Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Ads popping up when i use login window of any site in Chrome


  • This topic is locked This topic is locked
25 replies to this topic

#1 contacthasan

contacthasan

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:01:38 AM

Posted 15 August 2015 - 12:05 PM

Hi
 
I use a windows 7 Home Basic OS. My problem is that whenever i click in any of username login boxes using chrome another tab opens up and a couple of URLs are displayed in the address bar before ultimately an ad page opens up. The first URL is mostly:
 
hxxttp://ad-type.google.com/sh.aspx?f=popup-u&h=c8d5ad7d804ba49015d1b83443fbc54d
 
Its very annoying, please help.
 
Hasan

Edited by nasdaq, 17 August 2015 - 07:44 AM.


BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 39,179 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:08 PM

Posted 17 August 2015 - 07:45 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Download Malwarebytes' Anti-Malware from Here

Double-click mbam-setup-2.X.X.XXXX.exe to install the application (X's are the current version number).
  • Make sure a checkmark is placed next to Launch Malwarebytes' Anti-Malware, then click Finish.
  • Once MBAM opens, when it says Your databases are out of date, click the Fix Now button.
  • Click the Settings tab at the top, and then in the left column, select Detections and Protections, and if not already checked place a checkmark in the selection box for Scan for rootkits.
  • Click the Scan tab at the top of the program window, select Threat Scan and click the Scan Now button.
  • If you receive a message that updates are available, click the Update Now button (the update will be downloaded, installed, and the scan will start).
  • The scan may take some time to finish,so please be patient.
  • If potential threats are detected, ensure that Quarantine is selected as the Action for all the listed items, and click the Apply Actions button.
  • While still on the Scan tab, click the link for View detailed log, and in the window that opens click the Export button, select Text file (*.txt), and save the log to your Desktop.
  • The log is automatically saved by MBAM and can also be viewed by clicking the History tab and then selecting Application Logs.
POST THE LOG FOR MY REVIEW.

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

===

Please download AdwCleaner by Xplode onto your Desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Click the Report button and the report will open in Notepad.
IMPORTANT
  • If you click the Clean button all items listed in the report will be removed.
If you find some false positive items or programs that you wish to keep, Close the AdwCleaner windows.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Check off the element(s) you wish to keep.
  • Click on the Clean button follow the prompts.
  • A log file will automatically open after the scan has finished.
  • Please post the content of that log file with your next answer.
  • You can find the log file at C:\AdwCleaner[Sn].txt (n is a number).
===

Download the version of this tool for your operating system.
Farbar Recovery Scan Tool (64 bit)
Farbar Recovery Scan Tool (32 bit)
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
===


How is the computer running now?
Wait for further instructions.

#3 contacthasan

contacthasan
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:01:38 AM

Posted 18 August 2015 - 06:36 AM

Hi Nasdaq,
 
As instructed:
 
Malwarebytes Anti-Malware
www.malwarebytes.org
 
Scan Date: 18-08-2015
Scan Time: 15:30:23
Logfile: mabmlog.txt
Administrator: Yes
 
Version: 2.01.6.1022
Malware Database: v2015.06.08.03
Rootkit Database: v2015.08.16.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
 
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Tab
 
Scan Type: Custom Scan
Result: Completed
Objects Scanned: 336027
Time Elapsed: 24 min, 19 sec
 
Memory: Enabled
Startup: Enabled
Filesystem: Disabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
 
Processes: 0
(No malicious items detected)
 
Modules: 0
(No malicious items detected)
 
Registry Keys: 0
(No malicious items detected)
 
Registry Values: 0
(No malicious items detected)
 
Registry Data: 0
(No malicious items detected)
 
Folders: 0
(No malicious items detected)
 
Files: 0
(No malicious items detected)
 
Physical Sectors: 0
(No malicious items detected)
 
 
(end)
 
 
 
 
# AdwCleaner v5.001 - Logfile created 18/08/2015 at 16:43:08
# Updated 17/08/2015 by Xplode
# Database : 2015-08-16.2 [Server]
# Operating system : Windows 7 Home Basic Service Pack 1 (x64)
# Username : Tab - TAB-HP
# Running from : C:\Users\Tab\Downloads\AdwCleaner.exe
# Option : Scan
 
***** [ Services ] *****
 
 
***** [ Folders ] *****
 
Folder Found : C:\ProgramData\apn
 
***** [ Files ] *****
 
 
***** [ Shortcuts ] *****
 
 
***** [ Scheduled tasks ] *****
 
 
***** [ Registry ] *****
 
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
 
***** [ Web browsers ] *****
 
 
*************************
 
C:\AdwCleaner[S2].txt - [1664 bytes] - [18/08/2015 16:43:08]
 
########## EOF - C:\AdwCleaner[S2].txt - [1726 bytes] ##########
 
Hope this helps


#4 contacthasan

contacthasan
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:01:38 AM

Posted 18 August 2015 - 06:43 AM

Additional Files

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:17-08-2015
Ran by Tab (administrator) on TAB-HP (18-08-2015 17:10:09)
Running from C:\Users\Tab\Downloads
Loaded Profiles: Tab (Available Profiles: Tab)
Platform: Windows 7 Home Basic Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Motorola Solutions, Inc.) C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe
(Motorola Solutions, Inc.) C:\Program Files\Motorola\Bluetooth\audiosrv.exe
(Motorola Solutions, Inc.) C:\Program Files\Motorola\Bluetooth\obexsrv.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
() C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar2.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(WordWeb Software) C:\Program Files (x86)\WordWeb\wweb32.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Macrovision Europe Ltd.) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(KeenHigh Tech.) C:\Program Files (x86)\Philips\GoGear SA3MXX Device Manager\main.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(QFX Software Corporation) C:\Program Files (x86)\KeyScrambler\KeyScrambler.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Motorola Solutions, Inc.) C:\Program Files\Motorola\Bluetooth\btplayerctrl.exe
(QFX Software Corporation) C:\Program Files (x86)\KeyScrambler\x64\KeyScrambler.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2832168 2011-10-01] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-01-04] (IDT, Inc.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files\Motorola\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [44880 2011-12-20] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-01-18] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291096 2011-12-05] (Intel Corporation)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2011-03-31] (CyberLink Corp.)
HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-20] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HP CoolSense] => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [1343904 2012-11-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [KeyScrambler] => C:\Program Files (x86)\KeyScrambler\keyscrambler.exe [508744 2014-10-26] (QFX Software Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\...\Run: [WordWeb] => C:\Program Files (x86)\WordWeb\wweb32.exe [80000 2014-07-05] (WordWeb Software)
HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22012688 2015-06-20] (Google)
HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8322328 2015-05-09] (Piriform Ltd)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GoGear SA3MXX Device Manager.lnk [2015-05-10]
ShortcutTarget: GoGear SA3MXX Device Manager.lnk -> C:\Program Files (x86)\Philips\GoGear SA3MXX Device Manager\main.exe (KeenHigh Tech.)
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.jp.msn.com/HPALL/26
HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.jp.msn.com/HPALL/26
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://in.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/4686-111078-17344-8/4?satitle={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://in.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/4686-111078-17344-8/4?satitle={searchTerms}
SearchScopes: HKU\S-1-5-21-1206459012-1669690168-1176892122-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1206459012-1669690168-1176892122-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1206459012-1669690168-1176892122-1000 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKU\S-1-5-21-1206459012-1669690168-1176892122-1000 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://in.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKU\S-1-5-21-1206459012-1669690168-1176892122-1000 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKU\S-1-5-21-1206459012-1669690168-1176892122-1000 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/4686-111078-17344-8/4?satitle={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-03-09] (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-03-09] (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
Toolbar: HKU\S-1-5-21-1206459012-1669690168-1176892122-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.137.1
Tcpip\..\Interfaces\{0559D97D-67EE-4138-9991-53D4AA7FAA4B}: [DhcpNameServer] 192.168.137.1
Tcpip\..\Interfaces\{A3DA2257-86AC-47E4-A1B7-1AF700743BEC}: [DhcpNameServer] 192.168.1.1 192.168.1.1
 
FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll [2011-11-07] (Adobe Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-08] (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.52 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2011-12-02] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2011-12-02] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-19] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-19] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2014-11-15] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\...\Firefox\Extensions: [wcapturex@deskperience.com] - C:\Program Files (x86)\WordWeb\WCaptureMoz
FF Extension: WordWeb one-click lookup - C:\Program Files (x86)\WordWeb\WCaptureMoz [2014-11-27]
 
Chrome: 
=======
CHR Profile: C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-06-05]
CHR Extension: (Google Docs) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-06-05]
CHR Extension: (Google Drive) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-06-05]
CHR Extension: (YouTube) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-06-05]
CHR Extension: (Google Search) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-06-05]
CHR Extension: (Google Sheets) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-06-05]
CHR Extension: (AdBlock) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-06-05]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-05]
CHR Extension: (Skype Click to Call) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-06-05]
CHR Extension: (Quick Search) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfneciejbnaieckfgfpnobffjcdggojn [2015-06-26]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-05]
CHR Extension: (Gmail) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-05]
CHR HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-05-01]
 
==================== Services (Whitelisted) ========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)
S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [647680 2014-10-01] (Macrovision Europe Ltd.) [File not signed]
R3 FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [1028096 2014-10-01] (Macrovision Europe Ltd.) [File not signed]
S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-11-20] (WildTangent)
R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [128280 2011-12-17] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [161560 2011-12-17] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
 
