Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Adware and Global Update Removal Help


  • This topic is locked This topic is locked
3 replies to this topic

#1 beau_denver

beau_denver

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:09:23 PM

Posted 24 June 2015 - 02:36 PM

Good day/evening!

 

I am desparately trying to get rid of the adware on my laptop. It's a shared machine(Not anymore) and a key generator was downloaded and installed to play a game. I don't condone piracy, for the record.

 

Anyway, I have Malware-bytes PRO and I ran that WITHOUT an internet connection. It found bad stuff and I was able to remove it, but it still came back. After doing some research I found this thread(http://www.bleepingcomputer.com/forums/t/579801/adware-continually-reinstalling-despite-being-taken-away/) and the OP is having the EXACT same issue as me. Pasted below is the results of my Farbar scan, and attached is the addition log.

 

Please help me as I need my laptop in top shape ASAP!

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:21-06-2015 01
Ran by Tuneuki (administrator) on THEDUKE on 24-06-2015 13:33:46
Running from C:\Users\Tuneuki\Downloads
Loaded Profiles: Tuneuki (Available Profiles: Tuneuki & KaylaKitty)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Windows\System32\nvwmi64.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\WTabletServiceCon.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Windows\System32\nvwmi64.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(                                                                                                    ) C:\Windows\Temp\mrtC4D4.tmp\stdrt.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
(Ellora Assets Corp.) C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe
(Seagate Technology LLC) C:\Program Files (x86)\Maxtor\Sync\SyncServices.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Copyright © Microsoft 2015) C:\Program Files (x86)\Microsoft.NET\v2.0.507277\msnetcore.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Wacom Technology) C:\Program Files\Tablet\Pen\WacomHost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler64.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Graphic Tablet Company Shenzhen) C:\Program Files\TabletDriver\TabletDriver.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Maxtor Corporation) C:\Program Files (x86)\Maxtor\OneTouch Status\MaxMenuMgr.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(SAMSUNG Electornics Co., Ltd.) C:\Users\Tuneuki\AppData\Roaming\VERIZON\UA_ar\UA.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPConnectionManager.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel® Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
() C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-04-15] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2816240 2014-08-19] (Synaptics Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [558496 2014-02-27] (Adobe Systems Incorporated)
HKLM\...\Run: [TabletDriver] => C:\Program Files\TabletDriver\TabletDriver.exe [1141464 2015-02-05] (Graphic Tablet Company Shenzhen)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-07] (Apple Inc.)
HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2727568 2015-05-19] ()
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284480 2014-08-05] (Intel Corporation)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe [133400 2012-03-28] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292088 2014-08-05] (Intel Corporation)
HKLM-x32\...\Run: [mxomssmenu] => C:\Program Files (x86)\Maxtor\OneTouch Status\maxmenumgr.exe [169256 2008-04-17] (Maxtor Corporation)
HKLM-x32\...\Run: [QLBController] => C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe [336672 2014-05-16] (Hewlett-Packard Company)
HKLM-x32\...\Run: [HPConnectionManager] => C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [185144 2013-10-31] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe [2618680 2015-04-08] (Malwarebytes Corporation)
HKLM-x32\...\Run: [gmsd_us_005010009] => [X]
HKU\S-1-5-21-1634310370-3456045754-646884147-1001\...\MountPoints2: {1542acf2-ca7e-11e3-8712-a01d48b7a805} - D:\launcher.exe
HKU\S-1-5-18\...\Run: [] => [X]
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2015-06-16]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\Tuneuki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Verizon Wireless Software Utility Application for Android – Samsung.lnk [2015-03-08]
ShortcutTarget: Verizon Wireless Software Utility Application for Android – Samsung.lnk -> C:\Users\Tuneuki\AppData\Roaming\VERIZON\UA_ar\UA.exe (SAMSUNG Electornics Co., Ltd.)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
HKU\S-1-5-21-1634310370-3456045754-646884147-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-04-16] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-16] (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 
FireFox:
========
FF ProfilePath: C:\Users\Tuneuki\AppData\Roaming\Mozilla\Firefox\Profiles\xx7v7kmb.default-1407279614886
FF SelectedSearchEngine: Trovi
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-06-02] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2014-04-29] (Adobe Systems)
FF Plugin: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-06-02] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-01-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-01-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-16] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-16] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @qq.com/npAndroidAssistant -> C:\Program Files (x86)\Common Files\Tencent\QQPhoneManager\2.0.201.3198\npQQPhoneManagerExt.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-06-24] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-06-24] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2014-04-29] (Adobe Systems)
FF Plugin-x32: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF HKLM\...\Firefox\Extensions: [{535b69cf-44f6-4c9f-96b1-b5adb65c582d}] - C:\Program Files\shopperz\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{535b69cf-44f6-4c9f-96b1-b5adb65c582d}] - C:\Program Files\shopperz\Firefox
FF Extension: No Name - C:\Users\Tuneuki\AppData\Roaming\Mozilla\Firefox\Profiles\xx7v7kmb.default-1407279614886\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com [not found]
 
Chrome: 
=======
CHR Profile: C:\Users\Tuneuki\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Paper Mega Man) - C:\Users\Tuneuki\AppData\Local\Google\Chrome\User Data\Default\Extensions\benapcddigkllgjhfifafjdakepkicdl [2014-02-07]
CHR Extension: (Adblock Plus) - C:\Users\Tuneuki\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-06-24]
CHR Extension: (AdBlock) - C:\Users\Tuneuki\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-06-24]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Tuneuki\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-24]
CHR Extension: (Google Wallet) - C:\Users\Tuneuki\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-24]
 
