04-27 22:54 - 2014-08-23 17:18 - 02149376 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-04-27 22:54 - 2014-08-23 17:03 - 01346048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-04-27 22:54 - 2014-06-10 10:13 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2015-04-27 22:54 - 2014-06-10 10:13 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2015-04-27 22:54 - 2014-06-07 01:04 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2015-04-27 22:54 - 2014-06-07 00:18 - 00488960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2015-04-27 22:54 - 2014-06-06 02:13 - 00216368 _____ (Microsoft Corporation) C:\Windows\system32\rsaenh.dll
2015-04-27 22:54 - 2014-06-06 01:14 - 00189016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rsaenh.dll
2015-04-27 22:54 - 2014-06-02 14:10 - 00423768 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll
2015-04-27 22:54 - 2014-05-31 22:07 - 00467800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2015-04-27 22:54 - 2014-05-31 22:07 - 00440664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2015-04-27 22:54 - 2014-05-31 22:07 - 00419672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2015-04-27 22:54 - 2014-05-31 22:07 - 00089944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2015-04-27 22:54 - 2014-05-31 22:07 - 00027480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2015-04-27 22:54 - 2014-05-31 18:30 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2015-04-27 22:54 - 2014-05-31 18:27 - 00110592 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys
2015-04-27 22:54 - 2014-05-31 18:26 - 00227840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys
2015-04-27 22:54 - 2014-05-31 16:01 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe
2015-04-27 22:54 - 2014-05-31 16:01 - 00209408 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll
2015-04-27 22:54 - 2014-05-31 16:01 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll
2015-04-27 22:54 - 2014-05-28 03:53 - 02518360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2015-04-27 22:54 - 2014-05-27 21:56 - 00323584 _____ (Microsoft Corporation) C:\Windows\system32\DaOtpCredentialProvider.dll
2015-04-27 22:54 - 2014-05-27 21:53 - 00270848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DaOtpCredentialProvider.dll
2015-04-27 22:54 - 2014-05-17 16:59 - 16871936 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.dll
2015-04-27 22:54 - 2014-05-17 16:13 - 12711424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll
2015-04-27 22:54 - 2014-04-30 16:43 - 01975296 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-04-27 22:54 - 2014-04-30 16:26 - 01345536 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-04-27 22:54 - 2014-04-30 15:47 - 01509888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-04-27 22:54 - 2014-02-06 23:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-04-27 22:53 - 2015-03-14 20:54 - 00133256 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-04-27 22:53 - 2015-03-14 13:56 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-04-27 22:53 - 2015-03-14 13:56 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-04-27 22:53 - 2015-03-14 13:51 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-04-27 22:53 - 2015-03-14 13:37 - 00267264 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-04-27 22:53 - 2015-03-14 13:14 - 00027136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-04-27 22:53 - 2015-03-14 12:22 - 03678720 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-04-27 22:53 - 2015-03-14 12:12 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-04-27 22:53 - 2015-03-14 12:12 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-04-27 22:53 - 2015-03-14 12:09 - 00200192 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll
2015-04-27 22:53 - 2015-03-14 12:08 - 00408064 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2015-04-27 22:53 - 2015-03-14 12:08 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-04-27 22:53 - 2015-03-14 12:06 - 02373632 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-04-27 22:53 - 2015-03-14 12:06 - 00891392 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-04-27 22:53 - 2015-03-14 12:02 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-04-27 22:53 - 2015-03-14 12:02 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-04-27 22:53 - 2015-03-14 11:59 - 00721920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-04-27 22:53 - 2015-03-14 11:59 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-04-27 22:53 - 2015-03-04 22:25 - 00377152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
2015-04-27 22:53 - 2015-03-04 15:04 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-27 22:53 - 2015-03-04 14:19 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2015-04-27 22:53 - 2015-02-24 20:32 - 00991552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-04-27 22:53 - 2015-02-13 05:40 - 22291584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-04-27 22:53 - 2015-02-13 05:34 - 19731824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-04-27 22:53 - 2015-01-30 06:45 - 01763352 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-04-27 22:53 - 2015-01-30 06:34 - 01488040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-04-27 22:53 - 2015-01-28 13:31 - 00402432 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-04-27 22:53 - 2015-01-28 13:11 - 00357376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-04-27 22:53 - 2014-12-09 07:42 - 00535640 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2015-04-27 22:53 - 2014-12-09 07:42 - 00531616 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2015-04-27 22:53 - 2014-12-09 07:42 - 00448792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2015-04-27 22:53 - 2014-12-09 07:42 - 00413248 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