===================== Drivers (Whitelisted) ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [31360 2012-01-18] (Advanced Micro Devices, Inc.)
S3 btmaudio; C:\Windows\System32\drivers\btmaud.sys [43520 2011-02-23] (Motorola Solutions, Inc.)
R3 KeyScrambler; C:\Windows\System32\drivers\keyscrambler.sys [222200 2013-05-31] (QFX Software Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19152 2013-09-30] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [12504 2013-09-30] ()
S3 rockusb; C:\Windows\System32\DRIVERS\rockusb.sys [66088 2009-10-22] (Fuzhou Rockchip Electronics Co,Ltd.)
S3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [258664 2011-09-22] (Realtek Semiconductor Corp.)
S3 usbohci; C:\Windows\system32\drivers\usbohci.sys [25600 2012-02-05] (Microsoft Corporation) [File not signed]
S3 usbuhci; C:\Windows\system32\drivers\usbuhci.sys [30720 2012-02-05] (Microsoft Corporation) [File not signed]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-08-18 17:10 - 2015-08-18 17:10 - 00023397 _____ C:\Users\Tab\Downloads\FRST.txt
2015-08-18 17:09 - 2015-08-18 17:10 - 00000000 ____D C:\FRST
2015-08-18 17:06 - 2015-08-18 17:07 - 02173440 _____ (Farbar) C:\Users\Tab\Downloads\FRST64.exe
2015-08-18 16:43 - 2015-08-18 16:44 - 00001826 _____ C:\AdwCleaner[S2].txt
2015-08-18 16:42 - 2015-08-18 16:42 - 01573888 _____ C:\Users\Tab\Downloads\AdwCleaner.exe
2015-08-18 16:20 - 2015-08-18 16:20 - 00000000 _____ C:\Windows\setuperr.log
2015-08-18 16:20 - 2015-08-18 16:20 - 00000000 _____ C:\Windows\setupact.log
2015-08-18 16:04 - 2015-08-18 16:04 - 00000000 ____D C:\AdwCleaner
2015-08-18 15:28 - 2015-08-18 16:15 - 00003174 _____ C:\Windows\System32\Tasks\HPCeeScheduleForTab
2015-08-18 15:28 - 2015-08-18 16:15 - 00000324 _____ C:\Windows\Tasks\HPCeeScheduleForTab.job
2015-08-05 21:48 - 2015-05-01 18:47 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-08-05 21:48 - 2015-05-01 18:46 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-08-05 21:27 - 2015-06-27 08:17 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-08-05 21:27 - 2015-06-27 08:13 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-08-05 21:27 - 2015-06-27 07:28 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-08-05 21:27 - 2015-06-27 07:09 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-08-05 21:27 - 2015-06-25 23:39 - 00389832 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-08-05 21:27 - 2015-06-25 23:13 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-08-05 21:27 - 2015-06-21 01:36 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-08-05 21:27 - 2015-06-21 01:20 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-08-05 21:27 - 2015-06-21 01:19 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-08-05 21:27 - 2015-06-21 01:19 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-08-05 21:27 - 2015-06-21 01:19 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-08-05 21:27 - 2015-06-21 01:10 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-08-05 21:27 - 2015-06-21 01:09 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-08-05 21:27 - 2015-06-21 01:04 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-08-05 21:27 - 2015-06-21 01:04 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-08-05 21:27 - 2015-06-21 01:04 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-08-05 21:27 - 2015-06-21 00:55 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-08-05 21:27 - 2015-06-21 00:51 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-08-05 21:27 - 2015-06-21 00:43 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-08-05 21:27 - 2015-06-21 00:37 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-08-05 21:27 - 2015-06-21 00:35 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-08-05 21:27 - 2015-06-21 00:18 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-08-05 21:27 - 2015-06-21 00:18 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-08-05 21:27 - 2015-06-21 00:16 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-08-05 21:27 - 2015-06-21 00:16 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-08-05 21:27 - 2015-06-20 23:56 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-08-05 21:27 - 2015-06-20 23:32 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-08-05 21:27 - 2015-06-19 23:55 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-08-05 21:27 - 2015-06-19 23:55 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-08-05 21:27 - 2015-06-19 23:54 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-08-05 21:27 - 2015-06-19 23:54 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-08-05 21:27 - 2015-06-19 23:53 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-08-05 21:27 - 2015-06-19 23:47 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-08-05 21:27 - 2015-06-19 23:46 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-08-05 21:27 - 2015-06-19 23:43 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-08-05 21:27 - 2015-06-19 23:43 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-08-05 21:27 - 2015-06-19 23:33 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-08-05 21:27 - 2015-06-19 23:27 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-08-05 21:27 - 2015-06-19 23:23 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-08-05 21:27 - 2015-06-19 23:22 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-08-05 21:27 - 2015-06-19 23:21 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-08-05 21:27 - 2015-06-19 23:10 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-08-05 21:27 - 2015-06-19 23:10 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-08-05 21:27 - 2015-06-19 23:09 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-08-05 21:27 - 2015-06-19 22:45 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-08-05 21:27 - 2015-06-19 22:41 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-08-05 21:27 - 2015-06-04 01:47 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-08-05 21:27 - 2015-04-11 08:49 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2015-08-05 21:26 - 2015-07-03 02:51 - 19877376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-08-05 21:26 - 2015-07-03 02:38 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-08-05 21:26 - 2015-07-03 02:20 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-08-05 21:26 - 2015-07-03 02:19 - 25193984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-08-05 21:26 - 2015-07-03 02:16 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-08-05 21:26 - 2015-07-03 02:10 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-08-05 21:26 - 2015-07-03 01:53 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-08-05 21:26 - 2015-07-03 01:49 - 12855296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-08-05 21:26 - 2015-07-03 01:42 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-08-05 21:26 - 2015-07-03 01:25 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-08-05 21:26 - 2015-07-03 00:50 - 14453248 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-08-05 21:26 - 2015-07-03 00:29 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-08-05 21:26 - 2015-07-02 02:26 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-08-05 21:26 - 2015-07-02 02:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-08-05 21:26 - 2015-07-02 02:19 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-08-05 21:26 - 2015-07-02 02:19 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-08-05 21:26 - 2015-07-02 02:19 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-08-05 21:26 - 2015-07-02 02:19 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-08-05 21:26 - 2015-07-02 02:19 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-08-05 21:26 - 2015-07-02 02:19 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-08-05 21:26 - 2015-07-02 02:19 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-08-05 21:26 - 2015-07-02 02:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-08-05 21:26 - 2015-07-02 02:19 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-08-05 21:26 - 2015-07-02 02:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-08-05 21:26 - 2015-07-02 02:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-08-05 21:26 - 2015-07-02 02:18 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-08-05 21:26 - 2015-07-02 02:18 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-08-05 21:26 - 2015-07-02 02:17 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-08-05 21:26 - 2015-07-02 02:17 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-08-05 21:26 - 2015-07-02 02:13 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-08-05 21:26 - 2015-07-02 02:13 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-08-05 21:26 - 2015-07-02 02:09 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-08-05 21:26 - 2015-07-02 02:00 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-08-05 21:26 - 2015-07-02 02:00 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-08-05 21:26 - 2015-07-02 02:00 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-08-05 21:26 - 2015-07-02 02:00 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-08-05 21:26 - 2015-07-02 02:00 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-08-05 21:26 - 2015-07-02 02:00 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-08-05 21:26 - 2015-07-02 02:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-08-05 21:26 - 2015-07-02 02:00 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-08-05 21:26 - 2015-07-02 02:00 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-08-05 21:26 - 2015-07-02 01:59 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-08-05 21:26 - 2015-07-02 01:59 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-08-05 21:26 - 2015-07-02 01:59 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-08-05 21:26 - 2015-07-02 01:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-08-05 21:26 - 2015-07-02 01:56 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-08-05 21:26 - 2015-07-02 01:54 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-08-05 21:26 - 2015-07-02 00:57 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-08-05 21:26 - 2015-07-02 00:56 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-08-05 21:26 - 2015-07-02 00:56 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-08-05 21:26 - 2015-06-21 01:18 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-08-05 21:26 - 2015-06-21 00:38 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-08-05 21:26 - 2015-04-18 08:40 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-08-05 21:26 - 2015-04-18 08:26 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-08-05 21:26 - 2015-03-10 08:55 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-08-05 21:26 - 2015-03-10 08:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-08-05 21:26 - 2015-03-10 08:38 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-08-05 21:26 - 2015-03-10 08:35 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-08-05 21:26 - 2015-02-13 10:56 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-08-05 21:26 - 2015-02-13 10:52 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-08-05 21:25 - 2015-05-25 23:54 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-08-05 21:25 - 2015-05-25 23:51 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 01255424 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-08-05 21:25 - 2015-05-25 23:48 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-08-05 21:25 - 2015-05-25 23:48 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-08-05 21:25 - 2015-05-25 23:48 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-08-05 21:25 - 2015-05-25 23:48 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-08-05 21:25 - 2015-05-25 23:48 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-08-05 21:25 - 2015-05-25 23:48 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-08-05 21:25 - 2015-05-25 23:48 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-08-05 21:25 - 2015-05-25 23:48 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-08-05 21:25 - 2015-05-25 23:48 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-08-05 21:25 - 2015-05-25 23:48 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-08-05 21:25 - 2015-05-25 23:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:37 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-08-05 21:25 - 2015-05-25 23:37 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-08-05 21:25 - 2015-05-25 23:34 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-08-05 21:25 - 2015-05-25 23:31 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-08-05 21:25 - 2015-05-25 23:31 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-08-05 21:25 - 2015-05-25 23:31 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-08-05 21:25 - 2015-05-25 23:31 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-08-05 21:25 - 2015-05-25 23:31 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-08-05 21:25 - 2015-05-25 23:30 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-08-05 21:25 - 2015-05-25 23:30 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-08-05 21:25 - 2015-05-25 23:30 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-08-05 21:25 - 2015-05-25 23:30 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-08-05 21:25 - 2015-05-25 23:30 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-08-05 21:25 - 2015-05-25 23:30 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-08-05 21:25 - 2015-05-25 23:29 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-08-05 21:25 - 2015-05-25 23:29 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-08-05 21:25 - 2015-05-25 23:29 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 22:30 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-08-05 21:25 - 2015-05-25 22:20 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-08-05 21:25 - 2015-05-25 22:20 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-08-05 21:25 - 2015-05-25 22:18 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 22:18 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 22:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 22:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-08-05 21:25 - 2015-04-20 08:47 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-08-05 21:25 - 2015-04-20 08:47 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-08-05 21:25 - 2015-04-20 08:26 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-08-05 21:24 - 2015-06-16 03:20 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-08-05 21:24 - 2015-06-16 03:15 - 03242496 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-08-05 21:24 - 2015-06-16 03:15 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-08-05 21:24 - 2015-06-16 03:15 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2015-08-05 21:24 - 2015-06-16 03:15 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-08-05 21:24 - 2015-06-16 03:14 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-08-05 21:24 - 2015-06-16 03:13 - 02364416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-08-05 21:24 - 2015-06-16 03:13 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-08-05 21:24 - 2015-06-16 03:13 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2015-08-05 21:24 - 2015-06-16 03:12 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-08-05 21:24 - 2015-06-16 03:12 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2015-08-05 21:24 - 2015-06-16 03:07 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2015-08-05 21:23 - 2015-02-03 09:04 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-08-05 21:23 - 2015-02-03 09:04 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-08-05 21:23 - 2015-02-03 09:03 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-08-05 21:23 - 2015-02-03 09:01 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-08-05 21:23 - 2015-02-03 09:00 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-08-05 21:23 - 2015-02-03 09:00 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-08-05 21:23 - 2015-02-03 09:00 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-08-05 21:23 - 2015-02-03 09:00 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-08-05 21:23 - 2015-02-03 09:00 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-08-05 21:23 - 2015-02-03 09:00 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-08-05 21:23 - 2015-02-03 08:59 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-08-05 21:23 - 2015-02-03 08:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-08-05 21:23 - 2015-02-03 08:49 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-08-05 21:23 - 2015-02-03 08:42 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-08-05 21:23 - 2015-02-03 08:41 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-08-05 21:23 - 2015-02-03 08:41 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-08-05 21:23 - 2015-02-03 08:39 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-08-05 21:23 - 2015-02-03 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-08-05 21:23 - 2014-11-01 03:54 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-08-05 21:23 - 2014-06-28 05:51 - 00532176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2015-08-05 21:23 - 2014-06-28 05:51 - 00457400 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2015-08-05 21:22 - 2015-01-29 08:49 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-08-05 21:22 - 2015-01-29 08:32 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-08-05 21:21 - 2015-07-09 23:28 - 03154944 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-08-05 21:21 - 2015-07-09 23:28 - 02603008 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-08-05 21:21 - 2015-07-09 23:28 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-08-05 21:21 - 2015-07-09 23:28 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-08-05 21:21 - 2015-07-09 23:28 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-08-05 21:21 - 2015-07-09 23:28 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-08-05 21:21 - 2015-07-09 23:28 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-08-05 21:21 - 2015-07-09 23:28 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-08-05 21:21 - 2015-07-09 23:28 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-08-05 21:21 - 2015-07-09 23:28 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-08-05 21:21 - 2015-07-09 23:28 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-08-05 21:21 - 2015-07-09 23:13 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-08-05 21:21 - 2015-07-09 23:13 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-08-05 21:21 - 2015-07-09 23:13 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-08-05 21:21 - 2015-07-09 23:13 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-08-05 21:21 - 2015-07-09 23:12 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-08-05 21:21 - 2015-04-29 23:52 - 14635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-08-05 21:21 - 2015-03-04 10:11 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-08-05 21:21 - 2015-03-04 10:11 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-08-05 21:21 - 2015-03-04 10:11 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-08-05 21:21 - 2015-03-04 10:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-08-05 21:21 - 2015-03-04 09:41 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-08-05 21:21 - 2015-03-04 09:40 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-08-05 21:21 - 2015-03-04 09:40 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-08-05 21:20 - 2015-04-29 23:51 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-08-05 21:20 - 2015-04-29 23:51 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-08-05 21:20 - 2015-04-29 23:51 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-08-05 21:20 - 2015-04-29 23:49 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-08-05 21:20 - 2015-04-29 23:37 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-08-05 21:20 - 2015-04-29 23:37 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-08-05 21:20 - 2015-04-29 23:37 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-08-05 21:20 - 2015-04-29 23:37 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-08-05 21:20 - 2015-04-29 23:35 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-08-05 21:20 - 2015-04-28 00:53 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-08-05 21:20 - 2015-04-28 00:53 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-08-05 21:20 - 2015-04-28 00:53 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-08-05 21:20 - 2015-04-28 00:53 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-08-05 21:20 - 2015-04-28 00:35 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-08-05 21:20 - 2015-04-28 00:34 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-08-05 21:20 - 2015-04-28 00:34 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-08-05 21:20 - 2015-04-28 00:34 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-08-05 21:20 - 2014-11-26 09:23 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-08-05 21:20 - 2014-11-26 09:02 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-08-05 21:19 - 2015-07-25 23:37 - 00017856 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-08-05 21:19 - 2015-07-25 23:34 - 00765440 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-08-05 21:19 - 2015-07-25 23:34 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-08-05 21:19 - 2015-07-25 23:33 - 01085440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-08-05 21:19 - 2015-07-25 23:33 - 00433664 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-08-05 21:19 - 2015-07-25 23:33 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-08-05 21:19 - 2015-07-25 23:33 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-08-05 21:19 - 2015-07-25 23:25 - 01145856 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-08-05 21:19 - 2015-07-15 08:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-08-05 21:19 - 2015-07-15 08:49 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-08-05 21:19 - 2015-07-15 08:49 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-08-05 21:19 - 2015-07-15 08:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-08-05 21:19 - 2015-07-15 08:25 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-08-05 21:19 - 2015-07-15 08:25 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-08-05 21:19 - 2015-07-15 08:25 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-08-05 21:19 - 2015-07-15 08:24 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-08-05 21:19 - 2015-07-15 07:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-08-05 21:19 - 2015-07-15 07:22 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-08-05 21:19 - 2015-06-04 01:46 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-08-05 21:19 - 2015-06-04 01:46 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-08-05 21:19 - 2015-04-08 08:59 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-08-05 21:19 - 2015-04-08 08:44 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-08-05 21:19 - 2015-02-25 08:48 - 00754688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-08-05 21:19 - 2015-02-18 12:36 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-08-05 21:19 - 2015-02-18 12:34 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-08-05 21:18 - 2015-07-04 23:37 - 02087424 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-08-05 21:18 - 2015-07-04 23:18 - 01414656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-08-05 21:18 - 2015-06-25 14:27 - 03207168 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-08-05 21:18 - 2015-04-24 23:47 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-08-05 21:18 - 2015-04-24 23:26 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2015-08-05 21:15 - 2014-12-11 23:17 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-08-05 21:09 - 2015-02-03 09:01 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-08-05 21:09 - 2015-02-03 08:42 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-08-05 21:08 - 2015-04-13 08:58 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-08-05 21:08 - 2014-12-19 07:16 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-08-05 21:07 - 2015-06-17 23:17 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-08-05 21:07 - 2015-06-17 23:07 - 00312320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-08-05 21:07 - 2015-01-17 08:18 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-08-05 21:07 - 2015-01-17 08:00 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-08-05 21:07 - 2014-12-19 08:36 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-08-05 21:07 - 2014-12-06 09:47 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-08-05 21:07 - 2014-12-06 09:20 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-08-05 21:07 - 2014-12-06 09:20 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-08-05 21:07 - 2014-10-04 07:40 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-08-05 21:07 - 2014-10-04 07:12 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-08-05 21:07 - 2014-10-04 07:12 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2015-08-05 21:05 - 2015-03-04 10:25 - 00367552 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-08-05 21:05 - 2015-03-04 10:11 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-08-05 21:05 - 2015-03-04 09:40 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2015-08-05 21:05 - 2015-02-04 08:46 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-08-05 21:05 - 2015-02-04 08:24 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-08-05 21:05 - 2015-02-03 09:01 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-08-05 21:05 - 2015-02-03 08:42 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-08-05 21:05 - 2014-12-08 08:39 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-08-05 21:05 - 2014-12-08 08:16 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-08-18 16:56 - 2015-06-08 21:52 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-08-18 16:39 - 2014-11-29 12:16 - 00000000 ____D C:\Users\Tab\AppData\Roaming\Skype
2015-08-18 16:29 - 2012-02-05 04:42 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-08-18 16:29 - 2012-02-05 04:42 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-08-18 16:25 - 2009-07-14 10:15 - 00022624 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-08-18 16:25 - 2009-07-14 10:15 - 00022624 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-08-18 16:22 - 2014-09-30 23:37 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-08-18 16:22 - 2014-09-30 23:19 - 01362195 _____ C:\Windows\WindowsUpdate.log
2015-08-18 16:15 - 2014-09-30 23:19 - 00000000 ____D C:\Users\Tab
2015-08-18 16:10 - 2014-10-03 09:30 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2015-08-18 16:07 - 2014-10-07 16:49 - 00000000 ____D C:\Users\Tab\AppData\Local\CrashDumps
2015-08-18 16:00 - 2015-06-05 20:45 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-08-18 15:55 - 2014-09-30 23:23 - 00003910 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{F5CB8745-DB0A-4F02-B88A-9FA5BEE4236A}
2015-08-18 15:25 - 2009-07-14 10:43 - 00785366 _____ C:\Windows\system32\PerfStringBackup.INI
2015-08-15 21:56 - 2015-01-20 22:09 - 00000000 ___RD C:\Users\Tab\Google Drive
2015-08-15 21:54 - 2014-09-30 23:37 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-08-15 21:54 - 2009-07-14 10:38 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-08-10 12:39 - 2009-07-14 08:50 - 00000000 ____D C:\Windows\AppCompat
2015-08-07 11:30 - 2009-07-14 10:39 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-08-07 11:30 - 2009-07-14 10:27 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-08-07 11:24 - 2014-10-01 00:54 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-08-07 11:24 - 2014-10-01 00:54 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-08-07 11:24 - 2009-07-14 10:15 - 00408584 _____ C:\Windows\system32\FNTCACHE.DAT
2015-08-05 22:36 - 2014-12-20 13:58 - 00000000 ____D C:\Windows\system32\appraiser
2015-08-05 22:36 - 2014-10-05 13:14 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-08-05 22:36 - 2009-07-14 08:50 - 00000000 ____D C:\Windows\SysWOW64\Dism
2015-08-05 22:36 - 2009-07-14 08:50 - 00000000 ____D C:\Windows\system32\Dism
2015-08-05 22:36 - 2009-07-14 08:50 - 00000000 ____D C:\Windows\system32\AdvancedInstallers
2015-08-05 22:36 - 2009-07-14 08:50 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-08-05 22:27 - 2015-03-29 20:55 - 00002117 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2015-08-05 22:27 - 2015-03-29 20:55 - 00001945 _____ C:\Windows\epplauncher.mif
2015-08-05 22:26 - 2015-03-29 20:55 - 00000000 ____D C:\Program Files\Microsoft Security Client
2015-08-05 22:26 - 2015-03-29 20:55 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2015-08-05 22:20 - 2014-11-27 10:37 - 00769768 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2015-08-05 22:18 - 2014-09-30 23:30 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-08-05 22:14 - 2009-07-14 08:04 - 00000478 _____ C:\Windows\win.ini
2015-08-05 21:55 - 2014-11-29 13:40 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-08-05 21:55 - 2012-02-05 04:54 - 00000000 ____D C:\ProgramData\Skype
2015-08-05 21:47 - 2014-10-01 00:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-08-05 21:43 - 2014-11-27 08:48 - 00000000 ____D C:\Windows\system32\MRT
2015-08-04 15:42 - 2015-01-03 14:21 - 00000000 ____D C:\Users\Tab\AppData\Roaming\vlc
2015-07-19 18:27 - 2015-01-20 22:08 - 00002042 _____ C:\Users\Public\Desktop\Google Slides.lnk
2015-07-19 18:27 - 2015-01-20 22:08 - 00002040 _____ C:\Users\Public\Desktop\Google Sheets.lnk
2015-07-19 18:27 - 2015-01-20 22:08 - 00002030 _____ C:\Users\Public\Desktop\Google Docs.lnk
2015-07-19 18:27 - 2015-01-20 22:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-07-19 18:17 - 2014-09-30 23:37 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-07-19 18:17 - 2014-09-30 23:37 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
 