==================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S2 Adobe Licensing Console; C:\Windows\SysWOW64\lnsecsl.exe [1202396 2015-06-21] (                                                                                                    ) [File not signed] <==== ATTENTION
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-20] (Apple Inc.)
R2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [108032 2015-04-15] (Freemake) [File not signed]
R2 FreemakeVideoCapture; C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe [9216 2014-10-09] (Ellora Assets Corp.) [File not signed]
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe [683296 2014-05-16] (Hewlett-Packard Company)
R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [128280 2012-03-28] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [165144 2012-03-28] (Intel Corporation)
R2 Maxtor Sync Service; C:\Program Files (x86)\Maxtor\Sync\SyncServices.exe [181544 2008-04-17] (Seagate Technology LLC)
R2 MbaeSvc; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [656184 2015-04-08] (Malwarebytes Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [398184 2012-12-14] (Malwarebytes Corporation) [File not signed]
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [682344 2012-12-14] (Malwarebytes Corporation) [File not signed]
R2 msdotnetserv; C:\Program Files (x86)\Microsoft.NET\v2.0.507277\msnetcore.exe [3505640 2015-06-23] (Copyright © Microsoft 2015)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [268192 2014-12-04] ()
R2 NVWMI; C:\Windows\system32\nvwmi64.exe [2692296 2015-05-19] ()
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5405456 2014-11-12] (TeamViewer GmbH)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
R2 WTabletServiceCon; C:\Program Files\Tablet\Pen\WTabletServiceCon.exe [656664 2014-08-19] (Wacom Technology, Corp.)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3820960 2014-12-04] (Intel® Corporation)
S3 Origin Client Service; "C:\Program Files (x86)\Origin\OriginClientService.exe" [X]
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [163368 2012-03-31] (Broadcom Corporation.)
R1 ESProtectionDriver; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [63064 2015-04-08] ()
R3 johci; C:\Windows\System32\DRIVERS\johci.sys [26208 2012-07-16] (JMicron Technology Corp.)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [24176 2012-12-14] (Malwarebytes Corporation) [File not signed]
S3 SmbDrvAMDASF; C:\Windows\system32\drivers\Smb_driver_AMDASF.sys [25912 2012-05-18] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [34544 2014-08-19] (Synaptics Incorporated)
S3 SmbDrvIntel; C:\Windows\system32\drivers\Smb_driver_Intel.sys [34544 2014-08-19] (Synaptics Incorporated)
S3 TSSKX64; C:\Windows\System32\drivers\tsskx64.sys [38200 2015-06-21] (电脑管家)
R3 vmulti; C:\Windows\System32\DRIVERS\vmulti.sys [10752 2014-09-16] (Windows ® Win 7 DDK provider)
S3 NPF; system32\drivers\NPF.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-06-24 13:33 - 2015-06-24 13:33 - 00020565 _____ C:\Users\Tuneuki\Downloads\FRST.txt
2015-06-24 13:12 - 2015-06-24 13:33 - 00000000 ____D C:\FRST
2015-06-24 13:12 - 2015-06-24 13:13 - 00045411 _____ C:\Users\Tuneuki\Downloads\Addition.txt
2015-06-24 12:45 - 2015-06-24 12:45 - 00002255 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-06-24 12:45 - 2015-06-24 12:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-06-24 12:44 - 2015-06-24 13:24 - 00000894 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-24 12:44 - 2015-06-24 12:55 - 00000898 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-24 12:44 - 2015-06-24 12:50 - 00003894 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-06-24 12:44 - 2015-06-24 12:50 - 00003642 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-06-24 10:53 - 2015-06-24 10:53 - 02109952 _____ (Farbar) C:\Users\Tuneuki\Downloads\FRST64.exe
2015-06-24 10:52 - 2015-06-24 12:47 - 00003930 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{C76D6768-3D41-44F7-B610-DFFDA8219620}
2015-06-24 10:29 - 2015-06-24 10:31 - 00000000 ____D C:\AdwCleaner
2015-06-22 16:44 - 2015-06-22 16:44 - 00613255 _____ (CMI Limited) C:\Users\Tuneuki\AppData\Local\nss45A9.tmp
2015-06-22 16:41 - 2015-06-24 12:52 - 00000000 ____D C:\Users\Tuneuki\AppData\Local\bvxvyvyg
2015-06-22 16:12 - 2015-06-22 16:12 - 00000000 ____D C:\Users\Tuneuki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth Devices
2015-06-22 16:07 - 2012-03-31 21:52 - 00184872 _____ (Broadcom Corporation.) C:\windows\system32\Drivers\btwaudio.sys
2015-06-22 16:07 - 2012-03-05 06:29 - 00210984 _____ (Broadcom Corporation.) C:\windows\system32\Drivers\btwavdt.sys
2015-06-22 16:07 - 2012-03-05 06:29 - 00021544 _____ (Broadcom Corporation.) C:\windows\system32\Drivers\btwrchid.sys
2015-06-22 16:07 - 2011-09-16 19:38 - 00039976 _____ (Broadcom Corporation.) C:\windows\system32\Drivers\btwl2cap.sys
2015-06-22 16:03 - 2015-06-22 16:05 - 241625581 _____ (Igor Pavlov) C:\Users\Tuneuki\Downloads\VISTA_WIN7.exe
2015-06-22 13:49 - 2015-06-22 13:49 - 00002126 _____ C:\Users\KaylaKitty\Desktop\Google Chrome.lnk
2015-06-22 13:46 - 2015-06-24 10:33 - 00000000 ____D C:\ProgramData\MSNetCore
2015-06-22 13:44 - 2015-06-22 13:44 - 00000004 _____ C:\windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-06-21 20:38 - 2015-06-21 20:38 - 00000000 ____D C:\windows\SysWOW64\Flash
2015-06-21 19:58 - 2015-06-21 19:58 - 00000000 ____D C:\Users\KaylaKitty\AppData\Local\Geckofx
2015-06-21 19:19 - 2015-06-21 19:19 - 00772016 _____ (Reimage®) C:\Users\KaylaKitty\Downloads\ReimageRepair.exe
2015-06-21 19:14 - 2015-06-21 19:14 - 00000000 ____D C:\Users\KaylaKitty\AppData\Roaming\Symantec
2015-06-21 19:14 - 2015-01-19 07:17 - 00060728 _____ (NetFilterSDK.com) C:\windows\system32\Drivers\gfilterdrv.sys
2015-06-21 19:11 - 2015-06-22 14:59 - 00000000 ____D C:\windows\Provider32
