Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Aluren E infection


  • This topic is locked This topic is locked
28 replies to this topic

#1 elbruceo

elbruceo

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:10:09 PM

Posted 29 May 2015 - 07:50 PM

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 29-05-2015
Ran by Lou (administrator) on LOU-PC on 29-05-2015 17:34:32
Running from C:\Users\Lou\Desktop\Antivirus\FRST-OlderVersion
Loaded Profiles: Lou (Available Profiles: Lou)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe
(GoPro) C:\Program Files (x86)\CineForm\Tools\GoProCineFormStatusViewer.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Windows\SysWOW64\PnkBstrB.exe
(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.EXE
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreamsDownloader.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-03] (Adobe Systems Incorporated)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7981088 2009-07-20] (Realtek Semiconductor)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-07] (Apple Inc.)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [406992 2010-02-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-03-20] (Apple Inc.)
HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2439190036-1487290522-1786115400-1000\...\Run: [MobileDocuments] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
HKU\S-1-5-21-2439190036-1487290522-1786115400-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-2439190036-1487290522-1786115400-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-2439190036-1487290522-1786115400-1000\...\Run: [AppleIEDAV] => C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe [1080104 2014-08-04] (Apple Inc.)
HKU\S-1-5-21-2439190036-1487290522-1786115400-1000\...\Run: [CAHeadless] => C:\Program Files (x86)\Adobe\Elements 12 Organizer\CAHeadless\ElementsAutoAnalyzer.exe [1400224 2013-09-03] (Adobe Systems Incorporated)
HKU\S-1-5-21-2439190036-1487290522-1786115400-1000\...\MountPoints2: {4e1f0794-1867-11e1-a794-806e6f6e6963} - D:\Autorun.exe
HKU\S-1-5-18\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-18\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoResolveSearch] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoInternetOpenWith] 1
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CineForm Status.lnk [2012-12-17]
ShortcutTarget: CineForm Status.lnk -> C:\Program Files (x86)\CineForm\Tools\GoProCineFormStatusViewer.exe (GoPro)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2011-11-26]
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
HKU\S-1-5-21-2439190036-1487290522-1786115400-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2439190036-1487290522-1786115400-1000 -> {65EC778E-5130-46E8-9B7E-7665B18977D5} URL = http://startpage.com/do/search?query={searchTerms}&cat=web&pl=ie&language=english
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-04] (Google Inc.)
BHO: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-10-22] (Hewlett-Packard Co.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-04] (Google Inc.)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-10-22] (Hewlett-Packard Co.)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-04] (Google Inc.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-04] (Google Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-15] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-15] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll [2011-11-03] (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.116.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.116.0\npesnlaunch.dll [2012-02-13] (ESN Social Software AB)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-14] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-14] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-09-04] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011-11-26]
FF HKU\S-1-5-21-2439190036-1487290522-1786115400-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
 
Chrome: 
=======
CHR Profile: C:\Users\Lou\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (eye perform) - C:\Users\Lou\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdgaeefibgplgbehalndfkjeagicdfoe [2015-05-22]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Lou\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-01]
CHR Extension: (Google Wallet) - C:\Users\Lou\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-11]
 