==================== Files in the root of some directories =======
 
2014-11-29 13:45 - 2015-03-15 17:25 - 0002794 _____ () C:\Users\Tab\AppData\Local\mbt-actwiz.log
 
==================== Bamital & volsnap =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2015-05-24 00:19
 
==================== End of log ============================
 
 
 
 
 
 
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version:17-08-2015
Ran by Tab (2015-08-18 17:11:14)
Running from C:\Users\Tab\Downloads
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-1206459012-1669690168-1176892122-500 - Administrator - Disabled)
Guest (S-1-5-21-1206459012-1669690168-1176892122-501 - Limited - Disabled)
Tab (S-1-5-21-1206459012-1669690168-1176892122-1000 - Administrator - Enabled) => C:\Users\Tab
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Microsoft Security Essentials (Enabled - Out of date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Out of date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
Adobe Flash Player 11 ActiveX 64-bit (HKLM\...\Adobe Flash Player ActiveX) (Version: 11.2.202.160 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.3.633 - Adobe Systems, Inc.)
AMD Catalyst Install Manager (HKLM\...\{51F9B09B-2FE4-8B3A-628A-0C0654E253AF}) (Version: 3.0.859.0 - Advanced Micro Devices, Inc.)
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
BitTorrent (HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\...\BitTorrent) (Version: 7.9.3.40299 - BitTorrent Inc.)
Blackhawk Striker 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.06 - Piriform)
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
CyberLink PowerDVD (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4.3516 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.2.4725 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dora's World Adventure (x32 Version: 2.2.0.95 - WildTangent) Hidden
ESU for Microsoft Windows 7 SP1 (HKLM-x32\...\{768A6276-5822-489C-8A2B-67190F745655}) (Version: 4.1.2 - Hewlett-Packard)
Evernote v. 4.5.2 (HKLM-x32\...\{8CE152BA-1D16-11E1-867D-984BE15F174E}) (Version: 4.5.2.5904 - Evernote Corp.)
Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Farmscapes (x32 Version: 2.2.0.98 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Final Drive Fury (x32 Version: 2.2.0.95 - WildTangent) Hidden
GoGear SA3MXX Device Manager (HKLM-x32\...\{200F62A0-CB7C-4F57-8E79-45D92E901DA2}) (Version: 0.1 - Philips)
GoGear SA3MXX Device Manager (x32 Version: 0.1 - Philips) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 44.0.2403.155 - Google Inc.)
Google Drive (HKLM-x32\...\{6EA8B94E-D869-4D96-88DF-5E1ECE1D6876}) (Version: 1.23.9648.8824 - Google, Inc.)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.28.1 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
Hoyle Card Games (x32 Version: 2.2.0.95 - WildTangent) Hidden
HP 3D DriveGuard (HKLM\...\{54CE68A8-4F2D-4328-B1F7-D6C720405F7F}) (Version: 4.2.9.1 - Hewlett-Packard Company)
HP CoolSense (HKLM-x32\...\{11AF9A96-6D83-4C3B-8DCB-16EA2A358E3F}) (Version: 2.10.51 - Hewlett-Packard Company)
HP Documentation (HKLM-x32\...\{EDA2B6DE-C67C-4FD7-AF6A-9D79E002707C}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)
HP Launch Box (HKLM\...\{5A847522-375C-4D05-BD3D-88C450CC047F}) (Version: 1.1.5 - Hewlett-Packard Company)
HP On Screen Display (HKLM-x32\...\{ED1BD69A-07E3-418C-91F1-D856582581BF}) (Version: 1.3.5 - Hewlett-Packard Company)
HP Power Manager (HKLM-x32\...\{D8BCE5B9-67CF-4F3F-93AE-3ACC754C72EB}) (Version: 1.4.7 - Hewlett-Packard Company)
HP Quick Launch (HKLM-x32\...\{53B17A98-5BF0-40BC-AAFF-850A357975AC}) (Version: 2.7.2 - Hewlett-Packard Company)
HP Security Assistant (HKLM\...\{ED6CD3AC-616B-4B20-BCF3-6E637B92A5AD}) (Version: 3.0.4 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{F5E7D9AF-60F6-4A30-87E3-4EA94D322CE1}) (Version: 9.0.15109.3899 - Hewlett-Packard Company)
HP Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.2.14901.3869 - Hewlett-Packard Company)
HP Software Framework (HKLM-x32\...\{675D093B-815D-47FD-AB2C-192EC751E8E2}) (Version: 4.6.10.1 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6381.0 - IDT)
Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel® Display Audio Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 6.14.00.3090 - Intel Corporation)
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.0.1351 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)
Intel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.0.199 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{6199B534-A1B6-46ED-873B-97B0ECF8F81E}) (Version: 1.23.216.0 - Intel Corporation)
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Jewel Quest Mysteries: The Seventh Gate Collector's Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
KeyScrambler (HKLM-x32\...\KeyScrambler) (Version: 3.5.0.0 - QFX Software Corporation)
Letters from Nowhere 2 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Luxor HD (x32 Version: 2.2.0.98 - WildTangent) Hidden
Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
MiniTool Partition Wizard Home Edition 8.1.1 (HKLM-x32\...\{05D996FA-ADCB-4D23-BA3C-A7C184A8FAC6}_is1) (Version:  - MiniTool Solution Ltd.)
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
Poker Superstars III (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Polar Golfer (x32 Version: 2.2.0.98 - WildTangent) Hidden
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
Ralink Motorola BC8 Bluetooth 3.0+HS Adapter (HKLM\...\1DF1F719-D43A-46E8-950F-65A8D96C678A.MBT_is1) (Version: 3.0.43.307 - Motorola Solutions, Inc.)
Ralink RT5390 802.11b/g/n WiFi Adapter (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 5.0.25.0 - Mediatek)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7601.29004 - Realtek Semiconductor Corp.)
RollerCoaster Tycoon 3: Platinum (x32 Version: 2.2.0.98 - WildTangent) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.4.0.9058 - Microsoft Corporation)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.27.1 - Synaptics Incorporated)
The Treasures of Mystery Island: The Ghost Ship (x32 Version: 2.2.0.98 - WildTangent) Hidden
Torchlight (x32 Version: 2.2.0.98 - WildTangent) Hidden
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WildTangent Games App (HP Games) (x32 Version: 4.0.5.32 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Phone app for desktop (HKLM-x32\...\{5F71448B-88EB-4357-9A98-8658D4C49C48}) (Version: 1.1.2726.0 - Microsoft Corporation)
WordWeb (HKLM-x32\...\WordWeb) (Version: 7 - WordWeb Software)
Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== Restore Points =========================
 
13-06-2015 13:29:20 Windows Update
21-06-2015 21:33:43 Windows Update
24-06-2015 22:43:10 Windows Update
28-06-2015 21:41:25 Windows Update
01-07-2015 22:09:37 Windows Update
06-07-2015 21:24:56 Windows Update
11-07-2015 15:01:43 Windows Update
17-07-2015 20:25:30 Windows Update
30-07-2015 21:02:51 Windows Update
03-08-2015 23:03:16 Windows Update
05-08-2015 21:28:41 Windows Update
10-08-2015 12:48:16 Windows Update
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-14 08:04 - 2009-06-11 02:30 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {002A8A22-C0C5-4442-841D-B50FB4D426A7} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {0F63B5B0-B4E1-4505-A225-E99D9169F0A9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {3B6F42C7-B62D-4A56-BEC2-332549B88AAA} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-05-09] (Piriform Ltd)
Task: {4DC319D2-82E9-4135-9CE7-0D0C1CE07F2B} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPW10UpgradeReminder => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPW10UpgradeReminder.exe [2015-07-24] (Hewlett-Packard)
Task: {6D2A2F43-F5D9-4707-8626-5ADF15E22C66} - System32\Tasks\{4A2BA09E-A91A-4B57-A0A1-89822C41931A} => pcalua.exe -a G:\Setup.exe -d G:\
Task: {7849AEE9-00BE-4CC3-B45A-4D040BD2C868} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {9001E3A7-D220-4082-B714-797B627B6855} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-02-05] (Adobe Systems Incorporated)
Task: {983E9A3D-BB17-42DD-98A4-3F5C5FEB33CB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {B5268D40-1933-438D-969E-1966B6BE8A02} - System32\Tasks\HPCeeScheduleForTab => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {C24EAAAF-9D27-45B6-BCEE-058A7D0B61F5} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-09-30] (Google Inc.)
Task: {C60AF23E-962B-4FD0-8E8F-FF1BADCD4E3A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-09-30] (Google Inc.)
Task: {E95399B7-F1AF-4DDE-B1A7-5A4B3410EEA7} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-11-29] (CyberLink)
Task: {EFB8256D-C4CA-4963-B388-4DE28068826F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForTab.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
 
==================== Loaded Modules (Whitelisted) ==============
 
2013-04-04 01:09 - 2013-04-04 01:09 - 04300432 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 15:23 - 2010-10-20 15:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2014-10-01 11:25 - 2011-12-17 02:07 - 00128280 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe
2012-01-06 06:54 - 2012-01-06 06:54 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2011-12-20 12:04 - 2011-12-20 12:04 - 00108880 _____ () C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe
2012-01-18 11:04 - 2012-01-18 11:04 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-12-27 04:11 - 2011-12-27 04:11 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2013-04-04 01:09 - 2013-04-04 01:09 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 15:45 - 2010-10-20 15:45 - 08801120 _____ () C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2015-08-15 21:54 - 2015-08-15 21:54 - 00098816 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\win32api.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00110080 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\pywintypes27.dll
2015-08-15 21:54 - 2015-08-15 21:54 - 00364544 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\pythoncom27.dll
2015-08-15 21:54 - 2015-08-15 21:54 - 00045568 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\_socket.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 01161216 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\_ssl.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00320512 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\win32com.shell.shell.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00713216 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\_hashlib.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 01175040 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\wx._core_.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00805888 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\wx._gdi_.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00811008 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\wx._windows_.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 01062400 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\wx._controls_.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00735232 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\wx._misc_.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00682496 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\pysqlite2._sqlite.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00087552 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\_ctypes.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00119808 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\win32file.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00108544 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\win32security.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00007168 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\hashobjs_ext.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00068096 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\usb_ext.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00167936 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\win32gui.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00018432 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\win32event.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00128512 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\_elementtree.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00127488 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\pyexpat.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00013824 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\common.time34.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00036864 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\_psutil_windows.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00038912 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\win32inet.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00011264 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\win32crypt.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00070656 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\wx._html2.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00027136 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\_multiprocessing.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00020480 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\_yappi.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00035840 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\win32process.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00686080 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\unicodedata.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00122368 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\wx._wizard.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00024064 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\win32pipe.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00010240 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\select.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00025600 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\win32pdh.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00525640 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\windows._lib_cacheinvalidation.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00017408 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\win32profile.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00022528 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\win32ts.pyd
2015-08-15 21:54 - 2015-08-15 21:54 - 00078336 ____N () C:\Users\Tab\AppData\Local\Temp\_MEI38922\wx._animate.pyd
2014-11-29 11:21 - 2014-11-29 11:21 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\a32af7d4063795ba02dd17d56f4502d8\IsdiInterop.ni.dll
2014-10-01 11:25 - 2011-11-30 08:30 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll
2014-10-01 11:25 - 2011-12-17 00:09 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll
2015-08-18 16:00 - 2015-08-08 05:43 - 01405768 _____ () C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.155\libglesv2.dll
2015-08-18 16:00 - 2015-08-08 05:43 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.155\libegl.dll
2015-08-18 16:00 - 2015-08-08 05:43 - 16393032 _____ () C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.155\PepperFlash\pepflashplayer.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 
==================== EXE Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Tab\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.137.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
(Currently there is no automatic fix for this section.)
 