2015-06-21 19:11 - 2015-06-18 12:48 - 00174080 _____ (drms media group) C:\windows\Provider.dll
2015-06-21 19:10 - 2015-06-21 19:10 - 00000000 _____ C:\windows\SysWOW64\Number of results
2015-06-21 19:08 - 2015-06-21 19:08 - 00000000 ____D C:\ProgramData\28341ff220e0446c9fff27c4493d622e
2015-06-21 18:41 - 2015-06-21 20:18 - 00139416 _____ C:\windows\SysWOW64\debug.log
2015-06-21 18:40 - 2015-06-24 13:26 - 00000105 _____ C:\windows\SysWOW64\get.dat
2015-06-21 18:39 - 2015-06-21 20:34 - 00028984 _____ (Tencent) C:\windows\SysWOW64\Drivers\TS888x64.sys
2015-06-21 18:37 - 2015-06-21 18:37 - 00000000 _____ C:\windows\SysWOW64\x64.txt
2015-06-21 18:28 - 2015-06-24 13:31 - 00000000 ____D C:\Users\KaylaKitty\AppData\Roaming\B728ECE8-1434932910-11E3-BAEC-428DBF0C505F
2015-06-21 18:27 - 2015-06-21 18:30 - 00000000 ____D C:\ProgramData\abc
2015-06-21 18:25 - 2015-06-21 18:25 - 01202396 _____ ( ) C:\windows\SysWOW64\lnsecsl.exe
2015-06-21 18:22 - 2015-06-21 18:22 - 00087864 _____ (电脑管家) C:\windows\system32\Drivers\TFsFltX64.sys
2015-06-21 18:22 - 2015-06-21 18:22 - 00038200 _____ (电脑管家) C:\windows\system32\Drivers\TSSKX64.sys
2015-06-21 18:22 - 2015-06-21 18:22 - 00000000 ____D C:\Users\KaylaKitty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\腾讯软件
2015-06-21 18:20 - 2015-06-21 18:37 - 00000000 ____D C:\ProgramData\Rising
2015-06-21 18:20 - 2015-06-21 18:24 - 00000000 ____D C:\Program Files (x86)\Rs
2015-06-21 18:19 - 2015-06-21 18:19 - 00000000 ____D C:\ProgramData\13127044441722747751
2015-06-21 18:09 - 2015-06-21 18:10 - 00000000 ____D C:\Users\KaylaKitty\Documents\Keygen
2015-06-21 18:02 - 2015-06-21 18:02 - 00000000 ____D C:\Users\KaylaKitty\Documents\Data
2015-06-21 18:02 - 2014-09-11 05:24 - 00000000 ____D C:\Users\KaylaKitty\Documents\Support
2015-06-21 18:02 - 2014-09-11 05:24 - 00000000 ____D C:\Users\KaylaKitty\Documents\Game
2015-06-21 18:02 - 2014-09-04 14:54 - 00000382 _____ C:\Users\KaylaKitty\Documents\da_DK.reg
2015-06-21 18:02 - 2014-09-04 14:54 - 00000378 _____ C:\Users\KaylaKitty\Documents\fi_FI.reg
2015-06-21 18:02 - 2014-09-04 14:54 - 00000378 _____ C:\Users\KaylaKitty\Documents\es_ES.reg
2015-06-21 18:02 - 2014-09-04 14:54 - 00000378 _____ C:\Users\KaylaKitty\Documents\en_US.reg
2015-06-21 18:02 - 2014-09-04 14:54 - 00000378 _____ C:\Users\KaylaKitty\Documents\de_DE.reg
2015-06-21 18:02 - 2014-09-04 14:53 - 00000378 _____ C:\Users\KaylaKitty\Documents\ru_RU.reg
2015-06-21 18:02 - 2014-09-04 14:53 - 00000378 _____ C:\Users\KaylaKitty\Documents\pt_BR.reg
2015-06-21 18:02 - 2014-09-04 14:53 - 00000378 _____ C:\Users\KaylaKitty\Documents\pl_PL.reg
2015-06-21 18:02 - 2014-09-04 14:53 - 00000378 _____ C:\Users\KaylaKitty\Documents\no_NO.reg
2015-06-21 18:02 - 2014-09-04 14:53 - 00000378 _____ C:\Users\KaylaKitty\Documents\nl_NL.reg
2015-06-21 18:02 - 2014-09-04 14:53 - 00000378 _____ C:\Users\KaylaKitty\Documents\ko_KR.reg
2015-06-21 18:02 - 2014-09-04 14:53 - 00000378 _____ C:\Users\KaylaKitty\Documents\it_IT.reg
2015-06-21 18:02 - 2014-09-04 14:53 - 00000378 _____ C:\Users\KaylaKitty\Documents\fr_FR.reg
2015-06-21 18:02 - 2014-09-04 14:53 - 00000374 _____ C:\Users\KaylaKitty\Documents\ja_JP.reg
2015-06-21 18:02 - 2014-09-04 14:52 - 00000382 _____ C:\Users\KaylaKitty\Documents\cs_CZ.reg
2015-06-21 18:02 - 2014-09-04 14:52 - 00000378 _____ C:\Users\KaylaKitty\Documents\zh_TW.reg
2015-06-21 18:02 - 2014-09-04 14:52 - 00000378 _____ C:\Users\KaylaKitty\Documents\sv_SE.reg
2015-06-21 18:02 - 2014-09-03 18:02 - 17088592 _____ (Electronic Arts, Inc.) C:\Users\KaylaKitty\Documents\Origin_Setup.exe
2015-06-21 17:40 - 2015-06-21 17:58 - 00001783 _____ C:\Users\KaylaKitty\Desktop\Play The Sims 4.lnk
2015-06-21 17:29 - 2015-06-21 17:44 - 00000000 ____D C:\Users\KaylaKitty\AppData\Roaming\Origin
2015-06-21 17:27 - 2015-06-21 20:23 - 00000000 ____D C:\ProgramData\Origin
2015-06-21 17:27 - 2015-06-21 20:23 - 00000000 ____D C:\Program Files (x86)\Origin
2015-06-21 17:26 - 2015-06-21 17:26 - 17116168 _____ (Electronic Arts, Inc.) C:\Users\KaylaKitty\Downloads\OriginThinSetup.exe
2015-06-21 17:23 - 2015-06-21 17:23 - 00000634 _____ C:\Users\KaylaKitty\Downloads\Setup.website
2015-06-21 17:09 - 2014-09-11 19:20 - 286233699 _____ C:\Users\KaylaKitty\Documents\Sim4-update2+DLC+CrashFIX.exe
2015-06-20 22:08 - 2015-06-20 22:08 - 00050520 _____ (Windows ® Win 7 DDK provider) C:\windows\system32\Drivers\zwi1mzf2y3mxbgv.sys
2015-06-19 17:03 - 2015-06-19 17:03 - 00000000 ____D C:\Users\Tuneuki\Tracing
2015-06-18 17:55 - 2015-06-18 17:55 - 00001147 _____ C:\Users\KaylaKitty\Desktop\Play Zandronum (Online).lnk
2015-06-17 22:28 - 2015-06-17 22:28 - 00000000 ____D C:\Users\Tuneuki\AppData\Local\DOSBox
2015-06-17 22:21 - 2015-06-17 22:21 - 00001918 _____ C:\Users\Public\Desktop\DOSBox 0.74.lnk
2015-06-17 22:21 - 2015-06-17 22:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DOSBox-0.74
2015-06-17 22:21 - 2015-06-17 22:21 - 00000000 ____D C:\Program Files (x86)\DOSBox-0.74
2015-06-16 09:46 - 2015-06-16 09:46 - 00000000 ____D C:\Users\Tuneuki\Documents\Bluetooth Exchange Folder
2015-06-16 09:46 - 2015-06-16 09:46 - 00000000 ____D C:\Users\Tuneuki\AppData\Local\Broadcom
2015-06-16 09:46 - 2012-03-31 21:52 - 00594472 _____ (Broadcom Corporation.) C:\windows\system32\Drivers\btwampfl.sys
2015-06-16 09:45 - 2015-06-16 09:45 - 00000000 ____D C:\Program Files\WIDCOMM
2015-06-14 22:10 - 2015-06-14 22:10 - 00000000 ____D C:\Users\Tuneuki\AppData\Roaming\IDT
2015-06-14 16:53 - 2015-06-14 16:54 - 00000647 _____ C:\Users\Tuneuki\F5AF6C2E.pnach
2015-06-14 13:20 - 2015-06-14 13:21 - 00000000 ____D C:\Users\Tuneuki\Documents\PCSX2
2015-06-14 13:10 - 2015-06-14 13:11 - 00000000 ____D C:\Program Files (x86)\PCSX2 1.2.1
2015-06-12 13:47 - 2015-06-12 13:47 - 00000751 _____ C:\Users\KaylaKitty\AppData\Local\recently-used.xbel
