Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

MS Security Essentials hangs on sysWOW64/perfnet.dll


  • This topic is locked This topic is locked
8 replies to this topic

#1 yaddow

yaddow

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:56 PM

Posted 24 August 2015 - 09:38 AM

Hi,

 

Had a virus identified Friday by MS Security Essentials.  

 

It was called trojan win32/dorv.b!frn and it seems to be associated with FileZilla (which I use) and which I recently updated.

 

MS Security Essentials seemed to take care of it, but I found that later updating the computer with all the recent Win7 updates repeatedly hung up.

 

I was unable to do anything so i rolled back to 10 days ago and system seems better as I was able to download and install all Win7 security updates last night just fine.

 

Then I ran MSSE again and it hung up on sysWOW64/perfnet.dll after 3 hours of scanning.  Problem?  I can't tell.

 

So I resort to my old friends here at Bleeping Computer to double check things.

 

Here's my first.txt (and no addition.txt was generated - so that might tell us something right now)...

 

Standing by for next steps.

 

Thanks in advance,

 

Yaddow

 

============================

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:23-08-2015
Ran by Test (administrator) on YADDOW-E6430 (24-08-2015 10:21:19)
Running from C:\Users\Test\Downloads
Loaded Profiles: Test (Available Profiles: Test & HomeGroupUser$)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 10 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Caphyon) C:\Program Files (x86)\Caphyon\Advanced Web Ranking\Scheduler.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Marvell Semiconductor, Inc.) C:\Program Files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.1\GoogleCrashHandler.exe
(Intel® Corporation) C:\Program Files\Intel\CAM\bin\CAMService.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Projector\Epson USB Display V1.6\EMP_UDSA.exe
() C:\Program Files\Everything\Everything.exe
() C:\Program Files\Everything\Everything.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.1\GoogleCrashHandler64.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Seagate) C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedhlp.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(TechSmith Corporation) C:\Program Files (x86)\TechSmith\SnagIt 8\SnagIt32.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Apple Inc.) C:\Program Files (x86)\AirPort\APAgent.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe
(j2 Global Communications, Inc.) C:\Program Files (x86)\eFax Messenger 4.4\J2GDllCmd.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Acronis International GmbH) C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(TechSmith Corporation) C:\Program Files (x86)\TechSmith\SnagIt 8\TscHelp.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
(MadeForNet.com) C:\Program Files (x86)\HTTP Debugger\HTTPDebuggerSvc.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe
() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
(Intuit) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Seagate) C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedul2.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(TechSmith Corporation) C:\Program Files (x86)\TechSmith\SnagIt 8\SnagPriv.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\CCLibrary.exe
(Joyent, Inc) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\libs\node.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
(O2Micro International) C:\Windows\System32\o2flash.exe
() C:\Windows\SysWOW64\srvany.exe
(O2Micro.) C:\Windows\SysWOW64\SDIOAssist.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Farbar) C:\Users\Test\Downloads\FRST64(1).exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AESTFltr] => %SystemRoot%\system32\AESTFl64.exe /NoDlg
HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [708952 2013-07-08] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-08-16] (IDT, Inc.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)
HKLM\...\Run: [PrnStatusMX] => C:\Program Files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe [1240064 2012-07-04] (Marvell Semiconductor, Inc.)
HKLM\...\Run: [IntelPROSet] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [4876496 2014-06-18] (Intel® Corporation)
HKLM\...\Run: [Everything] => C:\Program Files\Everything\Everything.exe [1441792 2014-08-05] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500936 2015-07-22] (Adobe Systems Incorporated)
