Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

I'm infected


  • This topic is locked This topic is locked
4 replies to this topic

#1 thoroughnut

thoroughnut

  • Members
  • 111 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:54 PM

Posted 11 June 2015 - 08:14 PM

Tried to clean. Not good enough. Some kind of Trojan for sure.

Edited by Queen-Evie, 11 June 2015 - 10:15 PM.
moved to MRL. FRST logs are allowed only in MRL forum


BC AdBot (Login to Remove)

 


#2 thoroughnut

thoroughnut
  • Topic Starter

  • Members
  • 111 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:54 PM

Posted 11 June 2015 - 09:58 PM

Hi there, I seem to have an infection I cannot get rid of. Hoping you can help out.

Thank you for your time.

 

 

firefox and chrome keep redirecting. Although ie seems to be unaffected.

here are my FRST logs;

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:08-06-2015
Ran by Vincent (administrator) on FAMILY on 11-06-2015 21:38:02
Running from C:\Users\Vincent\Downloads
Loaded Profiles: Vincent (Available Profiles: Vincent)
Platform: Windows 8.1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser not detected!)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AdminService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Nero AG) C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
() C:\Program Files\Touro Cloud Backup\Touro Cloud BackupCrawler.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Atheros) C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe
() C:\Program Files\Touro Cloud Backup\Touro Cloud Backup.exe
(Google Inc.) C:\Users\Vincent\AppData\Local\Programs\Google\MusicManager\MusicManager.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(i-Funbox.com) C:\Program Files (x86)\i-Funbox DevTeam\iFunBox_x64.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Wondershare) C:\Program Files (x86)\Wondershare\MobileGo for Android\MobileGoService.exe
() C:\Program Files (x86)\Multimedia Card Reader(9106)\Shwicon9106.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 7520 series\Bin\HPNetworkCommunicator.exe
(Wondershare) C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Eyeo GmbH) C:\Program Files\Adblock Plus for IE\AdblockPlusEngine.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2012-06-12] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212560 2012-06-13] (Realtek Semiconductor)
HKLM\...\Run: [BtTray] => C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtTray.exe [757888 2012-07-02] (Qualcomm Atheros)
HKLM\...\Run: [BtvStack] => C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe [127104 2012-07-02] (Qualcomm Atheros Commnucations)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-01-20] (NVIDIA Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-07] (Apple Inc.)
HKLM\...\Run: [Windesk Winsearch] => C:\Program Files (x86)\WindeskWinsearch\Windesk Winsearch.exe
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation)
HKLM-x32\...\Run: [Shwicon9106] => C:\Program Files (x86)\Multimedia Card Reader(9106)\Shwicon9106.exe [262144 2012-06-28] ()
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-03-20] (Apple Inc.)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2014-02-14] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [Wondershare Helper Compact] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1985824 2013-07-25] (Wondershare)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1985824 2013-07-25] (Wondershare)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [335232 2015-03-07] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKU\S-1-5-21-3463171804-1537994893-3906066650-1002\...\Run: [HP Photosmart 7520 series (NET)] => C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-3463171804-1537994893-3906066650-1002\...\Run: [Touro Cloud Backup] => C:\Program Files\Touro Cloud Backup\Touro Cloud Backup.exe [1324544 2012-10-18] ()
HKU\S-1-5-21-3463171804-1537994893-3906066650-1002\...\Run: [Wondershare Helper Compact] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1985824 2013-07-25] (Wondershare)
HKU\S-1-5-21-3463171804-1537994893-3906066650-1002\...\Run: [MusicManager] => C:\Users\Vincent\AppData\Local\Programs\Google\MusicManager\MusicManager.exe [7631872 2014-05-15] (Google Inc.)
HKU\S-1-5-21-3463171804-1537994893-3906066650-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd)
HKU\S-1-5-21-3463171804-1537994893-3906066650-1002\...\Run: [iFunBox Fast App Install Handler] => C:\Program Files (x86)\i-Funbox DevTeam\iFunBox_x64.exe [2692608 2015-04-12] (i-Funbox.com)
HKU\S-1-5-21-3463171804-1537994893-3906066650-1002\...\MountPoints2: {2a045e94-e180-11e4-befb-b8ca3a890dd5} - "J:\HTC_Sync_Manager_PC.exe"
HKU\S-1-5-21-3463171804-1537994893-3906066650-1002\...\MountPoints2: {d150fbb7-a9f9-11e3-be87-bc855631869e} - "J:\HTC_Sync_Manager_PC.exe"
HKU\S-1-5-21-3463171804-1537994893-3906066650-1002\...\MountPoints2: {d5d5d7ff-570f-11e3-be65-806e6f6e6963} - "I:\Autorun.exe"
HKU\S-1-5-18\...\Run: [] => [X]
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll => C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll File not found
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\MobileGo Service.lnk [2014-03-07]
ShortcutTarget: MobileGo Service.lnk -> C:\Program Files (x86)\Wondershare\MobileGo for Android\MobileGoService.exe (Wondershare)
Startup: C:\Users\Vincent\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Photosmart 7520 series (Network).lnk [2013-11-27]
ShortcutTarget: Monitor Ink Alerts - HP Photosmart 7520 series (Network).lnk -> C:\Program Files\HP\HP Photosmart 7520 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
ShellIconOverlayIdentifiers: [MemopalBackedUp] -> {8ED3CC2D-6BC2-43AD-8C43-F51FBB413AE6} => C:\Program Files\Touro Cloud Backup\ShellExtensionx64\ShellExtension.dll [2012-10-18] ()
ShellIconOverlayIdentifiers: [MemopalError] -> {B9CA6E12-7975-4997-B5BD-CA12ECE0FEAD} => C:\Program Files\Touro Cloud Backup\ShellExtensionx64\ShellExtension.dll [2012-10-18] ()
ShellIconOverlayIdentifiers: [MemopalPartiallyBackedUp] -> {95DDC869-FC98-4D47-BD34-2EDC9AA09C01} => C:\Program Files\Touro Cloud Backup\ShellExtensionx64\ShellExtension.dll [2012-10-18] ()
ShellIconOverlayIdentifiers: [MemopalToBackup] -> {2CDD871E-60EB-40BD-9721-A1CB57042F75} => C:\Program Files\Touro Cloud Backup\ShellExtensionx64\ShellExtension.dll [2012-10-18] ()
ShellIconOverlayIdentifiers-x32: [MemopalBackedUp] -> {8ED3CC2D-6BC2-43AD-8C43-F51FBB413AE6} => C:\Program Files\Touro Cloud Backup\ShellExtension\ShellExtension.dll [2012-10-18] ()
ShellIconOverlayIdentifiers-x32: [MemopalError] -> {B9CA6E12-7975-4997-B5BD-CA12ECE0FEAD} => C:\Program Files\Touro Cloud Backup\ShellExtension\ShellExtension.dll [2012-10-18] ()
ShellIconOverlayIdentifiers-x32: [MemopalPartiallyBackedUp] -> {95DDC869-FC98-4D47-BD34-2EDC9AA09C01} => C:\Program Files\Touro Cloud Backup\ShellExtension\ShellExtension.dll [2012-10-18] ()
ShellIconOverlayIdentifiers-x32: [MemopalToBackup] -> {2CDD871E-60EB-40BD-9721-A1CB57042F75} => C:\Program Files\Touro Cloud Backup\ShellExtension\ShellExtension.dll [2012-10-18] ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3463171804-1537994893-3906066650-1002\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxySettingsPerUser] 0 <======= ATTENTION (Policy restriction on ProxySettings)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=MSE1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=MSE1
HKU\S-1-5-21-3463171804-1537994893-3906066650-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL =
SearchScopes: HKLM-x32 -> DefaultScope value is missing
BHO: No Name -> {3C2C21F7-FDB6-4b10-B605-FA4A281E3016} ->  No File
BHO: shopperz -> {5081D2D4-1637-404c-B74F-50526718257D} -> C:\Program Files\shopperz\mseff64.dll No File
BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll [2012-07-02] (Qualcomm Atheros Commnucations)
BHO: Consumer Input DCA BHO -> {B49699FC-1665-4414-A1CB-C4A2A4A13EEC} -> C:\Program Files (x86)\Consumer Input\InternetExplorer\x64\dca-bho.dll No File
BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll [2014-12-16] (Adblock Plus)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-16] (Oracle Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-16] (Oracle Corporation)
BHO-x32: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll [2014-12-16] (Adblock Plus)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\Vincent\AppData\Roaming\Mozilla\Firefox\Profiles\q8rmd48w.default-1406612492362
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-06-09] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-06-09] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1217157.dll [2015-02-05] (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-16] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-16] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2013-12-19] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2013-12-19] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-06-09] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-06-09] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3463171804-1537994893-3906066650-1002: @tools.google.com/Google Update;version=3 -> C:\Users\Vincent\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin HKU\S-1-5-21-3463171804-1537994893-3906066650-1002: @tools.google.com/Google Update;version=9 -> C:\Users\Vincent\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin HKU\S-1-5-21-3463171804-1537994893-3906066650-1002: tdameritrade.com/thinkorswim -> C:\Program Files (x86)\thinkorswim\npthinkorswim.dll [2015-04-01] (TD Ameritrade)
FF Plugin HKU\S-1-5-21-3463171804-1537994893-3906066650-1002: tdameritrade.com/tossc -> C:\Program Files (x86)\thinkorswim\nptossc.dll [2015-04-01] (TD Ameritrade)
FF Extension: CinemaPlus-4.2v - C:\Users\Vincent\AppData\Roaming\Mozilla\Firefox\Profiles\q8rmd48w.default-1406612492362\Extensions\6a1a03975fde4c8690f6b883c36bc1@7d88519bfe704d8cae3851239.com [2015-06-10]
FF Extension: Adblock Plus - C:\Users\Vincent\AppData\Roaming\Mozilla\Firefox\Profiles\q8rmd48w.default-1406612492362\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-12-21]
FF HKLM\...\Firefox\Extensions: [{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}] - C:\Program Files\shopper-z\Firefox
FF HKLM\...\Firefox\Extensions: [{5081D2D4-1637-404c-B74F-50526718257D}] - C:\Program Files\shopperz\Firefox