2015-06-12 13:41 - 2015-06-12 13:41 - 00000000 ____D C:\Users\KaylaKitty\AppData\Roaming\inkscape
2015-06-12 13:36 - 2015-06-12 13:37 - 97868152 _____ C:\Users\KaylaKitty\Downloads\inkscape-0.91-x64.msi
2015-06-11 13:36 - 2015-06-11 18:23 - 00000000 ____D C:\Users\Tuneuki\Documents\D & D
2015-06-09 12:47 - 2015-06-01 13:16 - 00389840 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-06-09 12:47 - 2015-06-01 12:07 - 00342736 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2015-06-09 12:47 - 2015-05-27 08:35 - 24917504 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-06-09 12:47 - 2015-05-27 08:08 - 19607040 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-06-09 12:47 - 2015-05-25 12:24 - 05569984 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-06-09 12:47 - 2015-05-25 12:23 - 00155584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-06-09 12:47 - 2015-05-25 12:23 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2015-06-09 12:47 - 2015-05-25 12:21 - 01728960 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2015-06-09 12:47 - 2015-05-25 12:19 - 01461760 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-06-09 12:47 - 2015-05-25 12:19 - 01255424 _____ (Microsoft Corporation) C:\windows\system32\diagtrack.dll
2015-06-09 12:47 - 2015-05-25 12:19 - 01162752 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll
2015-06-09 12:47 - 2015-05-25 12:19 - 00879104 _____ (Microsoft Corporation) C:\windows\system32\tdh.dll
2015-06-09 12:47 - 2015-05-25 12:19 - 00728576 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2015-06-09 12:47 - 2015-05-25 12:19 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-06-09 12:47 - 2015-05-25 12:19 - 00424960 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2015-06-09 12:47 - 2015-05-25 12:19 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll
2015-06-09 12:47 - 2015-05-25 12:19 - 00342016 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-06-09 12:47 - 2015-05-25 12:19 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2015-06-09 12:47 - 2015-05-25 12:19 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2015-06-09 12:47 - 2015-05-25 12:19 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2015-06-09 12:47 - 2015-05-25 12:19 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll
2015-06-09 12:47 - 2015-05-25 12:19 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2015-06-09 12:47 - 2015-05-25 12:19 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2015-06-09 12:47 - 2015-05-25 12:19 - 00113664 _____ (Microsoft Corporation) C:\windows\system32\sechost.dll
2015-06-09 12:47 - 2015-05-25 12:19 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2015-06-09 12:47 - 2015-05-25 12:19 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-06-09 12:47 - 2015-05-25 12:19 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2015-06-09 12:47 - 2015-05-25 12:19 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2015-06-09 12:47 - 2015-05-25 12:19 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
2015-06-09 12:47 - 2015-05-25 12:19 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
2015-06-09 12:47 - 2015-05-25 12:18 - 00879104 _____ (Microsoft Corporation) C:\windows\system32\advapi32.dll
2015-06-09 12:47 - 2015-05-25 12:18 - 00404992 _____ (Microsoft Corporation) C:\windows\system32\tracerpt.exe
2015-06-09 12:47 - 2015-05-25 12:18 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
2015-06-09 12:47 - 2015-05-25 12:18 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-06-09 12:47 - 2015-05-25 12:18 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2015-06-09 12:47 - 2015-05-25 12:18 - 00104448 _____ (Microsoft Corporation) C:\windows\system32\logman.exe
2015-06-09 12:47 - 2015-05-25 12:18 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2015-06-09 12:47 - 2015-05-25 12:18 - 00047104 _____ (Microsoft Corporation) C:\windows\system32\typeperf.exe
2015-06-09 12:47 - 2015-05-25 12:18 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2015-06-09 12:47 - 2015-05-25 12:18 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\relog.exe
2015-06-09 12:47 - 2015-05-25 12:18 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2015-06-09 12:47 - 2015-05-25 12:18 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2015-06-09 12:47 - 2015-05-25 12:18 - 00019456 _____ (Microsoft Corporation) C:\windows\system32\diskperf.exe
2015-06-09 12:47 - 2015-05-25 12:14 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-06-09 12:47 - 2015-05-25 12:14 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:11 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 12:07 - 03989440 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2015-06-09 12:47 - 2015-05-25 12:07 - 03934144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2015-06-09 12:47 - 2015-05-25 12:04 - 01310744 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2015-06-09 12:47 - 2015-05-25 12:01 - 00641536 _____ (Microsoft Corporation) C:\windows\SysWOW64\advapi32.dll
2015-06-09 12:47 - 2015-05-25 12:01 - 00635392 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdh.dll
2015-06-09 12:47 - 2015-05-25 12:01 - 00551424 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2015-06-09 12:47 - 2015-05-25 12:01 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2015-06-09 12:47 - 2015-05-25 12:01 - 00248832 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2015-06-09 12:47 - 2015-05-25 12:01 - 00221184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2015-06-09 12:47 - 2015-05-25 12:01 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2015-06-09 12:47 - 2015-05-25 12:01 - 00092160 _____ (Microsoft Corporation) C:\windows\SysWOW64\sechost.dll