HKLM\...\Run: [Seagate Scheduler2 Service] => C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedhlp.exe [400384 2015-03-12] (Seagate)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170280 2015-06-29] (Apple Inc.)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [570152 2014-08-14] (Acronis)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [AirPort Base Station Agent] => C:\Program Files (x86)\AirPort\APAgent.exe [771360 2009-11-11] (Apple Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe [3499896 2014-05-08] (Adobe Systems Inc.)
HKLM-x32\...\Run: [Intuit SyncManager] => C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe [3776824 2015-03-17] (Intuit Inc. All rights reserved.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-05-15] (Apple Inc.)
HKLM-x32\...\Run: [eFax 4.4] => C:\Program Files (x86)\eFax Messenger 4.4\J2GDllCmd.exe [95744 2012-08-29] (j2 Global Communications, Inc.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)
HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150016 2008-08-20] (Hewlett-Packard)
HKLM-x32\...\Run: [EPSON_UD_START] => C:\Program Files (x86)\EPSON Projector\Epson USB Display V1.6\EMP_UD.exe [536168 2013-05-31] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2303152 2015-07-23] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-06-08] (Oracle Corporation)
HKLM-x32\...\Run: [DiscWizardMonitor.exe] => "C:\Program Files (x86)\Seagate\DiscWizard\DiscWizardMonitor.exe"
HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [691056 2015-07-20] (Acronis International GmbH)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [5343664 2015-07-20] (Acronis)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\Run: [GoogleChromeAutoLaunch_E1D46C574EBA950FEDF46817FE573EFA] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [863560 2015-08-18] (Google Inc.)
HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\Run: [Google Update] => C:\Users\Test\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2014-12-25] (Google Inc.)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-06-14] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SnagIt 8.lnk [2014-09-06]
ShortcutTarget: SnagIt 8.lnk -> C:\Program Files (x86)\TechSmith\SnagIt 8\SnagIt32.exe (TechSmith Corporation)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-07-22] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-07-22] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-07-22] ()
ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis)
GroupPolicyScripts: Group Policy detected <======= ATTENTION
GroupPolicyScripts\User: Group Policy detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: [S-1-5-21-3105234330-458141651-3949311147-1000] => :0
HKU\S-1-5-21-3105234330-458141651-3949311147-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
HKU\S-1-5-21-3105234330-458141651-3949311147-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKU\S-1-5-21-3105234330-458141651-3949311147-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3105234330-458141651-3949311147-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?ocid=U218DHP&pc=U218
SearchScopes: HKU\S-1-5-21-3105234330-458141651-3949311147-1000 -> Comcast URL = hxxp://search.xfinity.com/?cat=subweb&con=mmchrome&q={searchTerms}&cid=xfstart_tech_search
SearchScopes: HKU\S-1-5-21-3105234330-458141651-3949311147-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
BHO: SnagIt Toolbar Loader -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> C:\Program Files (x86)\TechSmith\SnagIt 8\DLLx64\SnagItBHO64.dll [2007-05-01] (TechSmith Corporation)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_51\bin\ssv.dll [2015-07-31] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-07-31] (Oracle Corporation)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
BHO-x32: SnagIt Toolbar Loader -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> C:\Program Files (x86)\TechSmith\SnagIt 8\SnagItBHO.dll [2007-05-01] (TechSmith Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\SnagIt 8\SnagItIEAddin.dll [2007-05-01] (TechSmith Corporation)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab
Handler-x32: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\BelarcAdvisor\System\BAVoilaX.dll [2013-04-16] (Belarc, Inc.)
Handler-x32: intu-help-qb8 - {CD17C364-2EC8-4929-91A9-C4839A20E909} - C:\Program Files (x86)\Intuit\QuickBooks 2015\HelpAsyncPluggableProtocol.dll [2015-03-17] (Intuit, Inc.)
Handler-x32: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\SysWOW64\mscoree.dll [2010-11-04] (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{5F59AC16-0D1B-42A4-A9F0-131475B7CA05}: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{817251EC-EE0C-4769-A974-CDFE86A9ECAD}: [DhcpNameServer] 75.75.75.75 75.75.76.76