Chrome:
=======
CHR Profile: C:\Users\Vincent\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-03]
CHR Extension: (No Name) - C:\Users\Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\faoigfclahgbjjjaopddafnnapmeppnc [2015-06-10]
CHR Extension: (HQCinema Pro 2.1V03.06) - C:\Users\Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\gegdfeiahlfolhcfioipjlkombmgbakh [2015-06-03]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-10]
CHR Extension: (Google Wallet) - C:\Users\Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-02-03]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
R2 AtherosSvc; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe [128640 2012-07-02] (Qualcomm Atheros Commnucations) [File not signed]
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-28] (Microsoft Corporation)
R2 HTCMonitorService; C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2014-08-04] (Nero AG)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-01-20] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16939296 2014-01-20] (NVIDIA Corporation)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] () [File not signed]
R2 Touro Cloud Backup Crawler; C:\Program Files\Touro Cloud Backup\Touro Cloud BackupCrawler.exe [3671176 2012-10-18] ()
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-03] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-03] (Microsoft Corporation)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe [77824 2012-06-19] (Atheros) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-07-02] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
S3 HtcVCom32; C:\Windows\system32\DRIVERS\HtcVComV64.sys [121800 2010-03-09] (QUALCOMM Incorporated)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2013-11-27] ()
S3 qcusbser; C:\Windows\system32\DRIVERS\qcusbser.sys [242688 2013-04-24] (QUALCOMM Incorporated)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-03] (Microsoft Corporation)
S3 MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-11 21:38 - 2015-06-11 21:38 - 00021298 _____ C:\Users\Vincent\Downloads\FRST.txt
2015-06-11 21:37 - 2015-06-11 21:38 - 00000000 ____D C:\FRST
2015-06-11 21:36 - 2015-06-11 21:36 - 02108928 _____ (Farbar) C:\Users\Vincent\Downloads\FRST64.exe
2015-06-10 20:19 - 2015-06-10 20:19 - 00003870 _____ C:\Users\Vincent\Desktop\ESET2.txt
2015-06-10 18:17 - 2015-06-10 18:17 - 02870984 _____ (ESET) C:\Users\Vincent\Downloads\esetsmartinstaller_enu(2).exe
2015-06-10 16:18 - 2015-06-10 16:18 - 02870984 _____ (ESET) C:\Users\Vincent\Downloads\esetsmartinstaller_enu(1).exe
2015-06-10 16:16 - 2015-06-10 16:16 - 00022990 _____ C:\Users\Vincent\Desktop\ESET.txt
2015-06-10 15:24 - 2015-06-10 15:24 - 02870984 _____ (ESET) C:\Users\Vincent\Downloads\esetsmartinstaller_enu.exe
2015-06-10 15:24 - 2015-06-10 15:24 - 00000000 ____D C:\Program Files (x86)\ESET
2015-06-10 15:15 - 2015-06-10 15:15 - 00013655 _____ C:\Users\Vincent\Desktop\JRT.txt
2015-06-10 15:13 - 2015-06-10 15:13 - 00000207 _____ C:\WINDOWS\tweaking.com-regbackup-FAMILY-Windows-8.1-(64-bit).dat
2015-06-10 15:13 - 2015-06-10 15:13 - 00000000 ____D C:\RegBackup
2015-06-10 15:12 - 2015-06-10 15:12 - 02943663 _____ (Thisisu) C:\Users\Vincent\Downloads\JRT.exe
2015-06-10 15:01 - 2015-06-10 15:01 - 02231296 _____ C:\Users\Vincent\Downloads\AdwCleaner(1).exe
2015-06-10 14:53 - 2015-06-10 14:53 - 00019525 _____ C:\Users\Vincent\Desktop\ToNi5IW1.htm
2015-06-10 14:38 - 2015-06-10 14:38 - 02231296 _____ C:\Users\Vincent\Downloads\adwcleaner_4.206.exe
2015-06-10 14:36 - 2015-06-10 14:36 - 02231296 _____ C:\Users\Vincent\Downloads\AdwCleaner.exe
2015-06-10 14:20 - 2015-06-10 14:20 - 00000000 ____D C:\TDSSKiller_Quarantine
2015-06-10 14:14 - 2015-06-10 14:14 - 00037798 _____ C:\Users\Vincent\Downloads\Result.txt
2015-06-10 14:13 - 2015-06-10 14:13 - 00403456 _____ (Farbar) C:\Users\Vincent\Downloads\MiniToolBox.exe
2015-06-10 12:57 - 2015-06-10 12:57 - 00000693 _____ C:\Users\Vincent\Downloads\Setup                         .website
2015-06-10 01:07 - 2015-05-27 09:35 - 24917504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-06-10 01:07 - 2015-05-27 09:08 - 19607040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-06-10 01:07 - 2015-05-25 08:23 - 00036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\UtcResources.dll
2015-06-10 01:07 - 2015-05-25 08:07 - 01430528 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2015-06-10 01:07 - 2015-05-22 22:15 - 00503808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-06-10 01:07 - 2015-05-22 22:14 - 00341504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2015-06-10 01:07 - 2015-05-22 22:10 - 02278912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-06-10 01:07 - 2015-05-22 22:05 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-06-10 01:07 - 2015-05-22 22:04 - 00620032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2015-06-10 01:07 - 2015-05-22 21:48 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2015-06-10 01:07 - 2015-05-22 21:47 - 04305920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-06-10 01:07 - 2015-05-22 21:47 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2015-06-10 01:07 - 2015-05-22 21:47 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2015-06-10 01:07 - 2015-05-22 21:43 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-06-10 01:07 - 2015-05-22 21:38 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-06-10 01:07 - 2015-05-22 21:38 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-06-10 01:07 - 2015-05-22 21:37 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-06-10 01:07 - 2015-05-22 21:28 - 12829696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-06-10 01:07 - 2015-05-22 21:28 - 01042944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2015-06-10 01:07 - 2015-05-22 21:20 - 01950720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-06-10 01:07 - 2015-05-22 21:16 - 01309696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-06-10 01:07 - 2015-05-22 21:14 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-06-10 01:07 - 2015-05-22 14:00 - 02885632 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-06-10 01:07 - 2015-05-22 14:00 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-06-10 01:07 - 2015-05-22 14:00 - 00417792 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2015-06-10 01:07 - 2015-05-22 13:52 - 06026240 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-06-10 01:07 - 2015-05-22 13:48 - 00633856 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2015-06-10 01:07 - 2015-05-22 13:47 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-06-10 01:07 - 2015-05-22 13:47 - 00814080 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2015-06-10 01:07 - 2015-05-22 13:24 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-06-10 01:07 - 2015-05-22 13:23 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2015-06-10 01:07 - 2015-05-22 13:21 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2015-06-10 01:07 - 2015-05-22 13:15 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-06-10 01:07 - 2015-05-22 13:09 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-06-10 01:07 - 2015-05-22 13:08 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-06-10 01:07 - 2015-05-22 13:06 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-06-10 01:07 - 2015-05-22 13:05 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-06-10 01:07 - 2015-05-22 12:57 - 14404096 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-06-10 01:07 - 2015-05-22 12:50 - 02426880 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-06-10 01:07 - 2015-05-22 12:49 - 02865152 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2015-06-10 01:07 - 2015-05-22 12:38 - 01545728 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-06-10 01:07 - 2015-05-22 12:26 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-06-10 01:07 - 2015-05-22 08:08 - 00700416 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-06-10 01:07 - 2015-05-21 08:08 - 01119232 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2015-06-10 01:07 - 2015-05-21 08:08 - 01020928 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-06-10 01:07 - 2015-05-21 08:08 - 00756736 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2015-06-10 01:07 - 2015-05-21 08:08 - 00422912 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2015-06-10 01:07 - 2015-05-21 08:08 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2015-06-10 01:07 - 2015-05-21 08:08 - 00045568 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-06-10 01:07 - 2015-04-24 21:34 - 00653824 _____ (Microsoft Corporation) C:\WINDOWS\system32\comctl32.dll
2015-06-10 01:07 - 2015-04-24 21:33 - 00549888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comctl32.dll
2015-06-10 01:07 - 2015-04-16 17:07 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2015-06-10 01:07 - 2015-04-16 01:17 - 00325464 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS
2015-06-10 01:07 - 2015-04-13 17:37 - 00275968 _____ (Microsoft Corporation) C:\WINDOWS\system32\authz.dll
2015-06-10 01:07 - 2015-04-13 17:34 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authz.dll
2015-06-10 01:07 - 2015-04-09 19:40 - 01249280 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCore.dll
2015-06-10 01:07 - 2015-04-09 19:17 - 01018880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCore.dll
2015-06-10 01:07 - 2015-04-08 17:41 - 00158720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rgb9rast.dll
2015-06-10 01:07 - 2015-04-08 17:07 - 00410336 _____ C:\WINDOWS\system32\ApnDatabase.xml
2015-06-10 01:07 - 2015-04-01 17:42 - 03097600 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2015-06-10 01:07 - 2015-04-01 17:30 - 02483712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2015-06-10 01:07 - 2015-03-31 23:21 - 00337408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
2015-06-10 01:07 - 2015-03-31 23:18 - 00468480 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssph.dll
2015-06-10 01:07 - 2015-03-31 23:17 - 00248832 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssphtb.dll
2015-06-10 01:07 - 2015-03-31 23:08 - 00774144 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssvp.dll
2015-06-10 01:07 - 2015-03-31 22:46 - 03633664 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2015-06-10 01:07 - 2015-03-31 22:17 - 02551808 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
2015-06-10 01:07 - 2015-03-31 22:17 - 00903168 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
2015-06-10 01:07 - 2015-03-31 21:53 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssph.dll
2015-06-10 01:07 - 2015-03-31 21:53 - 00272896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe
2015-06-10 01:07 - 2015-03-31 21:45 - 02749952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2015-06-10 01:07 - 2015-03-31 21:45 - 00699392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssvp.dll
2015-06-10 01:07 - 2015-03-31 21:14 - 01920000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
2015-06-10 01:07 - 2015-03-31 21:12 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
2015-06-10 01:07 - 2015-03-19 22:49 - 00309760 _____ (Microsoft Corporation) C:\WINDOWS\system32\compstui.dll
2015-06-10 01:07 - 2015-03-19 22:08 - 00477184 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
2015-06-10 01:07 - 2015-03-19 21:37 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll
2015-06-10 01:07 - 2015-03-19 21:07 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2015-06-10 01:07 - 2015-03-01 20:43 - 00222208 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastapi.dll
2015-06-10 01:07 - 2015-03-01 20:21 - 00207872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastapi.dll
2015-06-10 01:06 - 2015-05-21 11:47 - 04177920 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-06-09 23:26 - 2015-06-09 23:26 - 00004308 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskUserM_1_7_22_478699874-4155726479-3780505679-3006UA__323932393134323039392d232d783232575b5a34452d2a
2015-06-09 23:26 - 2015-06-09 23:26 - 00003472 _____ C:\WINDOWS\System32\Tasks\avabvbavad
2015-06-09 23:23 - 2015-06-10 21:46 - 00000000 ____D C:\ProgramData\hiAHTbn
2015-06-09 23:16 - 2015-06-10 18:06 - 00000000 ____D C:\Users\Vincent\AppData\Roaming\4C4C4544-1433909803-5410-8030-C6C04F475831
2015-06-09 22:19 - 2015-06-09 22:24 - 00003392 _____ C:\Users\Vincent\Desktop\Rkill.txt
2015-06-09 22:12 - 2015-06-09 22:12 - 00002281 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-06-09 22:12 - 2015-06-09 22:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-06-09 22:11 - 2015-06-11 21:16 - 00000914 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-09 22:11 - 2015-06-10 22:16 - 00000910 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-09 22:11 - 2015-06-09 22:11 - 00003886 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-06-09 22:11 - 2015-06-09 22:11 - 00003650 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-06-09 22:10 - 2015-06-09 22:10 - 00931408 _____ (Google Inc.) C:\Users\Vincent\Downloads\ChromeSetup.exe
2015-06-08 10:53 - 2015-06-08 10:53 - 00493824 _____ C:\Users\Vincent\Downloads\Unconfirmed 337617.crdownload
2015-06-03 22:42 - 2015-06-03 22:42 - 00511032 _____ C:\Users\Vincent\Downloads\Unconfirmed 329957.crdownload
2015-06-03 21:22 - 2015-06-10 15:19 - 00003452 _____ C:\WINDOWS\System32\Tasks\Hecoemiftaenx
2015-06-03 21:22 - 2015-06-03 21:22 - 00000000 ____D C:\ProgramData\Hecoemiftaenx
2015-06-03 20:10 - 2015-06-03 20:11 - 00233051 _____ C:\Users\Vincent\Downloads\A899.tmp
2015-06-03 17:45 - 2015-06-10 21:46 - 00350290 _____ C:\WINDOWS\PFRO.log
2015-06-03 17:45 - 2015-06-10 21:46 - 00003874 _____ C:\WINDOWS\setupact.log
2015-06-03 17:45 - 2015-06-03 17:45 - 00000000 _____ C:\WINDOWS\setuperr.log
2015-06-03 15:15 - 2015-06-10 21:46 - 00000348 _____ C:\WINDOWS\Tasks\DERKZ1.job
2015-06-03 15:15 - 2015-06-03 15:15 - 00003562 _____ C:\WINDOWS\System32\Tasks\RFZCDR
2015-06-03 15:15 - 2015-06-03 15:15 - 00002862 _____ C:\WINDOWS\System32\Tasks\DERKZ1
2015-06-03 15:15 - 2015-06-03 15:15 - 00000000 _____ C:\WINDOWS\SysWOW64\Number of results
2015-06-03 14:47 - 2015-06-03 14:47 - 00000010 _____ C:\Users\Public\Documents\test.txt
2015-06-03 14:42 - 2015-06-03 14:42 - 00003562 _____ C:\WINDOWS\System32\Tasks\TYVYITY
2015-06-03 14:41 - 2015-06-10 18:06 - 00000000 ____D C:\Users\Vincent\AppData\Roaming\Eppink
2015-06-03 14:41 - 2015-06-10 18:06 - 00000000 ____D C:\Users\Vincent\AppData\Roaming\4C4C4544-1433360506-5410-8030-C6C04F475831
2015-06-03 14:40 - 2015-06-10 21:46 - 00000342 _____ C:\WINDOWS\Tasks\TBVVKDQJO1.job
2015-06-03 14:40 - 2015-06-03 14:40 - 00002856 _____ C:\WINDOWS\System32\Tasks\TBVVKDQJO1