2015-04-27 22:53 - 2014-12-09 07:42 - 00372408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll
2015-04-27 22:53 - 2014-12-09 07:42 - 00108944 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-04-27 22:53 - 2014-12-09 07:42 - 00038264 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe
2015-04-27 22:53 - 2014-12-09 07:42 - 00033584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFaultSecure.exe
2015-04-27 22:53 - 2014-12-06 13:35 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2015-04-27 22:53 - 2014-11-10 11:19 - 00991232 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-04-27 22:53 - 2014-11-10 11:19 - 00806400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-04-27 22:53 - 2014-10-31 10:37 - 00129536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-04-27 22:53 - 2014-10-31 10:34 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-04-27 22:53 - 2014-10-29 16:00 - 00465320 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
2015-04-27 22:53 - 2014-10-29 16:00 - 00139984 _____ (Microsoft Corporation) C:\Windows\system32\wermgr.exe
2015-04-27 22:53 - 2014-10-29 15:52 - 00500016 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-04-27 22:53 - 2014-10-29 15:52 - 00482872 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-04-27 22:53 - 2014-10-29 15:52 - 00394120 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-04-27 22:53 - 2014-10-29 15:52 - 00272248 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-04-27 22:53 - 2014-10-29 15:12 - 00413136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe
2015-04-27 22:53 - 2014-10-29 15:12 - 00136296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wermgr.exe
2015-04-27 22:53 - 2014-10-29 15:07 - 00424544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-04-27 22:53 - 2014-10-29 15:07 - 00370424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-04-27 22:53 - 2014-10-29 15:07 - 00344536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-04-27 22:53 - 2014-10-29 14:44 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll
2015-04-27 22:53 - 2014-10-29 13:59 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werdiagcontroller.dll
2015-04-27 22:53 - 2014-10-29 13:02 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-04-27 22:53 - 2014-10-18 18:50 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\wuaext.dll
2015-04-27 22:53 - 2014-07-24 15:20 - 00875688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr120_clr0400.dll
2015-04-27 22:53 - 2014-07-24 15:20 - 00869544 _____ (Microsoft Corporation) C:\Windows\system32\msvcr120_clr0400.dll
2015-04-27 22:53 - 2014-06-04 21:27 - 00114520 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-04-27 22:53 - 2014-06-04 17:31 - 00356352 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2015-04-27 22:53 - 2014-06-04 17:22 - 02790912 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-04-27 22:53 - 2014-06-04 16:43 - 00281088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2015-04-27 22:53 - 2014-06-04 16:38 - 03304448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-04-27 22:40 - 2015-04-27 22:40 - 00000000 ____D () C:\Users\Victoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Queen's Garden 2
2015-04-27 22:40 - 2015-04-27 22:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Queen's Garden 2
2015-04-27 22:40 - 2015-04-27 22:40 - 00000000 ____D () C:\Program Files (x86)\Queen's Garden 2
2015-04-27 22:38 - 2015-04-27 22:38 - 00001950 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Game Manager.lnk
2015-04-27 22:38 - 2015-04-27 22:38 - 00001248 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\More Great Games.lnk
2015-04-27 22:38 - 2015-04-27 22:38 - 00000000 ____D () C:\ProgramData\Big Fish
2015-04-27 22:38 - 2015-04-27 22:38 - 00000000 ____D () C:\Program Files (x86)\bfgclient
2015-04-27 22:38 - 2015-01-21 17:54 - 01384712 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-04-27 22:38 - 2015-01-21 17:15 - 01123848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-04-27 22:37 - 2015-04-27 22:37 - 00237568 _____ (Big Fish Games) C:\Users\Victoria\Downloads\queens-garden-2_s1_l1_gF8524T1L1_d2459267543.exe
2015-04-27 22:36 - 2015-04-27 22:39 - 00000000 ____D () C:\Users\Victoria\AppData\Local\Big Fish
2015-04-27 22:36 - 2015-04-27 22:39 - 00000000 ____D () C:\BigFishCache
2015-04-27 22:36 - 2015-04-27 22:36 - 00237568 _____ (Big Fish Games) C:\Users\Victoria\Downloads\queens-garden-2_s1_l1_gF8524T1L1_d2459267339.exe
2015-04-27 22:20 - 2015-04-27 22:22 - 00000000 ____D () C:\Users\Victoria\AppData\Roaming\WildTangent
2015-04-26 20:07 - 2015-04-26 20:07 - 00000000 ____D () C:\Users\Victoria\Tracing
2015-04-26 20:04 - 2015-04-26 20:04 - 00000886 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1039196443-4011642949-4200754541-1001Core1d07ff78ffccfdd.job
2015-04-26 20:00 - 2015-04-29 07:41 - 00000000 ____D () C:\Users\Victoria\AppData\Roaming\Skype
2015-04-26 20:00 - 2015-04-26 20:00 - 00002713 _____ () C:\Users\Public\Desktop\Skype.lnk
2015-04-26 20:00 - 2015-04-26 20:00 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-04-26 20:00 - 2015-04-26 20:00 - 00000000 ____D () C:\Users\Victoria\AppData\Local\Skype
2015-04-26 20:00 - 2015-04-26 20:00 - 00000000 ____D () C:\ProgramData\Skype
2015-04-26 20:00 - 2015-04-26 20:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-04-26 19:59 - 2015-04-26 19:59 - 01384064 _____ (Skype Technologies S.A.) C:\Users\Victoria\Downloads\SkypeSetup.exe
2015-04-26 19:58 - 2015-04-26 19:58 - 00000000 ____D () C:\Program Files (x86)\SectionAppend
2015-04-15 22:48 - 2015-04-15 22:48 - 00000258 __RSH () C:\ProgramData\ntuser.pol