FireFox:
========
FF ProfilePath: C:\Users\Test\AppData\Roaming\Mozilla\Firefox\Profiles\2kmoi98h.default-1434756000445
FF DefaultSearchEngine.US: Google
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-11] ()
FF Plugin: @java.com/DTPlugin,version=11.51.2 -> C:\Program Files\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll [2015-07-31] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.51.2 -> C:\Program Files\Java\jre1.8.0_51\bin\plugin2\npjp2.dll [2015-07-31] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2015-07-23] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-11] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1217157.dll [2015-02-16] (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-01-06] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-15] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll [2014-05-08] (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2015-07-23] (Adobe Systems)
FF Plugin HKU\S-1-5-21-3105234330-458141651-3949311147-1000: @citrixonline.com/appdetectorplugin -> C:\Users\Test\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2014-08-06] (Citrix Online)
FF Plugin HKU\S-1-5-21-3105234330-458141651-3949311147-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\Test\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)
FF Plugin HKU\S-1-5-21-3105234330-458141651-3949311147-1000: @talk.google.com/O1DPlugin -> C:\Users\Test\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-04-17] (Google)
FF Plugin HKU\S-1-5-21-3105234330-458141651-3949311147-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Test\AppData\Local\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-15] (Google Inc.)
FF Plugin HKU\S-1-5-21-3105234330-458141651-3949311147-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Test\AppData\Local\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-15] (Google Inc.)
FF Plugin HKU\S-1-5-21-3105234330-458141651-3949311147-1000: google.com/WidevineMediaOptimizer -> C:\Users\Test\AppData\Roaming\IDM\bin\npwidevinemediaoptimizer.dll [2014-06-09] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Test\AppData\Roaming\mozilla\plugins\npatgpc.dll [2015-06-23] (Cisco WebEx LLC)
FF Plugin ProgramFiles/Appdata: C:\Users\Test\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Test\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-04-17] (Google)
FF Extension: HTML5 YouTube Everywhere - C:\Users\Test\AppData\Roaming\Mozilla\Firefox\Profiles\2kmoi98h.default-1434756000445\Extensions\jid1-b2ybw6mPlFZm6Q@jetpack.xpi [2015-06-24]
FF Extension: Pin It button - C:\Users\Test\AppData\Roaming\Mozilla\Firefox\Profiles\2kmoi98h.default-1434756000445\Extensions\jid1-YcMV6ngYmQRA2w@jetpack.xpi [2015-07-07]
FF Extension: NoScript - C:\Users\Test\AppData\Roaming\Mozilla\Firefox\Profiles\2kmoi98h.default-1434756000445\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2015-07-14]
FF Extension: Adblock Plus - C:\Users\Test\AppData\Roaming\Mozilla\Firefox\Profiles\2kmoi98h.default-1434756000445\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-06-20]
FF Extension: Textise Add-On v3.0 - C:\Users\Test\AppData\Roaming\Mozilla\Firefox\Profiles\2kmoi98h.default-1434756000445\Extensions\{d358dc61-498f-3de1-4d99-deacebaa276f}.xpi [2015-06-24]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-05-01]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2015-01-09]