==================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 AdobeActiveFileMonitor12.0; C:\Program Files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe [181152 2013-09-03] (Adobe Systems Incorporated)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 Norton PC Checkup Application Launcher; C:\Program Files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe [132504 2013-03-24] (Symantec Corporation)
R2 PCCUJobMgr; C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe [126392 2011-11-07] (Symantec Corporation)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2012-03-20] ()
R2 PnkBstrB; C:\Windows\SysWOW64\PnkBstrB.exe [189248 2012-03-20] ()
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
R0 PxHlpa64; C:\Windows\System32\drivers\PxHlpa64.sys [56336 2013-07-19] (Corel Corporation)
R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [926824 2013-03-12] (Realtek Semiconductor Corporation                           )
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-05-29 15:01 - 2015-05-29 15:06 - 00000000 ___SD () C:\Windows\system32\GWX
2015-05-29 15:01 - 2015-05-29 15:01 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-05-29 15:01 - 2015-05-29 15:01 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-05-29 15:01 - 2015-05-29 15:01 - 00000000 ____D () C:\Windows\system32\appraiser
2015-05-29 14:33 - 2015-01-08 16:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls
2015-05-29 14:33 - 2015-01-08 16:43 - 00419936 _____ () C:\Windows\system32\locale.nls
2015-05-29 14:32 - 2015-05-29 15:25 - 00000000 ____D () C:\ProgramData\Skype
2015-05-29 14:32 - 2015-05-29 15:22 - 00000000 ____D () C:\Users\Lou\AppData\Roaming\Skype
2015-05-29 14:32 - 2015-05-29 14:32 - 00000000 ____D () C:\Users\Lou\AppData\Local\Skype
2015-05-29 14:27 - 2013-10-01 19:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2015-05-29 14:27 - 2013-10-01 19:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2015-05-29 14:27 - 2013-10-01 19:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2015-05-29 14:27 - 2013-10-01 18:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2015-05-29 14:27 - 2013-10-01 18:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2015-05-29 14:27 - 2013-10-01 18:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2015-05-29 14:27 - 2013-10-01 18:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2015-05-29 14:27 - 2013-10-01 17:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2015-05-29 14:27 - 2013-10-01 17:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2015-05-29 14:27 - 2013-10-01 17:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2015-05-29 14:27 - 2013-10-01 17:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-05-29 14:27 - 2013-10-01 17:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2015-05-29 14:27 - 2013-10-01 16:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2015-05-29 14:27 - 2013-10-01 16:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2015-05-29 14:27 - 2013-10-01 16:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2015-05-29 14:27 - 2013-10-01 15:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2015-05-29 14:27 - 2013-10-01 13:57 - 06578176 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-05-29 14:27 - 2013-10-01 13:55 - 05698048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-05-29 14:10 - 2012-08-23 07:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-05-29 14:10 - 2012-08-23 07:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2015-05-29 14:10 - 2012-08-23 06:24 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-05-29 14:10 - 2012-08-23 04:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2015-05-29 14:10 - 2012-08-23 03:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2015-05-29 14:10 - 2012-08-23 02:51 - 03174912 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-05-29 14:04 - 2012-07-25 20:08 - 00744448 _____ (Microsoft Corporation) C:\Windows\system32\WUDFx.dll
2015-05-29 14:04 - 2012-07-25 20:08 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe
2015-05-29 14:04 - 2012-07-25 20:08 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll
2015-05-29 14:04 - 2012-07-25 20:08 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll
2015-05-29 14:04 - 2012-07-25 20:08 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\WUDFCoinstaller.dll
2015-05-29 14:04 - 2012-07-25 19:26 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys
2015-05-29 14:04 - 2012-07-25 19:26 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys
2015-05-29 14:04 - 2012-06-02 07:57 - 00000003 _____ () C:\Windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
2015-05-29 13:50 - 2014-06-26 19:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2015-05-29 13:50 - 2014-06-26 18:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2015-05-29 13:47 - 2015-04-27 12:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-29 13:47 - 2015-04-27 12:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-29 13:47 - 2015-04-27 12:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-29 13:47 - 2015-04-27 12:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-05-29 13:47 - 2015-04-27 12:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-05-29 13:47 - 2015-04-27 12:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-29 13:47 - 2015-04-27 12:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-05-29 13:47 - 2015-04-27 12:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-29 13:47 - 2015-04-27 12:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-29 13:47 - 2015-04-27 12:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-29 13:47 - 2015-04-27 12:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-29 13:47 - 2015-04-27 12:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-29 13:47 - 2015-04-27 12:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-29 13:47 - 2015-04-27 12:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-29 13:47 - 2015-04-27 12:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-29 13:47 - 2015-04-27 12:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-29 13:47 - 2015-04-27 12:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 12:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-05-29 13:47 - 2015-04-27 12:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-05-29 13:47 - 2015-04-27 12:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-05-29 13:47 - 2015-04-27 12:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-05-29 13:47 - 2015-04-27 12:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-29 13:47 - 2015-04-27 12:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-29 13:47 - 2015-04-27 12:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-29 13:47 - 2015-04-27 12:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-05-29 13:47 - 2015-04-27 12:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-29 13:47 - 2015-04-27 12:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-05-29 13:47 - 2015-04-27 12:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-29 13:47 - 2015-04-27 12:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-05-29 13:47 - 2015-04-27 12:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-05-29 13:47 - 2015-04-27 12:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-29 13:47 - 2015-04-27 12:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-05-29 13:47 - 2015-04-27 12:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-05-29 13:47 - 2015-04-27 12:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-05-29 13:47 - 2015-04-27 12:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-05-29 13:47 - 2015-04-27 12:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-05-29 13:47 - 2015-04-27 12:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-29 13:47 - 2015-04-27 12:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-05-29 13:47 - 2015-04-27 12:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-05-29 13:47 - 2015-04-27 12:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-29 13:47 - 2015-04-27 12:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-29 13:47 - 2015-04-27 12:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-05-29 13:47 - 2015-04-27 12:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-05-29 13:47 - 2015-04-27 12:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-29 13:47 - 2015-04-27 12:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 11:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-29 13:47 - 2015-04-27 10:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-05-29 13:47 - 2015-04-27 10:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-05-29 13:47 - 2015-04-27 10:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 10:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 10:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-05-29 13:47 - 2015-04-27 10:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-05-29 13:47 - 2015-03-22 20:25 - 00769536 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-05-29 13:47 - 2015-03-22 20:25 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-05-29 13:47 - 2015-03-22 20:24 - 00957952 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-05-29 13:47 - 2015-03-22 20:24 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-05-29 13:47 - 2015-03-22 20:24 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-05-29 13:47 - 2015-03-22 20:24 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-05-29 13:47 - 2015-03-22 20:24 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-05-29 13:47 - 2015-03-22 20:17 - 01111552 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-05-29 13:47 - 2015-01-27 16:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-05-29 13:47 - 2012-10-09 11:17 - 00226816 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcore6.dll
2015-05-29 13:47 - 2012-10-09 11:17 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcsvc6.dll
2015-05-29 13:47 - 2012-10-09 10:40 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcore6.dll
2015-05-29 13:47 - 2012-10-09 10:40 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcsvc6.dll
2015-05-29 13:46 - 2015-03-03 21:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-29 13:46 - 2015-03-03 21:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-29 13:46 - 2015-03-03 21:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-29 13:46 - 2015-03-03 21:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-29 13:46 - 2015-03-03 21:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-05-29 13:46 - 2015-03-03 21:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-05-29 13:46 - 2015-03-03 21:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-29 13:46 - 2014-07-08 19:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2015-05-29 13:46 - 2014-07-08 19:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2015-05-29 13:46 - 2014-07-08 19:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2015-05-29 13:46 - 2014-07-08 19:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2015-05-29 13:46 - 2014-07-08 19:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2015-05-29 13:46 - 2014-07-08 18:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2015-05-29 13:46 - 2014-07-08 18:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2015-05-29 13:46 - 2014-07-08 18:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2015-05-29 13:46 - 2014-07-08 18:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2015-05-29 13:46 - 2014-07-08 18:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2015-05-29 13:46 - 2013-12-03 19:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2015-05-29 13:46 - 2013-12-03 19:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2015-05-29 13:46 - 2013-12-03 19:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2015-05-29 13:46 - 2013-12-03 19:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2015-05-29 13:46 - 2013-12-03 19:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2015-05-29 13:46 - 2013-12-03 19:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2015-05-29 13:46 - 2013-12-03 19:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2015-05-29 13:46 - 2013-12-03 19:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2015-05-29 13:46 - 2013-12-03 19:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2015-05-29 13:46 - 2013-12-03 19:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2015-05-29 13:46 - 2013-12-03 19:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2015-05-29 13:46 - 2013-12-03 19:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2015-05-29 13:46 - 2013-12-03 19:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2015-05-29 13:46 - 2013-12-03 19:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2015-05-29 13:46 - 2013-12-03 18:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2015-05-29 13:46 - 2013-12-03 18:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2015-05-29 13:46 - 2013-12-03 18:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2015-05-29 13:46 - 2013-12-03 18:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2015-05-29 13:46 - 2012-12-07 06:20 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\Wpc.dll
2015-05-29 13:46 - 2012-12-07 06:15 - 02746368 _____ (Microsoft Corporation) C:\Windows\system32\gameux.dll
2015-05-29 13:46 - 2012-12-07 05:26 - 00308736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wpc.dll
2015-05-29 13:46 - 2012-12-07 05:20 - 02576384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gameux.dll
2015-05-29 13:46 - 2012-12-07 04:20 - 00045568 _____ (Microsoft) C:\Windows\system32\oflc-nz.rs
2015-05-29 13:46 - 2012-12-07 04:20 - 00044544 _____ (Microsoft) C:\Windows\system32\pegibbfc.rs
2015-05-29 13:46 - 2012-12-07 04:20 - 00043520 _____ (Microsoft) C:\Windows\system32\csrr.rs
2015-05-29 13:46 - 2012-12-07 04:20 - 00030720 _____ (Microsoft) C:\Windows\system32\usk.rs
2015-05-29 13:46 - 2012-12-07 04:20 - 00023552 _____ (Microsoft) C:\Windows\system32\oflc.rs
2015-05-29 13:46 - 2012-12-07 04:20 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-pt.rs
2015-05-29 13:46 - 2012-12-07 04:20 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-fi.rs
2015-05-29 13:46 - 2012-12-07 04:19 - 00055296 _____ (Microsoft) C:\Windows\system32\cero.rs
2015-05-29 13:46 - 2012-12-07 04:19 - 00051712 _____ (Microsoft) C:\Windows\system32\esrb.rs
2015-05-29 13:46 - 2012-12-07 04:19 - 00046592 _____ (Microsoft) C:\Windows\system32\fpb.rs
2015-05-29 13:46 - 2012-12-07 04:19 - 00040960 _____ (Microsoft) C:\Windows\system32\cob-au.rs
2015-05-29 13:46 - 2012-12-07 04:19 - 00021504 _____ (Microsoft) C:\Windows\system32\grb.rs
2015-05-29 13:46 - 2012-12-07 04:19 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi.rs
2015-05-29 13:46 - 2012-12-07 04:19 - 00015360 _____ (Microsoft) C:\Windows\system32\djctq.rs
2015-05-29 13:46 - 2012-12-07 03:46 - 00055296 _____ (Microsoft) C:\Windows\SysWOW64\cero.rs
2015-05-29 13:46 - 2012-12-07 03:46 - 00051712 _____ (Microsoft) C:\Windows\SysWOW64\esrb.rs
2015-05-29 13:46 - 2012-12-07 03:46 - 00046592 _____ (Microsoft) C:\Windows\SysWOW64\fpb.rs
2015-05-29 13:46 - 2012-12-07 03:46 - 00045568 _____ (Microsoft) C:\Windows\SysWOW64\oflc-nz.rs
2015-05-29 13:46 - 2012-12-07 03:46 - 00044544 _____ (Microsoft) C:\Windows\SysWOW64\pegibbfc.rs
2015-05-29 13:46 - 2012-12-07 03:46 - 00043520 _____ (Microsoft) C:\Windows\SysWOW64\csrr.rs
2015-05-29 13:46 - 2012-12-07 03:46 - 00040960 _____ (Microsoft) C:\Windows\SysWOW64\cob-au.rs
2015-05-29 13:46 - 2012-12-07 03:46 - 00030720 _____ (Microsoft) C:\Windows\SysWOW64\usk.rs
2015-05-29 13:46 - 2012-12-07 03:46 - 00023552 _____ (Microsoft) C:\Windows\SysWOW64\oflc.rs
2015-05-29 13:46 - 2012-12-07 03:46 - 00021504 _____ (Microsoft) C:\Windows\SysWOW64\grb.rs
2015-05-29 13:46 - 2012-12-07 03:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi-pt.rs
2015-05-29 13:46 - 2012-12-07 03:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi-fi.rs
2015-05-29 13:46 - 2012-12-07 03:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi.rs
2015-05-29 13:46 - 2012-12-07 03:46 - 00015360 _____ (Microsoft) C:\Windows\SysWOW64\djctq.rs
2015-05-29 13:45 - 2014-11-07 20:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-05-29 13:45 - 2014-11-07 19:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2015-05-29 13:45 - 2013-10-03 19:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2015-05-29 13:45 - 2013-10-03 19:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2015-05-29 13:45 - 2013-10-03 18:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2015-05-29 13:45 - 2013-10-03 18:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2015-05-29 13:44 - 2015-01-08 20:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-05-29 13:44 - 2015-01-08 20:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-05-29 13:44 - 2015-01-08 20:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-05-29 13:44 - 2015-01-08 19:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-05-29 13:44 - 2014-08-01 04:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2015-05-29 13:44 - 2014-08-01 04:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2015-05-29 13:44 - 2014-02-03 19:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2015-05-29 13:44 - 2014-02-03 19:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2015-05-29 13:44 - 2014-02-03 19:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2015-05-29 13:44 - 2014-02-03 19:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2015-05-29 13:44 - 2014-02-03 19:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2015-05-29 13:44 - 2013-10-29 19:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2015-05-29 13:44 - 2013-10-29 19:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2015-05-29 13:44 - 2013-07-04 05:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2015-05-29 13:44 - 2013-07-04 05:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2015-05-29 13:44 - 2013-07-04 04:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2015-05-29 13:44 - 2013-07-04 04:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2015-05-29 13:44 - 2013-05-09 22:49 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2015-05-29 13:44 - 2013-05-09 20:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2015-05-29 13:44 - 2012-10-03 10:44 - 00246272 _____ (Microsoft Corporation) C:\Windows\system32\netcorehc.dll
2015-05-29 13:44 - 2012-10-03 10:44 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\netevent.dll
2015-05-29 13:44 - 2012-10-03 10:42 - 00569344 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll
2015-05-29 13:44 - 2012-10-03 09:42 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcorehc.dll
2015-05-29 13:44 - 2012-10-03 09:42 - 00018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netevent.dll
2015-05-29 13:44 - 2012-10-03 09:07 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys
2015-05-29 13:44 - 2012-08-22 11:12 - 00950128 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2015-05-29 13:44 - 2012-07-04 13:26 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\RNDISMP.sys
2015-05-29 13:43 - 2015-04-10 20:19 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2015-05-29 13:43 - 2015-03-13 20:21 - 01632768 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-05-29 13:43 - 2015-03-13 20:21 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2015-05-29 13:43 - 2015-03-13 20:04 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-05-29 13:43 - 2015-03-13 20:04 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2015-05-29 13:43 - 2015-01-28 20:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-29 13:43 - 2015-01-28 20:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-29 13:43 - 2014-11-25 20:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-05-29 13:43 - 2014-11-25 20:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-05-29 13:43 - 2014-11-10 18:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2015-05-29 13:43 - 2014-10-29 19:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2015-05-29 13:43 - 2014-10-29 18:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe
2015-05-29 13:43 - 2014-10-13 19:13 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-05-29 13:43 - 2014-10-13 18:50 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-05-29 13:43 - 2014-10-02 19:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2015-05-29 13:43 - 2014-10-02 19:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2015-05-29 13:43 - 2014-10-02 19:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2015-05-29 13:43 - 2014-10-02 19:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2015-05-29 13:43 - 2014-10-02 19:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2015-05-29 13:43 - 2014-10-02 18:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2015-05-29 13:43 - 2014-10-02 18:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
2015-05-29 13:43 - 2014-10-02 18:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2015-05-29 13:43 - 2014-10-02 18:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2015-05-29 13:43 - 2014-10-02 18:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
2015-05-29 13:43 - 2014-06-23 20:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2015-05-29 13:43 - 2014-06-23 19:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2015-05-29 13:43 - 2014-01-27 19:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2015-05-29 13:43 - 2014-01-23 19:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2015-05-29 13:43 - 2013-08-04 19:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2015-05-29 13:43 - 2013-03-18 22:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll
2015-05-29 13:43 - 2013-01-23 23:01 - 00223752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys
2015-05-29 13:43 - 2012-08-21 14:01 - 00245760 _____ (Microsoft Corporation) C:\Windows\system32\OxpsConverter.exe
2015-05-29 13:17 - 2011-05-03 22:25 - 02315776 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2015-05-29 13:17 - 2011-05-03 22:22 - 02223616 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2015-05-29 13:17 - 2011-05-03 22:22 - 00778752 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2015-05-29 13:17 - 2011-05-03 22:22 - 00491520 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2015-05-29 13:17 - 2011-05-03 22:22 - 00288256 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2015-05-29 13:17 - 2011-05-03 22:22 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll
2015-05-29 13:17 - 2011-05-03 22:19 - 00591872 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2015-05-29 13:17 - 2011-05-03 22:19 - 00249856 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2015-05-29 13:17 - 2011-05-03 22:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
2015-05-29 13:17 - 2011-05-03 21:34 - 01549312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2015-05-29 13:17 - 2011-05-03 21:32 - 01401344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2015-05-29 13:17 - 2011-05-03 21:32 - 00666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2015-05-29 13:17 - 2011-05-03 21:32 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2015-05-29 13:17 - 2011-05-03 21:32 - 00197120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssphtb.dll
2015-05-29 13:17 - 2011-05-03 21:32 - 00059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscntrs.dll
2015-05-29 13:17 - 2011-05-03 21:28 - 00427520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2015-05-29 13:17 - 2011-05-03 21:28 - 00164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2015-05-29 13:17 - 2011-05-03 21:28 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFilterHost.exe
2015-05-29 13:14 - 2013-08-27 18:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2015-05-29 12:58 - 2015-05-29 12:58 - 00000000 ____D () C:\Windows\erdnt
2015-05-29 12:58 - 2015-05-29 12:58 - 00000000 ____D () C:\Qoobox
2015-05-29 12:57 - 2015-05-29 12:58 - 00000000 ___SD () C:\32788R22FWJFW
2015-05-29 12:34 - 2015-05-29 12:34 - 00001759 _____ () C:\Users\Lou\Desktop\JRT.txt
2015-05-29 12:31 - 2015-05-29 12:31 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-LOU-PC-Windows-7-Home-Premium-(64-bit).dat
2015-05-29 12:31 - 2015-05-29 12:31 - 00000000 ____D () C:\RegBackup
2015-05-29 11:59 - 2015-05-29 17:34 - 00000000 ____D () C:\FRST
2015-05-29 11:28 - 2015-05-29 11:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TP-LINK
2015-05-29 11:27 - 2013-03-12 20:49 - 00926824 _____ (Realtek Semiconductor Corporation ) C:\Windows\system32\rtl8192cu.sys
2015-05-29 11:27 - 2013-03-12 20:49 - 00926824 _____ (Realtek Semiconductor Corporation ) C:\Windows\system32\Drivers\RTL8192cu.sys
2015-05-29 11:27 - 2013-03-12 20:49 - 00007540 _____ () C:\Windows\system32\net8192cu.cat
2015-05-29 11:25 - 2015-05-29 11:25 - 00000000 ____D () C:\ProgramData\TP-LINK
2015-05-29 11:14 - 2015-05-29 15:36 - 00000000 ____D () C:\AdwCleaner
2015-05-29 11:12 - 2015-05-29 17:32 - 00000000 ____D () C:\Users\Lou\Desktop\Antivirus
2015-05-28 18:15 - 2015-05-28 18:15 - 00000000 ____D () C:\Users\Default\AppData\Local\SlimWare Utilities Inc
2015-05-28 18:15 - 2015-05-28 18:15 - 00000000 ____D () C:\Users\Default User\AppData\Local\SlimWare Utilities Inc
2015-05-25 15:31 - 2015-05-25 15:31 - 00000000 ____D () C:\Users\Lou\AppData\Local\LogMeIn Rescue Applet
2015-05-25 15:04 - 2015-05-29 15:38 - 00000258 __RSH () C:\ProgramData\ntuser.pol
2015-05-22 15:47 - 2015-05-22 15:47 - 00009045 _____ () C:\Users\Lou\Desktop\iPhoto.exe
2015-05-21 13:38 - 2015-05-29 01:38 - 00000000 ____D () C:\ProgramData\{a9c70ba8-df70-f0cc-a9c7-70ba8df72ea3}
2015-05-21 13:38 - 2015-05-21 13:38 - 00001991 _____ () C:\Users\Lou\Desktop\iPhoto.lnk
2015-05-13 15:44 - 2015-05-01 06:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 15:44 - 2015-05-01 06:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 12:44 - 2015-05-04 18:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 12:44 - 2015-05-04 18:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-13 12:44 - 2015-04-21 19:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-13 12:44 - 2015-04-21 18:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-13 12:44 - 2015-04-21 10:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 12:44 - 2015-04-21 10:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 12:44 - 2015-04-21 09:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-13 12:44 - 2015-04-21 09:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 12:44 - 2015-04-21 09:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-13 12:44 - 2015-04-21 09:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 12:44 - 2015-04-21 09:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 12:44 - 2015-04-21 09:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-13 12:44 - 2015-04-21 09:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 12:44 - 2015-04-21 09:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 12:44 - 2015-04-21 09:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 12:44 - 2015-04-21 09:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-13 12:44 - 2015-04-21 09:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-13 12:44 - 2015-04-21 09:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 12:44 - 2015-04-21 09:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 12:44 - 2015-04-21 09:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-13 12:44 - 2015-04-21 09:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-13 12:44 - 2015-04-21 09:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 12:44 - 2015-04-21 09:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 12:44 - 2015-04-21 09:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-13 12:44 - 2015-04-21 09:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-13 12:44 - 2015-04-21 09:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-13 12:44 - 2015-04-21 09:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-13 12:44 - 2015-04-21 09:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 12:44 - 2015-04-21 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-13 12:44 - 2015-04-21 09:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 12:44 - 2015-04-21 09:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-13 12:44 - 2015-04-21 09:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-13 12:44 - 2015-04-21 09:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-13 12:44 - 2015-04-21 09:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-13 12:44 - 2015-04-21 08:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-13 12:44 - 2015-04-21 08:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-13 12:44 - 2015-04-21 08:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-13 12:44 - 2015-04-21 08:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 12:44 - 2015-04-21 08:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-13 12:44 - 2015-04-21 08:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-13 12:44 - 2015-04-21 08:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-13 12:44 - 2015-04-21 08:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 12:44 - 2015-04-21 08:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-13 12:44 - 2015-04-21 08:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 12:44 - 2015-04-21 08:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-13 12:44 - 2015-04-21 08:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-13 12:44 - 2015-04-21 08:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-13 12:44 - 2015-04-21 08:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-13 12:44 - 2015-04-21 08:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-13 12:44 - 2015-04-21 08:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-13 12:44 - 2015-04-21 08:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-13 12:44 - 2015-04-21 08:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-13 12:44 - 2015-04-21 08:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 12:44 - 2015-04-21 08:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-13 12:44 - 2015-04-21 08:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-13 12:44 - 2015-04-21 07:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-13 12:44 - 2015-04-21 07:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-13 12:44 - 2015-04-17 20:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 12:44 - 2015-04-17 19:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-13 12:43 - 2015-04-21 10:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 12:43 - 2015-04-21 09:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 12:43 - 2015-04-21 09:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-13 12:43 - 2015-04-21 09:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-13 12:43 - 2015-04-21 08:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 12:42 - 2015-04-19 20:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 12:42 - 2015-04-19 20:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 12:42 - 2015-04-19 19:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-13 12:42 - 2015-04-19 19:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 12:42 - 2015-04-12 20:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 12:42 - 2015-04-07 20:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 12:42 - 2015-04-07 20:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 12:42 - 2015-04-07 20:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-13 12:42 - 2015-02-18 00:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-13 12:42 - 2015-02-18 00:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-05-29 17:32 - 2012-10-05 19:03 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-29 17:26 - 2009-07-13 22:13 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-29 16:45 - 2009-07-13 21:45 - 00016112 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-29 16:45 - 2009-07-13 21:45 - 00016112 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-29 16:41 - 2011-11-26 12:51 - 01417201 _____ () C:\Windows\WindowsUpdate.log
2015-05-29 16:40 - 2013-02-22 21:17 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-29 16:37 - 2013-02-22 21:17 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-29 16:36 - 2012-07-11 10:55 - 00031212 _____ () C:\Windows\setupact.log
2015-05-29 16:36 - 2009-07-13 22:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-29 15:27 - 2012-02-25 18:15 - 00002113 _____ () C:\Windows\epplauncher.mif
2015-05-29 15:07 - 2011-11-26 13:32 - 00107608 _____ () C:\Users\Lou\AppData\Local\GDIPFONTCACHEV1.DAT
2015-05-29 15:06 - 2009-07-13 20:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2015-05-29 15:05 - 2009-07-13 21:45 - 04958808 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-29 15:04 - 2013-02-23 11:29 - 00025456 _____ () C:\Windows\PFRO.log
2015-05-29 15:01 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\tracing
2015-05-29 15:01 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-05-29 15:01 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-05-29 15:01 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-29 15:01 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-05-29 15:01 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\AppCompat
2015-05-29 14:33 - 2011-11-26 13:09 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-05-29 14:23 - 2012-02-25 18:12 - 00773342 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-05-29 13:00 - 2013-09-26 12:50 - 00000000 ____D () C:\Users\Lou\AppData\Local\D31C7373-0F48-41AA-8BBD-872EEDECA5F2.aplzod
2015-05-29 11:27 - 2011-11-26 13:54 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-05-29 09:45 - 2009-07-13 22:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-05-29 02:00 - 2011-11-26 13:56 - 00000000 ____D () C:\Users\Lou\AppData\Local\Adobe
2015-05-25 16:07 - 2009-07-13 19:34 - 00000615 _____ () C:\Windows\win.ini
2015-05-25 15:42 - 2013-02-22 21:18 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-05-22 17:01 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\system32\GroupPolicy
2015-05-22 16:07 - 2012-07-07 16:55 - 00731136 ___SH () C:\Users\Lou\Desktop\Thumbs.db
2015-05-22 16:05 - 2014-10-17 13:54 - 00000000 ____D () C:\Users\Lou\Desktop\Mo 2
2015-05-14 21:35 - 2013-02-22 21:17 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-14 21:35 - 2013-02-22 21:17 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-13 19:00 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\rescache
2015-05-13 15:55 - 2009-07-14 00:45 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-13 15:48 - 2013-08-15 03:02 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-13 15:48 - 2012-03-21 00:18 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-13 15:44 - 2013-03-13 17:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-13 15:43 - 2013-03-13 17:34 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-05-13 15:43 - 2013-03-13 17:34 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
 