2015-06-03 14:37 - 2015-06-09 22:12 - 00000112 _____ C:\ProgramData\g0PXd7.dat
2015-06-03 14:36 - 2015-06-03 14:36 - 00004626 _____ C:\WINDOWS\System32\Tasks\Web Tool Runner
2015-06-03 14:34 - 2015-06-10 18:06 - 00000000 ____D C:\Users\Vincent\AppData\Roaming\4C4C4544-1433360085-5410-8030-C6C04F475831
2015-06-03 14:34 - 2015-06-03 14:35 - 00000000 ____D C:\ProgramData\Package Cache
2015-06-03 14:33 - 2015-06-03 14:33 - 03573285 _____ C:\Users\Vincent\Downloads\The-Sims-FreePlay-Hack-Tool.zip
2015-06-03 14:33 - 2015-06-03 14:33 - 03573285 _____ C:\Users\Vincent\Downloads\The-Sims-FreePlay-Hack-Tool (2).zip
2015-06-03 14:33 - 2015-06-03 14:33 - 03573285 _____ C:\Users\Vincent\Downloads\The-Sims-FreePlay-Hack-Tool (1).zip
2015-06-03 14:28 - 2015-06-03 14:28 - 06357354 _____ C:\Users\Vincent\Downloads\The-Sims-Freeplay-Hack-AndroidiOS (1).rar
2015-06-03 14:27 - 2015-06-03 14:27 - 06357354 _____ C:\Users\Vincent\Downloads\The-Sims-Freeplay-Hack-AndroidiOS.rar
2015-06-03 14:22 - 2013-08-22 08:25 - 00000824 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak
2015-06-03 14:21 - 2015-06-10 20:01 - 00000000 ____D C:\Users\Vincent\AppData\Roaming\4C4C4544-1433359301-5410-8030-C6C04F475831
2015-06-03 14:20 - 2015-06-09 22:52 - 00000000 ____D C:\Program Files (x86)\9b5af7f8-571f-4257-ac86-b814c6c63b4a
2015-06-03 14:20 - 2015-06-09 21:20 - 00000004 _____ C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-06-03 14:15 - 2015-06-03 20:15 - 00000000 ____D C:\ProgramData\{1e3738be-c410-f6cb-1e37-738bec41e2fb}
2015-06-03 14:03 - 2015-06-03 14:03 - 05452492 _____ C:\Users\Vincent\Downloads\The-Sims-Freeplay-Hack-Tool.rar
2015-06-03 14:03 - 2015-06-03 14:03 - 05452492 _____ C:\Users\Vincent\Downloads\The-Sims-Freeplay-Hack-Tool (1).rar
2015-06-03 13:58 - 2015-06-03 13:58 - 03605435 _____ C:\Users\Vincent\Downloads\The-sims-FreePlay-hack (3).rar
2015-06-03 13:58 - 2015-06-03 13:58 - 03605435 _____ C:\Users\Vincent\Downloads\The-sims-FreePlay-hack (2).rar
2015-06-03 13:57 - 2015-06-03 13:57 - 03605435 _____ C:\Users\Vincent\Downloads\The-sims-FreePlay-hack.rar
2015-06-03 13:57 - 2015-06-03 13:57 - 03605435 _____ C:\Users\Vincent\Downloads\The-sims-FreePlay-hack (1).rar
2015-06-02 21:25 - 2015-06-02 21:25 - 21348024 _____ ( ) C:\Users\Vincent\Downloads\ifunbox-2-95-beta-en-win.exe
2015-06-02 16:30 - 2015-06-02 16:30 - 00001767 _____ C:\Users\Public\Desktop\iTunes.lnk
2015-06-02 16:30 - 2015-06-02 16:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-06-02 16:29 - 2015-06-02 16:30 - 00000000 ____D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-06-02 16:29 - 2015-06-02 16:30 - 00000000 ____D C:\Program Files\iTunes
2015-06-02 16:29 - 2015-06-02 16:29 - 00000000 ____D C:\Program Files\iPod
2015-06-02 16:29 - 2015-06-02 16:29 - 00000000 ____D C:\Program Files (x86)\iTunes
2015-06-02 16:06 - 2015-06-02 20:20 - 00000000 ____D C:\Users\Vincent\AppData\Roaming\iFunbox_UserCache
2015-06-02 16:05 - 2015-06-09 21:24 - 00000000 ____D C:\Program Files (x86)\i-Funbox DevTeam
2015-06-02 16:04 - 2015-06-02 16:04 - 21348024 _____ ( ) C:\Users\Vincent\Downloads\ifunbox_setup.exe
2015-06-02 13:55 - 2015-06-03 14:43 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-06-01 18:27 - 2015-06-01 18:27 - 00000000 ____D C:\Users\Vincent\Desktop\New folder
2015-06-01 18:14 - 2015-06-01 18:14 - 00000000 ____D C:\Users\Vincent\AppData\Local\GWX
2015-05-26 20:45 - 2015-05-27 17:36 - 00000000 ____D C:\Users\Vincent\Desktop\Sims 3 Save Backups
2015-05-26 13:14 - 2015-06-01 15:18 - 04159652 _____ C:\Users\Vincent\Documents\2015-Draftkings-MLB-Projection-Tool-week-of-2015-05-18 (4).xlsm
2015-05-24 20:48 - 2015-05-24 20:48 - 00400811 _____ C:\Users\Vincent\Downloads\MLB-DraftKings-Solver (2).xlsm
2015-05-24 20:39 - 2015-05-26 13:14 - 04192202 _____ C:\Users\Vincent\Downloads\2015-Draftkings-MLB-Projection-Tool-week-of-2015-05-18 (4).xlsm
2015-05-24 19:40 - 2015-05-24 19:40 - 00000000 ___SD C:\Users\Vincent\Documents\My Data Sources
2015-05-24 19:00 - 2015-05-24 19:00 - 03195704 _____ C:\Users\Vincent\Downloads\2015-Draftkings-MLB-Projection-Tool-week-of-2015-05-18 (3).xlsm
2015-05-24 19:00 - 2015-05-24 19:00 - 03195704 _____ C:\Users\Vincent\Downloads\2015-Draftkings-MLB-Projection-Tool-week-of-2015-05-18 (2).xlsm
2015-05-24 18:57 - 2015-05-24 19:40 - 00415695 _____ C:\Users\Vincent\Downloads\MLB-DraftKings-Solver (1).xlsm
2015-05-24 18:56 - 2015-05-24 18:56 - 00400811 _____ C:\Users\Vincent\Downloads\MLB-DraftKings-Solver.xlsm
2015-05-24 11:04 - 2015-05-24 13:03 - 04177710 _____ C:\Users\Vincent\Downloads\2015-Draftkings-MLB-Projection-Tool-week-of-2015-05-18 (1).xlsm
2015-05-23 22:21 - 2015-05-24 11:05 - 02841958 _____ C:\Users\Vincent\Downloads\2015-Draftkings-MLB-Projection-Tool-week-of-2015-05-18.xlsm
2015-05-18 17:34 - 2015-05-18 17:34 - 00000000 ____D C:\Users\Vincent\Documents\Lily's Things
2015-05-16 20:26 - 2015-05-16 20:26 - 01453292 _____ C:\Users\Vincent\Downloads\cherryberry - Fun girls outfit.sims3pack
2015-05-16 20:23 - 2015-05-16 20:23 - 01447237 _____ C:\Users\Vincent\Downloads\Wimmie_pm_sweater_mrniceguy.sims3pack
2015-05-12 16:52 - 2015-04-30 15:35 - 00124112 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-12 16:52 - 2015-04-30 15:35 - 00102608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-12 16:30 - 2015-05-12 16:30 - 16897311 _____ C:\Users\Vincent\Downloads\Villa Samantha.Sims3Pack
2015-05-12 14:01 - 2015-04-30 18:05 - 00429568 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2015-05-12 14:01 - 2015-04-30 17:48 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2015-05-12 14:01 - 2015-04-09 20:00 - 01996800 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2015-05-12 14:01 - 2015-04-09 19:50 - 01387008 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2015-05-12 14:01 - 2015-04-09 19:34 - 02256896 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2015-05-12 14:01 - 2015-04-09 19:26 - 01560576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2015-05-12 14:01 - 2015-04-09 19:11 - 01943040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2015-05-12 14:01 - 2015-04-01 17:22 - 02985984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2015-05-12 14:01 - 2015-04-01 17:20 - 04417536 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2015-05-12 14:01 - 2015-03-31 22:45 - 01491456 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll
2015-05-12 14:01 - 2015-03-31 21:31 - 01207296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll
2015-05-12 14:01 - 2015-03-19 20:56 - 00080384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-05-12 14:01 - 2015-03-17 12:26 - 00467776 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2015-05-12 14:01 - 2015-03-12 20:11 - 02162176 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2015-05-12 14:01 - 2015-03-12 19:39 - 01812992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRH.dll
2015-05-12 14:01 - 2015-03-08 21:02 - 00057856 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthhfenum.sys
2015-05-12 14:01 - 2015-03-03 20:32 - 00172544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Input.Inking.dll
2015-05-12 14:01 - 2015-03-03 20:12 - 00141824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Input.Inking.dll
2015-05-12 14:01 - 2015-01-29 19:53 - 02819584 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2015-05-12 14:01 - 2014-11-14 01:58 - 00116736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsDatabase.dll
2015-05-12 14:00 - 2015-04-21 11:13 - 00107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\inseng.dll
2015-05-12 14:00 - 2015-04-21 10:49 - 00720384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-05-12 14:00 - 2015-04-21 10:28 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-05-12 14:00 - 2015-04-08 17:55 - 00410128 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe
2015-05-12 14:00 - 2015-04-02 19:35 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhotoMetadataHandler.dll
2015-05-12 14:00 - 2015-04-02 19:14 - 00364544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhotoMetadataHandler.dll
2015-05-12 14:00 - 2015-03-30 00:47 - 00561928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2015-05-12 14:00 - 2015-03-26 22:27 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2015-05-12 14:00 - 2015-03-26 21:50 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2015-05-12 14:00 - 2015-03-26 21:48 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-05-12 14:00 - 2015-03-12 23:03 - 00239424 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2015-05-12 14:00 - 2015-03-12 23:03 - 00154432 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2015-05-12 14:00 - 2015-03-12 21:02 - 00316416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\udfs.sys
2015-05-12 14:00 - 2015-03-10 20:49 - 00024576 _____ (Microsoft Corporation) C:\WINDOWS\system32\sdbinst.exe
2015-05-12 14:00 - 2015-03-10 20:09 - 00021504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sdbinst.exe
2015-05-12 14:00 - 2015-03-05 22:08 - 02067968 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdshext.dll
2015-05-12 14:00 - 2015-03-05 21:47 - 01696256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2015-05-12 14:00 - 2015-03-05 21:43 - 01969664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpdshext.dll
2015-05-12 14:00 - 2015-02-17 18:19 - 00186368 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-11 21:36 - 2014-01-26 00:14 - 00381440 ___SH C:\Users\Vincent\Downloads\Thumbs.db
2015-06-11 21:34 - 2015-04-10 18:27 - 01825168 _____ C:\WINDOWS\WindowsUpdate.log
2015-06-11 21:33 - 2014-06-05 00:23 - 00000930 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-3463171804-1537994893-3906066650-1002UA.job
2015-06-11 21:05 - 2013-11-27 20:10 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-06-11 21:02 - 2013-08-22 10:36 - 00000000 ____D C:\WINDOWS\system32\sru
2015-06-11 18:27 - 2014-02-11 23:23 - 00003926 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{B9770E8C-F5B4-4A2E-B61F-8AA911FA33BA}
2015-06-10 22:33 - 2014-06-05 00:22 - 00000878 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-3463171804-1537994893-3906066650-1002Core.job
2015-06-10 22:04 - 2013-11-27 16:18 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3463171804-1537994893-3906066650-1002
2015-06-10 21:51 - 2014-12-09 09:31 - 00000000 __SHD C:\Users\Vincent\AppData\Local\EmieBrowserModeList
2015-06-10 21:51 - 2014-04-25 13:51 - 00000000 __SHD C:\Users\Vincent\AppData\Local\EmieUserList
2015-06-10 21:51 - 2014-04-25 13:51 - 00000000 __SHD C:\Users\Vincent\AppData\Local\EmieSiteList
2015-06-10 21:48 - 2014-02-11 20:49 - 00000000 ___DO C:\Users\Vincent\SkyDrive
2015-06-10 21:46 - 2014-02-11 20:27 - 00000000 ____D C:\ProgramData\NVIDIA
2015-06-10 21:46 - 2013-08-22 09:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-06-10 21:45 - 2013-08-22 08:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2015-06-10 15:32 - 2013-08-22 10:36 - 00000000 ____D C:\WINDOWS\rescache
2015-06-10 15:03 - 2014-06-05 13:29 - 00000000 ____D C:\AdwCleaner
2015-06-10 15:03 - 2013-11-28 00:16 - 00000000 ____D C:\Users\Vincent\AppData\Local\CrashDumps
2015-06-10 14:24 - 2013-08-22 09:44 - 00481176 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-06-10 14:21 - 2014-12-12 10:10 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-06-10 14:21 - 2014-07-13 13:19 - 00000000 ___SD C:\WINDOWS\system32\CompatTel
2015-06-10 14:21 - 2013-08-22 10:36 - 00000000 ___RD C:\WINDOWS\ToastData
2015-06-10 14:21 - 2013-08-22 10:36 - 00000000 ____D C:\WINDOWS\PolicyDefinitions
2015-06-10 06:36 - 2013-11-27 16:43 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-06-10 06:36 - 2013-08-22 10:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-06-10 06:36 - 2012-07-26 02:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-06-10 06:33 - 2013-12-12 23:17 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-06-10 06:33 - 2013-11-27 16:43 - 140135120 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-06-09 22:35 - 2014-02-11 20:48 - 00000000 ____D C:\Users\Vincent\AppData\Local\Deployment
2015-06-09 22:29 - 2013-11-27 19:56 - 01517568 ___SH C:\Users\Vincent\Desktop\Thumbs.db
2015-06-09 22:11 - 2013-12-02 21:08 - 00000000 ____D C:\Program Files (x86)\Google
2015-06-09 22:05 - 2013-11-27 20:10 - 00003718 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-06-09 20:04 - 2013-11-14 02:28 - 00865408 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-06-09 19:47 - 2014-02-11 20:32 - 00000000 ____D C:\Users\Vincent
2015-06-09 19:36 - 2014-08-01 18:25 - 00000983 _____ C:\Users\Vincent\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-06-09 19:36 - 2014-02-11 20:47 - 00000937 _____ C:\Users\Vincent\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-06-09 19:36 - 2013-11-27 17:16 - 00000983 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-06-03 16:57 - 2013-11-27 20:01 - 00000000 ____D C:\Program Files (x86)\Steam
2015-06-03 16:18 - 2012-07-26 00:26 - 00000269 _____ C:\WINDOWS\win.ini
2015-06-03 15:29 - 2014-01-05 21:07 - 00000000 ____D C:\Program Files (x86)\Origin
2015-06-03 14:43 - 2013-11-27 17:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-06-03 14:00 - 2013-11-27 16:11 - 00000000 ____D C:\Users\Vincent\AppData\Local\Packages
2015-06-03 11:18 - 2013-08-22 10:38 - 00792568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-06-03 11:18 - 2013-08-22 10:38 - 00178168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-06-02 16:46 - 2014-01-05 21:07 - 00000000 ____D C:\ProgramData\Origin
2015-06-02 16:30 - 2014-01-15 17:50 - 00000000 ____D C:\Users\Vincent\AppData\Roaming\Apple Computer
2015-06-02 16:29 - 2014-03-31 20:29 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2015-06-02 16:29 - 2014-01-15 17:47 - 00000000 ____D C:\Program Files\Common Files\Apple
2015-05-24 16:30 - 2013-12-12 23:17 - 00000000 ____D C:\Users\Vincent\AppData\Local\Microsoft Help
2015-05-23 19:09 - 2013-12-12 23:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2015-05-20 04:45 - 2015-04-04 19:53 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX
2015-05-20 04:45 - 2015-04-04 19:53 - 00000000 ___SD C:\WINDOWS\system32\GWX
2015-05-13 17:46 - 2013-12-23 20:56 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-12 16:57 - 2013-12-04 22:07 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-05-12 16:57 - 2013-12-04 22:07 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-05-12 16:54 - 2013-08-22 10:36 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2015-05-12 16:54 - 2013-08-22 08:36 - 00000000 ____D C:\WINDOWS\system32\AdvancedInstallers
2015-05-12 16:46 - 2013-12-04 22:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-12 16:44 - 2013-11-14 02:17 - 00000000 ____D C:\Program Files\Windows Journal