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-29 07:45 - 2014-12-30 21:59 - 00000000 ____D () C:\Program Files (x86)\Solution Real
2015-04-29 07:45 - 2013-08-23 01:25 - 00000301 _____ () C:\Windows\win.ini
2015-04-29 07:44 - 2014-03-18 21:53 - 00958356 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-29 07:42 - 2013-08-23 02:46 - 00023918 _____ () C:\Windows\setupact.log
2015-04-29 07:40 - 2014-12-30 21:33 - 00000000 __RDO () C:\Users\Victoria\OneDrive
2015-04-29 07:37 - 2013-08-23 02:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-29 07:36 - 2014-12-30 21:15 - 01270625 _____ () C:\Windows\WindowsUpdate.log
2015-04-29 07:34 - 2013-08-23 03:36 - 00000000 ____D () C:\Windows\system32\sru
2015-04-28 09:13 - 2014-12-30 21:29 - 00003938 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{51E93816-A1DF-439A-8781-1C8329C0D162}
2015-04-28 09:09 - 2014-12-30 21:31 - 00000000 ____D () C:\Users\Victoria\Documents\Youcam
2015-04-28 09:00 - 2013-08-23 03:36 - 00000000 ____D () C:\Windows\rescache
2015-04-28 05:44 - 2014-12-30 22:30 - 00047104 ___SH () C:\Users\Victoria\Desktop\Thumbs.db
2015-04-28 05:41 - 2013-08-23 02:44 - 00430448 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-04-28 05:40 - 2013-08-23 01:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-04-28 05:38 - 2013-08-23 03:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-04-28 05:38 - 2013-08-23 03:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-04-28 05:38 - 2013-08-23 03:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2015-04-28 05:38 - 2013-08-23 03:36 - 00000000 ____D () C:\Program Files\Windows Defender
2015-04-28 05:38 - 2013-08-23 03:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2015-04-28 05:37 - 2014-03-18 21:44 - 00008336 _____ () C:\Windows\PFRO.log
2015-04-28 05:37 - 2014-03-18 21:38 - 00000000 ____D () C:\Program Files\Windows Journal
2015-04-28 05:37 - 2013-08-23 03:36 - 00000000 ___RD () C:\Windows\ToastData
2015-04-28 05:37 - 2013-08-23 03:36 - 00000000 ____D () C:\Windows\WinStore
2015-04-28 05:37 - 2013-08-23 03:36 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-04-28 05:37 - 2013-08-23 03:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2015-04-28 05:30 - 2013-08-23 01:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2015-04-28 05:29 - 2013-10-15 03:59 - 00029280 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klkbdflt.sys
2015-04-28 05:29 - 2013-06-06 17:38 - 00178272 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys
2015-04-28 05:29 - 2013-05-07 17:56 - 00065120 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klwfp.sys
2015-04-28 05:28 - 2013-10-15 03:59 - 00458336 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2015-04-28 05:28 - 2012-07-27 18:38 - 00029792 _____ (Kaspersky Lab) C:\Windows\system32\Drivers\klelam.sys
2015-04-28 05:19 - 2014-12-30 21:34 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1039196443-4011642949-4200754541-1001
2015-04-28 05:14 - 2013-08-23 03:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-04-28 05:14 - 2013-08-23 03:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-04-28 05:10 - 2013-08-23 03:36 - 00000000 ___HD () C:\Windows\ELAMBKUP
2015-04-28 05:09 - 2014-12-30 07:15 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-04-28 04:07 - 2014-12-30 21:28 - 00000000 ____D () C:\Users\Victoria
2015-04-28 03:31 - 2014-09-07 04:59 - 00000000 ____D () C:\ProgramData\CyberLink
2015-04-27 23:14 - 2014-09-07 04:58 - 00000000 ____D () C:\ProgramData\Temp
2015-04-27 22:40 - 2014-04-25 14:28 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-04-27 22:29 - 2013-08-23 03:36 - 00000000 ____D () C:\Windows\system32\NDF
2015-04-27 22:27 - 2014-04-25 14:27 - 00000000 ____D () C:\ProgramData\WildTangent
2015-04-26 23:13 - 2014-12-30 21:59 - 00000000 ____D () C:\Program Files (x86)\SupTab
2015-04-26 22:46 - 2014-12-30 21:59 - 00000000 ____D () C:\ProgramData\IePluginServices
2015-04-26 22:46 - 2014-12-30 21:29 - 00001465 _____ () C:\Users\Victoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-26 22:11 - 2014-12-30 22:10 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-04-26 22:11 - 2014-12-30 22:10 - 00000000 ____D () C:\Program Files (x86)\Java