Chrome:
=======
CHR Profile: C:\Users\Test\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Test\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-04]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Test\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-01]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2014-05-08]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-05-01]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [680112 2015-07-22] (Adobe Systems Incorporated)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)
R2 AWRScheduler; C:\Program Files (x86)\Caphyon\Advanced Web Ranking\Scheduler.exe [166304 2014-05-27] (Caphyon) [File not signed]
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)
R2 CAMService; C:\Program Files\Intel\CAM\bin\CAMService.exe [1243344 2014-06-18] (Intel® Corporation)
R2 EMP_UDSA; C:\Program Files (x86)\EPSON Projector\Epson USB Display V1.6\EMP_UDSA.exe [157696 2013-05-31] (SEIKO EPSON CORPORATION) [File not signed]
R2 Everything; C:\Program Files\Everything\Everything.exe [1441792 2014-08-05] () [File not signed]
S3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [248832 2009-05-18] (Hewlett-Packard Co.) [File not signed]
R2 HTTPDebugger; C:\Program Files (x86)\HTTP Debugger\HTTPDebuggerSvc.exe [336936 2014-08-04] (MadeForNet.com)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319376 2014-10-01] (Intel Corporation)
S4 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [265936 2014-06-18] ()
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)
R2 O2FLASH; C:\Windows\system32\o2flash.exe [244328 2011-11-16] (O2Micro International)
R2 O2SDIOAssist; C:\Windows\SysWOW64\srvany.exe [8192 2003-04-18] () [File not signed]
R2 QBCFMonitorService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe [45056 2015-03-17] (Intuit) [File not signed]
S3 QBFCService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [65536 2014-12-06] (Intuit Inc.) [File not signed]
R2 QBVSS; C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe [1248256 2014-12-06] (Intuit Inc.) [File not signed]
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5491984 2015-05-20] (TeamViewer GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3816656 2014-06-18] (Intel® Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S1 EMP_MIRRUD; C:\Windows\System32\DRIVERS\EMP_MirrUD.sys [5632 2013-05-31] (Windows ® Codename Longhorn DDK provider)
R3 eppvad_simple; C:\Windows\System32\drivers\EMP_UDAU.sys [23040 2013-05-31] (SEIKO EPSON CORPORATION)
R0 file_tracker; C:\Windows\System32\DRIVERS\file_tracker.sys [296736 2015-08-14] (Acronis International GmbH)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-08-08] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
R1 netfilter2; C:\Windows\System32\drivers\netfilter2.sys [48408 2014-08-04] (Windows ® Win 7 DDK provider)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [300320 2013-12-04] (NVIDIA Corporation)
S4 snapman380; C:\Windows\System32\DRIVERS\snman380.sys [237600 2014-07-20] (Acronis)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1058632 2015-08-14] (Acronis International GmbH)
R2 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [248648 2015-08-14] (Acronis International GmbH)
S3 AESTAud; system32\drivers\AESTAu64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-08-24 09:33 - 2015-08-24 09:33 - 02173952 _____ (Farbar) C:\Users\Test\Downloads\FRST64(1).exe
2015-08-24 01:42 - 2015-07-22 20:06 - 05568960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-08-24 01:42 - 2015-07-22 20:06 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-08-24 01:42 - 2015-07-22 20:06 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-08-24 01:42 - 2015-07-22 20:03 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-08-24 01:42 - 2015-07-22 20:03 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-08-24 01:42 - 2015-07-22 20:03 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-08-24 01:42 - 2015-07-22 20:03 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-08-24 01:42 - 2015-07-22 20:03 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 01390592 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-08-24 01:42 - 2015-07-22 20:02 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-08-24 01:42 - 2015-07-22 20:02 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-08-24 01:42 - 2015-07-22 20:01 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-08-24 01:42 - 2015-07-22 20:01 