==================== Files in the root of some directories =======
 
2008-02-05 14:28 - 2008-02-05 14:28 - 0000051 _____ () C:\Users\Lou\AppData\Local\setup.txt
2013-12-05 16:18 - 2013-12-05 16:18 - 2427882 _____ () C:\Users\Lou\AppData\Local\[j0002]-[p02].bmp
2013-12-05 16:18 - 2013-12-05 16:18 - 2427882 _____ () C:\Users\Lou\AppData\Local\[j0002]-[p03].bmp
2013-12-05 16:18 - 2013-12-05 16:18 - 2427882 _____ () C:\Users\Lou\AppData\Local\[j0002]-[p04].bmp
2013-12-05 16:18 - 2013-12-05 16:18 - 2427882 _____ () C:\Users\Lou\AppData\Local\[j0002]-[p05].bmp
2013-12-05 16:18 - 2013-12-05 16:18 - 2427882 _____ () C:\Users\Lou\AppData\Local\[j0002]-[p06].bmp
2013-12-05 16:18 - 2013-12-05 16:18 - 2427882 _____ () C:\Users\Lou\AppData\Local\[j0002]-[p07].bmp
2013-12-05 16:18 - 2013-12-05 16:18 - 2427882 _____ () C:\Users\Lou\AppData\Local\[j0002]-[p08].bmp
2013-12-05 16:18 - 2013-12-05 16:18 - 2427882 _____ () C:\Users\Lou\AppData\Local\[j0002]-[p09].bmp
2013-12-05 16:18 - 2013-12-05 16:18 - 2427882 _____ () C:\Users\Lou\AppData\Local\[j0002]-[p10].bmp
2014-01-04 23:38 - 2014-01-04 23:38 - 0000057 _____ () C:\ProgramData\Ament.ini
2011-11-26 14:20 - 2011-11-26 14:27 - 0001277 _____ () C:\ProgramData\hpzinstall.log
 
Some files in TEMP:
====================
C:\Users\Lou\AppData\Local\Temp\DefaultAssets.exe
C:\Users\Lou\AppData\Local\Temp\DefaultOfflineContent.exe
C:\Users\Lou\AppData\Local\Temp\dotNetFx40_Client_x86_x64.exe
C:\Users\Lou\AppData\Local\Temp\NLStubInstallerResources.dll
C:\Users\Lou\AppData\Local\Temp\PCCU_Installer.exe
C:\Users\Lou\AppData\Local\Temp\Quarantine.exe
C:\Users\Lou\AppData\Local\Temp\readSTILog.dll
C:\Users\Lou\AppData\Local\Temp\sqlite3.dll
 
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2015-05-28 22:01
 
==================== End of log ============================

Attached Files



BC AdBot (Login to Remove)

 


m

#2 deeprybka

deeprybka

  • Malware Response Team
  • 5,198 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:08:09 AM

Posted 30 May 2015 - 03:47 AM

Hi & :welcome: to Bleeping Computer Forums!
My name is Jürgen and I will be assisting you with your Malware related problems. :warrior:

Before we move on, please read the following points carefully: :exclame:

  • My native language isn't English. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.
  • Please read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
  • Perform everything in the correct order. Sometimes one step requires the previous one.
  • If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
  • If you have illegal/cracked software, cracks, keygens, etc. on the system, please remove or uninstall them now!
  • Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
  • Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
  • If I don't hear from you within 5 days from this initial or any subsequent post, then this thread will be closed.
  • If I don't reply within 24 hours please PM me!
  • Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.