==================== Files in the root of some directories =======

2014-07-30 13:57 - 2015-02-03 01:09 - 0000140 _____ () C:\Users\Vincent\AppData\Roaming\WB.CFG
2014-12-21 18:09 - 2014-12-21 18:09 - 0000010 _____ () C:\Users\Vincent\AppData\Local\DSI.DAT
2015-02-03 20:13 - 2015-02-03 20:13 - 0000017 _____ () C:\Users\Vincent\AppData\Local\resmon.resmoncfg
2013-11-27 18:18 - 2013-11-27 18:18 - 0000057 _____ () C:\ProgramData\Ament.ini
2015-06-03 14:37 - 2015-06-09 22:12 - 0000112 _____ () C:\ProgramData\g0PXd7.dat

Files to move or delete:
====================
C:\ProgramData\g0PXd7.dat

Some files in TEMP:
====================
C:\Users\Vincent\AppData\Local\Temp\compete.exe
C:\Users\Vincent\AppData\Local\Temp\cw.exe
C:\Users\Vincent\AppData\Local\Temp\Quarantine.exe
C:\Users\Vincent\AppData\Local\Temp\Setup_223940.exe
C:\Users\Vincent\AppData\Local\Temp\sqlite3.dll
C:\Users\Vincent\AppData\Local\Temp\Uninstall.exe
C:\Users\Vincent\AppData\Local\Temp\{27391BB0-F84A-44AE-981C-FDE048A3F69A}.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-06-11 04:23

==================== End of log ============================

 

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version:08-06-2015
Ran by Vincent at 2015-06-11 21:38:37
Running from C:\Users\Vincent\Downloads
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-3463171804-1537994893-3906066650-500 - Administrator - Disabled)
Guest (S-1-5-21-3463171804-1537994893-3906066650-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3463171804-1537994893-3906066650-1007 - Limited - Enabled)
UpdatusUser (S-1-5-21-3463171804-1537994893-3906066650-1005 - Limited - Enabled)
Vincent (S-1-5-21-3463171804-1537994893-3906066650-1002 - Administrator - Enabled) => C:\Users\Vincent