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-08-24 01:42 - 2015-07-22 20:01 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-08-24 01:42 - 2015-07-22 19:58 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-08-24 01:42 - 2015-07-22 19:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:51 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-08-24 01:42 - 2015-07-22 13:57 - 03989952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-08-24 01:42 - 2015-07-22 13:57 - 03934656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-08-24 01:42 - 2015-07-22 13:54 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-08-24 01:42 - 2015-07-22 13:52 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-08-24 01:42 - 2015-07-22 13:52 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-08-24 01:42 - 2015-07-22 13:52 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-08-24 01:42 - 2015-07-22 13:52 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-08-24 01:42 - 2015-07-22 13:52 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-08-24 01:42 - 2015-07-22 13:52 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-08-24 01:42 - 2015-07-22 13:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-08-24 01:42 - 2015-07-22 13:47 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-08-24 01:42 - 2015-07-22 13:46 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 12:48 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-08-24 01:42 - 2015-07-22 12:45 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-08-24 01:42 - 2015-07-22 12:44 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-08-24 01:42 - 2015-07-22 12:44 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-08-24 01:42 - 2015-07-22 12:34 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-08-24 01:42 - 2015-07-22 12:34 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-08-24 01:42 - 2015-07-22 12:31 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 12:31 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 12:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 12:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-08-24 01:42 - 2015-06-25 06:06 - 00115136 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-08-24 01:42 - 2015-06-25 06:01 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-08-24 01:42 - 2015-06-25 06:01 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-08-24 01:42 - 2015-06-25 05:44 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-08-24 01:37 - 2015-08-13 08:34 - 19292160 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-08-24 01:37 - 2015-08-13 07:02 - 14383616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-08-24 01:37 - 2015-08-13 06:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-08-24 01:37 - 2015-08-13 06:44 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-08-24 01:13 - 2015-08-24 01:13 - 25527544 _____ C:\Users\Test\Downloads\SeaToolsforWindowsSetup.exe
2015-08-24 01:13 - 2015-08-24 01:13 - 00001442 _____ C:\Users\Public\Desktop\SeaTools for Windows.lnk
2015-08-23 19:33 - 2015-07-30 09:13 - 00124624 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-08-23 19:33 - 2015-07-30 09:13 - 00103120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-08-23 19:15 - 2015-08-23 19:15 - 00001266 _____ C:\Users\Test\Desktop\Windows Update.lnk
2015-08-23 19:10 - 2015-08-23 19:10 - 00189202 _____ C:\Users\Test\Documents\Playrific_Kids_Stories_Keyword_Discovery_20150823.xlsx
2015-08-23 18:32 - 2015-07-30 14:06 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2015-08-23 18:32 - 2015-07-30 14:06 - 01648128 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-08-23 18:32 - 2015-07-30 14:06 - 01180160 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-08-23 18:32 - 2015-07-30 14:06 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-08-23 18:32 - 2015-07-30 14:06 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-08-23 18:32 - 2015-07-30 14:06 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-08-23 18:32 - 2015-07-30 14:06 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-08-23 18:32 - 2015-07-30 13:57 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2015-08-23 18:32 - 2015-07-30 13:57 - 01251328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-08-23 18:32 - 2015-07-30 13:57 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-08-23 18:32 - 2015-07-30 13:57 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-08-23 18:32 - 