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [{10ABE77B-A03D-446B-BF7C-E275D1BC1136}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{A848057E-F634-4F48-AEEE-39EB560B3093}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{D7454C6D-ED31-4992-9D19-FC414E442749}] => (Allow) LPort=2869
FirewallRules: [{A3E5F776-77CB-4FC7-B7E8-4A0FBF8E9514}] => (Allow) LPort=1900
FirewallRules: [{BF3DB69D-C84F-4B97-8F3E-A565FF79C80A}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{1D640359-D234-4B96-8191-1D4A35EB0005}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [{74B5B76C-8F7B-47BD-B0AB-2AA711EEC6DE}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{522183CA-D831-4984-B740-299ABA5F7C31}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{4FD348D4-6543-4AF4-8F3C-3188E83EC593}] => (Allow) C:\Users\Tab\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{9D4F4FCB-B2F9-4E2F-B346-73BAFF0F8567}] => (Allow) C:\Users\Tab\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{8AF20F49-D9EA-451B-BFAF-B108C78FD764}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (08/15/2015 09:55:12 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (08/10/2015 12:35:24 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (08/07/2015 11:25:12 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (08/05/2015 08:46:38 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (08/04/2015 03:42:14 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: vlc.exe, version: 2.1.5.0, time stamp: 0x00000000
Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521eaf24
Exception code: 0xc0000005
Fault offset: 0x0000000000018e5d
Faulting process id: 0x568
Faulting application start time: 0xvlc.exe0
Faulting application path: vlc.exe1
Faulting module path: vlc.exe2
Report Id: vlc.exe3
 
Error: (08/04/2015 03:34:28 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (08/03/2015 10:48:59 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (08/03/2015 03:23:49 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (07/31/2015 08:05:06 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (07/30/2015 08:32:36 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 
System errors:
=============
Error: (08/18/2015 04:13:35 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
 
New Signature Version: 
 
Previous Signature Version: 1.203.1783.0
 
Update Source: %NT AUTHORITY59
 
Update Stage: 4.8.0204.00
 
Source Path: 4.8.0204.01
 
Signature Type: %NT AUTHORITY602
 
Update Type: %NT AUTHORITY604
 
User: NT AUTHORITY\SYSTEM
 
Current Engine Version: %NT AUTHORITY605
 
Previous Engine Version: %NT AUTHORITY606
 
Error code: %NT AUTHORITY607
 
Error description: %NT AUTHORITY608
 
Error: (08/18/2015 04:12:55 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
 
New Signature Version: 
 
Previous Signature Version: 1.203.1783.0
 
Update Source: %NT AUTHORITY59
 
Update Stage: 4.8.0204.00
 
Source Path: 4.8.0204.01
 
Signature Type: %NT AUTHORITY602
 
Update Type: %NT AUTHORITY604
 
User: NT AUTHORITY\SYSTEM
 
Current Engine Version: %NT AUTHORITY605
 
Previous Engine Version: %NT AUTHORITY606
 
Error code: %NT AUTHORITY607
 
Error description: %NT AUTHORITY608
 
Error: (08/18/2015 04:12:55 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
 
New Signature Version: 
 
Previous Signature Version: 1.203.1783.0
 
Update Source: %NT AUTHORITY59
 
Update Stage: 4.8.0204.00
 
Source Path: 4.8.0204.01
 
Signature Type: %NT AUTHORITY602
 
Update Type: %NT AUTHORITY604
 
User: NT AUTHORITY\SYSTEM
 
Current Engine Version: %NT AUTHORITY605
 
Previous Engine Version: %NT AUTHORITY606
 
Error code: %NT AUTHORITY607
 
Error description: %NT AUTHORITY608
 
Error: (08/18/2015 03:31:35 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
 
New Signature Version: 
 
Previous Signature Version: 115.9.0.0
 
Update Source: %NT AUTHORITY51
 
Update Stage: 4.8.0204.00
 
Source Path: 4.8.0204.01
 
Signature Type: %NT AUTHORITY602
 
Update Type: %NT AUTHORITY604
 
User: NT AUTHORITY\NETWORK SERVICE
 
Current Engine Version: %NT AUTHORITY605
 
Previous Engine Version: %NT AUTHORITY606
 
Error code: %NT AUTHORITY607
 
Error description: %NT AUTHORITY608
 
Error: (08/18/2015 03:31:35 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
 
New Signature Version: 
 
Previous Signature Version: 1.203.1783.0
 
Update Source: %NT AUTHORITY51
 
Update Stage: 4.8.0204.00
 
Source Path: 4.8.0204.01
 
Signature Type: %NT AUTHORITY602
 
Update Type: %NT AUTHORITY604
 
User: NT AUTHORITY\NETWORK SERVICE
 
Current Engine Version: %NT AUTHORITY605
 
Previous Engine Version: %NT AUTHORITY606
 
Error code: %NT AUTHORITY607
 
Error description: %NT AUTHORITY608
 
Error: (08/18/2015 03:31:35 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
 
New Signature Version: 
 
Previous Signature Version: 1.203.1783.0
 
Update Source: %NT AUTHORITY51
 
Update Stage: 4.8.0204.00
 
Source Path: 4.8.0204.01
 
Signature Type: %NT AUTHORITY602
 
Update Type: %NT AUTHORITY604
 
User: NT AUTHORITY\NETWORK SERVICE
 
Current Engine Version: %NT AUTHORITY605
 
Previous Engine Version: %NT AUTHORITY606
 
Error code: %NT AUTHORITY607
 
Error description: %NT AUTHORITY608
 
Error: (08/18/2015 03:31:35 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
 
New Signature Version: 
 
Previous Signature Version: 1.203.1783.0
 
Update Source: %NT AUTHORITY59
 
Update Stage: 4.8.0204.00
 
Source Path: 4.8.0204.01
 
Signature Type: %NT AUTHORITY602
 
Update Type: %NT AUTHORITY604
 
User: NT AUTHORITY\SYSTEM
 
Current Engine Version: %NT AUTHORITY605
 
Previous Engine Version: %NT AUTHORITY606
 
Error code: %NT AUTHORITY607
 
Error description: %NT AUTHORITY608
 
Error: (08/18/2015 03:31:34 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
 
New Signature Version: 
 
Previous Signature Version: 115.9.0.0
 
Update Source: %NT AUTHORITY51
 
Update Stage: 4.8.0204.00
 
Source Path: 4.8.0204.01
 
Signature Type: %NT AUTHORITY602
 
Update Type: %NT AUTHORITY604
 
User: NT AUTHORITY\NETWORK SERVICE
 
Current Engine Version: %NT AUTHORITY605
 
Previous Engine Version: %NT AUTHORITY606
 
Error code: %NT AUTHORITY607
 
Error description: %NT AUTHORITY608
 
Error: (08/18/2015 03:31:34 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
 
New Signature Version: 
 
Previous Signature Version: 1.203.1783.0
 
Update Source: %NT AUTHORITY51
 
Update Stage: 4.8.0204.00
 
Source Path: 4.8.0204.01
 
Signature Type: %NT AUTHORITY602
 
Update Type: %NT AUTHORITY604
 
User: NT AUTHORITY\NETWORK SERVICE
 
Current Engine Version: %NT AUTHORITY605
 
Previous Engine Version: %NT AUTHORITY606
 
Error code: %NT AUTHORITY607
 
Error description: %NT AUTHORITY608
 
Error: (08/18/2015 03:31:34 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
 
New Signature Version: 
 
Previous Signature Version: 1.203.1783.0
 
Update Source: %NT AUTHORITY51
 
Update Stage: 4.8.0204.00
 
Source Path: 4.8.0204.01
 
Signature Type: %NT AUTHORITY602
 
Update Type: %NT AUTHORITY604
 
User: NT AUTHORITY\NETWORK SERVICE
 
Current Engine Version: %NT AUTHORITY605
 
Previous Engine Version: %NT AUTHORITY606
 
Error code: %NT AUTHORITY607
 
Error description: %NT AUTHORITY608
 
 
Microsoft Office:
=========================
Error: (08/15/2015 09:55:12 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (08/10/2015 12:35:24 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (08/07/2015 11:25:12 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (08/05/2015 08:46:38 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (08/04/2015 03:42:14 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: vlc.exe2.1.5.000000000ntdll.dll6.1.7601.18247521eaf24c00000050000000000018e5d56801d0ce9e0115d797C:\Program Files\VideoLAN\VLC\vlc.exeC:\Windows\SYSTEM32\ntdll.dll46c8718d-3a91-11e5-908e-80c16e5888a3
 
Error: (08/04/2015 03:34:28 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (08/03/2015 10:48:59 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (08/03/2015 03:23:49 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (07/31/2015 08:05:06 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (07/30/2015 08:32:36 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 
==================== Memory info =========================== 
 
Processor: Intel® Core™ i3-2350M CPU @ 2.30GHz
Percentage of memory in use: 61%
Total physical RAM: 3994.36 MB
Available physical RAM: 1519.67 MB
Total Virtual: 7986.93 MB
Available Virtual: 4735.05 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:446.15 GB) (Free:280.9 GB) NTFS ==>[system with boot components (obtained from reading drive)]
Drive d: (Recovery) (Fixed) (Total:19.31 GB) (Free:2.1 GB) NTFS ==>[system with boot components (obtained from reading drive)]
Drive e: (2013-02-13 2043) (CDROM) (Total:4.38 GB) (Free:0.55 GB) UDF
Drive f: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.08 GB) FAT32
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 794AE9E5)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=446.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=19.3 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)
 
==================== End of log ============================


#5 nasdaq

nasdaq

  • Malware Response Team
  • 39,179 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:08 PM

Posted 18 August 2015 - 07:47 AM

Press the windows key Windows_Logo_key.gif+ r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.
Please copy the entire contents of the code box below to the a new file.


start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://in.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://in.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKU\S-1-5-21-1206459012-1669690168-1176892122-1000 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKU\S-1-5-21-1206459012-1669690168-1176892122-1000 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://in.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKU\S-1-5-21-1206459012-1669690168-1176892122-1000 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
Toolbar: HKU\S-1-5-21-1206459012-1669690168-1176892122-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
CHR Extension: (Quick Search) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfneciejbnaieckfgfpnobffjcdggojn [2015-06-26]
CHR HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx
C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfneciejbnaieckfgfpnobffjcdggojn

End
Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Reset Chrome...
Open Google Chrome, click on menu icon google-chrome-setting-icon.png which is located right side top of the google chrome.
 
Click "Settings" then "Show advanced settings" at the bottom of the screen.
 
Click "Reset browser settings" button.
 
Clear your cache and cookies
https://support.google.com/chromebook/answer/183083?hl=en
Select "From the beginning of time"

Restart Chrome.

====

How is the computer running now?