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
Adblock Plus for IE (32-bit and 64-bit) (HKLM\...\{C5D8EEB2-EDBC-4375-829D-BE50547C8890}) (Version: 1.3 - Eyeo GmbH)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.7.157 - Adobe Systems, Inc.)
AnyProtect (HKLM-x32\...\AnyProtect) (Version: 1.0.0.4 - CMI Limited) <==== ATTENTION
AnySend (HKLM-x32\...\ASPackage) (Version: 1.0.0.0 - CMI Limited) <==== ATTENTION!
Apple Application Support (32-bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.02 - Piriform)
Chronicle Keepers: The Dreaming Garden (HKLM-x32\...\Chronicle Keepers: The Dreaming Garden) (Version: 32.0.0.0 - Shockwave.com)
Company of Heroes 2 (HKLM-x32\...\Steam App 231430) (Version:  - Relic Entertainment)
Consumer Input (remove only) (HKLM-x32\...\Consumer Input Installer) (Version:  - Compete Inc.) <==== ATTENTION
Consumer Input Update Helper (x32 Version: 1.3.25.309 - Compete Inc.) Hidden <==== ATTENTION
Dell System Detect (HKU\S-1-5-21-3463171804-1537994893-3906066650-1002\...\9204f5692a8faf3b) (Version: 5.4.0.4 - Dell)
Dell WLAN and Bluetooth Client Installation (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Dell Inc.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
FinanceAlert (HKLM-x32\...\FinanceAlert) (Version: 3.0.60 - Valid Applications)
Free M4a to MP3 Converter 8.1 (HKLM-x32\...\Free M4a to MP3 Converter_is1) (Version:  - ManiacTools.com)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.124 - Google Inc.)
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
Heart's Medicine - Season One (HKLM-x32\...\Heart's Medicine - Season One) (Version: 32.0.0.0 - Shockwave.com)
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)
HP Photosmart 7520 series Basic Device Software (HKLM\...\{27ABA988-D480-4F44-B0FD-45E5656D2CFE}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Photosmart 7520 series Help (HKLM-x32\...\{08295D09-E002-48F8-905D-34E4B08509BA}) (Version: 28.0.0 - Hewlett Packard)
HP Update (HKLM-x32\...\{97486FBE-A3FC-4783-8D55-EA37E9D171CC}) (Version: 5.005.000.002 - Hewlett-Packard)
HTC Driver Installer (HKLM-x32\...\{4CEEE5D0-F905-4688-B9F9-ECC710507796}) (Version: 4.13.0.003 - HTC Corporation)
HTC Sync Manager (HKLM-x32\...\{231D0C79-98A6-4693-A366-36DE7D7346EC}) (Version: 3.1.24.5 - HTC)
Idle Crawler (HKLM-x32\...\B34D9DE2-9421-A246-989C-2FC69A579E84) (Version: 180.0.0.500 - GREYSTONE VENTURES LP) <==== ATTENTION
Infonaut 1.10.0.14 (HKLM-x32\...\Infonaut_1.10.0.14) (Version: 1.10.0.14 - Infonaut)
Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)
IPTInstaller (HKLM-x32\...\{08208143-777D-4A06-BB54-71BF0AD1BB70}) (Version: 4.0.8 - HTC)
iTunes (HKLM\...\{93F2A022-6C37-48B8-B241-FFABD9F60C30}) (Version: 12.1.2.27 - Apple Inc.)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java 8 Update 40 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation)
Malwarebytes Anti-Malware version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
Marine Park Empire (HKLM-x32\...\Marine Park Empire) (Version: 32.0.0.0 - Shockwave.com)
Microsoft Mouse and Keyboard Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Small Business 2007 (HKLM-x32\...\SMALLBUSINESSR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 38.0.5 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 38.0.5 (x86 en-US)) (Version: 38.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Multimedia Card Reader (HKLM-x32\...\InstallShield_{4B3D9AA4-B47A-4349-A64F-04D5A9226D7C}) (Version: 2.2.915.108 - Fitipower)
Multimedia Card Reader (x32 Version: 2.2.915.108 - Fitipower) Hidden
Music Manager (HKU\S-1-5-21-3463171804-1537994893-3906066650-1002\...\MusicManager) (Version:  - Google, Inc.)
MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.4 - F.J. Wechselberger)
Nancy Drew®: Danger by Design (HKLM-x32\...\Nancy Drew®: Danger by Design) (Version: 32.0.0.0 - Shockwave.com)
Nancy Drew®: Ghost of Thornton Hall (HKLM-x32\...\Nancy Drew®: Ghost of Thornton Hall) (Version:  - )
Nancy Drew®: Message in a Haunted Mansion (HKLM-x32\...\Nancy Drew®: Message in a Haunted Mansion) (Version: 32.0.0.0 - Shockwave.com)
Nancy Drew®: The Captive Curse (HKLM-x32\...\Nancy Drew®: The Captive Curse) (Version: 32.0.0.0 - Shockwave.com)
NVIDIA 3D Vision Controller Driver 332.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 332.21 - NVIDIA Corporation)
NVIDIA 3D Vision Driver 332.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 332.21 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2 - NVIDIA Corporation)
NVIDIA Graphics Driver 332.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 332.21 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA Virtual Audio 1.2.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.0.14.2148 - Electronic Arts, Inc.)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.200 - Qualcomm Atheros Communications)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
Revo Uninstaller Pro 3.1.2 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.1.2 - VS Revo Group, Ltd.)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.2.14014_7 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.6.2.14014_7 - Samsung Electronics Co., Ltd.) Hidden
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14024.11 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.14024.11 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.33.0 - SAMSUNG Electronics Co., Ltd.)
Search Protect (HKLM-x32\...\SearchProtect) (Version: 2.23.32.25 - Client Connect LTD)
Setup (HKLM-x32\...\{7ADF667E-E14D-4D2C-827C-B0108F0D93BC}) (Version:  - )
SHIELD Streaming (Version: 1.7.306 - NVIDIA Corporation) Hidden
SmartWeb (HKLM-x32\...\SmartWeb) (Version: 8.0.9 - SoftBrain Technologies Ltd.) <==== ATTENTION
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
Super Optimizer v3.2 (HKLM-x32\...\Super Optimizer_is1) (Version: 3.2.0.1 - Super PC Tools ltd) <==== ATTENTION
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
The Sims™ 3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.67.2 - Electronic Arts)
The Sims™ 3 Generations (HKLM-x32\...\{E6B88BD6-E4B2-4701-A648-B6DAC6E491CC}) (Version: 8.0.152 - Electronic Arts)
The Sims™ 3 High-End Loft Stuff (HKLM-x32\...\{71828142-5A24-4BD0-97E7-976DA08CE6CF}) (Version: 3.0.38 - Electronic Arts)
The Sims™ 3 Into the Future (HKLM-x32\...\{A0BBD6C7-B546-4048-B33A-F21F5C9F5B09}) (Version: 21.0.150 - Electronic Arts)
The Sims™ 3 Island Paradise (HKLM-x32\...\{DB21639E-FE55-432C-BCA2-0C5249E3F79E}) (Version: 19.0.101 - Electronic Arts)
The Sims™ 3 Late Night (HKLM-x32\...\{45057FCE-5784-48BE-8176-D9D00AF56C3C}) (Version: 6.0.81 - Electronic Arts)
The Sims™ 3 Master Suite Stuff (HKLM-x32\...\{08A25478-C5DD-4EA7-B168-3D687CA987FF}) (Version: 11.0.84 - Electronic Arts)
The Sims™ 3 Outdoor Living Stuff (HKLM-x32\...\{117B6BF6-82C3-420C-B284-9247C8568E53}) (Version: 7.0.55 - Electronic Arts)
The Sims™ 3 Pets (HKLM-x32\...\{C12631C6-804D-4B32-B0DD-8A496462F106}) (Version: 10.0.96 - Electronic Arts)
The Sims™ 3 Seasons (HKLM-x32\...\{3DE92282-CB49-434F-81BF-94E5B380E889}) (Version: 16.0.136 - Electronic Arts)
The Sims™ 3 Showtime (HKLM-x32\...\{3BBFD444-5FAB-49F6-98B1-A1954E831399}) (Version: 12.0.273 - Electronic Arts)
The Sims™ 3 Town Life Stuff (HKLM-x32\...\{7B11296A-F894-449C-8DF6-6AAAA7D4D118}) (Version: 9.0.73 - Electronic Arts)
The Sims™ 3 University Life (HKLM-x32\...\{F26DE8EF-F2CF-40DC-8CDA-CC0D82D11B36}) (Version: 18.0.126 - Electronic Arts)
The Sims™ 3 World Adventures (HKLM-x32\...\{BA26FFA5-6D47-47DB-BE56-34C357B5F8CC}) (Version: 2.0.86 - Electronic Arts)
thinkorswim (HKLM-x32\...\9968-4488-2169-7623) (Version: desktop - thinkorswim, Inc)
Touro Cloud Backup 2.0.5 (HKLM\...\Touro Cloud Backup) (Version: 2.0.5 - Touro Cloud Backup)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Windows Movie Maker 6.1 (HKLM-x32\...\{3CC29C1A-B5FE-457B-8F22-32A2winmovie}}_is1) (Version:  - win-movie-maker-free)
Wondershare MobileGo for Android ( Version 4.3.0 ) (HKLM-x32\...\{1E04C795-7359-4E05-8A0E-5644F777AA08}_is1) (Version: 4.3.0 - Wondershare)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== Restore Points =========================

27-05-2015 06:29:36 Windows Update
30-05-2015 18:50:00 Windows Update
03-06-2015 06:51:33 Windows Update
07-06-2015 17:57:27 Windows Update
11-06-2015 04:23:43 Windows Update

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 08:25 - 2013-08-22 08:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {06307C1A-3777-4C49-914C-6C25E82A4CDB} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {231B4307-6C7A-49F1-A168-1F18AB53D8D9} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {258BD58A-481D-4F70-BDE2-B2ADC3F9C5B3} - System32\Tasks\Microsoft\Windows\Maintenance\Web Tool Updater => %LOCALAPPDATA%\B34D9DE2-9421-A246-989C-2FC69A579E84\Runner.exe <==== ATTENTION
Task: {25E5AABB-3F0E-4BE5-A6F1-3E3027D219BE} - \Super Optimizer Schedule No Task File <==== ATTENTION
Task: {278E0F74-2E36-4A4D-9FC3-806CFAF3BC89} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {3268F948-3026-46CD-B4C9-E91D12D2DE0B} - System32\Tasks\DERKZ1 => C:\ProgramData\FlashBeat\FlashBeat.exe <==== ATTENTION
Task: {354ADB97-AF96-4187-9886-D9039AECB996} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {358497D4-8714-4C0C-A617-C0A2D3D406EA} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3463171804-1537994893-3906066650-1002 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {3B43FCC3-D612-469A-AAF3-B234D88B5279} - \SmartWeb Upgrade Trigger Task No Task File <==== ATTENTION
Task: {3E19779B-A2E1-4412-AD19-4EC85739C7D5} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)
Task: {468A52E2-A62B-4474-A45F-DA855727064E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-06-09] (Adobe Systems Incorporated)
Task: {53C6AEC8-F29A-440B-8884-60BA8FC8A53A} - System32\Tasks\Web Tool Runner => %LOCALAPPDATA%\B34D9DE2-9421-A246-989C-2FC69A579E84\Runner.exe <==== ATTENTION
Task: {57093BB8-52D6-4BEB-9962-CB21E796CBFC} - \LaunchPreSignup No Task File <==== ATTENTION
Task: {5FDD8066-A0F1-439F-B550-3A912C56E3BE} - \WSE_Vosteran No Task File <==== ATTENTION
Task: {613DACA9-FE12-4FA4-B090-64534E27DE33} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {65D11677-E9E0-4B05-B4C6-29D629AA532A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-09] (Google Inc.)
Task: {683E1E79-77DC-4EEF-90C0-22ACB8B93547} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-01-20] (Piriform Ltd)
Task: {6B250238-20BE-4D9E-A4F2-B559212E1644} - System32\Tasks\{E5EB5EC4-33DD-45B6-8B53-C1549FC8FF1B} => pcalua.exe -a C:\Users\Vincent\AppData\Local\4081\a21898.exe -c /uninstall
Task: {6CC70DCE-2D50-40DE-87BC-79292B031D0F} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks
Task: {7C92E8E5-8311-4377-975A-F026579B1B42} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3463171804-1537994893-3906066650-1002UA => C:\Users\Vincent\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {7CBE6EA2-5DD3-4CEC-8871-AA225CB47731} - System32\Tasks\TBVVKDQJO1 => C:\ProgramData\NavRight\NavRight.exe
Task: {917B2A42-866B-4B13-B88E-ABD012708148} - System32\Tasks\avabvbavad => C:\Users\Vincent\AppData\Local\avabvbavad\avabvbavad.exe <==== ATTENTION
Task: {95A0EECF-3FD6-4F42-8AAE-36F7FF68CEB5} - System32\Tasks\Hecoemiftaenx => C:\ProgramData\Hecoemiftaenx\1.0.1.0\avssaonk.exe
Task: {96D08BFC-EE3E-4096-AAAC-284A7558A950} - \Bidaily Synchronize Task[973b] No Task File <==== ATTENTION
Task: {9ACD3E74-1161-40CB-9583-DDD2C3BF5769} - System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser => C:\Windows\system32\compattel\DiagTrackRunner.exe [2015-03-15] (Microsoft Corporation)
Task: {A556D863-104C-4F30-A9E9-4BAAC0769814} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-06-10] (Microsoft Corporation)
Task: {A7C67519-873A-40F2-A5D8-C1A2E4B89552} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-06] (Microsoft Corporation)
Task: {B1CA970A-811C-49AB-B555-98E858E5229F} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3463171804-1537994893-3906066650-1002 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {B8BB8D73-3088-4341-82D4-14DEBABE74CE} - \BackgroundContainer Startup Task No Task File <==== ATTENTION
Task: {BD93B4FF-9BD5-4878-B98E-4A41F5F2C32C} - System32\Tasks\RFZCDR => C:\ProgramData\a999a84076744259bfb99f6ac1335239\a999a84076744259bfb99f6ac1335239.exe
Task: {C760E6B6-0012-4360-9C5C-FA5CB3B3EAEE} - System32\Tasks\TYVYITY => C:\ProgramData\d1fb0a090c54447b835aef1f921b6dbe\d1fb0a090c54447b835aef1f921b6dbe.exe
Task: {C9657C09-4905-41C8-88A3-D4C284F03A95} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3463171804-1537994893-3906066650-1002Core => C:\Users\Vincent\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {CA15C04B-5862-4A5B-B8EE-410F77457A8C} - \bench-sys No Task File <==== ATTENTION
Task: {CB972030-328B-44A2-85D7-1C49250559EB} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {CE995AEA-7DBA-4631-90A0-13760B66D5CC} - \Bidaily Synchronize Task[3c32] No Task File <==== ATTENTION
Task: {D2411419-CF58-42E1-A11B-6982B7F6DA3C} - System32\Tasks\GoogleUpdateTaskUserM_1_7_22_478699874-4155726479-3780505679-3006UA__323932393134323039392d232d783232575b5a34452d2a => Wscript.exe //B "C:\ProgramData\PastaLeadsAgent\startprocess.js" pastaleadss.exe /invoke /f:check_services /l:0
Task: {D99C310A-31E3-4F6A-BD84-D74DF508CD8D} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {DAE03C4C-8C2C-420C-969C-27758C280002} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {E4333F5B-D0B7-4FF8-A7B2-1457C74689FD} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-09] (Google Inc.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\DERKZ1.job => C:\ProgramData\FlashBeat\FlashBeat.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-3463171804-1537994893-3906066650-1002Core.job => C:\Users\Vincent\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-3463171804-1537994893-3906066650-1002UA.job => C:\Users\Vincent\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\TBVVKDQJO1.job => C:\ProgramData\NavRight\NavRight.exe