2015-07-30 13:57 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-08-23 18:32 - 2015-07-30 13:55 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-08-23 18:32 - 2015-07-30 12:56 - 03208192 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-08-23 18:32 - 2015-07-30 12:52 - 00372736 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-08-23 18:32 - 2015-07-30 12:49 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-08-23 18:32 - 2015-07-16 15:12 - 06131200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-08-23 18:32 - 2015-07-16 15:12 - 00856064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2015-08-23 18:32 - 2015-07-16 15:12 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2015-08-23 18:32 - 2015-07-16 15:11 - 07077376 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-08-23 18:32 - 2015-07-16 15:11 - 01057792 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2015-08-23 18:32 - 2015-07-16 15:11 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2015-08-23 18:32 - 2015-07-15 14:15 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-08-23 18:32 - 2015-07-15 14:10 - 01743360 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2015-08-23 18:32 - 2015-07-15 14:10 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-08-23 18:32 - 2015-07-14 23:19 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\basesrv.dll
2015-08-23 18:32 - 2015-07-11 09:15 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2015-08-23 18:32 - 2015-07-01 16:49 - 00260096 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2015-08-23 18:32 - 2015-07-01 16:48 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2015-08-23 18:32 - 2015-07-01 16:30 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2015-08-23 18:32 - 2015-07-01 16:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2015-08-23 18:31 - 2015-07-25 19:18 - 02239488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-08-23 18:31 - 2015-07-25 19:18 - 01409024 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-08-23 18:31 - 2015-07-25 19:18 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-08-23 18:31 - 2015-07-25 19:18 - 00601600 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-08-23 18:31 - 2015-07-25 19:18 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-08-23 18:31 - 2015-07-25 19:18 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-08-23 18:31 - 2015-07-25 19:18 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-08-23 18:31 - 2015-07-25 19:17 - 15415808 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-08-23 18:31 - 2015-07-25 19:17 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-08-23 18:31 - 2015-07-25 19:17 - 02657280 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-08-23 18:31 - 2015-07-25 19:17 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-08-23 18:31 - 2015-07-25 19:17 - 00856064 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-08-23 18:31 - 2015-07-25 19:17 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-08-23 18:31 - 2015-07-25 19:17 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-08-23 18:31 - 2015-07-25 19:17 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-08-23 18:31 - 2015-07-25 19:17 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-08-23 18:31 - 2015-07-25 19:17 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2015-08-23 18:31 - 2015-07-25 19:17 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-08-23 18:31 - 2015-07-25 19:17 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-08-23 18:31 - 2015-07-25 19:17 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-08-23 18:31 - 2015-07-25 16:24 - 01763328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-08-23 18:31 - 2015-07-25 16:24 - 01181696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-08-23 18:31 - 2015-07-25 16:24 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-08-23 18:31 - 2015-07-25 16:24 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-08-23 18:31 - 2015-07-25 16:24 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-08-23 18:31 - 2015-07-25 16:24 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 13774848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 02865664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 02056704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 01441280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-08-23 18:31 - 2015-07-25 16:23 - 00690176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-08-23 18:31 - 2015-07-25 14:17 - 00361984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-08-23 18:31 - 2015-07-25 14:09 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-08-23 18:31 - 2015-07-25 13:52 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2015-08-23 18:31 - 2015-07-25 13:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2015-08-23 17:04 - 2015-08-23 17:11 - 00017859 _____ C:\Users\Test\Documents\Playrific_gWMT_CLICKS_IMPRESSIONS_HISTORIC_WWW_non-WWW_20150823.xlsx