#6 contacthasan

contacthasan
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:01:38 AM

Posted 18 August 2015 - 12:48 PM

Hi Nasdaq,

 

Fix result of Farbar Recovery Scan Tool (x64) Version:17-08-2015
Ran by Tab (2015-08-18 22:44:08) Run:1
Running from C:\Users\Tab\Downloads
Loaded Profiles: Tab (Available Profiles: Tab)
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
start
 
CreateRestorePoint:
EmptyTemp:
CloseProcesses:
 
SearchScopes: HKLM
-> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://in.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://in.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKU\S-1-5-21-1206459012-1669690168-1176892122-1000 -> {2fa28606-de77-4029-af96-b231e3b8f827}
URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKU\S-1-5-21-1206459012-1669690168-1176892122-1000 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://in.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKU\S-1-5-21-1206459012-1669690168-1176892122-1000 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
Toolbar: HKU\S-1-5-21-1206459012-1669690168-1176892122-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
CHR Extension: (Quick Search) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfneciejbnaieckfgfpnobffjcdggojn [2015-06-26]
CHR HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx
C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfneciejbnaieckfgfpnobffjcdggojn
 
End
*****************
 
Restore point was successfully created.
Processes closed successfully.
\\SearchScopes: HKLM => value not found.
-> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF => Error: No automatic fix found for this entry.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}" => key removed successfully
HKCR\CLSID\{b7fca997-d0fb-4fe0-8afd-255e89cf9671} => key not found. 
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}" => key removed successfully
HKCR\CLSID\{d43b3890-80c7-4010-a95d-1e77b5924dc3} => key not found. 
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}" => key removed successfully
HKCR\Wow6432Node\CLSID\{2fa28606-de77-4029-af96-b231e3b8f827} => key not found. 
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}" => key removed successfully
HKCR\Wow6432Node\CLSID\{b7fca997-d0fb-4fe0-8afd-255e89cf9671} => key not found. 
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}" => key removed successfully
HKCR\Wow6432Node\CLSID\{d43b3890-80c7-4010-a95d-1e77b5924dc3} => key not found. 
HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\SearchScopes: HKU\S-1-5-21-1206459012-1669690168-1176892122-1000 -> {2fa28606-de77-4029-af96-b231e3b8f827} => value not found.
URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF => Error: No automatic fix found for this entry.
"HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}" => key removed successfully
HKCR\CLSID\{b7fca997-d0fb-4fe0-8afd-255e89cf9671} => key not found. 
"HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}" => key removed successfully
HKCR\CLSID\{d43b3890-80c7-4010-a95d-1e77b5924dc3} => key not found. 
HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => value removed successfully
HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => key not found. 
C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfneciejbnaieckfgfpnobffjcdggojn => moved successfully.
"HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\SOFTWARE\Google\Chrome\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh" => key removed successfully
"C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfneciejbnaieckfgfpnobffjcdggojn" => File/Folder not found.
EmptyTemp: => 140.5 MB temporary data Removed.
 
 
The system needed a reboot.. 
 
==== End of Fixlog 22:44:37 ====


#7 nasdaq

nasdaq

  • Malware Response Team
  • 39,179 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:08 PM

Posted 18 August 2015 - 12:59 PM

Any remaining issues?

#8 nasdaq

nasdaq

  • Malware Response Team
  • 39,179 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:08 PM

Posted 24 August 2015 - 07:37 AM

If all is well.

To learn more about how to protect yourself while on the internet read this little guide best security practices keep safe.
http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/
===

#9 contacthasan

contacthasan
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:01:38 AM

Posted 29 August 2015 - 07:50 AM

Hi Nasdaq

Problem restarted again probably after i enabled the AdBlock extension in chrome but when this problem began earlier  i had not downloaded Adblock. Should i repeat the steps or wait for instructions?



#10 nasdaq

nasdaq

  • Malware Response Team
  • 39,179 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:08 PM

Posted 29 August 2015 - 10:21 AM

Remove/delete AdBlock from the Chrome Extension

https://chrome.google.com/webstore/detail/adblock-plus/cfhdojbkjhnklbpkdaibdccddilifddb

Restart the computer normally.

You can install the new version AdBlock Plus
https://chrome.google.com/webstore/detail/adblock-plus/cfhdojbkjhnklbpkdaibdccddilifddb

I use it and have no problems.

===

If any other problem persists run the Farbar tool and post a fresh log for my review.

#11 contacthasan

contacthasan
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:01:38 AM

Posted 30 August 2015 - 10:18 AM

Ads are still popping up

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:28-08-2015
Ran by Tab (administrator) on TAB-HP (30-08-2015 20:27:49)
Running from C:\Users\Tab\Downloads
Loaded Profiles: Tab (Available Profiles: Tab)
Platform: Windows 7 Home Basic Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Motorola Solutions, Inc.) C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe
(Motorola Solutions, Inc.) C:\Program Files\Motorola\Bluetooth\audiosrv.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Motorola Solutions, Inc.) C:\Program Files\Motorola\Bluetooth\obexsrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Macrovision Europe Ltd.) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
() C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar2.exe
(WordWeb Software) C:\Program Files (x86)\WordWeb\wweb32.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(KeenHigh Tech.) C:\Program Files (x86)\Philips\GoGear SA3MXX Device Manager\main.exe
(Motorola Solutions, Inc.) C:\Program Files\Motorola\Bluetooth\btplayerctrl.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(QFX Software Corporation) C:\Program Files (x86)\KeyScrambler\KeyScrambler.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(QFX Software Corporation) C:\Program Files (x86)\KeyScrambler\x64\KeyScrambler.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
 
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2832168 2011-10-01] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-01-04] (IDT, Inc.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files\Motorola\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [44880 2011-12-20] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-01-18] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2015-08-29] (Intel Corporation)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2011-03-31] (CyberLink Corp.)
HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-20] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HP CoolSense] => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [1343904 2012-11-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [KeyScrambler] => C:\Program Files (x86)\KeyScrambler\keyscrambler.exe [508744 2014-10-26] (QFX Software Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\...\Run: [WordWeb] => C:\Program Files (x86)\WordWeb\wweb32.exe [80000 2014-07-05] (WordWeb Software)
HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22344224 2015-07-29] (Google)
HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8322328 2015-05-09] (Piriform Ltd)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GoGear SA3MXX Device Manager.lnk [2015-05-10]
ShortcutTarget: GoGear SA3MXX Device Manager.lnk -> C:\Program Files (x86)\Philips\GoGear SA3MXX Device Manager\main.exe (KeenHigh Tech.)
ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-07-29] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-07-29] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-07-29] (Google)
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.jp.msn.com/HPALL/26
HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.jp.msn.com/HPALL/26
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/4686-111078-17344-8/4?satitle={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/4686-111078-17344-8/4?satitle={searchTerms}
SearchScopes: HKU\S-1-5-21-1206459012-1669690168-1176892122-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1206459012-1669690168-1176892122-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1206459012-1669690168-1176892122-1000 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/4686-111078-17344-8/4?satitle={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-03-09] (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-03-09] (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 5.152.219.53 5.152.219.50
Tcpip\..\Interfaces\{0559D97D-67EE-4138-9991-53D4AA7FAA4B}: [DhcpNameServer] 5.152.219.53 5.152.219.50
Tcpip\..\Interfaces\{A3DA2257-86AC-47E4-A1B7-1AF700743BEC}: [DhcpNameServer] 192.168.1.1 192.168.1.1
 
FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll [2011-11-07] (Adobe Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-08] (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.52 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2011-12-02] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2011-12-02] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-30] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-30] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2014-11-15] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\...\Firefox\Extensions: [wcapturex@deskperience.com] - C:\Program Files (x86)\WordWeb\WCaptureMoz
FF Extension: WordWeb one-click lookup - C:\Program Files (x86)\WordWeb\WCaptureMoz [2014-11-27]
 
Chrome: 
=======
CHR Profile: C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-06-05]
CHR Extension: (Google Docs) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-06-05]
CHR Extension: (Google Drive) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-06-05]
CHR Extension: (YouTube) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-06-05]
CHR Extension: (Google Search) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-06-05]
CHR Extension: (Google Sheets) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-06-05]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-05]
CHR Extension: (Skype Click to Call) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-06-05]
CHR Extension: (No Name) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfneciejbnaieckfgfpnobffjcdggojn [2015-08-18]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-05]
CHR Extension: (Gmail) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-05]
CHR HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-05-01]
 
==================== Services (Whitelisted) ========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)
S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [647680 2014-10-01] (Macrovision Europe Ltd.) [File not signed]
R3 FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [1028096 2014-10-01] (Macrovision Europe Ltd.) [File not signed]
S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-11-20] (WildTangent)
R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [128280 2011-12-17] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [161560 2011-12-17] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
 