==================== Loaded Modules (Whitelisted) ==============

2014-02-11 20:27 - 2013-12-19 13:53 - 00117536 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-03-20 18:12 - 2015-03-20 18:12 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-03-20 18:12 - 2015-03-20 18:12 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2012-12-07 18:27 - 2012-12-07 18:27 - 00167424 _____ () C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
2012-10-18 12:44 - 2012-10-18 12:44 - 03671176 _____ () C:\Program Files\Touro Cloud Backup\Touro Cloud BackupCrawler.exe
2012-10-18 12:43 - 2012-10-18 12:43 - 01486848 _____ () C:\Program Files\Touro Cloud Backup\ShellExtensionx64\ShellExtension.dll
2012-10-18 12:41 - 2012-10-18 12:41 - 01324544 _____ () C:\Program Files\Touro Cloud Backup\Touro Cloud Backup.exe
2015-03-20 18:12 - 2015-03-20 18:12 - 00306984 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxslt.dll
2012-06-28 18:39 - 2012-06-28 18:39 - 00262144 _____ () C:\Program Files (x86)\Multimedia Card Reader(9106)\Shwicon9106.exe
2014-08-06 13:40 - 2014-08-06 13:40 - 00031080 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\DbAccess.dll
2014-08-06 13:41 - 2014-08-06 13:41 - 00607376 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\sqlite3.dll
2014-08-06 13:41 - 2014-08-06 13:41 - 00059752 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\NAdvLog.dll
2014-08-06 13:41 - 2014-08-06 13:41 - 00036216 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\NFileCacheDBAccess.dll
2014-08-06 13:42 - 2014-08-06 13:42 - 00080248 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\ninstallerhelper.dll
2012-10-11 08:13 - 2012-10-11 08:13 - 00897536 _____ () C:\Program Files\Touro Cloud Backup\NativeControls7.dll
2012-10-18 12:41 - 2012-10-18 12:41 - 01484288 _____ () C:\Program Files\Touro Cloud Backup\OnlineBackupFacade.dll
2013-12-10 16:06 - 2013-12-10 16:06 - 10683392 _____ () C:\Users\Vincent\AppData\Local\Programs\Google\MusicManager\QtWebKit4.dll
2013-12-10 16:06 - 2013-12-10 16:06 - 07741952 _____ () C:\Users\Vincent\AppData\Local\Programs\Google\MusicManager\QtGui4.dll
2013-12-10 16:06 - 2013-12-10 16:06 - 01681408 _____ () C:\Users\Vincent\AppData\Local\Programs\Google\MusicManager\QtNetwork4.dll
2013-12-10 16:06 - 2013-12-10 16:06 - 02248192 _____ () C:\Users\Vincent\AppData\Local\Programs\Google\MusicManager\QtCore4.dll
2014-05-15 16:20 - 2014-05-15 16:20 - 00117248 _____ () C:\Users\Vincent\AppData\Local\Programs\Google\MusicManager\libaacdec.dll
2014-05-15 16:20 - 2014-05-15 16:20 - 00231936 _____ () C:\Users\Vincent\AppData\Local\Programs\Google\MusicManager\libmpgdec.dll
2014-05-15 16:21 - 2014-05-15 16:21 - 00253440 _____ () C:\Users\Vincent\AppData\Local\Programs\Google\MusicManager\libid3tag.dll
2014-05-15 16:24 - 2014-05-15 16:24 - 00344064 _____ () C:\Users\Vincent\AppData\Local\Programs\Google\MusicManager\libaudioenc.dll
2013-12-10 16:06 - 2013-12-10 16:06 - 00026624 _____ () C:\Users\Vincent\AppData\Local\Programs\Google\MusicManager\imageformats\qgif4.dll
2014-03-07 16:41 - 2013-07-24 10:24 - 00137728 _____ () C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSCreateVC.dll
2014-10-18 15:33 - 2014-10-18 15:33 - 00016384 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PSIClient\1706c668394b6917a63634ebd3bedcf2\PSIClient.ni.dll
2013-11-27 12:03 - 2012-06-26 04:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:56E2E879
AlternateDataStreams: C:\Users\Vincent\SkyDrive:ms-properties

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\78516239.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\78516239.sys => ""="Driver"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-3463171804-1537994893-3906066650-1002\...\dell.com -> dell.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3463171804-1537994893-3906066650-1002\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Dell\Win CHROME 1920x1200.jpg
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\StartupFolder: => "PastaQuotes.lnk"
HKLM\...\StartupApproved\Run: => "BtTray"
HKLM\...\StartupApproved\Run: => "BtvStack"
HKLM\...\StartupApproved\Run32: => "t4pc_en_7"
HKU\S-1-5-21-3463171804-1537994893-3906066650-1002\...\StartupApproved\StartupFolder: => "Weather Alerts.lnk"
HKU\S-1-5-21-3463171804-1537994893-3906066650-1002\...\StartupApproved\Run: => "My Driver Updater"
HKU\S-1-5-21-3463171804-1537994893-3906066650-1002\...\StartupApproved\Run: => "KiesAirMessage"
HKU\S-1-5-21-3463171804-1537994893-3906066650-1002\...\StartupApproved\Run: => "Wondershare Helper Compact"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{ECCFCB7C-7D53-4187-AD48-FAE5218B7F6A}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{C5E7CB98-B2FE-4D27-9D17-BC044BA9AC5B}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{92E20BCE-6922-454C-8371-30E18C50231B}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{AC283450-C8E0-40EF-B1C3-078FFC5B92C7}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{A54B2F3A-364F-405C-8065-6FA043B6B368}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{1C1431B7-6E5F-4179-BAC3-93C52719E647}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{AA914C5A-CEC2-4FC7-B4CE-5E5EE49755D4}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{207AEEA5-0AA5-4DA2-B0A8-7F1F241BF5D7}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{87F387E3-AAC3-4D23-8E0E-D9D77E2AE541}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{C8116CD8-3A43-4042-B249-3901FFBCCCD9}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{86ED7A83-3784-4EEA-8711-ADCC04CF0638}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{B391214E-A8F9-4AA7-A559-7BC3BD2EEC0E}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{B729F7F9-CE9B-4E68-9F83-442BCE536024}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{567FAAC8-94E2-499A-B4C2-18BBC743D844}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{E4C58626-34CC-4642-820A-7EDA6C4B7929}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{6C558B1F-9DC5-4B38-A5B5-9C257CE7C3E8}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{C4C26ECC-E441-493B-AB33-D2A58B62A619}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Company of Heroes 2\RelicCoH2.exe
FirewallRules: [{09D20557-20C6-4526-8523-756479513C1A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Company of Heroes 2\RelicCoH2.exe
FirewallRules: [{FCD96652-913F-4350-B944-8EF88C6C4CE0}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Company of Heroes 2\RelicCoH2.exe
FirewallRules: [{96BE34AA-102B-4CBB-80A0-0AD1DDB216C7}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Company of Heroes 2\RelicCoH2.exe
FirewallRules: [{2ADCBD40-C118-4044-AF07-8B74B117494D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Company of Heroes 2\RelicCoH2.exe
FirewallRules: [{FFC8A081-D956-496A-8C71-DD9A22E15B6A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Company of Heroes 2\RelicCoH2.exe
FirewallRules: [{2F4F9ECA-C917-493C-ACA1-5960EC229F4F}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{FB3072C5-CB73-45D7-9E91-05278AD2547C}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{2FF3248B-6973-43B1-9AC4-7C507297E01B}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{7EECD16A-2F7C-423D-81E2-C85450A5A435}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{0C7986C5-2BA1-4F3D-B501-AC8F2087A832}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{62C2D67E-B854-4944-B2A8-8585318AF949}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{655FBA90-5FD4-4C20-9947-65C77E4CA4BE}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{F9EC5E12-8323-46BC-A417-C8218447A19F}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{236C163C-9CE0-4F74-98D3-B63C6F78D8A9}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{7F8CA338-B3DE-4679-95C3-01845A63FDB4}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{CA5E73DB-BE18-4B1B-879E-36B528D77419}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{05E3200E-26F2-46F8-98B9-123E476CAFB2}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{FAD30135-A1A5-4BD4-B93D-357FC1E277FE}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{D766A1E8-1E13-40D0-BF97-DCF8F87738FE}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\Bin\HPNetworkCommunicator.exe
FirewallRules: [{F628D3E9-2157-4978-90D9-F207366198DF}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\Bin\DeviceSetup.exe
FirewallRules: [{638C676C-3927-4E5F-86C0-EF7C1345FF3E}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\bin\SendAFax.exe
FirewallRules: [{E95B665F-F783-42F2-9B97-F6F8262EBF90}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\bin\DigitalWizards.exe
FirewallRules: [{FBEE904E-C3A5-4F56-9201-F853BEAB2C9B}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\bin\FaxApplications.exe
FirewallRules: [UDP Query User{CC05529A-93E8-404A-8F7E-856CAFD0EA1A}C:\program files (x86)\dell wireless\bluetooth suite\bttray.exe] => (Allow) C:\program files (x86)\dell wireless\bluetooth suite\bttray.exe
FirewallRules: [TCP Query User{A43A92C3-D4EE-4E6B-A317-CDB0D7FCC4D2}C:\program files (x86)\dell wireless\bluetooth suite\bttray.exe] => (Allow) C:\program files (x86)\dell wireless\bluetooth suite\bttray.exe
FirewallRules: [UDP Query User{C734A764-DF53-4B9E-A76A-EFEB07B7177E}C:\program files (x86)\dell wireless\bluetooth suite\btvstack.exe] => (Allow) C:\program files (x86)\dell wireless\bluetooth suite\btvstack.exe
FirewallRules: [TCP Query User{F059F5AD-175C-428C-A061-EFBF23D87C63}C:\program files (x86)\dell wireless\bluetooth suite\btvstack.exe] => (Allow) C:\program files (x86)\dell wireless\bluetooth suite\btvstack.exe
FirewallRules: [{392ED820-9A47-4971-866D-4FEC15C16501}] => (Allow) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Win7Ui.exe
FirewallRules: [{9F3A5EF2-C81C-4CF5-B7B8-9B8264E26B6F}] => (Allow) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtTray.exe
FirewallRules: [{D99ED326-D4D2-4929-9ADF-8EA1DE16523D}] => (Allow) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtTray.exe
FirewallRules: [{93FB7B69-33AB-4A62-9205-11FE1ABBD889}] => (Allow) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Btvstack.exe
FirewallRules: [{F8F9AAAF-7B5B-42BE-9DAA-F2E5BD0208B8}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{8E437324-D310-4A01-BCED-13691F66D246}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [TCP Query User{89E2B006-85AE-4F28-B981-3E0B10F1BC00}C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe] => (Allow) C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe
FirewallRules: [UDP Query User{81F13C1C-5113-4936-85E3-E6B52EB777B1}C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe] => (Allow) C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe
FirewallRules: [TCP Query User{4C9C8E4C-F708-4651-A826-D9F1ED9CFD06}C:\program files (x86)\wondershare\mobilego for android\mobilegoservice.exe] => (Allow) C:\program files (x86)\wondershare\mobilego for android\mobilegoservice.exe
FirewallRules: [UDP Query User{E7A84136-108D-46BA-83A8-EDEFBD029A37}C:\program files (x86)\wondershare\mobilego for android\mobilegoservice.exe] => (Allow) C:\program files (x86)\wondershare\mobilego for android\mobilegoservice.exe
FirewallRules: [TCP Query User{5F1F7651-D3C4-4879-AE82-91B1EC2D41B3}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{304C63EC-C0A0-4977-9429-DEAD2D85931B}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [{4A12BF82-32B0-481B-B95C-2B1A52D7C983}] => (Allow) C:\Program Files (x86)\HTC\HTC Sync Manager\HTCSyncManager.exe
FirewallRules: [{0FCE9F0F-2A07-447D-AA53-CA564081D1B5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{EA4FBEA0-FAB8-4C0E-9151-CEB1DE606406}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{F681CF36-DC3B-4838-91D7-0C0461868184}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{5FA75506-D201-4C27-874C-26EA6952A46F}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [TCP Query User{828BF95D-9F82-4EB6-8AE5-6476908320EE}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{EED07B00-A7B7-4438-AA08-8955000F4296}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{945336E6-E2DE-4B3C-A727-ADB637B73A75}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [TCP Query User{C411D303-E799-4536-8750-F1655D37D6F8}C:\program files (x86)\wondershare\mobilego for android\mobilegoservice.exe] => (Block) C:\program files (x86)\wondershare\mobilego for android\mobilegoservice.exe
FirewallRules: [UDP Query User{30E0A1FF-FCAA-43A9-932E-6C646FB23107}C:\program files (x86)\wondershare\mobilego for android\mobilegoservice.exe] => (Block) C:\program files (x86)\wondershare\mobilego for android\mobilegoservice.exe
FirewallRules: [{1AEBB239-3995-4298-9536-276EB3C660CF}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