Step 1
Please download ListPartslistparts.png(by Farbar) and save it to your Desktop

  • Start the ListParts64.exe.
  • Press the Scan Button.
  • When finished, Listparts will produce a log (Result.txt) in the same directory the tool was run from.
    Please copy and paste the log in your next reply.

regards,
deeprybka
:busy:
Neminem laede, immo omnes, quantum potes, iuva. Arthur Schopenhauer
 
unite_blue.png
asap.png

#3 elbruceo

elbruceo
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:10:09 PM

Posted 30 May 2015 - 12:30 PM

Unfortunately before i could get back to this device the owner ran tdsskiller and now we have a MBR problem system comes up with black screen.



#4 deeprybka

deeprybka

  • Malware Response Team
  • 5,198 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:08:09 AM

Posted 30 May 2015 - 01:00 PM

Unfortunately before i could get back to this device the owner ran tdsskiller and now we have a MBR problem system comes up with black screen.

 

:rolleyes:

 

MBR problem? Please describe it more in detail.


regards,
deeprybka
:busy:
Neminem laede, immo omnes, quantum potes, iuva. Arthur Schopenhauer
 
unite_blue.png
asap.png

#5 elbruceo

elbruceo
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:10:09 PM

Posted 30 May 2015 - 02:56 PM

ran tdsskiller now get blank screen at boot

Device will boot with CD boot disc and can see data

I don't have the original install disc so i am hesitant on doing a repair with another system 7 disc

I do have a copy of Active Boot Disc ver 3.0.72 but a little gun shy on using it

 

this info below may or may not be helpful

 

microsoft sec esnt showed

 

Alureon E virus (suspended)

Boot:\device\hardiskvolume4

Boot:\device\hardiskvolume4\

Boot:\\physicaldrive0\partion3 (type 17)



#6 deeprybka

deeprybka

  • Malware Response Team
  • 5,198 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:08:09 AM

Posted 31 May 2015 - 03:22 AM

Step 1

rufus-128.png + FRST.gif Scan with FRST from the Recovery Environment

On a clean machine, please download Farbar Recovery Scan Tool and save it to a flash drive.
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

To enter System Recovery Options from the Advanced Boot Options:

  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.

Note: In case you can not enter System Recovery Options by using F8 method, you can use Windows installation disc, or make a repair disc. Any Windows installation disc or a repair disc made on another computer can be used.
To make a repair disk on Windows 7 consult: http://www.sevenforums.com/tutorials/2083-system-repair-disc-create.html




To enter System Recovery Options by using Windows installation disc:

  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.

==========

On the System Recovery Options menu you will get the following options:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt


Select Command Prompt

==========


Once in the Command Prompt:

  • In the command window type in notepad and press Enter.
  • The notepad opens. Under File menu select Open.
  • Select "Computer" and find your flash drive letter and close the notepad.
  • In the command window type e:\frst (for x64 bit version type e:\frst64) and press Enter
    Note: Replace letter e with the drive letter of your flash drive.
  • The tool will start to run.
  • When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

regards,
deeprybka
:busy:
Neminem laede, immo omnes, quantum potes, iuva. Arthur Schopenhauer
 
unite_blue.png
asap.png

#7 elbruceo

elbruceo
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:10:09 PM

Posted 31 May 2015 - 06:09 PM

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 29-05-2015
Ran by SYSTEM on MININT-CVDSV8H on 31-05-2015 15:31:29
Running from l:\
Platform: Windows 7 Home Premium (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Recovery
 
The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-03] (Adobe Systems Incorporated)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7981088 2009-07-20] (Realtek Semiconductor)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-06] (Apple Inc.)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [406992 2010-02-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-03-20] (Apple Inc.)
HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\RunOnce: [{DB178A14-4938-4C56-9956-19C01E56277B}] => cmd.exe /C start /D "C:\Users\Lou\AppData\Local\Temp" /B {DB178A14-4938-4C56-9956-19C01E56277B}.exe -accepteula -accepteulaksn -postboot
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\Lou\...\Run: [MobileDocuments] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
HKU\Lou\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-11-21] (Apple Inc.)
HKU\Lou\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-11-21] (Apple Inc.)
HKU\Lou\...\Run: [AppleIEDAV] => C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe [1080104 2014-08-04] (Apple Inc.)
HKU\Lou\...\Run: [CAHeadless] => C:\Program Files (x86)\Adobe\Elements 12 Organizer\CAHeadless\ElementsAutoAnalyzer.exe [1400224 2013-09-03] (Adobe Systems Incorporated)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
 