===================== Drivers (Whitelisted) ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [31360 2012-01-18] (Advanced Micro Devices, Inc.)
S3 btmaudio; C:\Windows\System32\drivers\btmaud.sys [43520 2011-02-23] (Motorola Solutions, Inc.)
R3 KeyScrambler; C:\Windows\System32\drivers\keyscrambler.sys [222200 2013-05-31] (QFX Software Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19152 2013-09-30] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [12504 2013-09-30] ()
S3 rockusb; C:\Windows\System32\DRIVERS\rockusb.sys [66088 2009-10-22] (Fuzhou Rockchip Electronics Co,Ltd.)
S3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [258664 2011-09-22] (Realtek Semiconductor Corp.)
S3 usbohci; C:\Windows\system32\drivers\usbohci.sys [25600 2012-02-05] (Microsoft Corporation) [File not signed]
S3 usbuhci; C:\Windows\system32\drivers\usbuhci.sys [30720 2012-02-05] (Microsoft Corporation) [File not signed]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-08-30 20:23 - 2015-08-30 20:23 - 00000000 ____D C:\Users\Tab\Desktop\30.8.15
2015-08-30 20:20 - 2015-08-30 20:20 - 00001592 _____ C:\AdwCleaner[C1].txt
2015-08-30 20:19 - 2015-08-30 20:20 - 00001391 _____ C:\AdwCleaner[S4].txt
2015-08-29 19:59 - 2015-08-29 19:59 - 00786200 _____ (Intel Corporation) C:\Windows\system32\Drivers\iusb3xhc.sys
2015-08-29 19:59 - 2015-08-29 19:59 - 00355096 _____ (Intel Corporation) C:\Windows\system32\Drivers\iusb3hub.sys
2015-08-29 19:59 - 2015-08-29 19:59 - 00016152 _____ (Intel Corporation) C:\Windows\system32\Drivers\iusb3hcs.sys
2015-08-29 16:40 - 2015-08-29 16:40 - 00000000 ____D C:\Users\Tab\Downloads\FRST-OlderVersion
2015-08-29 16:38 - 2015-08-29 16:39 - 00001329 _____ C:\AdwCleaner[S3].txt
2015-08-19 00:07 - 2015-08-20 23:24 - 00000000 ____D C:\Users\Tab\AppData\Roaming\dvdcss
2015-08-18 17:10 - 2015-08-30 20:28 - 00021553 _____ C:\Users\Tab\Downloads\FRST.txt
2015-08-18 17:09 - 2015-08-30 20:27 - 00000000 ____D C:\FRST
2015-08-18 17:06 - 2015-08-29 16:40 - 02186752 _____ (Farbar) C:\Users\Tab\Downloads\FRST64.exe
2015-08-18 16:43 - 2015-08-18 16:44 - 00001826 _____ C:\AdwCleaner[S2].txt
2015-08-18 16:42 - 2015-08-18 16:42 - 01573888 _____ C:\Users\Tab\Downloads\AdwCleaner.exe
2015-08-18 16:20 - 2015-08-30 20:22 - 00000862 _____ C:\Windows\setupact.log
2015-08-18 16:20 - 2015-08-18 16:20 - 00000000 _____ C:\Windows\setuperr.log
2015-08-18 16:04 - 2015-08-18 16:04 - 00000000 ____D C:\AdwCleaner
2015-08-18 15:28 - 2015-08-18 22:27 - 00000324 _____ C:\Windows\Tasks\HPCeeScheduleForTab.job
2015-08-18 15:28 - 2015-08-18 16:15 - 00003174 _____ C:\Windows\System32\Tasks\HPCeeScheduleForTab
2015-08-05 21:48 - 2015-05-01 18:47 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-08-05 21:48 - 2015-05-01 18:46 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-08-05 21:27 - 2015-06-27 08:17 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-08-05 21:27 - 2015-06-27 08:13 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-08-05 21:27 - 2015-06-27 07:28 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-08-05 21:27 - 2015-06-27 07:09 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-08-05 21:27 - 2015-06-25 23:39 - 00389832 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-08-05 21:27 - 2015-06-25 23:13 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-08-05 21:27 - 2015-06-21 01:36 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-08-05 21:27 - 2015-06-21 01:20 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-08-05 21:27 - 2015-06-21 01:19 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-08-05 21:27 - 2015-06-21 01:19 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-08-05 21:27 - 2015-06-21 01:19 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-08-05 21:27 - 2015-06-21 01:10 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-08-05 21:27 - 2015-06-21 01:09 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-08-05 21:27 - 2015-06-21 01:04 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-08-05 21:27 - 2015-06-21 01:04 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-08-05 21:27 - 2015-06-21 01:04 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-08-05 21:27 - 2015-06-21 00:55 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-08-05 21:27 - 2015-06-21 00:51 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-08-05 21:27 - 2015-06-21 00:43 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-08-05 21:27 - 2015-06-21 00:37 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-08-05 21:27 - 2015-06-21 00:35 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-08-05 21:27 - 2015-06-21 00:18 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-08-05 21:27 - 2015-06-21 00:18 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-08-05 21:27 - 2015-06-21 00:16 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-08-05 21:27 - 2015-06-21 00:16 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-08-05 21:27 - 2015-06-20 23:56 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-08-05 21:27 - 2015-06-20 23:32 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-08-05 21:27 - 2015-06-19 23:55 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-08-05 21:27 - 2015-06-19 23:55 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-08-05 21:27 - 2015-06-19 23:54 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-08-05 21:27 - 2015-06-19 23:54 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-08-05 21:27 - 2015-06-19 23:53 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-08-05 21:27 - 2015-06-19 23:47 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-08-05 21:27 - 2015-06-19 23:46 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-08-05 21:27 - 2015-06-19 23:43 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-08-05 21:27 - 2015-06-19 23:43 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-08-05 21:27 - 2015-06-19 23:33 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-08-05 21:27 - 2015-06-19 23:27 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-08-05 21:27 - 2015-06-19 23:23 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-08-05 21:27 - 2015-06-19 23:22 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-08-05 21:27 - 2015-06-19 23:21 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-08-05 21:27 - 2015-06-19 23:10 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-08-05 21:27 - 2015-06-19 23:10 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-08-05 21:27 - 2015-06-19 23:09 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-08-05 21:27 - 2015-06-19 22:45 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-08-05 21:27 - 2015-06-19 22:41 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-08-05 21:27 - 2015-06-04 01:47 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-08-05 21:27 - 2015-04-11 08:49 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2015-08-05 21:26 - 2015-07-03 02:51 - 19877376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-08-05 21:26 - 2015-07-03 02:38 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-08-05 21:26 - 2015-07-03 02:20 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-08-05 21:26 - 2015-07-03 02:19 - 25193984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-08-05 21:26 - 2015-07-03 02:16 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-08-05 21:26 - 2015-07-03 02:10 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-08-05 21:26 - 2015-07-03 01:53 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-08-05 21:26 - 2015-07-03 01:49 - 12855296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-08-05 21:26 - 2015-07-03 01:42 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-08-05 21:26 - 2015-07-03 01:25 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-08-05 21:26 - 2015-07-03 00:50 - 14453248 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-08-05 21:26 - 2015-07-03 00:29 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-08-05 21:26 - 2015-07-02 02:26 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-08-05 21:26 - 2015-07-02 02:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-08-05 21:26 - 2015-07-02 02:19 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-08-05 21:26 - 2015-07-02 02:19 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-08-05 21:26 - 2015-07-02 02:19 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-08-05 21:26 - 2015-07-02 02:19 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-08-05 21:26 - 2015-07-02 02:19 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-08-05 21:26 - 2015-07-02 02:19 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-08-05 21:26 - 2015-07-02 02:19 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-08-05 21:26 - 2015-07-02 02:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-08-05 21:26 - 2015-07-02 02:19 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-08-05 21:26 - 2015-07-02 02:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-08-05 21:26 - 2015-07-02 02:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-08-05 21:26 - 2015-07-02 02:18 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-08-05 21:26 - 2015-07-02 02:18 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-08-05 21:26 - 2015-07-02 02:17 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-08-05 21:26 - 2015-07-02 02:17 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-08-05 21:26 - 2015-07-02 02:13 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-08-05 21:26 - 2015-07-02 02:13 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-08-05 21:26 - 2015-07-02 02:09 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-08-05 21:26 - 2015-07-02 02:00 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-08-05 21:26 - 2015-07-02 02:00 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-08-05 21:26 - 2015-07-02 02:00 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-08-05 21:26 - 2015-07-02 02:00 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-08-05 21:26 - 2015-07-02 02:00 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-08-05 21:26 - 2015-07-02 02:00 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-08-05 21:26 - 2015-07-02 02:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-08-05 21:26 - 2015-07-02 02:00 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-08-05 21:26 - 2015-07-02 02:00 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-08-05 21:26 - 2015-07-02 01:59 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-08-05 21:26 - 2015-07-02 01:59 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-08-05 21:26 - 2015-07-02 01:59 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-08-05 21:26 - 2015-07-02 01:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-08-05 21:26 - 2015-07-02 01:56 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-08-05 21:26 - 2015-07-02 01:54 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-08-05 21:26 - 2015-07-02 00:57 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-08-05 21:26 - 2015-07-02 00:56 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-08-05 21:26 - 2015-07-02 00:56 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-08-05 21:26 - 2015-06-21 01:18 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-08-05 21:26 - 2015-06-21 00:38 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-08-05 21:26 - 2015-04-18 08:40 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-08-05 21:26 - 2015-04-18 08:26 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-08-05 21:26 - 2015-03-10 08:55 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-08-05 21:26 - 2015-03-10 08:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-08-05 21:26 - 2015-03-10 08:38 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-08-05 21:26 - 2015-03-10 08:35 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-08-05 21:26 - 2015-02-13 10:56 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-08-05 21:26 - 2015-02-13 10:52 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-08-05 21:25 - 2015-05-25 23:54 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-08-05 21:25 - 2015-05-25 23:51 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 01255424 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-08-05 21:25 - 2015-05-25 23:49 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-08-05 21:25 - 2015-05-25 23:48 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-08-05 21:25 - 2015-05-25 23:48 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-08-05 21:25 - 2015-05-25 23:48 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-08-05 21:25 - 2015-05-25 23:48 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-08-05 21:25 - 2015-05-25 23:48 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-08-05 21:25 - 2015-05-25 23:48 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-08-05 21:25 - 2015-05-25 23:48 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-08-05 21:25 - 2015-05-25 23:48 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-08-05 21:25 - 2015-05-25 23:48 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-08-05 21:25 - 2015-05-25 23:48 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-08-05 21:25 - 2015-05-25 23:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:37 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-08-05 21:25 - 2015-05-25 23:37 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-08-05 21:25 - 2015-05-25 23:34 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-08-05 21:25 - 2015-05-25 23:31 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-08-05 21:25 - 2015-05-25 23:31 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-08-05 21:25 - 2015-05-25 23:31 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-08-05 21:25 - 2015-05-25 23:31 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-08-05 21:25 - 2015-05-25 23:31 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-08-05 21:25 - 2015-05-25 23:30 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-08-05 21:25 - 2015-05-25 23:30 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-08-05 21:25 - 2015-05-25 23:30 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-08-05 21:25 - 2015-05-25 23:30 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-08-05 21:25 - 2015-05-25 23:30 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-08-05 21:25 - 2015-05-25 23:30 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-08-05 21:25 - 2015-05-25 23:29 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-08-05 21:25 - 2015-05-25 23:29 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-08-05 21:25 - 2015-05-25 23:29 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 23:25 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 22:30 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-08-05 21:25 - 2015-05-25 22:20 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-08-05 21:25 - 2015-05-25 22:20 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-08-05 21:25 - 2015-05-25 22:18 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 22:18 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 22:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-08-05 21:25 - 2015-05-25 22:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-08-05 21:25 - 2015-04-20 08:47 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-08-05 21:25 - 2015-04-20 08:47 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-08-05 21:25 - 2015-04-20 08:26 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-08-05 21:24 - 2015-06-16 03:20 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-08-05 21:24 - 2015-06-16 03:15 - 03242496 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-08-05 21:24 - 2015-06-16 03:15 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-08-05 21:24 - 2015-06-16 03:15 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2015-08-05 21:24 - 2015-06-16 03:15 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-08-05 21:24 - 2015-06-16 03:14 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-08-05 21:24 - 2015-06-16 03:13 - 02364416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-08-05 21:24 - 2015-06-16 03:13 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-08-05 21:24 - 2015-06-16 03:13 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2015-08-05 21:24 - 2015-06-16 03:12 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-08-05 21:24 - 2015-06-16 03:12 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2015-08-05 21:24 - 2015-06-16 03:07 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2015-08-05 21:23 - 2015-02-03 09:04 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-08-05 21:23 - 2015-02-03 09:04 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-08-05 21:23 - 2015-02-03 09:03 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-08-05 21:23 - 2015-02-03 09:01 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-08-05 21:23 - 2015-02-03 09:01 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-08-05 21:23 - 2015-02-03 09:00 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-08-05 21:23 - 2015-02-03 09:00 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-08-05 21:23 - 2015-02-03 09:00 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-08-05 21:23 - 2015-02-03 09:00 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-08-05 21:23 - 2015-02-03 09:00 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-08-05 21:23 - 2015-02-03 09:00 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-08-05 21:23 - 2015-02-03 09:00 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-08-05 21:23 - 2015-02-03 08:59 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-08-05 21:23 - 2015-02-03 08:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-08-05 21:23 - 2015-02-03 08:49 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-08-05 21:23 - 2015-02-03 08:42 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2015-08-05 21:23 - 2015-02-03 08:42 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-08-05 21:23 - 2015-02-03 08:41 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-08-05 21:23 - 2015-02-03 08:41 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-08-05 21:23 - 2015-02-03 08:39 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-08-05 21:23 - 2015-02-03 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-08-05 21:23 - 2014-11-01 03:54 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-08-05 21:23 - 2014-06-28 05:51 - 00532176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2015-08-05 21:23 - 2014-06-28 05:51 - 00457400 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2015-08-05 21:22 - 2015-01-29 08:49 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-08-05 21:22 - 2015-01-29 08:32 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-08-05 21:21 - 2015-07-09 23:28 - 03154944 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-08-05 21:21 - 2015-07-09 23:28 - 02603008 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-08-05 21:21 - 2015-07-09 23:28 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-08-05 21:21 - 2015-07-09 23:28 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-08-05 21:21 - 2015-07-09 23:28 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-08-05 21:21 - 2015-07-09 23:28 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-08-05 21:21 - 2015-07-09 23:28 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-08-05 21:21 - 2015-07-09 23:28 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-08-05 21:21 - 2015-07-09 23:28 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-08-05 21:21 - 2015-07-09 23:28 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-08-05 21:21 - 2015-07-09 23:28 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-08-05 21:21 - 2015-07-09 23:13 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-08-05 21:21 - 2015-07-09 23:13 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-08-05 21:21 - 2015-07-09 23:13 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-08-05 21:21 - 2015-07-09 23:13 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-08-05 21:21 - 2015-07-09 23:12 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-08-05 21:21 - 2015-04-29 23:52 - 14635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-08-05 21:21 - 2015-03-04 10:11 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-08-05 21:21 - 2015-03-04 10:11 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-08-05 21:21 - 2015-03-04 10:11 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-08-05 21:21 - 2015-03-04 10:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-08-05 21:21 - 2015-03-04 09:41 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-08-05 21:21 - 2015-03-04 09:40 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-08-05 21:21 - 2015-03-04 09:40 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-08-05 21:20 - 2015-04-29 23:51 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-08-05 21:20 - 2015-04-29 23:51 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-08-05 21:20 - 2015-04-29 23:51 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-08-05 21:20 - 2015-04-29 23:49 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-08-05 21:20 - 2015-04-29 23:37 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-08-05 21:20 - 2015-04-29 23:37 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-08-05 21:20 - 2015-04-29 23:37 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-08-05 21:20 - 2015-04-29 23:37 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-08-05 21:20 - 2015-04-29 23:35 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-08-05 21:20 - 2015-04-28 00:53 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-08-05 21:20 - 2015-04-28 00:53 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-08-05 21:20 - 2015-04-28 00:53 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-08-05 21:20 - 2015-04-28 00:53 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-08-05 21:20 - 2015-04-28 00:35 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-08-05 21:20 - 2015-04-28 00:34 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-08-05 21:20 - 2015-04-28 00:34 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-08-05 21:20 - 2015-04-28 00:34 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-08-05 21:20 - 2014-11-26 09:23 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-08-05 21:20 - 2014-11-26 09:02 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-08-05 21:19 - 2015-07-25 23:37 - 00017856 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-08-05 21:19 - 2015-07-25 23:34 - 00765440 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-08-05 21:19 - 2015-07-25 23:34 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-08-05 21:19 - 2015-07-25 23:33 - 01085440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-08-05 21:19 - 2015-07-25 23:33 - 00433664 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-08-05 21:19 - 2015-07-25 23:33 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-08-05 21:19 - 2015-07-25 23:33 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-08-05 21:19 - 2015-07-25 23:25 - 01145856 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-08-05 21:19 - 2015-07-15 08:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-08-05 21:19 - 2015-07-15 08:49 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-08-05 21:19 - 2015-07-15 08:49 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-08-05 21:19 - 2015-07-15 08:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-08-05 21:19 - 2015-07-15 08:25 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-08-05 21:19 - 2015-07-15 08:25 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-08-05 21:19 - 2015-07-15 08:25 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-08-05 21:19 - 2015-07-15 08:24 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-08-05 21:19 - 2015-07-15 07:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-08-05 21:19 - 2015-07-15 07:22 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-08-05 21:19 - 2015-06-04 01:46 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-08-05 21:19 - 2015-06-04 01:46 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-08-05 21:19 - 2015-04-08 08:59 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-08-05 21:19 - 2015-04-08 08:44 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-08-05 21:19 - 2015-02-25 08:48 - 00754688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-08-05 21:19 - 2015-02-18 12:36 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-08-05 21:19 - 2015-02-18 12:34 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-08-05 21:18 - 2015-07-04 23:37 - 02087424 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-08-05 21:18 - 2015-07-04 23:18 - 01414656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-08-05 21:18 - 2015-06-25 14:27 - 03207168 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-08-05 21:18 - 2015-04-24 23:47 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-08-05 21:18 - 2015-04-24 23:26 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2015-08-05 21:15 - 2014-12-11 23:17 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-08-05 21:09 - 2015-02-03 09:01 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-08-05 21:09 - 2015-02-03 08:42 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-08-05 21:08 - 2015-04-13 08:58 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-08-05 21:08 - 2014-12-19 07:16 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-08-05 21:07 - 2015-06-17 23:17 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-08-05 21:07 - 2015-06-17 23:07 - 00312320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-08-05 21:07 - 2015-01-17 08:18 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-08-05 21:07 - 2015-01-17 08:00 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-08-05 21:07 - 2014-12-19 08:36 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-08-05 21:07 - 2014-12-06 09:47 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-08-05 21:07 - 2014-12-06 09:20 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-08-05 21:07 - 2014-12-06 09:20 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-08-05 21:07 - 2014-10-04 07:40 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-08-05 21:07 - 2014-10-04 07:12 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-08-05 21:07 - 2014-10-04 07:12 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2015-08-05 21:05 - 2015-03-04 10:25 - 00367552 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-08-05 21:05 - 2015-03-04 10:11 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-08-05 21:05 - 2015-03-04 09:40 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2015-08-05 21:05 - 2015-02-04 08:46 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-08-05 21:05 - 2015-02-04 08:24 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-08-05 21:05 - 2015-02-03 09:01 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-08-05 21:05 - 2015-02-03 08:42 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-08-05 21:05 - 2014-12-08 08:39 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-08-05 21:05 - 2014-12-08 08:16 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-08-30 20:29 - 2012-02-05 04:42 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-08-30 20:29 - 2012-02-05 04:42 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-08-30 20:28 - 2014-09-30 23:37 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-08-30 20:25 - 2014-09-30 23:19 - 01254245 _____ C:\Windows\WindowsUpdate.log
2015-08-30 20:22 - 2015-01-20 22:09 - 00000000 ___RD C:\Users\Tab\Google Drive
2015-08-30 20:22 - 2014-09-30 23:37 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-08-30 20:22 - 2009-07-14 10:39 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-08-30 20:22 - 2009-07-14 10:38 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-08-30 20:17 - 2015-06-08 21:52 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-08-30 20:00 - 2014-11-29 12:16 - 00000000 ____D C:\Users\Tab\AppData\Roaming\Skype
2015-08-30 15:54 - 2014-10-20 22:08 - 00000000 ____D C:\Users\Tab\Desktop\movies
2015-08-30 15:54 - 2009-07-14 10:27 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-08-30 15:23 - 2014-09-30 23:37 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-08-30 15:23 - 2014-09-30 23:37 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-08-30 15:09 - 2009-07-14 10:15 - 00022624 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-08-30 15:09 - 2009-07-14 10:15 - 00022624 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-08-30 00:09 - 2015-01-03 14:21 - 00000000 ____D C:\Users\Tab\AppData\Roaming\vlc
2015-08-30 00:09 - 2014-10-07 16:49 - 00000000 ____D C:\Users\Tab\AppData\Local\CrashDumps
2015-08-29 22:22 - 2014-09-30 23:23 - 00003910 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{F5CB8745-DB0A-4F02-B88A-9FA5BEE4236A}
2015-08-29 19:59 - 2014-10-01 11:24 - 00041984 _____ (Intel Corporation) C:\Windows\system32\Drivers\USB3Ver.dll
2015-08-29 19:59 - 2011-02-11 00:53 - 00000000 ____D C:\SWSetup
2015-08-29 19:41 - 2009-07-14 08:50 - 00000000 ____D C:\Windows\system32\NDF
2015-08-29 11:55 - 2009-07-14 08:50 - 00000000 ____D C:\Windows\rescache
2015-08-28 21:49 - 2014-10-03 09:30 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2015-08-21 23:24 - 2015-06-05 20:45 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-08-20 12:26 - 2015-01-20 22:08 - 00002042 _____ C:\Users\Public\Desktop\Google Slides.lnk
2015-08-20 12:26 - 2015-01-20 22:08 - 00002040 _____ C:\Users\Public\Desktop\Google Sheets.lnk
2015-08-20 12:26 - 2015-01-20 22:08 - 00002030 _____ C:\Users\Public\Desktop\Google Docs.lnk
2015-08-20 12:26 - 2015-01-20 22:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-08-18 16:15 - 2014-09-30 23:19 - 00000000 ____D C:\Users\Tab
2015-08-18 15:25 - 2009-07-14 10:43 - 00785366 _____ C:\Windows\system32\PerfStringBackup.INI
2015-08-10 12:39 - 2009-07-14 08:50 - 00000000 ____D C:\Windows\AppCompat
2015-08-07 11:24 - 2014-10-01 00:54 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-08-07 11:24 - 2014-10-01 00:54 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-08-07 11:24 - 2009-07-14 10:15 - 00408584 _____ C:\Windows\system32\FNTCACHE.DAT
2015-08-05 22:36 - 2014-12-20 13:58 - 00000000 ____D C:\Windows\system32\appraiser
2015-08-05 22:36 - 2014-10-05 13:14 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-08-05 22:36 - 2009-07-14 08:50 - 00000000 ____D C:\Windows\SysWOW64\Dism
2015-08-05 22:36 - 2009-07-14 08:50 - 00000000 ____D C:\Windows\system32\Dism
2015-08-05 22:36 - 2009-07-14 08:50 - 00000000 ____D C:\Windows\system32\AdvancedInstallers
2015-08-05 22:36 - 2009-07-14 08:50 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-08-05 22:27 - 2015-03-29 20:55 - 00002117 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2015-08-05 22:27 - 2015-03-29 20:55 - 00001945 _____ C:\Windows\epplauncher.mif
2015-08-05 22:26 - 2015-03-29 20:55 - 00000000 ____D C:\Program Files\Microsoft Security Client
2015-08-05 22:26 - 2015-03-29 20:55 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2015-08-05 22:20 - 2014-11-27 10:37 - 00769768 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2015-08-05 22:18 - 2014-09-30 23:30 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-08-05 22:14 - 2009-07-14 08:04 - 00000478 _____ C:\Windows\win.ini
2015-08-05 21:55 - 2014-11-29 13:40 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-08-05 21:55 - 2012-02-05 04:54 - 00000000 ____D C:\ProgramData\Skype
2015-08-05 21:47 - 2014-10-01 00:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-08-05 21:43 - 2014-11-27 08:48 - 00000000 ____D C:\Windows\system32\MRT
 