2015-06-09 12:47 - 2015-05-25 12:01 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2015-06-09 12:47 - 2015-05-25 12:01 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2015-06-09 12:47 - 2015-05-25 12:01 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2015-06-09 12:47 - 2015-05-25 12:01 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2015-06-09 12:47 - 2015-05-25 12:01 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2015-06-09 12:47 - 2015-05-25 12:00 - 00364544 _____ (Microsoft Corporation) C:\windows\SysWOW64\tracerpt.exe
2015-06-09 12:47 - 2015-05-25 12:00 - 00082944 _____ (Microsoft Corporation) C:\windows\SysWOW64\logman.exe
2015-06-09 12:47 - 2015-05-25 12:00 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe
2015-06-09 12:47 - 2015-05-25 12:00 - 00040448 _____ (Microsoft Corporation) C:\windows\SysWOW64\typeperf.exe
2015-06-09 12:47 - 2015-05-25 12:00 - 00037888 _____ (Microsoft Corporation) C:\windows\SysWOW64\relog.exe
2015-06-09 12:47 - 2015-05-25 12:00 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2015-06-09 12:47 - 2015-05-25 12:00 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\diskperf.exe
2015-06-09 12:47 - 2015-05-25 11:59 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll
2015-06-09 12:47 - 2015-05-25 11:59 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
2015-06-09 12:47 - 2015-05-25 11:59 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2015-06-09 12:47 - 2015-05-25 11:59 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2015-06-09 12:47 - 2015-05-25 11:57 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2015-06-09 12:47 - 2015-05-25 11:57 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00686080 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:55 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 11:08 - 03206144 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-06-09 12:47 - 2015-05-25 11:00 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\UtcResources.dll
2015-06-09 12:47 - 2015-05-25 10:50 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2015-06-09 12:47 - 2015-05-25 10:50 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2015-06-09 12:47 - 2015-05-25 10:48 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 10:48 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 10:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-06-09 12:47 - 2015-05-25 10:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-06-09 12:47 - 2015-05-22 21:28 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2015-06-09 12:47 - 2015-05-22 21:15 - 00503808 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-06-09 12:47 - 2015-05-22 21:15 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2015-06-09 12:47 - 2015-05-22 21:15 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2015-06-09 12:47 - 2015-05-22 21:14 - 00341504 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2015-06-09 12:47 - 2015-05-22 21:13 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2015-06-09 12:47 - 2015-05-22 21:10 - 02278912 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-06-09 12:47 - 2015-05-22 21:09 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2015-06-09 12:47 - 2015-05-22 21:08 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2015-06-09 12:47 - 2015-05-22 21:06 - 00478208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2015-06-09 12:47 - 2015-05-22 21:05 - 00664064 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2015-06-09 12:47 - 2015-05-22 21:05 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2015-06-09 12:47 - 2015-05-22 21:04 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2015-06-09 12:47 - 2015-05-22 20:57 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2015-06-09 12:47 - 2015-05-22 20:52 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-06-09 12:47 - 2015-05-22 20:49 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2015-06-09 12:47 - 2015-05-22 20:48 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2015-06-09 12:47 - 2015-05-22 20:47 - 04305920 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-06-09 12:47 - 2015-05-22 20:47 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2015-06-09 12:47 - 2015-05-22 20:38 - 00689152 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-06-09 12:47 - 2015-05-22 20:37 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2015-06-09 12:47 - 2015-05-22 20:37 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2015-06-09 12:47 - 2015-05-22 20:28 - 12829696 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-06-09 12:47 - 2015-05-22 20:20 - 01950720 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-06-09 12:47 - 2015-05-22 20:16 - 01309696 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-06-09 12:47 - 2015-05-22 20:14 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2015-06-09 12:47 - 2015-05-22 13:16 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2015-06-09 12:47 - 2015-05-22 13:16 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2015-06-09 12:47 - 2015-05-22 13:01 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2015-06-09 12:47 - 2015-05-22 13:00 - 02885632 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-06-09 12:47 - 2015-05-22 13:00 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-06-09 12:47 - 2015-05-22 13:00 - 00417792 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2015-06-09 12:47 - 2015-05-22 13:00 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2015-06-09 12:47 - 2015-05-22 12:59 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-06-09 12:47 - 2015-05-22 12:53 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2015-06-09 12:47 - 2015-05-22 12:52 - 06026240 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-06-09 12:47 - 2015-05-22 12:52 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2015-06-09 12:47 - 2015-05-22 12:48 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2015-06-09 12:47 - 2015-05-22 12:47 - 00816640 