==================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S2 AdobeActiveFileMonitor12.0; C:\Program Files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe [181152 2013-09-03] (Adobe Systems Incorporated)
S2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
S2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
S2 Norton PC Checkup Application Launcher; C:\Program Files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe [132504 2013-03-24] (Symantec Corporation)
S2 PCCUJobMgr; C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe [126392 2011-11-07] (Symantec Corporation)
S2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2012-03-20] ()
S2 PnkBstrB; C:\Windows\SysWOW64\PnkBstrB.exe [189248 2012-03-20] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S0 73179079; C:\Windows\System32\drivers\30288452.sys [248728 2015-05-29] (Kaspersky Lab, Yury Parshin)
S5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
S0 PxHlpa64; C:\Windows\System32\drivers\PxHlpa64.sys [56336 2013-07-19] (Corel Corporation)
S3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [926824 2013-03-12] (Realtek Semiconductor Corporation                           )
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-05-29 17:02 - 2015-05-29 17:02 - 00248728 _____ (Kaspersky Lab, Yury Parshin) C:\Windows\System32\Drivers\30288452.sys
2015-05-29 17:02 - 2015-05-29 17:02 - 00000000 ____D () C:\TDSSKiller_Quarantine
2015-05-29 17:00 - 2015-05-29 17:00 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Lou\Downloads\tdsskiller.exe
2015-05-29 14:01 - 2015-05-29 14:06 - 00000000 ___SD () C:\Windows\System32\GWX
2015-05-29 14:01 - 2015-05-29 14:01 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-05-29 14:01 - 2015-05-29 14:01 - 00000000 ___SD () C:\Windows\System32\CompatTel
2015-05-29 14:01 - 2015-05-29 14:01 - 00000000 ____D () C:\Windows\System32\appraiser
2015-05-29 13:33 - 2015-01-08 15:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls
2015-05-29 13:33 - 2015-01-08 15:43 - 00419936 _____ () C:\Windows\System32\locale.nls
2015-05-29 13:32 - 2015-05-29 14:25 - 00000000 ____D () C:\ProgramData\Skype
2015-05-29 13:32 - 2015-05-29 14:22 - 00000000 ____D () C:\Users\Lou\AppData\Roaming\Skype
2015-05-29 13:32 - 2015-05-29 13:32 - 00000000 ____D () C:\Users\Lou\AppData\Local\Skype
2015-05-29 13:27 - 2013-10-01 18:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\TsUsbFlt.sys
2015-05-29 13:27 - 2013-10-01 18:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\System32\TsUsbRedirectionGroupPolicyControl.exe
2015-05-29 13:27 - 2013-10-01 18:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll
2015-05-29 13:27 - 2013-10-01 17:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\System32\MsRdpWebAccess.dll
2015-05-29 13:27 - 2013-10-01 17:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\System32\wksprtPS.dll
2015-05-29 13:27 - 2013-10-01 17:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\System32\tsgqec.dll
2015-05-29 13:27 - 2013-10-01 17:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\System32\TsUsbGDCoInstaller.dll
2015-05-29 13:27 - 2013-10-01 16:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\System32\rdvidcrl.dll
2015-05-29 13:27 - 2013-10-01 16:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2015-05-29 13:27 - 2013-10-01 16:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2015-05-29 13:27 - 2013-10-01 16:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\System32\TSWbPrxy.exe
2015-05-29 13:27 - 2013-10-01 16:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\System32\wksprt.exe
2015-05-29 13:27 - 2013-10-01 15:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2015-05-29 13:27 - 2013-10-01 15:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\System32\mstsc.exe
2015-05-29 13:27 - 2013-10-01 15:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2015-05-29 13:27 - 2013-10-01 14:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2015-05-29 13:27 - 2013-10-01 12:57 - 06578176 _____ (Microsoft Corporation) C:\Windows\System32\mstscax.dll
2015-05-29 13:27 - 2013-10-01 12:55 - 05698048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-05-29 13:10 - 2012-08-23 06:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\System32\rdpudd.dll
2015-05-29 13:10 - 2012-08-23 06:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\rdpvideominiport.sys
2015-05-29 13:10 - 2012-08-23 05:24 - 00015360 _____ (Microsoft Corporation) C:\Windows\System32\RdpGroupPolicyExtension.dll
2015-05-29 13:10 - 2012-08-23 03:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2015-05-29 13:10 - 2012-08-23 02:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\System32\rdpendp_winip.dll
2015-05-29 13:10 - 2012-08-23 01:51 - 03174912 _____ (Microsoft Corporation) C:\Windows\System32\rdpcorets.dll
2015-05-29 13:04 - 2012-07-25 19:08 - 00744448 _____ (Microsoft Corporation) C:\Windows\System32\WUDFx.dll
2015-05-29 13:04 - 2012-07-25 19:08 - 00229888 _____ (Microsoft Corporation) C:\Windows\System32\WUDFHost.exe
2015-05-29 13:04 - 2012-07-25 19:08 - 00194048 _____ (Microsoft Corporation) C:\Windows\System32\WUDFPlatform.dll
2015-05-29 13:04 - 2012-07-25 19:08 - 00084992 _____ (Microsoft Corporation) C:\Windows\System32\WUDFSvc.dll
2015-05-29 13:04 - 2012-07-25 19:08 - 00045056 _____ (Microsoft Corporation) C:\Windows\System32\WUDFCoinstaller.dll
2015-05-29 13:04 - 2012-07-25 18:26 - 00198656 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\WUDFRd.sys
2015-05-29 13:04 - 2012-07-25 18:26 - 00087040 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\WUDFPf.sys
2015-05-29 13:04 - 2012-06-02 06:57 - 00000003 _____ () C:\Windows\System32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
2015-05-29 12:50 - 2014-06-26 18:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\System32\msmpeg2vdec.dll
2015-05-29 12:50 - 2014-06-26 17:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2015-05-29 12:47 - 2015-04-27 11:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2015-05-29 12:47 - 2015-04-27 11:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2015-05-29 12:47 - 2015-04-27 11:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2015-05-29 12:47 - 2015-04-27 11:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\System32\diagtrack.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\System32\kernel32.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\System32\tdh.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\System32\advapi32.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\System32\kerberos.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\System32\srcore.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\KernelBase.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\System32\wow64win.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\System32\msv1_0.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\System32\wow64.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\System32\winsrv.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\System32\wdigest.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\System32\sspicli.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\System32\sechost.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\System32\srclient.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\System32\csrsrv.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\System32\sspisrv.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\System32\secur32.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\System32\ntvdm64.dll
2015-05-29 12:47 - 2015-04-27 11:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\System32\wow64cpu.dll
2015-05-29 12:47 - 2015-04-27 11:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\System32\tracerpt.exe
2015-05-29 12:47 - 2015-04-27 11:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\System32\conhost.exe
2015-05-29 12:47 - 2015-04-27 11:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\System32\rstrui.exe
2015-05-29 12:47 - 2015-04-27 11:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\System32\smss.exe
2015-05-29 12:47 - 2015-04-27 11:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\System32\logman.exe
2015-05-29 12:47 - 2015-04-27 11:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\System32\typeperf.exe
2015-05-29 12:47 - 2015-04-27 11:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\System32\relog.exe
2015-05-29 12:47 - 2015-04-27 11:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\System32\lsass.exe
2015-05-29 12:47 - 2015-04-27 11:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\System32\diskperf.exe
2015-05-29 12:47 - 2015-04-27 11:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\System32\auditpol.exe
2015-05-29 12:47 - 2015-04-27 11:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\System32\msaudite.dll
2015-05-29 12:47 - 2015-04-27 11:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\System32\msobjs.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\System32\adtschema.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\System32\apisetschema.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 11:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-05-29 12:47 - 2015-04-27 11:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-05-29 12:47 - 2015-04-27 11:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-05-29 12:47 - 2015-04-27 11:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-05-29 12:47 - 2015-04-27 11:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-29 12:47 - 2015-04-27 11:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-29 12:47 - 2015-04-27 11:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-29 12:47 - 2015-04-27 11:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-05-29 12:47 - 2015-04-27 11:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-29 12:47 - 2015-04-27 11:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-05-29 12:47 - 2015-04-27 11:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-29 12:47 - 2015-04-27 11:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-05-29 12:47 - 2015-04-27 11:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-05-29 12:47 - 2015-04-27 11:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-29 12:47 - 2015-04-27 11:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-05-29 12:47 - 2015-04-27 11:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-05-29 12:47 - 2015-04-27 11:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-05-29 12:47 - 2015-04-27 11:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-05-29 12:47 - 2015-04-27 11:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-05-29 12:47 - 2015-04-27 11:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-29 12:47 - 2015-04-27 11:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-05-29 12:47 - 2015-04-27 11:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-05-29 12:47 - 2015-04-27 11:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-29 12:47 - 2015-04-27 11:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-29 12:47 - 2015-04-27 11:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-05-29 12:47 - 2015-04-27 11:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-05-29 12:47 - 2015-04-27 11:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-29 12:47 - 2015-04-27 11:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 10:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\System32\UtcResources.dll
2015-05-29 12:47 - 2015-04-27 09:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-05-29 12:47 - 2015-04-27 09:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-05-29 12:47 - 2015-04-27 09:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 09:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 09:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-05-29 12:47 - 2015-04-27 09:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-05-29 12:47 - 2015-03-22 19:25 - 00769536 _____ (Microsoft Corporation) C:\Windows\System32\invagent.dll
2015-05-29 12:47 - 2015-03-22 19:25 - 00726528 _____ (Microsoft Corporation) C:\Windows\System32\generaltel.dll
2015-05-29 12:47 - 2015-03-22 19:24 - 00957952 _____ (Microsoft Corporation) C:\Windows\System32\appraiser.dll
2015-05-29 12:47 - 2015-03-22 19:24 - 00419840 _____ (Microsoft Corporation) C:\Windows\System32\devinv.dll
2015-05-29 12:47 - 2015-03-22 19:24 - 00227328 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2015-05-29 12:47 - 2015-03-22 19:24 - 00192000 _____ (Microsoft Corporation) C:\Windows\System32\aepic.dll
2015-05-29 12:47 - 2015-03-22 19:24 - 00030720 _____ (Microsoft Corporation) C:\Windows\System32\acmigration.dll
2015-05-29 12:47 - 2015-03-22 19:17 - 01111552 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2015-05-29 12:47 - 2015-01-27 15:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\System32\aitstatic.exe
2015-05-29 12:47 - 2012-10-09 10:17 - 00226816 _____ (Microsoft Corporation) C:\Windows\System32\dhcpcore6.dll
2015-05-29 12:47 - 2012-10-09 10:17 - 00055296 _____ (Microsoft Corporation) C:\Windows\System32\dhcpcsvc6.dll
2015-05-29 12:47 - 2012-10-09 09:40 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcore6.dll
2015-05-29 12:47 - 2012-10-09 09:40 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcsvc6.dll
2015-05-29 12:46 - 2015-03-03 20:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\System32\apphelp.dll
2015-05-29 12:46 - 2015-03-03 20:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\System32\aelupsvc.dll
2015-05-29 12:46 - 2015-03-03 20:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\System32\sdbinst.exe
2015-05-29 12:46 - 2015-03-03 20:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\System32\shimeng.dll
2015-05-29 12:46 - 2015-03-03 20:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-05-29 12:46 - 2015-03-03 20:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-05-29 12:46 - 2015-03-03 20:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-29 12:46 - 2014-07-08 18:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\System32\KBDYAK.DLL
2015-05-29 12:46 - 2014-07-08 18:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\System32\KBDTAT.DLL
2015-05-29 12:46 - 2014-07-08 18:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\System32\KBDRU1.DLL
2015-05-29 12:46 - 2014-07-08 18:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\System32\KBDBASH.DLL
2015-05-29 12:46 - 2014-07-08 18:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\System32\KBDRU.DLL
2015-05-29 12:46 - 2014-07-08 17:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2015-05-29 12:46 - 2014-07-08 17:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2015-05-29 12:46 - 2014-07-08 17:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2015-05-29 12:46 - 2014-07-08 17:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2015-05-29 12:46 - 2014-07-08 17:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2015-05-29 12:46 - 2013-12-03 18:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\System32\secproc.dll
2015-05-29 12:46 - 2013-12-03 18:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\System32\secproc_isv.dll
2015-05-29 12:46 - 2013-12-03 18:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\System32\secproc_ssp_isv.dll
2015-05-29 12:46 - 2013-12-03 18:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\System32\secproc_ssp.dll
2015-05-29 12:46 - 2013-12-03 18:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\System32\msdrm.dll
2015-05-29 12:46 - 2013-12-03 18:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\System32\RMActivate_isv.exe
2015-05-29 12:46 - 2013-12-03 18:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\System32\RMActivate.exe
2015-05-29 12:46 - 2013-12-03 18:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\System32\RMActivate_ssp.exe
2015-05-29 12:46 - 2013-12-03 18:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\System32\RMActivate_ssp_isv.exe
2015-05-29 12:46 - 2013-12-03 18:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2015-05-29 12:46 - 2013-12-03 18:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2015-05-29 12:46 - 2013-12-03 18:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2015-05-29 12:46 - 2013-12-03 18:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2015-05-29 12:46 - 2013-12-03 18:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2015-05-29 12:46 - 2013-12-03 17:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2015-05-29 12:46 - 2013-12-03 17:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2015-05-29 12:46 - 2013-12-03 17:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2015-05-29 12:46 - 2013-12-03 17:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2015-05-29 12:46 - 2012-12-07 05:20 - 00441856 _____ (Microsoft Corporation) C:\Windows\System32\Wpc.dll
2015-05-29 12:46 - 2012-12-07 05:15 - 02746368 _____ (Microsoft Corporation) C:\Windows\System32\gameux.dll
2015-05-29 12:46 - 2012-12-07 04:26 - 00308736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wpc.dll
2015-05-29 12:46 - 2012-12-07 04:20 - 02576384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gameux.dll
2015-05-29 12:46 - 2012-12-07 03:20 - 00045568 _____ (Microsoft) C:\Windows\System32\oflc-nz.rs
2015-05-29 12:46 - 2012-12-07 03:20 - 00044544 _____ (Microsoft) C:\Windows\System32\pegibbfc.rs
2015-05-29 12:46 - 2012-12-07 03:20 - 00043520 _____ (Microsoft) C:\Windows\System32\csrr.rs
2015-05-29 12:46 - 2012-12-07 03:20 - 00030720 _____ (Microsoft) C:\Windows\System32\usk.rs
2015-05-29 12:46 - 2012-12-07 03:20 - 00023552 _____ (Microsoft) C:\Windows\System32\oflc.rs
2015-05-29 12:46 - 2012-12-07 03:20 - 00020480 _____ (Microsoft) C:\Windows\System32\pegi-pt.rs
2015-05-29 12:46 - 2012-12-07 03:20 - 00020480 _____ (Microsoft) C:\Windows\System32\pegi-fi.rs
2015-05-29 12:46 - 2012-12-07 03:19 - 00055296 _____ (Microsoft) C:\Windows\System32\cero.rs
2015-05-29 12:46 - 2012-12-07 03:19 - 00051712 _____ (Microsoft) C:\Windows\System32\esrb.rs
2015-05-29 12:46 - 2012-12-07 03:19 - 00046592 _____ (Microsoft) C:\Windows\System32\fpb.rs
2015-05-29 12:46 - 2012-12-07 03:19 - 00040960 _____ (Microsoft) C:\Windows\System32\cob-au.rs
2015-05-29 12:46 - 2012-12-07 03:19 - 00021504 _____ (Microsoft) C:\Windows\System32\grb.rs
2015-05-29 12:46 - 2012-12-07 03:19 - 00020480 _____ (Microsoft) C:\Windows\System32\pegi.rs
2015-05-29 12:46 - 2012-12-07 03:19 - 00015360 _____ (Microsoft) C:\Windows\System32\djctq.rs
2015-05-29 12:46 - 2012-12-07 02:46 - 00055296 _____ (Microsoft) C:\Windows\SysWOW64\cero.rs
2015-05-29 12:46 - 2012-12-07 02:46 - 00051712 _____ (Microsoft) C:\Windows\SysWOW64\esrb.rs
2015-05-29 12:46 - 2012-12-07 02:46 - 00046592 _____ (Microsoft) C:\Windows\SysWOW64\fpb.rs
2015-05-29 12:46 - 2012-12-07 02:46 - 00045568 _____ (Microsoft) C:\Windows\SysWOW64\oflc-nz.rs
2015-05-29 12:46 - 2012-12-07 02:46 - 00044544 _____ (Microsoft) C:\Windows\SysWOW64\pegibbfc.rs
2015-05-29 12:46 - 2012-12-07 02:46 - 00043520 _____ (Microsoft) C:\Windows\SysWOW64\csrr.rs
2015-05-29 12:46 - 2012-12-07 02:46 - 00040960 _____ (Microsoft) C:\Windows\SysWOW64\cob-au.rs
2015-05-29 12:46 - 2012-12-07 02:46 - 00030720 _____ (Microsoft) C:\Windows\SysWOW64\usk.rs
2015-05-29 12:46 - 2012-12-07 02:46 - 00023552 _____ (Microsoft) C:\Windows\SysWOW64\oflc.rs
2015-05-29 12:46 - 2012-12-07 02:46 - 00021504 _____ (Microsoft) C:\Windows\SysWOW64\grb.rs
2015-05-29 12:46 - 2012-12-07 02:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi-pt.rs
2015-05-29 12:46 - 2012-12-07 02:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi-fi.rs
2015-05-29 12:46 - 2012-12-07 02:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi.rs
2015-05-29 12:46 - 2012-12-07 02:46 - 00015360 _____ (Microsoft) C:\Windows\SysWOW64\djctq.rs