==================== Files in the root of some directories =======

2015-04-28 04:27 - 2015-04-28 04:27 - 0000020 _____ () C:\Users\Victoria\AppData\Roaming\appdataFr3.bin

Some content of TEMP:
====================
C:\Users\Victoria\AppData\Local\Temp\APNSetup.exe
C:\Users\Victoria\AppData\Local\Temp\BSvcProcessor.exe
C:\Users\Victoria\AppData\Local\Temp\BSvcUpdater.exe
C:\Users\Victoria\AppData\Local\Temp\cct.dll
C:\Users\Victoria\AppData\Local\Temp\CloudBackup4120.exe
C:\Users\Victoria\AppData\Local\Temp\ICReinstall_google-chrome_setup.exe
C:\Users\Victoria\AppData\Local\Temp\JavaIC.dll
C:\Users\Victoria\AppData\Local\Temp\jre-8u45-windows-au.exe
C:\Users\Victoria\AppData\Local\Temp\msscct32.dll
C:\Users\Victoria\AppData\Local\Temp\optprosetup.exe
C:\Users\Victoria\AppData\Local\Temp\ose00000.exe
C:\Users\Victoria\AppData\Local\Temp\ReimagePackage.exe
C:\Users\Victoria\AppData\Local\Temp\ReiSysUpdate.exe
C:\Users\Victoria\AppData\Local\Temp\vcredist_x64.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-28 05:20

==================== End Of Log ============================



BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 39,543 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:03:06 AM

Posted 02 May 2015 - 08:30 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Download Malwarebytes' Anti-Malware from Here

Double-click mbam-setup-2.X.X.XXXX.exe to install the application (X's are the current version number).
  • Make sure a checkmark is placed next to Launch Malwarebytes' Anti-Malware, then click Finish.
  • Once MBAM opens, when it says Your databases are out of date, click the Fix Now button.
  • Click the Settings tab at the top, and then in the left column, select Detections and Protections, and if not already checked place a checkmark in the selection box for Scan for rootkits.
  • Click the Scan tab at the top of the program window, select Threat Scan and click the Scan Now button.
  • If you receive a message that updates are available, click the Update Now button (the update will be downloaded, installed, and the scan will start).
  • The scan may take some time to finish,so please be patient.
  • If potential threats are detected, ensure that Quarantine is selected as the Action for all the listed items, and click the Apply Actions button.
  • While still on the Scan tab, click the link for View detailed log, and in the window that opens click the Export button, select Text file (*.txt), and save the log to your Desktop.
  • The log is automatically saved by MBAM and can also be viewed by clicking the History tab and then selecting Application Logs.
POST THE LOG FOR MY REVIEW.

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

===

Please download AdwCleaner by Xplode onto your Desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Click the Report button and the report will open in Notepad.
IMPORTANT
  • If you click the Clean button all items listed in the report will be removed.
If you find some false positive items or programs that you wish to keep, Close the AdwCleaner windows.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Check off the element(s) you wish to keep.
  • Click on the Clean button follow the prompts.
  • A log file will automatically open after the scan has finished.
  • Please post the content of that log file with your next answer.
  • You can find the log file at C:\AdwCleaner[Sn].txt (n is a number).
===

Download the version of this tool for your operating system.
Farbar Recovery Scan Tool (64 bit)
Farbar Recovery Scan Tool (32 bit)
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
===


How is the computer running?
Wait for further instructions.

#3 nasdaq

nasdaq

  • Malware Response Team
  • 39,543 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:03:06 AM

Posted 08 May 2015 - 07:08 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users