Name: amBX ™ device controller
Description: amBX ™ device controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Dell Wireless 1703 Bluetooth
Description: Dell Wireless 1703 Bluetooth
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: Qualcomm Atheros Communications
Service: BTHUSB
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

==================== Event log errors: =========================

Application errors:
==================
Error: (06/11/2015 09:36:35 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_a9edf09f013934e0.manifest.

Error: (06/11/2015 09:36:35 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_a9edf09f013934e0.manifest.

Error: (06/11/2015 09:36:34 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_a9edf09f013934e0.manifest.

Error: (06/11/2015 04:33:44 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_a9edf09f013934e0.manifest.

Error: (06/11/2015 04:29:43 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_a9edf09f013934e0.manifest.

Error: (06/11/2015 04:23:57 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_a9edf09f013934e0.manifest.

Error: (06/11/2015 04:23:56 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_a9edf09f013934e0.manifest.

Error: (06/11/2015 04:23:53 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_a9edf09f013934e0.manifest.

Error: (06/11/2015 04:23:33 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_a9edf09f013934e0.manifest.

Error: (06/11/2015 01:44:08 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_a9edf09f013934e0.manifest.

System errors:
=============
Error: (06/11/2015 09:16:25 PM) (Source: Microsoft-Windows-Bits-Client) (EventID: 16398) (User: NT AUTHORITY)
Description: A new BITS job could not be created. The current job count for the user family\Vincent (186) is equal to or greater than the job limit (60) specified through group policy.  To correct the problem, complete or cancel the BITS jobs that haven't made progress by looking at the error, and restart the BITS service. If this error recurs, contact your system administrator and increate the per-user and per-computer Group Policy job limits.

Error: (06/11/2015 08:11:06 PM) (Source: Microsoft-Windows-Bits-Client) (EventID: 16398) (User: NT AUTHORITY)
Description: A new BITS job could not be created. The current job count for the user family\Vincent (186) is equal to or greater than the job limit (60) specified through group policy.  To correct the problem, complete or cancel the BITS jobs that haven't made progress by looking at the error, and restart the BITS service. If this error recurs, contact your system administrator and increate the per-user and per-computer Group Policy job limits.

Error: (06/11/2015 08:11:06 PM) (Source: Microsoft-Windows-Bits-Client) (EventID: 16398) (User: NT AUTHORITY)
Description: A new BITS job could not be created. The current job count for the user family\Vincent (186) is equal to or greater than the job limit (60) specified through group policy.  To correct the problem, complete or cancel the BITS jobs that haven't made progress by looking at the error, and restart the BITS service. If this error recurs, contact your system administrator and increate the per-user and per-computer Group Policy job limits.

Error: (06/11/2015 07:48:26 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070490: Hewlett-Packard  - Imaging, Other hardware - Null Fax - HP Photosmart 7520 series.

Error: (06/11/2015 07:48:20 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070490: Hewlett-Packard  - Imaging, Other hardware - Null Print - HP Photosmart 7520 series.

Error: (06/11/2015 04:16:25 PM) (Source: Microsoft-Windows-Bits-Client) (EventID: 16398) (User: NT AUTHORITY)
Description: A new BITS job could not be created. The current job count for the user family\Vincent (186) is equal to or greater than the job limit (60) specified through group policy.  To correct the problem, complete or cancel the BITS jobs that haven't made progress by looking at the error, and restart the BITS service. If this error recurs, contact your system administrator and increate the per-user and per-computer Group Policy job limits.

Error: (06/11/2015 04:16:25 PM) (Source: Microsoft-Windows-Bits-Client) (EventID: 16398) (User: NT AUTHORITY)
Description: A new BITS job could not be created. The current job count for the user family\Vincent (186) is equal to or greater than the job limit (60) specified through group policy.  To correct the problem, complete or cancel the BITS jobs that haven't made progress by looking at the error, and restart the BITS service. If this error recurs, contact your system administrator and increate the per-user and per-computer Group Policy job limits.

Error: (06/11/2015 00:23:16 PM) (Source: Microsoft-Windows-Bits-Client) (EventID: 16398) (User: NT AUTHORITY)
Description: A new BITS job could not be created. The current job count for the user family\Vincent (186) is equal to or greater than the job limit (60) specified through group policy.  To correct the problem, complete or cancel the BITS jobs that haven't made progress by looking at the error, and restart the BITS service. If this error recurs, contact your system administrator and increate the per-user and per-computer Group Policy job limits.

Error: (06/11/2015 00:16:25 PM) (Source: Microsoft-Windows-Bits-Client) (EventID: 16398) (User: NT AUTHORITY)
Description: A new BITS job could not be created. The current job count for the user family\Vincent (186) is equal to or greater than the job limit (60) specified through group policy.  To correct the problem, complete or cancel the BITS jobs that haven't made progress by looking at the error, and restart the BITS service. If this error recurs, contact your system administrator and increate the per-user and per-computer Group Policy job limits.

Error: (06/11/2015 00:08:16 PM) (Source: Microsoft-Windows-Bits-Client) (EventID: 16398) (User: NT AUTHORITY)
Description: A new BITS job could not be created. The current job count for the user family\Vincent (186) is equal to or greater than the job limit (60) specified through group policy.  To correct the problem, complete or cancel the BITS jobs that haven't made progress by looking at the error, and restart the BITS service. If this error recurs, contact your system administrator and increate the per-user and per-computer Group Policy job limits.

Microsoft Office:
=========================

CodeIntegrity Errors:
===================================
  Date: 2015-06-11 04:25:08.193
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-06-10 07:30:18.881
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-06-10 07:30:18.733
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-06-10 07:30:18.579
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-06-10 07:30:18.421
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-06-10 07:30:18.275
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-06-10 07:30:18.129
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-06-10 07:30:17.983
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-06-10 07:30:17.837
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-06-10 07:30:17.694
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

==================== Memory info ===========================

Processor: Intel® Core™ i7-3770 CPU @ 3.40GHz
Percentage of memory in use: 11%
Total physical RAM: 24536.93 MB
Available physical RAM: 21776.86 MB
Total Pagefile: 28120.93 MB
Available Pagefile: 24659.15 MB
Total Virtual: 131072 MB
Available Virtual: 131071.77 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:1861.54 GB) (Free:1113.13 GB) NTFS
Drive d: (VINCEDRIVE) (Fixed) (Total:931.28 GB) (Free:122.38 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: 9AF5775E)

Partition: GPT Partition Type.

========================================================
Disk: 1 (Size: 931.5 GB) (Disk ID: 44FDFE06)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=0C)

==================== End of log ============================

 



#3 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,611 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:08:54 PM

Posted 15 June 2015 - 09:37 PM

Greetings thoroughnut and :welcome: to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

If you would allow me to call you by your first name I would prefer to do that. :thumbup2:

===================================================

Ground Rules:
  • First, I would like to inform you that most of us here at Bleeping Computer offer our expert assistance out of the goodness of our hearts. Please try to match our commitment to you with your patience toward us. If this was easy we would never have met. :)
  • Please do not run any tools or take any steps other than those I will provide for you while we work on your computer together. I need to be certain about the state of your computer in order to provide appropriate and effective steps for you to take. Most often "well intentioned" (and usually panic driven!) independent efforts can make things much worse for both of us. If at any point you would prefer to take your own steps please let me know, I will not be offended. I would be happy to focus on the many others who are waiting in line for assistance.
  • Please perform all steps in the order they are listed in each set of instructions. Some steps may be a bit complicated. If things are not clear, be sure to stop and let me know. We need to work on this together with confidence.
  • Please copy and paste all logs into your post unless directed otherwise. Please do not re-run any programs I suggest. If you encounter problems simply stop and tell me.
  • When you post your reply, use the Replytopic.jpg button instead.
  • In the upper right hand corner of the topic you will see the Followtopic.jpg button. Click on this then choose Immediate E-Mail notification and then Proceed and you will be sent an email once I have posted a response.
  • If you do not reply to your topic after 5 days we assume it has been abandoned and I will close it.
  • When your computer is clean I will alert you of such. I will also provide for you detailed information about how you can combat future infections.
  • I would like to remind you to make no further changes to your computer unless I direct you to do so.
  • Now let's get started :thumbup2:
===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and post that information so that I know you are still with me. Unfortunately, there are many people waiting to be assisted and not enough of us at BleepingComputer to go around. I appreciate your understanding and diligence.

Thank you for your patience thus far. Please consider and do this.

===================================================

Cracking Software Warning

--------------------

There is evidence of pirated software on your computer and I would request you remove it prior to completing the steps I have posted.
 

Post by quietman7, on 02 October 2009 - 05:16 AM, said:


A Keygen is a program which is used to illegally bypass copy protection on games and commercial software by generating a random serial number, or "cd key", that matches the software it is intended to be used with.

A Cracking tool is used to copy commercial software illegally by breaking the various copy-protection and registration techniques being used.

The practice of using cracking tools, keygens, warez or any pirated software is not only considered illegal activity but it is a serious security risk.