2015-05-29 12:45 - 2014-11-07 19:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2015-05-29 12:45 - 2014-11-07 18:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2015-05-29 12:45 - 2013-10-03 18:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\System32\SmartcardCredentialProvider.dll
2015-05-29 12:45 - 2013-10-03 18:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\System32\credui.dll
2015-05-29 12:45 - 2013-10-03 17:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2015-05-29 12:45 - 2013-10-03 17:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2015-05-29 12:44 - 2015-01-08 19:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\System32\perftrack.dll
2015-05-29 12:44 - 2015-01-08 19:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\System32\wdi.dll
2015-05-29 12:44 - 2015-01-08 19:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\System32\powertracker.dll
2015-05-29 12:44 - 2015-01-08 18:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-05-29 12:44 - 2014-08-01 03:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\System32\TSWorkspace.dll
2015-05-29 12:44 - 2014-08-01 03:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2015-05-29 12:44 - 2014-02-03 18:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\msiscsi.sys
2015-05-29 12:44 - 2014-02-03 18:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\storport.sys
2015-05-29 12:44 - 2014-02-03 18:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\Diskdump.sys
2015-05-29 12:44 - 2014-02-03 18:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\iologmsg.dll
2015-05-29 12:44 - 2014-02-03 18:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2015-05-29 12:44 - 2013-10-29 18:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\System32\msieftp.dll
2015-05-29 12:44 - 2013-10-29 18:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2015-05-29 12:44 - 2013-07-04 04:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\System32\WebClnt.dll
2015-05-29 12:44 - 2013-07-04 04:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\System32\davclnt.dll
2015-05-29 12:44 - 2013-07-04 03:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2015-05-29 12:44 - 2013-07-04 03:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2015-05-29 12:44 - 2013-05-09 21:49 - 00030720 _____ (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2015-05-29 12:44 - 2013-05-09 19:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2015-05-29 12:44 - 2012-10-03 09:44 - 00246272 _____ (Microsoft Corporation) C:\Windows\System32\netcorehc.dll
2015-05-29 12:44 - 2012-10-03 09:44 - 00018944 _____ (Microsoft Corporation) C:\Windows\System32\netevent.dll
2015-05-29 12:44 - 2012-10-03 09:42 - 00569344 _____ (Microsoft Corporation) C:\Windows\System32\iphlpsvc.dll
2015-05-29 12:44 - 2012-10-03 08:42 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcorehc.dll
2015-05-29 12:44 - 2012-10-03 08:42 - 00018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netevent.dll
2015-05-29 12:44 - 2012-10-03 08:07 - 00045568 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpipreg.sys
2015-05-29 12:44 - 2012-08-22 10:12 - 00950128 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ndis.sys
2015-05-29 12:44 - 2012-07-04 12:26 - 00041472 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\RNDISMP.sys
2015-05-29 12:43 - 2015-04-10 19:19 - 00069888 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\stream.sys
2015-05-29 12:43 - 2015-03-13 19:21 - 01632768 _____ (Microsoft Corporation) C:\Windows\System32\dwmcore.dll
2015-05-29 12:43 - 2015-03-13 19:21 - 00082944 _____ (Microsoft Corporation) C:\Windows\System32\dwmapi.dll
2015-05-29 12:43 - 2015-03-13 19:04 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-05-29 12:43 - 2015-03-13 19:04 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2015-05-29 12:43 - 2015-01-28 19:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\System32\wpdshext.dll
2015-05-29 12:43 - 2015-01-28 19:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-29 12:43 - 2014-11-25 19:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\System32\oleaut32.dll
2015-05-29 12:43 - 2014-11-25 19:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-05-29 12:43 - 2014-11-10 17:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tdx.sys
2015-05-29 12:43 - 2014-10-29 18:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\System32\charmap.exe
2015-05-29 12:43 - 2014-10-29 17:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe
2015-05-29 12:43 - 2014-10-13 18:13 - 03241984 _____ (Microsoft Corporation) C:\Windows\System32\msi.dll
2015-05-29 12:43 - 2014-10-13 17:50 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-05-29 12:43 - 2014-10-02 18:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\System32\WsmSvc.dll
2015-05-29 12:43 - 2014-10-02 18:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\System32\WSManMigrationPlugin.dll
2015-05-29 12:43 - 2014-10-02 18:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\System32\WsmWmiPl.dll
2015-05-29 12:43 - 2014-10-02 18:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\System32\WsmAuto.dll
2015-05-29 12:43 - 2014-10-02 18:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\System32\WSManHTTPConfig.exe
2015-05-29 12:43 - 2014-10-02 17:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2015-05-29 12:43 - 2014-10-02 17:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
2015-05-29 12:43 - 2014-10-02 17:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2015-05-29 12:43 - 2014-10-02 17:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2015-05-29 12:43 - 2014-10-02 17:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
2015-05-29 12:43 - 2014-06-23 19:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\System32\d3d10warp.dll
2015-05-29 12:43 - 2014-06-23 18:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2015-05-29 12:43 - 2014-01-27 18:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\System32\wwansvc.dll
2015-05-29 12:43 - 2014-01-23 18:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys
2015-05-29 12:43 - 2013-08-04 18:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ataport.sys
2015-05-29 12:43 - 2013-03-18 21:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll
2015-05-29 12:43 - 2013-01-23 22:01 - 00223752 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\fvevol.sys
2015-05-29 12:43 - 2012-08-21 13:01 - 00245760 _____ (Microsoft Corporation) C:\Windows\System32\OxpsConverter.exe
2015-05-29 12:17 - 2011-05-03 21:25 - 02315776 _____ (Microsoft Corporation) C:\Windows\System32\tquery.dll
2015-05-29 12:17 - 2011-05-03 21:22 - 02223616 _____ (Microsoft Corporation) C:\Windows\System32\mssrch.dll
2015-05-29 12:17 - 2011-05-03 21:22 - 00778752 _____ (Microsoft Corporation) C:\Windows\System32\mssvp.dll
2015-05-29 12:17 - 2011-05-03 21:22 - 00491520 _____ (Microsoft Corporation) C:\Windows\System32\mssph.dll
2015-05-29 12:17 - 2011-05-03 21:22 - 00288256 _____ (Microsoft Corporation) C:\Windows\System32\mssphtb.dll
2015-05-29 12:17 - 2011-05-03 21:22 - 00075264 _____ (Microsoft Corporation) C:\Windows\System32\msscntrs.dll
2015-05-29 12:17 - 2011-05-03 21:19 - 00591872 _____ (Microsoft Corporation) C:\Windows\System32\SearchIndexer.exe
2015-05-29 12:17 - 2011-05-03 21:19 - 00249856 _____ (Microsoft Corporation) C:\Windows\System32\SearchProtocolHost.exe
2015-05-29 12:17 - 2011-05-03 21:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\System32\SearchFilterHost.exe
2015-05-29 12:17 - 2011-05-03 20:34 - 01549312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2015-05-29 12:17 - 2011-05-03 20:32 - 01401344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2015-05-29 12:17 - 2011-05-03 20:32 - 00666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2015-05-29 12:17 - 2011-05-03 20:32 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2015-05-29 12:17 - 2011-05-03 20:32 - 00197120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssphtb.dll
2015-05-29 12:17 - 2011-05-03 20:32 - 00059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscntrs.dll
2015-05-29 12:17 - 2011-05-03 20:28 - 00427520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2015-05-29 12:17 - 2011-05-03 20:28 - 00164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2015-05-29 12:17 - 2011-05-03 20:28 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFilterHost.exe
2015-05-29 12:14 - 2013-08-27 17:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\System32\scavengeui.dll
2015-05-29 11:58 - 2015-05-29 11:58 - 00000000 ____D () C:\Windows\erdnt
2015-05-29 11:58 - 2015-05-29 11:58 - 00000000 ____D () C:\Qoobox
2015-05-29 11:57 - 2015-05-29 11:58 - 00000000 ___SD () C:\32788R22FWJFW
2015-05-29 11:34 - 2015-05-29 11:34 - 00001759 _____ () C:\Users\Lou\Desktop\JRT.txt
2015-05-29 11:31 - 2015-05-29 11:31 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-LOU-PC-Windows-7-Home-Premium-(64-bit).dat
2015-05-29 11:31 - 2015-05-29 11:31 - 00000000 ____D () C:\RegBackup
2015-05-29 10:59 - 2015-05-31 15:31 - 00000000 ____D () C:\FRST
2015-05-29 10:27 - 2013-03-12 19:49 - 00926824 _____ (Realtek Semiconductor Corporation ) C:\Windows\System32\rtl8192cu.sys
2015-05-29 10:27 - 2013-03-12 19:49 - 00926824 _____ (Realtek Semiconductor Corporation ) C:\Windows\System32\Drivers\RTL8192cu.sys
2015-05-29 10:27 - 2013-03-12 19:49 - 00007540 _____ () C:\Windows\System32\net8192cu.cat
2015-05-29 10:25 - 2015-05-29 10:25 - 00000000 ____D () C:\ProgramData\TP-LINK
2015-05-29 10:14 - 2015-05-29 14:36 - 00000000 ____D () C:\AdwCleaner
2015-05-29 10:12 - 2015-05-29 16:32 - 00000000 ____D () C:\Users\Lou\Desktop\Antivirus
2015-05-28 17:15 - 2015-05-28 17:15 - 00000000 ____D () C:\Users\Default\AppData\Local\SlimWare Utilities Inc
2015-05-28 17:15 - 2015-05-28 17:15 - 00000000 ____D () C:\Users\Default User\AppData\Local\SlimWare Utilities Inc
2015-05-25 14:31 - 2015-05-25 14:31 - 00000000 ____D () C:\Users\Lou\AppData\Local\LogMeIn Rescue Applet
2015-05-25 14:04 - 2015-05-29 14:38 - 00000258 __RSH () C:\ProgramData\ntuser.pol
2015-05-22 14:47 - 2015-05-22 14:47 - 00009045 _____ () C:\Users\Lou\Desktop\iPhoto.exe
2015-05-21 12:38 - 2015-05-29 00:38 - 00000000 ____D () C:\ProgramData\{a9c70ba8-df70-f0cc-a9c7-70ba8df72ea3}
2015-05-21 12:38 - 2015-05-21 12:38 - 00001991 _____ () C:\Users\Lou\Desktop\iPhoto.lnk
2015-05-13 14:44 - 2015-05-01 05:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 14:44 - 2015-05-01 05:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 11:44 - 2015-05-04 17:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll
2015-05-13 11:44 - 2015-05-04 17:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-13 11:44 - 2015-04-21 18:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2015-05-13 11:44 - 2015-04-21 17:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-13 11:44 - 2015-04-21 09:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2015-05-13 11:44 - 2015-04-21 09:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2015-05-13 11:44 - 2015-04-21 08:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2015-05-13 11:44 - 2015-04-21 08:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2015-05-13 11:44 - 2015-04-21 08:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2015-05-13 11:44 - 2015-04-21 08:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2015-05-13 11:44 - 2015-04-21 08:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2015-05-13 11:44 - 2015-04-21 08:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2015-05-13 11:44 - 2015-04-21 08:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2015-05-13 11:44 - 2015-04-21 08:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2015-05-13 11:44 - 2015-04-21 08:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2015-05-13 11:44 - 2015-04-21 08:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2015-05-13 11:44 - 2015-04-21 08:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2015-05-13 11:44 - 2015-04-21 08:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2015-05-13 11:44 - 2015-04-21 08:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2015-05-13 11:44 - 2015-04-21 08:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-13 11:44 - 2015-04-21 08:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-13 11:44 - 2015-04-21 08:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2015-05-13 11:44 - 2015-04-21 08:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2015-05-13 11:44 - 2015-04-21 08:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-13 11:44 - 2015-04-21 08:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-13 11:44 - 2015-04-21 08:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-13 11:44 - 2015-04-21 08:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-13 11:44 - 2015-04-21 08:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2015-05-13 11:44 - 2015-04-21 08:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-13 11:44 - 2015-04-21 08:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2015-05-13 11:44 - 2015-04-21 08:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-13 11:44 - 2015-04-21 08:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-13 11:44 - 2015-04-21 08:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-13 11:44 - 2015-04-21 08:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-13 11:44 - 2015-04-21 07:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-13 11:44 - 2015-04-21 07:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-13 11:44 - 2015-04-21 07:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-13 11:44 - 2015-04-21 07:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2015-05-13 11:44 - 2015-04-21 07:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2015-05-13 11:44 - 2015-04-21 07:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-13 11:44 - 2015-04-21 07:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2015-05-13 11:44 - 2015-04-21 07:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2015-05-13 11:44 - 2015-04-21 07:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-13 11:44 - 2015-04-21 07:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2015-05-13 11:44 - 2015-04-21 07:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-13 11:44 - 2015-04-21 07:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-13 11:44 - 2015-04-21 07:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-13 11:44 - 2015-04-21 07:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-13 11:44 - 2015-04-21 07:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-13 11:44 - 2015-04-21 07:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-13 11:44 - 2015-04-21 07:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-13 11:44 - 2015-04-21 07:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-13 11:44 - 2015-04-21 07:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2015-05-13 11:44 - 2015-04-21 07:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2015-05-13 11:44 - 2015-04-21 07:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-13 11:44 - 2015-04-21 06:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-13 11:44 - 2015-04-21 06:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-13 11:44 - 2015-04-17 19:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\System32\certcli.dll
2015-05-13 11:44 - 2015-04-17 18:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-13 11:43 - 2015-04-21 09:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2015-05-13 11:43 - 2015-04-21 08:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\System32\html.iec
2015-05-13 11:43 - 2015-04-21 08:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2015-05-13 11:43 - 2015-04-21 08:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2015-05-13 11:43 - 2015-04-21 07:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2015-05-13 11:42 - 2015-04-19 19:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\System32\DWrite.dll
2015-05-13 11:42 - 2015-04-19 19:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\System32\FntCache.dll
2015-05-13 11:42 - 2015-04-19 18:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-13 11:42 - 2015-04-19 18:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2015-05-13 11:42 - 2015-04-12 19:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\System32\services.exe
2015-05-13 11:42 - 2015-04-07 19:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\System32\InkEd.dll
2015-05-13 11:42 - 2015-04-07 19:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\System32\jnwmon.dll
2015-05-13 11:42 - 2015-04-07 19:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-13 11:42 - 2015-02-17 23:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-13 11:42 - 2015-02-17 23:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\System32\poqexec.exe
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-05-29 17:02 - 2011-11-26 11:51 - 01417960 _____ () C:\Windows\WindowsUpdate.log
2015-05-29 16:40 - 2013-02-22 20:17 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-29 16:32 - 2012-10-05 18:03 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-29 16:26 - 2009-07-13 21:13 - 00782510 _____ () C:\Windows\System32\PerfStringBackup.INI
2015-05-29 15:45 - 2009-07-13 20:45 - 00016112 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-29 15:45 - 2009-07-13 20:45 - 00016112 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-29 15:37 - 2013-02-22 20:17 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-29 15:36 - 2012-07-11 09:55 - 00031212 _____ () C:\Windows\setupact.log
2015-05-29 15:36 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-29 14:27 - 2012-02-25 17:15 - 00002113 _____ () C:\Windows\epplauncher.mif
2015-05-29 14:07 - 2011-11-26 12:32 - 00107608 _____ () C:\Users\Lou\AppData\Local\GDIPFONTCACHEV1.DAT
2015-05-29 14:05 - 2009-07-13 20:45 - 04958808 _____ () C:\Windows\System32\FNTCACHE.DAT
2015-05-29 14:04 - 2013-02-23 10:29 - 00025456 _____ () C:\Windows\PFRO.log
2015-05-29 14:01 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\tracing
2015-05-29 14:01 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-05-29 14:01 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\System32\Dism
2015-05-29 14:01 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\System32\AdvancedInstallers
2015-05-29 14:01 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-05-29 14:01 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\AppCompat
2015-05-29 13:33 - 2011-11-26 12:09 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-05-29 13:23 - 2012-02-25 17:12 - 00773342 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-05-29 12:00 - 2013-09-26 11:50 - 00000000 ____D () C:\Users\Lou\AppData\Local\D31C7373-0F48-41AA-8BBD-872EEDECA5F2.aplzod
2015-05-29 10:27 - 2011-11-26 12:54 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-05-29 08:45 - 2009-07-13 21:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-05-29 01:00 - 2011-11-26 12:56 - 00000000 ____D () C:\Users\Lou\AppData\Local\Adobe
2015-05-25 15:07 - 2009-07-13 18:34 - 00000615 _____ () C:\Windows\win.ini
2015-05-25 14:42 - 2013-02-22 20:18 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-05-22 16:01 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\System32\GroupPolicy
2015-05-22 15:07 - 2012-07-07 15:55 - 00731136 ___SH () C:\Users\Lou\Desktop\Thumbs.db
2015-05-22 15:05 - 2014-10-17 12:54 - 00000000 ____D () C:\Users\Lou\Desktop\Mo 2
2015-05-14 20:35 - 2013-02-22 20:17 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-14 20:35 - 2013-02-22 20:17 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-13 18:00 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\rescache
2015-05-13 14:55 - 2009-07-13 23:45 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-13 14:48 - 2013-08-15 02:02 - 00000000 ____D () C:\Windows\System32\MRT
2015-05-13 14:48 - 2012-03-20 23:18 - 140425016 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2015-05-13 14:43 - 2013-03-13 16:34 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-05-13 14:43 - 2013-03-13 16:34 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
 