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2015-06-09 12:47 - 2015-05-22 12:47 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2015-06-09 12:47 - 2015-05-22 12:47 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2015-06-09 12:47 - 2015-05-22 12:47 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2015-06-09 12:47 - 2015-05-22 12:40 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2015-06-09 12:47 - 2015-05-22 12:36 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-06-09 12:47 - 2015-05-22 12:29 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2015-06-09 12:47 - 2015-05-22 12:25 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2015-06-09 12:47 - 2015-05-22 12:24 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-06-09 12:47 - 2015-05-22 12:21 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-06-09 12:47 - 2015-05-22 12:18 - 01021440 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-06-09 12:47 - 2015-05-22 12:18 - 00757248 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-06-09 12:47 - 2015-05-22 12:18 - 00700416 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-06-09 12:47 - 2015-05-22 12:18 - 00423424 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-06-09 12:47 - 2015-05-22 12:18 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-06-09 12:47 - 2015-05-22 12:18 - 00045568 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2015-06-09 12:47 - 2015-05-22 12:13 - 01119232 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-06-09 12:47 - 2015-05-22 12:07 - 00720384 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-06-09 12:47 - 2015-05-22 12:06 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-06-09 12:47 - 2015-05-22 12:05 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-06-09 12:47 - 2015-05-22 12:05 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2015-06-09 12:47 - 2015-05-22 11:57 - 14404096 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-06-09 12:47 - 2015-05-22 11:50 - 02426880 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-06-09 12:47 - 2015-05-22 11:38 - 01545728 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-06-09 12:47 - 2015-05-22 11:26 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-06-09 12:47 - 2015-05-21 07:19 - 00193536 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2015-06-09 12:47 - 2015-04-29 12:22 - 14635008 _____ (Microsoft Corporation) C:\windows\system32\wmp.dll
2015-06-09 12:47 - 2015-04-29 12:21 - 00009728 _____ (Microsoft Corporation) C:\windows\system32\spwmp.dll
2015-06-09 12:47 - 2015-04-29 12:21 - 00005120 _____ (Microsoft Corporation) C:\windows\system32\msdxm.ocx
2015-06-09 12:47 - 2015-04-29 12:21 - 00005120 _____ (Microsoft Corporation) C:\windows\system32\dxmasf.dll
2015-06-09 12:47 - 2015-04-29 12:19 - 12625920 _____ (Microsoft Corporation) C:\windows\system32\wmploc.DLL
2015-06-09 12:47 - 2015-04-29 12:07 - 11411456 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmp.dll
2015-06-09 12:47 - 2015-04-29 12:07 - 00008192 _____ (Microsoft Corporation) C:\windows\SysWOW64\spwmp.dll
2015-06-09 12:47 - 2015-04-29 12:07 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\msdxm.ocx
2015-06-09 12:47 - 2015-04-29 12:07 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxmasf.dll
2015-06-09 12:47 - 2015-04-29 12:05 - 12625408 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmploc.DLL
2015-06-09 12:47 - 2015-04-24 12:17 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\comctl32.dll
2015-06-09 12:47 - 2015-04-24 11:56 - 00530432 _____ (Microsoft Corporation) C:\windows\SysWOW64\comctl32.dll
2015-06-09 12:47 - 2015-04-10 21:19 - 00069888 _____ (Microsoft Corporation) C:\windows\system32\Drivers\stream.sys
2015-06-08 15:24 - 2015-06-08 15:24 - 00000000 ____D C:\Users\Tuneuki\AppData\Roaming\fltk.org
2015-06-08 14:06 - 2015-06-08 14:06 - 00000000 _____ C:\Users\KaylaKitty\AppData\Roaming\monFDE.log
2015-06-08 02:35 - 2015-06-08 02:35 - 00043589 _____ C:\Users\Tuneuki\Downloads\Stonetemplepilotstinymusic.jpeg
2015-06-08 02:21 - 2015-06-08 02:21 - 01263712 _____ (Ellora Assets Corporation ) C:\Users\Tuneuki\Downloads\FreemakeAudioConverterSetup.exe
2015-06-02 13:14 - 2015-06-02 13:14 - 00000000 ____D C:\Users\Tuneuki\AppData\Local\GWX
2015-06-01 18:44 - 2015-06-01 18:44 - 00000000 ___HD C:\ProgramData\CanonBJ
2015-06-01 13:48 - 2015-06-01 13:48 - 00000000 ____D C:\Users\KaylaKitty\AppData\Local\GWX
2015-05-31 16:43 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\windows\SysWOW64\D3DX9_43.dll
2015-05-31 16:42 - 2015-06-21 20:22 - 00000000 ____D C:\FeralHeart
2015-05-31 16:42 - 2015-06-14 13:11 - 00000000 ___HD C:\windows\msdownld.tmp
2015-05-31 16:42 - 2015-06-14 13:11 - 00000000 ____D C:\windows\SysWOW64\directx
2015-05-31 16:40 - 2015-05-31 16:41 - 60391091 _____ (Kovuworks ) C:\Users\KaylaKitty\Downloads\FHSetup.exe
2015-05-31 16:39 - 2015-05-31 16:40 - 00004908 _____ C:\Users\KaylaKitty\Downloads\FHSetup (1).torrent
2015-05-31 16:39 - 2015-05-31 16:39 - 00004908 _____ C:\Users\KaylaKitty\Downloads\FHSetup.torrent
2015-05-28 22:56 - 2015-05-28 22:56 - 00000000 ____D C:\Users\Public\Documents\CrashDump
2015-05-28 22:51 - 2015-06-21 19:40 - 00000000 ____D C:\Users\KaylaKitty\AppData\Roaming\VERIZON
2015-05-27 21:19 - 2015-06-21 18:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-06-24 13:32 - 2009-07-13 22:45 - 00031536 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-24 13:32 - 2009-07-13 22:45 - 00031536 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-24 13:29 - 2009-07-13 23:13 - 00782470 _____ C:\windows\system32\PerfStringBackup.INI
2015-06-24 13:22 - 2010-11-20 21:47 - 00462700 _____ C:\windows\PFRO.log
2015-06-24 13:22 - 2009-07-13 23:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2015-06-24 13:22 - 2009-07-13 22:51 - 00101409 _____ C:\windows\setupact.log