Quote
Cracking applications are used for illegally breaking (cracking) various copy-protection and registration techniques used in commercial software. These programs may be distributed via Web sites, Usenet, and P2P networks.

trendmicro.com/vinfo

Quote
...warez and crack web pages are being used by cybercriminals as download sites for malware related to VIRUT and VIRUX. Searches for serial numbers, cracks, and even antivirus products like Trend Micro yield malcodes that come in the form of executables or self-extracting files...quick links in these sites also lead to malicious files. Ads and banners are also infection vectors...

Keygen and Crack Sites Distribute VIRUX and FakeAV

Quote
...warez/piracy sites ranked the highest in downloading spyware...just opening the web page usually sets off an exploit, never mind actually downloading anything. And by the time the malware is finished downloading, often the machine is trashed and rendered useless.

University of Washington spyware study

Some of the worst types of malware infections can be contracted and spread by visiting crack, keygen, warez and other pirated software sites. In many cases, those sites are infested with a smörgåsbord of malware and an increasing source of system infection. Those who attempt to get software for free can end up with a computer system so badly damaged that recovery is not possible and it cannot be repaired. When that happens there is nothing you can do besides reformatting and reinstalling the OS.


===================================================

Farbar's Recovery Scan Tool - Run Fix in Normal or Safe Mode

--------------------
  • Press the Windows key Windows_Logo_key.gif + r on your keyboard at the same time. Type in notepad and press Enter
  • Please copy and paste the contents of the below code box into the open notepad and save it to your desktop (<<<Important) as fixlist.txt
HKU\S-1-5-21-3463171804-1537994893-3906066650-1002\...\MountPoints2: {2a045e94-e180-11e4-befb-b8ca3a890dd5} - "J:\HTC_Sync_Manager_PC.exe"
HKU\S-1-5-21-3463171804-1537994893-3906066650-1002\...\MountPoints2: {d150fbb7-a9f9-11e3-be87-bc855631869e} - "J:\HTC_Sync_Manager_PC.exe"
HKU\S-1-5-21-3463171804-1537994893-3906066650-1002\...\MountPoints2: {d5d5d7ff-570f-11e3-be65-806e6f6e6963} - "I:\Autorun.exe"
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll => C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll File not found
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3463171804-1537994893-3906066650-1002\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxySettingsPerUser] 0 <======= ATTENTION (Policy restriction on ProxySettings)
SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL =
SearchScopes: HKLM-x32 -> DefaultScope value is missing
BHO: No Name -> {3C2C21F7-FDB6-4b10-B605-FA4A281E3016} ->  No File
BHO: shopperz -> {5081D2D4-1637-404c-B74F-50526718257D} -> C:\Program Files\shopperz\mseff64.dll No File
BHO: Consumer Input DCA BHO -> {B49699FC-1665-4414-A1CB-C4A2A4A13EEC} -> C:\Program Files (x86)\Consumer Input\InternetExplorer\x64\dca-bho.dll No File
FF Plugin HKU\S-1-5-21-3463171804-1537994893-3906066650-1002: @tools.google.com/Google Update;version=3 -> C:\Users\Vincent\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin HKU\S-1-5-21-3463171804-1537994893-3906066650-1002: @tools.google.com/Google Update;version=9 -> C:\Users\Vincent\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
S3 MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [X]
2015-06-10 14:53 - 2015-06-10 14:53 - 00019525 _____ C:\Users\Vincent\Desktop\ToNi5IW1.htm
2015-06-09 23:26 - 2015-06-09 23:26 - 00003472 _____ C:\WINDOWS\System32\Tasks\avabvbavad
2015-06-09 23:23 - 2015-06-10 21:46 - 00000000 ____D C:\ProgramData\hiAHTbn
2015-06-03 21:22 - 2015-06-10 15:19 - 00003452 _____ C:\WINDOWS\System32\Tasks\Hecoemiftaenx
2015-06-03 21:22 - 2015-06-03 21:22 - 00000000 ____D C:\ProgramData\Hecoemiftaenx
2015-06-03 20:10 - 2015-06-03 20:11 - 00233051 _____ C:\Users\Vincent\Downloads\A899.tmp
2015-06-03 15:15 - 2015-06-10 21:46 - 00000348 _____ C:\WINDOWS\Tasks\DERKZ1.job
2015-06-03 15:15 - 2015-06-03 15:15 - 00003562 _____ C:\WINDOWS\System32\Tasks\RFZCDR
2015-06-03 15:15 - 2015-06-03 15:15 - 00002862 _____ C:\WINDOWS\System32\Tasks\DERKZ1
2015-06-03 15:15 - 2015-06-03 15:15 - 00000000 _____ C:\WINDOWS\SysWOW64\Number of results
2015-06-03 14:42 - 2015-06-03 14:42 - 00003562 _____ C:\WINDOWS\System32\Tasks\TYVYITY
2015-06-03 14:41 - 2015-06-10 18:06 - 00000000 ____D C:\Users\Vincent\AppData\Roaming\Eppink
2015-06-03 14:41 - 2015-06-10 18:06 - 00000000 ____D C:\Users\Vincent\AppData\Roaming\4C4C4544-1433360506-5410-8030-C6C04F475831
2015-06-03 14:40 - 2015-06-10 21:46 - 00000342 _____ C:\WINDOWS\Tasks\TBVVKDQJO1.job
2015-06-03 14:40 - 2015-06-03 14:40 - 00002856 _____ C:\WINDOWS\System32\Tasks\TBVVKDQJO1
2015-06-03 14:37 - 2015-06-09 22:12 - 00000112 _____ C:\ProgramData\g0PXd7.dat
2015-06-03 14:36 - 2015-06-03 14:36 - 00004626 _____ C:\WINDOWS\System32\Tasks\Web Tool Runner
2015-06-03 14:34 - 2015-06-10 18:06 - 00000000 ____D C:\Users\Vincent\AppData\Roaming\4C4C4544-1433360085-5410-8030-C6C04F475831
2015-06-03 14:22 - 2013-08-22 08:25 - 00000824 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak
2015-06-03 14:21 - 2015-06-10 20:01 - 00000000 ____D C:\Users\Vincent\AppData\Roaming\4C4C4544-1433359301-5410-8030-C6C04F475831
2015-06-03 14:20 - 2015-06-09 22:52 - 00000000 ____D C:\Program Files (x86)\9b5af7f8-571f-4257-ac86-b814c6c63b4a
2015-06-03 14:20 - 2015-06-09 21:20 - 00000004 _____ C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-06-03 14:15 - 2015-06-03 20:15 - 00000000 ____D C:\ProgramData\{1e3738be-c410-f6cb-1e37-738bec41e2fb}
2015-06-03 14:37 - 2015-06-09 22:12 - 0000112 _____ () C:\ProgramData\g0PXd7.dat
C:\Users\Vincent\AppData\Local\Temp\compete.exe
C:\Users\Vincent\AppData\Local\Temp\cw.exe
C:\Users\Vincent\AppData\Local\Temp\Quarantine.exe
C:\Users\Vincent\AppData\Local\Temp\Setup_223940.exe
C:\Users\Vincent\AppData\Local\Temp\sqlite3.dll
C:\Users\Vincent\AppData\Local\Temp\Uninstall.exe
C:\Users\Vincent\AppData\Local\Temp\{27391BB0-F84A-44AE-981C-FDE048A3F69A}.exe
Task: {258BD58A-481D-4F70-BDE2-B2ADC3F9C5B3} - System32\Tasks\Microsoft\Windows\Maintenance\Web Tool Updater => %LOCALAPPDATA%\B34D9DE2-9421-A246-989C-2FC69A579E84\Runner.exe <==== ATTENTION
Task: {25E5AABB-3F0E-4BE5-A6F1-3E3027D219BE} - \Super Optimizer Schedule No Task File <==== ATTENTION
Task: {3268F948-3026-46CD-B4C9-E91D12D2DE0B} - System32\Tasks\DERKZ1 => C:\ProgramData\FlashBeat\FlashBeat.exe <==== ATTENTION
Task: {3B43FCC3-D612-469A-AAF3-B234D88B5279} - \SmartWeb Upgrade Trigger Task No Task File <==== ATTENTION
Task: {53C6AEC8-F29A-440B-8884-60BA8FC8A53A} - System32\Tasks\Web Tool Runner => %LOCALAPPDATA%\B34D9DE2-9421-A246-989C-2FC69A579E84\Runner.exe <==== ATTENTION
Task: {57093BB8-52D6-4BEB-9962-CB21E796CBFC} - \LaunchPreSignup No Task File <==== ATTENTION
Task: {5FDD8066-A0F1-439F-B550-3A912C56E3BE} - \WSE_Vosteran No Task File <==== ATTENTION
Task: {7CBE6EA2-5DD3-4CEC-8871-AA225CB47731} - System32\Tasks\TBVVKDQJO1 => C:\ProgramData\NavRight\NavRight.exe
Task: {96D08BFC-EE3E-4096-AAAC-284A7558A950} - \Bidaily Synchronize Task[973b] No Task File <==== ATTENTION
Task: {B8BB8D73-3088-4341-82D4-14DEBABE74CE} - \BackgroundContainer Startup Task No Task File <==== ATTENTION
Task: {BD93B4FF-9BD5-4878-B98E-4A41F5F2C32C} - System32\Tasks\RFZCDR => C:\ProgramData\a999a84076744259bfb99f6ac1335239\a999a84076744259bfb99f6ac1335239.exe
Task: {C760E6B6-0012-4360-9C5C-FA5CB3B3EAEE} - System32\Tasks\TYVYITY => C:\ProgramData\d1fb0a090c54447b835aef1f921b6dbe\d1fb0a090c54447b835aef1f921b6dbe.exe
Task: {CA15C04B-5862-4A5B-B8EE-410F77457A8C} - \bench-sys No Task File <==== ATTENTION
Task: {CE995AEA-7DBA-4631-90A0-13760B66D5CC} - \Bidaily Synchronize Task[3c32] No Task File <==== ATTENTION
Task: C:\WINDOWS\Tasks\DERKZ1.job => C:\ProgramData\FlashBeat\FlashBeat.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\TBVVKDQJO1.job => C:\ProgramData\NavRight\NavRight.exe
AlternateDataStreams: C:\ProgramData\TEMP:56E2E879
  • Launch FRST and press the Fix button just once and wait, the program will automatically launch fixlist.txt.
  • The tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
===================================================

Uninstalling a Program using Add/Remove Program

--------------------

I recommend the uninstalling of the below listed program(s).
  • Press windows key Windows_Logo_key.gif + r on your keyboard at the same time
  • Type appwiz.cpl and press Enter
  • A list of installed programs will be displayed
  • Uninstall the following by clicking on the program(s) below (and any other similar names) and selecting Remove or Uninstall

AnyProtect
AnySend
Consumer Input
Consumer Input Update Helper
Idle Crawler
SmartWeb
Super Optimizer v3.2

  • Reboot your computer
===================================================

System Summary Information

--------------------
  • Press the windows key Windows_Logo_key.gif + r on your keyboard at the same time
  • Type msinfo32 and press Enter
  • Left click on System Summary
  • Click File, Save, and name the file Summary
  • Zip and attach the file to your reply
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Fixlog
  • Did the programs uninstall properly?
  • System Summary Information

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#4 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,611 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:08:54 PM

Posted 18 June 2015 - 10:46 PM

Greetings,

===================================================

3 Day Bump

It has been more than 3 days since my last post.
  • Do you still need help with this?
  • If after 48hrs you have not replied to this thread then it will have to be closed.

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#5 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,611 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:08:54 PM

Posted 20 June 2015 - 08:12 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users