Some files in TEMP:
====================
C:\Users\Lou\AppData\Local\Temp\DefaultAssets.exe
C:\Users\Lou\AppData\Local\Temp\DefaultOfflineContent.exe
C:\Users\Lou\AppData\Local\Temp\dotNetFx40_Client_x86_x64.exe
C:\Users\Lou\AppData\Local\Temp\NLStubInstallerResources.dll
C:\Users\Lou\AppData\Local\Temp\PCCU_Installer.exe
C:\Users\Lou\AppData\Local\Temp\Quarantine.exe
C:\Users\Lou\AppData\Local\Temp\readSTILog.dll
C:\Users\Lou\AppData\Local\Temp\sqlite3.dll
C:\Users\Lou\AppData\Local\Temp\{DB178A14-4938-4C56-9956-19C01E56277B}.exe
 
 
==================== Known DLLs (Whitelisted) ================
 
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe
[2015-05-13 11:42] - [2015-04-12 19:28] - 0328704 ____A (Microsoft Corporation) 71C85477DF9347FE8E7BC55768473FCA
 
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
==================== Restore Points =========================
 
Restore point made on: 2015-05-20 02:00:30
Restore point made on: 2015-05-20 20:56:51
Restore point made on: 2015-05-21 12:43:25
Restore point made on: 2015-05-21 22:01:00
Restore point made on: 2015-05-22 21:40:56
Restore point made on: 2015-05-25 15:58:05
Restore point made on: 2015-05-29 02:00:31
Restore point made on: 2015-05-29 10:27:14
Restore point made on: 2015-05-29 10:37:46
Restore point made on: 2015-05-29 10:50:34
Restore point made on: 2015-05-29 11:28:23
Restore point made on: 2015-05-29 12:02:17
Restore point made on: 2015-05-29 12:48:57
Restore point made on: 2015-05-29 14:25:02
Restore point made on: 2015-05-29 14:26:18
 
==================== Memory info =========================== 
 
Percentage of memory in use: 14%
Total physical RAM: 6007.09 MB
Available physical RAM: 5141.72 MB
Total Pagefile: 6005.24 MB
Available Pagefile: 5251.31 MB
Total Virtual: 8192 MB
Available Virtual: 8191.89 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:919.41 GB) (Free:692.23 GB) NTFS
Drive d: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (GRMCHPXFRER_EN_DVD) (CDROM) (Total:3 GB) (Free:0 GB) UDF
Drive l: (USB) (Removable) (Total:0.25 GB) (Free:0.25 GB) FAT
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (PQSERVICE) (Fixed) (Total:12 GB) (Free:4.5 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows XP) (Size: 931.5 GB) (Disk ID: AC7856D0)
Partition 1: (Active) - (Size=12 GB) - (Type=0B)
Partition 2: (Not Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=919.4 GB) - (Type=07 NTFS)
Partition 4: (Active) - (Size=1744 KB) - (Type=17) ATTENTION ===> Suspicious partition bootkit on partition 4
 
========================================================
Disk: 6 (Size: 979.8 MB) (Disk ID: 00000000)
 
Partition: GPT Partition Type.
 
 
LastRegBack: 2015-05-28 21:01
 
==================== End of log ============================


#8 deeprybka

deeprybka

  • Malware Response Team
  • 5,198 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:08:09 AM

Posted 31 May 2015 - 10:37 PM

Hi there,

Step 1

frst.pngfrstfixre.png

Please download the fixlist to your flash drive and save it in the same directory as FRST64.exe.
Start FRST again (like for the scan above) and press this time the FIX Button.
FRST will generate two files: Fixlog.txt and MBRDUMP. Please attach both to your next reply.