2015-06-24 13:03 - 2014-05-13 13:25 - 00000000 ____D C:\Users\Tuneuki\Downloads\Torrents
2015-06-24 12:54 - 2014-02-07 23:18 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2015-06-24 12:49 - 2013-12-11 19:08 - 01547363 _____ C:\windows\WindowsUpdate.log
2015-06-24 12:47 - 2014-08-05 17:04 - 11032736 _____ (SurfRight B.V.) C:\Users\Tuneuki\Downloads\HitmanPro_x64.exe
2015-06-24 12:44 - 2014-02-07 22:09 - 00000000 ____D C:\Users\Tuneuki\AppData\Local\Deployment
2015-06-24 12:44 - 2014-02-07 22:09 - 00000000 ____D C:\Program Files (x86)\Google
2015-06-24 12:42 - 2014-08-06 13:16 - 00000000 ____D C:\ProgramData\Malwarebytes Anti-Exploit
2015-06-24 10:34 - 2014-12-24 20:47 - 00003886 _____ C:\windows\System32\Tasks\Adobe Acrobat Update Task
2015-06-24 10:33 - 2014-02-07 04:35 - 00001413 _____ C:\Users\Tuneuki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-06-24 10:33 - 2009-07-13 22:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-06-24 10:28 - 2014-08-06 11:30 - 00000000 ____D C:\Users\Tuneuki\Documents\Anti-Virus Stuff
2015-06-22 16:11 - 2009-07-13 21:20 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2015-06-22 16:04 - 2015-05-12 14:18 - 00000352 _____ C:\windows\Tasks\HPCeeScheduleForKaylaKitty.job
2015-06-22 13:48 - 2014-02-07 23:21 - 00000000 ____D C:\Program Files (x86)\Adobe
2015-06-21 20:27 - 2009-07-13 23:09 - 00000000 ____D C:\windows\System32\Tasks\WPD
2015-06-21 19:57 - 2015-01-19 20:10 - 00001413 _____ C:\Users\KaylaKitty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-06-21 19:40 - 2014-02-07 04:38 - 00000000 ____D C:\windows\system32\appmgmt
2015-06-21 19:13 - 2014-11-21 17:04 - 00000000 ____D C:\ProgramData\Package Cache
2015-06-21 18:58 - 2014-02-07 04:35 - 00114760 _____ C:\Users\Tuneuki\AppData\Local\GDIPFONTCACHEV1.DAT
2015-06-21 18:46 - 2015-04-23 16:57 - 00000000 __SHD C:\windows\SysWOW64\AI_RecycleBin
2015-06-21 18:45 - 2015-04-23 17:00 - 00000000 ____D C:\Program Files\OBS
2015-06-21 18:45 - 2015-04-23 17:00 - 00000000 ____D C:\Program Files (x86)\OBS
2015-06-21 18:44 - 2015-01-19 20:10 - 00003942 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{AEAC8DF4-8D92-4CEF-B79B-8EB4A84AC4C1}
2015-06-21 18:41 - 2014-08-06 11:38 - 00000000 ____D C:\ProgramData\Foolish IT
2015-06-21 18:36 - 2009-07-13 22:45 - 00420432 _____ C:\windows\system32\FNTCACHE.DAT
2015-06-21 18:29 - 2015-01-19 20:11 - 00114760 _____ C:\Users\KaylaKitty\AppData\Local\GDIPFONTCACHEV1.DAT
2015-06-21 18:22 - 2015-02-13 18:08 - 00000000 __SHD C:\Users\KaylaKitty\AppData\Local\EmieUserList
2015-06-21 18:22 - 2015-02-13 18:08 - 00000000 __SHD C:\Users\KaylaKitty\AppData\Local\EmieSiteList
2015-06-21 18:22 - 2015-02-13 18:08 - 00000000 __SHD C:\Users\KaylaKitty\AppData\Local\EmieBrowserModeList
2015-06-21 18:22 - 2015-01-19 20:10 - 00000000 ____D C:\Users\KaylaKitty\AppData\Local\VirtualStore
2015-06-21 18:19 - 2014-04-04 23:49 - 00000000 ____D C:\Program Files (x86)\Steam
2015-06-21 17:51 - 2015-03-03 16:31 - 00000000 ____D C:\Games
2015-06-21 02:47 - 2015-03-11 02:30 - 00000000 ____D C:\Users\Tuneuki\AppData\Roaming\vlc
2015-06-19 22:33 - 2014-02-08 01:07 - 00000000 ____D C:\Users\Tuneuki\AppData\Roaming\BitTorrent
2015-06-19 17:23 - 2014-02-07 23:57 - 00000000 ____D C:\Users\Tuneuki\AppData\Roaming\Skype
2015-06-19 17:03 - 2014-11-19 19:02 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-06-19 17:03 - 2014-02-07 04:31 - 00000000 ____D C:\Users\Tuneuki
2015-06-19 17:03 - 2013-12-11 19:37 - 00000000 ____D C:\ProgramData\Skype
2015-06-19 08:55 - 2015-03-28 21:16 - 00000000 ____D C:\Users\Tuneuki\Desktop\Tor Browser
2015-06-18 12:59 - 2014-02-15 18:30 - 00000000 ____D C:\Users\Tuneuki\Documents\Emulators & ROMs
2015-06-17 22:28 - 2014-07-12 12:26 - 00000000 ____D C:\Users\Tuneuki\Documents\My Games
2015-06-16 13:57 - 2014-11-21 22:17 - 00000000 __SHD C:\Users\Tuneuki\AppData\Local\EmieBrowserModeList
2015-06-16 13:57 - 2014-05-11 15:38 - 00000000 __SHD C:\Users\Tuneuki\AppData\Local\EmieUserList
2015-06-16 13:57 - 2014-05-11 15:38 - 00000000 __SHD C:\Users\Tuneuki\AppData\Local\EmieSiteList
2015-06-16 07:14 - 2014-08-05 14:26 - 00000052 _____ C:\windows\SysWOW64\DOErrors.log
2015-06-13 22:04 - 2015-05-12 14:18 - 00003216 _____ C:\windows\System32\Tasks\HPCeeScheduleForKaylaKitty
2015-06-13 20:25 - 2015-01-19 20:10 - 00000000 ____D C:\Users\KaylaKitty
2015-06-12 14:37 - 2009-07-13 21:20 - 00000000 ____D C:\windows\rescache
2015-06-10 11:43 - 2014-02-07 23:11 - 00000000 ____D C:\Users\Public\Documents\My Stuff
2015-06-10 10:34 - 2014-12-11 09:13 - 00000000 ____D C:\windows\system32\appraiser
2015-06-10 10:34 - 2014-05-06 15:18 - 00000000 ___SD C:\windows\system32\CompatTel
2015-06-10 10:33 - 2009-07-13 21:20 - 00000000 ____D C:\windows\PolicyDefinitions
2015-06-09 23:14 - 2014-02-07 23:39 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-06-09 23:12 - 2014-02-08 23:01 - 00000000 ____D C:\windows\system32\MRT
2015-06-09 23:08 - 2014-02-08 23:01 - 140135120 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-06-08 02:22 - 2014-02-07 23:41 - 00001320 _____ C:\Users\Public\Desktop\Freemake Audio Converter.lnk
2015-06-08 02:22 - 2014-02-07 23:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freemake
2015-06-08 00:25 - 2015-02-04 20:33 - 00039424 _____ C:\Users\Tuneuki\Documents\Press CheckIn.xls
2015-06-02 13:15 - 2014-09-22 22:03 - 00000000 ____D C:\Users\Tuneuki\AppData\Local\Adobe
2015-06-02 13:15 - 2014-02-07 23:18 - 00778416 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-06-02 13:15 - 2014-02-07 23:18 - 00142512 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-06-02 13:15 - 2014-02-07 23:18 - 00003768 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-06-01 18:44 - 2009-07-13 21:20 - 00000000 ____D C:\windows\system32\spool
2015-05-31 20:51 - 2015-03-03 16:27 - 00000000 ____D C:\Users\KaylaKitty\AppData\Roaming\BitTorrent
 