==================== Files in the root of some directories =======
 
2014-11-29 13:45 - 2015-03-15 17:25 - 0002794 _____ () C:\Users\Tab\AppData\Local\mbt-actwiz.log
 
Some files in TEMP:
====================
C:\Users\Tab\AppData\Local\Temp\Extract.exe
C:\Users\Tab\AppData\Local\Temp\SP61721.exe
C:\Users\Tab\AppData\Local\Temp\sqlite3.dll
 
 
==================== Bamital & volsnap =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2015-08-24 22:44
 
==================== End of FRST.txt ============================
 
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version:28-08-2015
Ran by Tab (2015-08-30 20:29:05)
Running from C:\Users\Tab\Downloads
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-1206459012-1669690168-1176892122-500 - Administrator - Disabled)
Guest (S-1-5-21-1206459012-1669690168-1176892122-501 - Limited - Disabled)
Tab (S-1-5-21-1206459012-1669690168-1176892122-1000 - Administrator - Enabled) => C:\Users\Tab
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
Adobe Flash Player 11 ActiveX 64-bit (HKLM\...\Adobe Flash Player ActiveX) (Version: 11.2.202.160 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.3.633 - Adobe Systems, Inc.)
AMD Catalyst Install Manager (HKLM\...\{51F9B09B-2FE4-8B3A-628A-0C0654E253AF}) (Version: 3.0.859.0 - Advanced Micro Devices, Inc.)
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
BitTorrent (HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\...\BitTorrent) (Version: 7.9.3.40299 - BitTorrent Inc.)
Blackhawk Striker 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.06 - Piriform)
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
CyberLink PowerDVD (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4.3516 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.2.4725 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dora's World Adventure (x32 Version: 2.2.0.95 - WildTangent) Hidden
ESU for Microsoft Windows 7 SP1 (HKLM-x32\...\{768A6276-5822-489C-8A2B-67190F745655}) (Version: 4.1.2 - Hewlett-Packard)
Evernote v. 4.5.2 (HKLM-x32\...\{8CE152BA-1D16-11E1-867D-984BE15F174E}) (Version: 4.5.2.5904 - Evernote Corp.)
Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Farmscapes (x32 Version: 2.2.0.98 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Final Drive Fury (x32 Version: 2.2.0.95 - WildTangent) Hidden
GoGear SA3MXX Device Manager (HKLM-x32\...\{200F62A0-CB7C-4F57-8E79-45D92E901DA2}) (Version: 0.1 - Philips)
GoGear SA3MXX Device Manager (x32 Version: 0.1 - Philips) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 44.0.2403.157 - Google Inc.)
Google Drive (HKLM-x32\...\{12ADFB82-D5A3-43E4-B2F4-FCD9B690315B}) (Version: 1.24.9931.5480 - Google, Inc.)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.28.13 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
Hoyle Card Games (x32 Version: 2.2.0.95 - WildTangent) Hidden
HP 3D DriveGuard (HKLM\...\{54CE68A8-4F2D-4328-B1F7-D6C720405F7F}) (Version: 4.2.9.1 - Hewlett-Packard Company)
HP CoolSense (HKLM-x32\...\{11AF9A96-6D83-4C3B-8DCB-16EA2A358E3F}) (Version: 2.10.51 - Hewlett-Packard Company)
HP Documentation (HKLM-x32\...\{EDA2B6DE-C67C-4FD7-AF6A-9D79E002707C}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)
HP Launch Box (HKLM\...\{5A847522-375C-4D05-BD3D-88C450CC047F}) (Version: 1.1.5 - Hewlett-Packard Company)
HP On Screen Display (HKLM-x32\...\{ED1BD69A-07E3-418C-91F1-D856582581BF}) (Version: 1.3.5 - Hewlett-Packard Company)
HP Power Manager (HKLM-x32\...\{D8BCE5B9-67CF-4F3F-93AE-3ACC754C72EB}) (Version: 1.4.7 - Hewlett-Packard Company)
HP Quick Launch (HKLM-x32\...\{53B17A98-5BF0-40BC-AAFF-850A357975AC}) (Version: 2.7.2 - Hewlett-Packard Company)
HP Security Assistant (HKLM\...\{ED6CD3AC-616B-4B20-BCF3-6E637B92A5AD}) (Version: 3.0.4 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{F5E7D9AF-60F6-4A30-87E3-4EA94D322CE1}) (Version: 9.0.15109.3899 - Hewlett-Packard Company)
HP Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.2.14901.3869 - Hewlett-Packard Company)
HP Software Framework (HKLM-x32\...\{675D093B-815D-47FD-AB2C-192EC751E8E2}) (Version: 4.6.10.1 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6381.0 - IDT)
Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel® Display Audio Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 6.14.00.3090 - Intel Corporation)
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.0.1351 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)
Intel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.1.209 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{6199B534-A1B6-46ED-873B-97B0ECF8F81E}) (Version: 1.23.216.0 - Intel Corporation)
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Jewel Quest Mysteries: The Seventh Gate Collector's Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
KeyScrambler (HKLM-x32\...\KeyScrambler) (Version: 3.5.0.0 - QFX Software Corporation)
Letters from Nowhere 2 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Luxor HD (x32 Version: 2.2.0.98 - WildTangent) Hidden
Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
MiniTool Partition Wizard Home Edition 8.1.1 (HKLM-x32\...\{05D996FA-ADCB-4D23-BA3C-A7C184A8FAC6}_is1) (Version:  - MiniTool Solution Ltd.)
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
Poker Superstars III (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Polar Golfer (x32 Version: 2.2.0.98 - WildTangent) Hidden
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
Ralink Motorola BC8 Bluetooth 3.0+HS Adapter (HKLM\...\1DF1F719-D43A-46E8-950F-65A8D96C678A.MBT_is1) (Version: 3.0.43.307 - Motorola Solutions, Inc.)
Ralink RT5390 802.11b/g/n WiFi Adapter (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 5.0.25.0 - Mediatek)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7601.29004 - Realtek Semiconductor Corp.)
RollerCoaster Tycoon 3: Platinum (x32 Version: 2.2.0.98 - WildTangent) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.4.0.9058 - Microsoft Corporation)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.27.1 - Synaptics Incorporated)
The Treasures of Mystery Island: The Ghost Ship (x32 Version: 2.2.0.98 - WildTangent) Hidden
Torchlight (x32 Version: 2.2.0.98 - WildTangent) Hidden
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WildTangent Games App (HP Games) (x32 Version: 4.0.5.32 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Phone app for desktop (HKLM-x32\...\{5F71448B-88EB-4357-9A98-8658D4C49C48}) (Version: 1.1.2726.0 - Microsoft Corporation)
WordWeb (HKLM-x32\...\WordWeb) (Version: 7 - WordWeb Software)
Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== Restore Points =========================
 
11-07-2015 15:01:43 Windows Update
17-07-2015 20:25:30 Windows Update
30-07-2015 21:02:51 Windows Update
03-08-2015 23:03:16 Windows Update
05-08-2015 21:28:41 Windows Update
10-08-2015 12:48:16 Windows Update
18-08-2015 22:44:13 Restore Point Created by FRST
18-08-2015 23:36:26 Windows Update
24-08-2015 14:51:42 Windows Update
29-08-2015 12:20:34 Windows Update
29-08-2015 19:55:07 HPSF Applying updates
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-14 08:04 - 2009-06-11 02:30 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {002A8A22-C0C5-4442-841D-B50FB4D426A7} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {0F63B5B0-B4E1-4505-A225-E99D9169F0A9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {3B6F42C7-B62D-4A56-BEC2-332549B88AAA} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-05-09] (Piriform Ltd)
Task: {6D2A2F43-F5D9-4707-8626-5ADF15E22C66} - System32\Tasks\{4A2BA09E-A91A-4B57-A0A1-89822C41931A} => pcalua.exe -a G:\Setup.exe -d G:\
Task: {7849AEE9-00BE-4CC3-B45A-4D040BD2C868} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {9001E3A7-D220-4082-B714-797B627B6855} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-02-05] (Adobe Systems Incorporated)
Task: {983E9A3D-BB17-42DD-98A4-3F5C5FEB33CB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {B5268D40-1933-438D-969E-1966B6BE8A02} - System32\Tasks\HPCeeScheduleForTab => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {C24EAAAF-9D27-45B6-BCEE-058A7D0B61F5} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
Task: {C60AF23E-962B-4FD0-8E8F-FF1BADCD4E3A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
Task: {E95399B7-F1AF-4DDE-B1A7-5A4B3410EEA7} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-11-29] (CyberLink)
Task: {EFB8256D-C4CA-4963-B388-4DE28068826F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForTab.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
 
==================== Loaded Modules (Whitelisted) ==============
 
2014-10-01 11:25 - 2011-12-17 02:07 - 00128280 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe
2013-04-04 01:09 - 2013-04-04 01:09 - 04300432 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 15:23 - 2010-10-20 15:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2012-01-06 06:54 - 2012-01-06 06:54 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2011-12-20 12:04 - 2011-12-20 12:04 - 00108880 _____ () C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe
2012-01-18 11:04 - 2012-01-18 11:04 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-12-27 04:11 - 2011-12-27 04:11 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2013-04-04 01:09 - 2013-04-04 01:09 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 15:45 - 2010-10-20 15:45 - 08801120 _____ () C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2015-08-30 20:22 - 2015-08-30 20:22 - 00098816 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\win32api.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00110080 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\pywintypes27.dll
2015-08-30 20:22 - 2015-08-30 20:22 - 00364544 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\pythoncom27.dll
2015-08-30 20:22 - 2015-08-30 20:22 - 00045568 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\_socket.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 01161216 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\_ssl.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00320512 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\win32com.shell.shell.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00713216 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\_hashlib.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 01176576 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\wx._core_.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00806400 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\wx._gdi_.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00816128 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\wx._windows_.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 01067008 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\wx._controls_.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00733184 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\wx._misc_.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00682496 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\pysqlite2._sqlite.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00087552 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\_ctypes.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00119808 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\win32file.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00108544 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\win32security.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00007168 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\hashobjs_ext.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00068096 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\usb_ext.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00167936 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\win32gui.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00018432 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\win32event.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00128512 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\_elementtree.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00127488 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\pyexpat.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00013824 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\common.time34.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00036864 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\_psutil_windows.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00038912 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\win32inet.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00011264 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\win32crypt.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00077312 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\wx._html2.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00027136 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\_multiprocessing.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00020480 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\_yappi.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00035840 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\win32process.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00686080 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\unicodedata.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00123392 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\wx._wizard.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00024064 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\win32pipe.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00010240 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\select.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00025600 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\win32pdh.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00525640 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\windows._lib_cacheinvalidation.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00017408 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\win32profile.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00022528 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\win32ts.pyd
2015-08-30 20:22 - 2015-08-30 20:22 - 00078848 _____ () C:\Users\Tab\AppData\Local\Temp\_MEI30642\wx._animate.pyd
2014-11-29 11:21 - 2014-11-29 11:21 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\a32af7d4063795ba02dd17d56f4502d8\IsdiInterop.ni.dll
2014-10-01 11:25 - 2011-11-30 08:30 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll
2014-10-01 11:25 - 2011-12-17 00:09 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 
==================== EXE Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Tab\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 5.152.219.53 - 5.152.219.50
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
(Currently there is no automatic fix for this section.)
 