Attached File  fixlist.txt   48bytes   12 downloads

attachlogs.png

Edited by deeprybka, 31 May 2015 - 10:44 PM.

regards,
deeprybka
:busy:
Neminem laede, immo omnes, quantum potes, iuva. Arthur Schopenhauer
 
unite_blue.png
asap.png

#9 elbruceo

elbruceo
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:10:09 PM

Posted 01 June 2015 - 11:54 AM

i get message " it looks like you don't know what your doing"



#10 elbruceo

elbruceo
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:10:09 PM

Posted 01 June 2015 - 11:58 AM

I think i figured it out i will try again



#11 deeprybka

deeprybka

  • Malware Response Team
  • 5,198 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:08:09 AM

Posted 01 June 2015 - 12:00 PM

Please post a screenshot.


edit: OK

Edited by deeprybka, 01 June 2015 - 12:06 PM.

regards,
deeprybka
:busy:
Neminem laede, immo omnes, quantum potes, iuva. Arthur Schopenhauer
 
unite_blue.png
asap.png

#12 elbruceo

elbruceo
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:10:09 PM

Posted 01 June 2015 - 12:36 PM

here are the 2 files

Attached Files



#13 deeprybka

deeprybka

  • Malware Response Team
  • 5,198 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:08:09 AM

Posted 01 June 2015 - 12:41 PM

Hi,

Step 1
Please download ListPartslistparts.png(by Farbar) to your USB flash drive.

  • In the command window type e:\listparts64 and press Enter.
    Note: Replace letter e with the drive letter of your flash drive.
  • The tool will Open.
  • Press Scan button to run the tool.
  • When it finished it will make a log (Result.txt) on the flash drive. Please copy and paste it to your reply.

regards,
deeprybka
:busy:
Neminem laede, immo omnes, quantum potes, iuva. Arthur Schopenhauer
 
unite_blue.png
asap.png

#14 elbruceo

elbruceo
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:10:09 PM

Posted 01 June 2015 - 01:29 PM

first without "BCD" checked

ListParts by Farbar Version: 31-07-2014
Ran by SYSTEM (administrator) on 01-06-2015 at 11:24:32
Windows 7 (X64)
Running From: J:\
Language: English (United States)
************************************************************
 
========================= Memory info ====================== 
 
Percentage of memory in use: 9%
Total physical RAM: 6007.09 MB
Available physical RAM: 5416.4 MB
Total Pagefile: 6005.24 MB
Available Pagefile: 5393.24 MB
Total Virtual: 8192 MB
Available Virtual: 8191.93 MB
 
======================= Partitions =========================
 
1 Drive c: (PQSERVICE) (Fixed) (Total:12 GB) (Free:4.5 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
2 Drive d: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
3 Drive e: () (Fixed) (Total:919.41 GB) (Free:692.22 GB) NTFS
4 Drive f: (GRMCHPXFRER_EN_DVD) (CDROM) (Total:3 GB) (Free:0 GB) UDF
8 Drive j: () (Removable) (Total:1.86 GB) (Free:1.86 GB) FAT
10 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
 
  Disk ###  Status         Size     Free     Dyn  Gpt
  --------  -------------  -------  -------  ---  ---
  Disk 0    Online          931 GB      0 B         
  Disk 1    No Media           0 B      0 B         
  Disk 2    No Media           0 B      0 B         
  Disk 3    No Media           0 B      0 B         
  Disk 4    Online         1906 MB      0 B         
  Disk 5    No Media           0 B      0 B         
 
Partitions of Disk 0:
===============
 
Disk ID: AC7856D0
 
  Partition ###  Type              Size     Offset
  -------------  ----------------  -------  -------
  Partition 1    Primary             12 GB  1024 KB
  Partition 2    Primary            100 MB    12 GB
  Partition 3    Primary            919 GB    12 GB
  Partition 4    Primary           1744 KB   931 GB
 
======================================================================================================
 
Disk: 0
Partition 1
Type  : 0B
Hidden: No
Active: Yes
 
  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 1     C   PQSERVICE    NTFS   Partition     12 GB  Healthy            
 
======================================================================================================
 
Disk: 0
Partition 2
Type  : 07
Hidden: No
Active: No
 
  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 2     D   SYSTEM RESE  NTFS   Partition    100 MB  Healthy            
 
======================================================================================================
 
Disk: 0
Partition 3
Type  : 07
Hidden: No
Active: No
 
  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 3     E                NTFS   Partition    919 GB  Healthy            
 
======================================================================================================
 
Disk: 0
Partition 4
Type  : 17 (Suspicious Type)
Hidden: Yes
Active: Yes
 
There is no volume associated with this partition.
 
======================================================================================================
 
Partitions of Disk 4:
===============
 
Disk ID: 00000000
 
  Partition ###  Type              Size     Offset
  -------------  ----------------  -------  -------
  Partition 1    Primary           1905 MB    64 KB
 
======================================================================================================
 
Disk: 4
Partition 1
Type  : 06
Hidden: No
Active: No
 
  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 7     J                FAT    Removable   1905 MB  Healthy            
 
======================================================================================================
============================== MBR Partition Table ==================
 
==============================
Partitions of Disk 0:
===============
Disk ID: AC7856D0
Partition 1: (Active) - (Size=12 GB) - (Type=0B)
Partition 2: (Not Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=919 GB) - (Type=07 NTFS)
Partition 4: (Active) - (Size=1744 KB) - (Type=17) ATTENTION ===> Suspicious partition bootkit on partition 4
 
==============================
Partitions of Disk 4:
===============
Disk ID: 00000000
 
Partition: GPT Partition Type.
 
 
****** End Of Log ****** 
 
 
 
*************************************************************************************************************************************************************
 
this one with "BCD" checked
 
ListParts by Farbar Version: 31-07-2014
Ran by SYSTEM (administrator) on 01-06-2015 at 11:25:18
Windows 7 (X64)
Running From: J:\
Language: English (United States)
************************************************************
 
========================= Memory info ====================== 
 
Percentage of memory in use: 9%
Total physical RAM: 6007.09 MB
Available physical RAM: 5411.91 MB
Total Pagefile: 6005.24 MB
Available Pagefile: 5395.5 MB
Total Virtual: 8192 MB
Available Virtual: 8191.93 MB
 
======================= Partitions =========================
 
1 Drive c: (PQSERVICE) (Fixed) (Total:12 GB) (Free:4.5 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
2 Drive d: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
3 Drive e: () (Fixed) (Total:919.41 GB) (Free:692.22 GB) NTFS
4 Drive f: (GRMCHPXFRER_EN_DVD) (CDROM) (Total:3 GB) (Free:0 GB) UDF
8 Drive j: () (Removable) (Total:1.86 GB) (Free:1.86 GB) FAT
10 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
 
  Disk ###  Status         Size     Free     Dyn  Gpt
  --------  -------------  -------  -------  ---  ---
  Disk 0    Online          931 GB      0 B         
  Disk 1    No Media           0 B      0 B         
  Disk 2    No Media           0 B      0 B         
  Disk 3    No Media           0 B      0 B         
  Disk 4    Online         1906 MB      0 B         
  Disk 5    No Media           0 B      0 B         
 
Partitions of Disk 0:
===============
 
Disk ID: AC7856D0
 
  Partition ###  Type              Size     Offset
  -------------  ----------------  -------  -------
  Partition 1    Primary             12 GB  1024 KB
  Partition 2    Primary            100 MB    12 GB
  Partition 3    Primary            919 GB    12 GB
  Partition 4    Primary           1744 KB   931 GB
 
======================================================================================================
 
Disk: 0
Partition 1
Type  : 0B
Hidden: No
Active: Yes
 
  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 1     C   PQSERVICE    NTFS   Partition     12 GB  Healthy            
 
======================================================================================================
 
Disk: 0
Partition 2
Type  : 07
Hidden: No
Active: No
 
  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 2     D   SYSTEM RESE  NTFS   Partition    100 MB  Healthy            
 
======================================================================================================
 
Disk: 0
Partition 3
Type  : 07
Hidden: No
Active: No
 
  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 3     E                NTFS   Partition    919 GB  Healthy            
 
======================================================================================================
 
Disk: 0
Partition 4
Type  : 17 (Suspicious Type)
Hidden: Yes
Active: Yes
 
There is no volume associated with this partition.
 
======================================================================================================
 
Partitions of Disk 4:
===============
 
Disk ID: 00000000
 
  Partition ###  Type              Size     Offset
  -------------  ----------------  -------  -------
  Partition 1    Primary           1905 MB    64 KB
 
======================================================================================================
 
Disk: 4
Partition 1
Type  : 06
Hidden: No
Active: No
 
  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 7     J                FAT    Removable   1905 MB  Healthy            
 
======================================================================================================
============================== MBR Partition Table ==================
 
==============================
Partitions of Disk 0:
===============
Disk ID: AC7856D0
Partition 1: (Active) - (Size=12 GB) - (Type=0B)
Partition 2: (Not Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=919 GB) - (Type=07 NTFS)
Partition 4: (Active) - (Size=1744 KB) - (Type=17) ATTENTION ===> Suspicious partition bootkit on partition 4
 
==============================
Partitions of Disk 4:
===============
Disk ID: 00000000
 
Partition: GPT Partition Type.
 
 
Windows Boot Manager
--------------------
identifier              {bootmgr}
device                  partition=C:
path                    \bootmgr
description             Windows Boot Manager
locale                  en-US
default                 {default}
displayorder            {default}
timeout                 30
 
Windows Boot Loader
-------------------
identifier              {default}
device                  partition=E:
path                    \Windows\system32\winload.exe
description             Windows 7 Home Premium (recovered) 
locale                  en-US
recoverysequence        {592d61ab-07ea-11e5-8db5-ee29514d967c}
recoveryenabled         Yes
osdevice                partition=E:
systemroot              \Windows
 
Windows Boot Loader
-------------------
identifier              {592d61ab-07ea-11e5-8db5-ee29514d967c}
device                  ramdisk=[E:]\Recovery\6a176518-185b-11e1-86c2-ffff3cf38308\Winre.wim,{592d61ac-07ea-11e5-8db5-ee29514d967c}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment (recovered) 
locale                  
osdevice                ramdisk=[E:]\Recovery\6a176518-185b-11e1-86c2-ffff3cf38308\Winre.wim,{592d61ac-07ea-11e5-8db5-ee29514d967c}
systemroot              \windows
winpe                   Yes
 
Windows Memory Tester
---------------------
identifier              {memdiag}
device                  partition=C:
path                    \boot\memtest.exe
description             Windows Memory Diagnostic
locale                  en-US
 
Device options
--------------
identifier              {592d61ac-07ea-11e5-8db5-ee29514d967c}
ramdisksdidevice        partition=E:
ramdisksdipath          \Recovery\6a176518-185b-11e1-86c2-ffff3cf38308\boot.sdi
 
 
****** End Of Log ****** 

Edited by elbruceo, 01 June 2015 - 01:30 PM.


#15 deeprybka

deeprybka

  • Malware Response Team
  • 5,198 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:08:09 AM

Posted 01 June 2015 - 01:42 PM

Fix with Listparts

Step 1
listparts.pnglistpartsfix.PNG
Please download the attached fix.txt to your flashdrive.
  • Start ListParts again.
  • Press the Fix button.
  • When finished, Listparts will produce a new log (Result.txt) in the same directory the tool was run from.
    Please copy and paste the log in your next reply.
Attached File  fix.txt   91bytes   10 downloads

Edited by deeprybka, 01 June 2015 - 01:42 PM.

regards,
deeprybka
:busy:
Neminem laede, immo omnes, quantum potes, iuva. Arthur Schopenhauer
 
unite_blue.png
asap.png




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users