2015-08-23 15:49 - 2015-07-28 16:09 - 00017344 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-08-23 15:49 - 2015-07-28 16:05 - 01116672 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-08-23 15:49 - 2015-07-28 16:05 - 00774656 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-08-23 15:49 - 2015-07-28 16:05 - 00743424 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-08-23 15:49 - 2015-07-28 16:05 - 00437760 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-08-23 15:49 - 2015-07-28 16:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-08-23 15:49 - 2015-07-28 16:05 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-08-23 15:49 - 2015-07-28 15:55 - 01148416 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-08-23 15:49 - 2015-07-14 23:19 - 02004992 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2015-08-23 15:49 - 2015-07-14 23:19 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-08-23 15:49 - 2015-07-14 23:14 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2015-08-23 15:49 - 2015-07-14 23:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-08-23 15:49 - 2015-07-14 22:55 - 01390592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2015-08-23 15:49 - 2015-07-14 22:55 - 01241088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-08-23 15:49 - 2015-07-14 22:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2015-08-23 15:49 - 2015-07-14 22:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-08-23 15:49 - 2015-07-10 13:51 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-08-23 15:49 - 2015-07-10 13:34 - 12875776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-08-23 15:49 - 2015-07-09 13:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\notepad.exe
2015-08-23 15:49 - 2015-07-09 13:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\notepad.exe
2015-08-23 15:49 - 2015-07-09 13:42 - 00179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
2015-08-23 15:44 - 2015-07-20 14:12 - 03154944 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-08-23 15:44 - 2015-07-20 14:12 - 02606080 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-08-23 15:44 - 2015-07-20 14:12 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-08-23 15:44 - 2015-07-20 14:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-08-23 15:44 - 2015-07-20 14:12 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-08-23 15:44 - 2015-07-20 14:12 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-08-23 15:44 - 2015-07-20 14:12 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-08-23 15:44 - 2015-07-20 14:12 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-08-23 15:44 - 2015-07-20 14:12 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-08-23 15:44 - 2015-07-20 14:12 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-08-23 15:44 - 2015-07-20 14:12 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-08-23 15:44 - 2015-07-20 13:56 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-08-23 15:44 - 2015-07-20 13:56 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-08-23 15:44 - 2015-07-20 13:56 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-08-23 15:44 - 2015-07-20 13:56 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-08-23 15:44 - 2015-07-20 13:56 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-08-23 14:18 - 2015-07-14 23:17 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-08-23 14:18 - 2015-07-14 22:54 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2015-08-23 14:18 - 2015-07-09 13:58 - 01632256 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-08-23 14:18 - 2015-07-09 13:58 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2015-08-23 14:18 - 2015-07-09 13:42 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-08-23 14:18 - 2015-07-09 13:42 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2015-08-23 00:34 - 2015-08-23 00:34 - 00000000 ____D C:\Users\Test\Downloads\openhardwaremonitor-v0.7.1-beta