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [{10ABE77B-A03D-446B-BF7C-E275D1BC1136}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{A848057E-F634-4F48-AEEE-39EB560B3093}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{D7454C6D-ED31-4992-9D19-FC414E442749}] => (Allow) LPort=2869
FirewallRules: [{A3E5F776-77CB-4FC7-B7E8-4A0FBF8E9514}] => (Allow) LPort=1900
FirewallRules: [{BF3DB69D-C84F-4B97-8F3E-A565FF79C80A}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{1D640359-D234-4B96-8191-1D4A35EB0005}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [{74B5B76C-8F7B-47BD-B0AB-2AA711EEC6DE}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{522183CA-D831-4984-B740-299ABA5F7C31}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{4FD348D4-6543-4AF4-8F3C-3188E83EC593}] => (Allow) C:\Users\Tab\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{9D4F4FCB-B2F9-4E2F-B346-73BAFF0F8567}] => (Allow) C:\Users\Tab\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{2443C9D0-1C6B-4618-8ADB-FAA8AB9B1529}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (08/30/2015 08:22:22 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (08/30/2015 02:38:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (08/30/2015 12:09:44 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: vlc.exe, version: 2.1.5.0, time stamp: 0x00000000
Faulting module name: ntdll.dll, version: 6.1.7601.18869, time stamp: 0x556366f2
Exception code: 0xc0000005
Fault offset: 0x000000000001883d
Faulting process id: 0x1a70
Faulting application start time: 0xvlc.exe0
Faulting application path: vlc.exe1
Faulting module path: vlc.exe2
Report Id: vlc.exe3
 
Error: (08/30/2015 12:09:22 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: vlc.exe, version: 2.1.5.0, time stamp: 0x00000000
Faulting module name: ntdll.dll, version: 6.1.7601.18869, time stamp: 0x556366f2
Exception code: 0xc0000005
Fault offset: 0x000000000001883d
Faulting process id: 0x1318
Faulting application start time: 0xvlc.exe0
Faulting application path: vlc.exe1
Faulting module path: vlc.exe2
Report Id: vlc.exe3
 
Error: (08/29/2015 11:45:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: vlc.exe, version: 2.1.5.0, time stamp: 0x00000000
Faulting module name: ntdll.dll, version: 6.1.7601.18869, time stamp: 0x556366f2
Exception code: 0xc0000005
Fault offset: 0x000000000001883d
Faulting process id: 0x14f4
Faulting application start time: 0xvlc.exe0
Faulting application path: vlc.exe1
Faulting module path: vlc.exe2
Report Id: vlc.exe3
 
Error: (08/29/2015 11:34:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: vlc.exe, version: 2.1.5.0, time stamp: 0x00000000
Faulting module name: ntdll.dll, version: 6.1.7601.18869, time stamp: 0x556366f2
Exception code: 0xc0000005
Fault offset: 0x000000000001883d
Faulting process id: 0x55c
Faulting application start time: 0xvlc.exe0
Faulting application path: vlc.exe1
Faulting module path: vlc.exe2
Report Id: vlc.exe3
 
Error: (08/29/2015 11:31:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: vlc.exe, version: 2.1.5.0, time stamp: 0x00000000
Faulting module name: ntdll.dll, version: 6.1.7601.18869, time stamp: 0x556366f2
Exception code: 0xc0000005
Fault offset: 0x000000000001883d
Faulting process id: 0xe80
Faulting application start time: 0xvlc.exe0
Faulting application path: vlc.exe1
Faulting module path: vlc.exe2
Report Id: vlc.exe3
 
Error: (08/29/2015 10:55:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: vlc.exe, version: 2.1.5.0, time stamp: 0x00000000
Faulting module name: ntdll.dll, version: 6.1.7601.18869, time stamp: 0x556366f2
Exception code: 0xc0000005
Fault offset: 0x000000000001883d
Faulting process id: 0x670
Faulting application start time: 0xvlc.exe0
Faulting application path: vlc.exe1
Faulting module path: vlc.exe2
Report Id: vlc.exe3
 
Error: (08/29/2015 10:20:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: vlc.exe, version: 2.1.5.0, time stamp: 0x00000000
Faulting module name: ntdll.dll, version: 6.1.7601.18869, time stamp: 0x556366f2
Exception code: 0xc0000005
Fault offset: 0x000000000001883d
Faulting process id: 0x144c
Faulting application start time: 0xvlc.exe0
Faulting application path: vlc.exe1
Faulting module path: vlc.exe2
Report Id: vlc.exe3
 
Error: (08/29/2015 09:56:34 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 
System errors:
=============
Error: (08/30/2015 08:20:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Windows Media Player Network Sharing Service service failed to start due to the following error: 
%%1069
 
Error: (08/30/2015 08:20:57 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: The WMPNetworkSvc service was unable to log on as NT AUTHORITY\NetworkService with the currently configured password due to the following error: 
%%50
 
To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).
 
Error: (08/30/2015 08:20:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Windows Search service failed to start due to the following error: 
%%1069
 
Error: (08/30/2015 08:20:56 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: The WSearch service was unable to log on as NT AUTHORITY\SYSTEM with the currently configured password due to the following error: 
%%50
 
To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).
 
Error: (08/30/2015 08:20:27 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Office  Source Engine service terminated unexpectedly.  It has done this 1 time(s).
 
Error: (08/30/2015 08:20:27 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Office Software Protection Platform service terminated unexpectedly.  It has done this 1 time(s).
 
Error: (08/30/2015 08:20:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Presentation Foundation Font Cache 3.0.0.0 service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 0 milliseconds: Restart the service.
 
Error: (08/30/2015 08:20:27 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Intel® Management and Security Application User Notification Service service terminated unexpectedly.  It has done this 1 time(s).
 
Error: (08/30/2015 08:20:27 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Intel® Rapid Storage Technology service terminated unexpectedly.  It has done this 1 time(s).
 
Error: (08/30/2015 08:20:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The HP Support Assistant Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.
 
 
Microsoft Office:
=========================
Error: (08/30/2015 08:22:22 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (08/30/2015 02:38:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (08/30/2015 12:09:44 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: vlc.exe2.1.5.000000000ntdll.dll6.1.7601.18869556366f2c0000005000000000001883d1a7001d0e28a09097cc4C:\Program Files\VideoLAN\VLC\vlc.exeC:\Windows\SYSTEM32\ntdll.dll5061895b-4e7d-11e5-b228-80c16e5888a3
 
Error: (08/30/2015 12:09:22 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: vlc.exe2.1.5.000000000ntdll.dll6.1.7601.18869556366f2c0000005000000000001883d131801d0e286abea53a2C:\Program Files\VideoLAN\VLC\vlc.exeC:\Windows\SYSTEM32\ntdll.dll43972391-4e7d-11e5-b228-80c16e5888a3
 
Error: (08/29/2015 11:45:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: vlc.exe2.1.5.000000000ntdll.dll6.1.7601.18869556366f2c0000005000000000001883d14f401d0e2852b59f298C:\Program Files\VideoLAN\VLC\vlc.exeC:\Windows\SYSTEM32\ntdll.dlle949b87b-4e79-11e5-b228-80c16e5888a3
 
Error: (08/29/2015 11:34:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: vlc.exe2.1.5.000000000ntdll.dll6.1.7601.18869556366f2c0000005000000000001883d55c01d0e2850489139aC:\Program Files\VideoLAN\VLC\vlc.exeC:\Windows\SYSTEM32\ntdll.dll65ea0a7c-4e78-11e5-b228-80c16e5888a3
 
Error: (08/29/2015 11:31:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: vlc.exe2.1.5.000000000ntdll.dll6.1.7601.18869556366f2c0000005000000000001883de8001d0e27faf8d3863C:\Program Files\VideoLAN\VLC\vlc.exeC:\Windows\SYSTEM32\ntdll.dllfa8f847d-4e77-11e5-b228-80c16e5888a3
 
Error: (08/29/2015 10:55:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: vlc.exe2.1.5.000000000ntdll.dll6.1.7601.18869556366f2c0000005000000000001883d67001d0e27ad55eecceC:\Program Files\VideoLAN\VLC\vlc.exeC:\Windows\SYSTEM32\ntdll.dlle39b341d-4e72-11e5-b228-80c16e5888a3
 
Error: (08/29/2015 10:20:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: vlc.exe2.1.5.000000000ntdll.dll6.1.7601.18869556366f2c0000005000000000001883d144c01d0e2759bd649c7C:\Program Files\VideoLAN\VLC\vlc.exeC:\Windows\SYSTEM32\ntdll.dll08943bac-4e6e-11e5-b228-80c16e5888a3
 
Error: (08/29/2015 09:56:34 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 
==================== Memory info =========================== 
 
Processor: Intel® Core™ i3-2350M CPU @ 2.30GHz
Percentage of memory in use: 60%
Total physical RAM: 3994.36 MB
Available physical RAM: 1576.39 MB
Total Virtual: 7986.93 MB
Available Virtual: 5679.91 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:446.15 GB) (Free:273.82 GB) NTFS ==>[system with boot components (obtained from reading drive)]
Drive d: (Recovery) (Fixed) (Total:19.31 GB) (Free:2.1 GB) NTFS ==>[system with boot components (obtained from reading drive)]
Drive e: (2013-02-13 2043) (CDROM) (Total:4.38 GB) (Free:0.55 GB) UDF
Drive f: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.08 GB) FAT32
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 794AE9E5)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=446.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=19.3 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)
 
==================== End of Addition.txt ============================

Edited by contacthasan, 30 August 2015 - 10:21 AM.


#12 nasdaq

nasdaq

  • Malware Response Team
  • 39,179 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:08 PM

Posted 30 August 2015 - 01:15 PM



Press the windows key Windows_Logo_key.gif+ r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.
Please copy the entire contents of the code box below to the a new file.


start

EmptyTemp:
CloseProcesses:

CHR Extension: (No Name) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfneciejbnaieckfgfpnobffjcdggojn [2015-08-18]
CHR HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx[/B]
C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfneciejbnaieckfgfpnobffjcdggojn

End
Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Reset Chrome...
Open Google Chrome, click on menu icon google-chrome-setting-icon.png which is located right side top of the google chrome.
 
Click "Settings" then "Show advanced settings" at the bottom of the screen.
 
Click "Reset browser settings" button.
 
Clear your cache and cookies
https://support.google.com/chromebook/answer/183083?hl=en
Select "From the beginning of time"

Restart Chrome.

How is the computer running now?

#13 contacthasan

contacthasan
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:01:38 AM

Posted 06 September 2015 - 05:26 AM

Ads are still popping up. here is the fixlog:

Fix result of Farbar Recovery Scan Tool (x64) Version:04-09-2015
Ran by Tab (2015-09-06 14:40:43) Run:3
Running from C:\Users\Tab\Downloads
Loaded Profiles: Tab (Available Profiles: Tab)
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
start
 
EmptyTemp:
CloseProcesses:
 
CHR Extension: (No Name) - C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfneciejbnaieckfgfpnobffjcdggojn [2015-08-18]
CHR HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx[/B]
C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfneciejbnaieckfgfpnobffjcdggojn
 
End
*****************
 
Processes closed successfully.
C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfneciejbnaieckfgfpnobffjcdggojn => moved successfully
"HKU\S-1-5-21-1206459012-1669690168-1176892122-1000\SOFTWARE\Google\Chrome\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh" => key removed successfully
"C:\Users\Tab\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfneciejbnaieckfgfpnobffjcdggojn" => File/Folder not found.
EmptyTemp: => 133.7 MB temporary data Removed.
 
 
The system needed a reboot.. 
 
==== End of Fixlog 14:40:48 ====


#14 nasdaq

nasdaq

  • Malware Response Team
  • 39,179 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:08 PM

Posted 06 September 2015 - 09:21 AM

If the popups are only in Chrome remove Chrome using the the instructions on this page.
https://support.google.com/chrome/answer/95319?hl=en

Before you do Export your Bookmarks
Chrome will export your bookmarks as a HTML file, which you can then import into another browser.

If you want to save your passwords as well see here: http://www.intowindows.com/how-to-backup-saved-passwords-in-google-chrome-browser/

Re-install Chrome and the Bookmarks.

<<<>>>

#15 contacthasan

contacthasan
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:01:38 AM

Posted 09 September 2015 - 10:54 AM

The pop ups appear in IE too. I removed and reinstalled Chrome but the Ads reappeared.

What now?






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users