==================== Files in the root of some directories =======
 
2014-07-30 12:27 - 2014-07-30 12:27 - 0000000 _____ () C:\Users\Tuneuki\AppData\Roaming\monFDE.log
2015-04-14 10:28 - 2015-04-14 10:28 - 0004387 _____ () C:\Users\Tuneuki\AppData\Roaming\Y17px7S
2015-04-19 06:20 - 2015-04-19 06:20 - 0005872 _____ () C:\Users\Tuneuki\AppData\Roaming\YHSqmREnaizpyMKlvihh4i1pFJ
2015-06-22 16:44 - 2015-06-22 16:44 - 0613255 _____ (CMI Limited) C:\Users\Tuneuki\AppData\Local\nss45A9.tmp
2014-07-30 12:24 - 2014-07-30 12:26 - 0000356 _____ () C:\ProgramData\monFDE.log
 
Some files in TEMP:
====================
C:\Users\KaylaKitty\AppData\Local\Temp\AdobeApplicationManager.exe
C:\Users\KaylaKitty\AppData\Local\Temp\OK_V17_10_SENTRA_4.exe
C:\Users\KaylaKitty\AppData\Local\Temp\PCPamonew.exe
C:\Users\KaylaKitty\AppData\Local\Temp\ReimagePackage.exe
C:\Users\KaylaKitty\AppData\Local\Temp\ReiSysUpdate.exe
C:\Users\KaylaKitty\AppData\Local\Temp\SAMSUNG_USB_Driver_for_Mobile_Phones.exe
C:\Users\KaylaKitty\AppData\Local\Temp\TheSims4KeygenToolSetup__6196_il718466.exe
C:\Users\KaylaKitty\AppData\Local\Temp\UnityWebPlayer1518223174075323503.exe
C:\Users\KaylaKitty\AppData\Local\Temp\uobnyv04ydl6.exe
C:\Users\Tuneuki\AppData\Local\Temp\default-search.DLL
C:\Users\Tuneuki\AppData\Local\Temp\Extract.exe
C:\Users\Tuneuki\AppData\Local\Temp\FreemakeAudioConverterFull.exe
C:\Users\Tuneuki\AppData\Local\Temp\FreemakeVideoDownloader_3.7.0.17.exe
C:\Users\Tuneuki\AppData\Local\Temp\fsdA3EC.exe
C:\Users\Tuneuki\AppData\Local\Temp\fsdA63D.exe
C:\Users\Tuneuki\AppData\Local\Temp\HitmanPro.exe
C:\Users\Tuneuki\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\Tuneuki\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\Tuneuki\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Tuneuki\AppData\Local\Temp\jre-8u45-windows-au.exe
C:\Users\Tuneuki\AppData\Local\Temp\LiveUpdater.exe
C:\Users\Tuneuki\AppData\Local\Temp\mVOD097.exe
C:\Users\Tuneuki\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\Tuneuki\AppData\Local\Temp\nvStInst.exe
C:\Users\Tuneuki\AppData\Local\Temp\Quarantine.exe
C:\Users\Tuneuki\AppData\Local\Temp\SAMSUNG_USB_Driver_for_Mobile_Phones.exe
C:\Users\Tuneuki\AppData\Local\Temp\sp64126.exe
C:\Users\Tuneuki\AppData\Local\Temp\SP64284.exe
C:\Users\Tuneuki\AppData\Local\Temp\SP66111.exe
C:\Users\Tuneuki\AppData\Local\Temp\SP68380.exe
C:\Users\Tuneuki\AppData\Local\Temp\SP69840.exe
C:\Users\Tuneuki\AppData\Local\Temp\SP70759.exe
C:\Users\Tuneuki\AppData\Local\Temp\SP70954.exe
C:\Users\Tuneuki\AppData\Local\Temp\sqlite3.dll
C:\Users\Tuneuki\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\Tuneuki\AppData\Local\Temp\vcredist_2013_x86.exe
 
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2015-06-13 22:04
 
==================== End of log ============================
 
Attached File  Addition.txt   44.35KB   2 downloads

Edited by beau_denver, 24 June 2015 - 02:57 PM.


BC AdBot (Login to Remove)

 


#2 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:06:23 AM

Posted 27 June 2015 - 04:24 AM

Hello! Welcome to BleepingComputer Forums! :welcome:
My name is Georgi and and I will be helping you with your computer problems.

Before we begin, please note the following:

  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The logs can take some time to research, so please be patient with me.
  • Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  • Instructions that I give are for your system only!
  • Please do not run any tools until requested ! The reason for this is so I know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.
  • Please perform all steps in the order received. If you can't understand something don't hesitate to ask.
  • Again I would like to remind you to make no further changes to your computer unless I direct you to do so. I will not help you if you do not follow my instructions.

 

Please download the latest version of Farbar Recovery Scan Tool and save it to your desktop. Don't kill any malicious processes at your own.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Make sure that Addition.txt is checked before you press the Scan button.
  • Press Scan button.
  • It will make 2 logs (FRST.txt and Addition.txt) in the same directory the tool is run. Please copy and paste them to your reply.

 

 

Regards,

Georgi


cXfZ4wS.png


#3 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:06:23 AM

Posted 01 July 2015 - 03:10 AM

Hi,

 

It's been several days. Are you still around?

 

 

Regards,

Georgi


cXfZ4wS.png


#4 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:06:23 AM

Posted 04 July 2015 - 01:05 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.

cXfZ4wS.png





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users