2015-08-23 00:33 - 2015-08-23 00:33 - 00511764 _____ C:\Users\Test\Downloads\openhardwaremonitor-v0.7.1-beta.zip
2015-08-22 23:33 - 2015-08-22 23:33 - 00000052 _____ C:\Users\Test\Documents\trojan_20150822.txt
2015-08-22 19:17 - 2015-08-24 01:08 - 00000219 _____ C:\Users\Test\Documents\wordpress_for_playrific.txt
2015-08-22 19:17 - 2015-08-22 19:17 - 00000010 _____ C:\Users\Test\Documents\mdbc_Yeat_2015.txt
2015-08-21 21:18 - 2015-08-22 13:22 - 00010682 _____ C:\Users\Test\Documents\Playrific_Production_AdWords_Draft_20150821.xlsx
2015-08-21 12:16 - 2015-08-22 13:49 - 00000460 _____ C:\Users\Test\Documents\playrific_beth_marcus_20150821.txt
2015-08-21 11:45 - 2015-08-21 11:45 - 00352326 _____ C:\Users\Test\Documents\bugreport.txt
2015-08-21 11:24 - 2015-08-21 11:24 - 00004885 _____ C:\Users\Test\Documents\scrapebox_2.xlsx
2015-08-21 11:22 - 2015-08-21 11:22 - 00004973 _____ C:\Users\Test\Documents\scrapebox_1.xlsx
2015-08-21 11:18 - 2015-08-21 11:18 - 00000084 _____ C:\Users\Test\Documents\scrapebox_google_proxies.txt
2015-08-21 11:17 - 2015-08-21 11:31 - 00000000 ____D C:\Program Files\Scrapebox
2015-08-21 10:52 - 2015-08-21 11:28 - 00000324 _____ C:\Users\Test\Documents\scrapebox_cheats.txt
2015-08-21 10:48 - 2015-08-21 11:31 - 00000036 _____ C:\Users\Test\Documents\scrapebox.id
2015-08-21 10:18 - 2015-08-21 10:18 - 00000000 _____ C:\Users\Test\Documents\flagrestart.dat
2015-08-21 09:36 - 2015-08-23 15:28 - 00000000 ____D C:\Users\Test\Documents\Configuration
2015-08-21 09:36 - 2015-08-23 15:28 - 00000000 ____D C:\Users\Test\Documents\Addons
2015-08-21 09:36 - 2015-08-21 11:45 - 00000000 ____D C:\Users\Test\Documents\Harvester_Sessions
2015-08-21 09:36 - 2015-08-21 09:36 - 00000000 ____D C:\Users\Test\Documents\TempFolder
2015-08-21 09:36 - 2015-08-21 09:36 - 00000000 ____D C:\Users\Test\Documents\Plugins
2015-08-21 09:36 - 2015-08-21 09:36 - 00000000 ____D C:\Users\Test\Documents\Grabbed Emails
2015-08-21 09:36 - 2015-08-21 09:36 - 00000000 ____D C:\Users\Test\Documents\Grabbed Data
2015-08-21 09:36 - 2015-08-21 09:36 - 00000000 ____D C:\Users\Test\Documents\Favorite Automator Jobs
2015-08-21 09:36 - 2015-08-21 09:36 - 00000000 ____D C:\Users\Test\Documents\Addon_Sessions
2015-08-21 09:30 - 2015-08-21 09:30 - 31893291 _____ C:\Users\Test\Downloads\scrapebox64.zip
2015-08-21 09:26 - 2015-08-21 09:26 - 00000000 ____D C:\Users\Test\Documents\Microsys
2015-08-21 09:26 - 2015-08-21 09:26 - 00000000 ____D C:\Users\Test\AppData\Roaming\Microsys
2015-08-21 09:25 - 2015-08-21 09:25 - 00000000 ____D C:\Program Files\Microsys
2015-08-21 08:55 - 2015-08-22 13:35 - 00010240 _____ C:\Users\Test\Documents\Playrific_Sprint_Scrum_Log.xlsx
2015-08-20 13:20 - 2015-08-20 13:21 - 00000199 _____ C:\Users\Test\Documents\REGEX_FILTER_FOR_REFERRAL_SPAM_20150820.txt
2015-08-19 20:30 - 2015-08-19 20:30 - 00019067 _____ C:\Users\Test\Documents\playrific_dead_brand_pages_custom_filter_2_20150819.xlsx
2015-08-19 20:21 - 2015-08-19 20:27 - 06505624 _____ (Tim Kosse) C:\Users\Test\Downloads\FileZilla_3.13.0_win64-setup.exe
2015-08-19 12:14 - 2015-08-22 13:22 - 00804432 _____ C:\Users\Test\Documents\playrific_demographics_by_page_w_summary_20150819.xlsx
2015-08-19 10:21 - 2015-08-21 14:53 - 00046180 _____ C:\Users\Test\Documents\playrific_demographics_take_1_20150819.xlsx
2015-08-18 21:59 - 2015-08-21 08:54 - 00425072 _____ C:\Users\Test\Documents\playrific_t_landing_pages_with_keywords_With_DWELL_FLOW_20150818.xlsx
2015-08-18 17:26 - 2015-08-21 08:16 - 00001478 _____ C:\Users\Test\Documents\Sprit_story_for_playrific_SEO_21050821.txt
2015-08-18 16:39 - 2015-08-22 13:47 - 00089465 _____ C:\Users\Test\Documents\Dead_End_Tags_custom_filter_2_for_KK_20150818.xlsx
2015-08-18 16:15 - 2015-08-18 16:15 - 00076625 _____ C:\Users\Test\Documents\playrific_gwmt_pages_with_duplicate_titles_20150818.xlsx
2015-08-18 15:15 - 2015-08-18 15:21 - 00343782 _____ C:\Users\Test\Documents\playrific_b2b_keyword_discovery_take_two.xlsx
2015-08-17 17:46 - 2015-08-17 17:58 - 00215161 _____ C:\Users\Test\Documents\FDP_FOR_ASHLEY_JUL_2015_DRAFT_For_Improvements.xlsx
2015-08-17 11:23 - 2015-08-17 11:23 - 00002466 _____ C:\Users\Test\Documents\Playrific_basic_deliverables_20150603.txt
2015-08-17 11:09 - 2015-08-18 11:03 - 00018445 _____ C:\Users\Test\Documents\FDP_Report_Jul_2015.xlsx
2015-08-17 08:27 - 2015-08-17 16:24 - 00002467 _____ C:\Users\Test\Documents\beaver-dam-stream-20150817.txt
2015-08-16 11:02 - 2015-08-22 13:35 - 15986896 _____ C:\Users\Test\Documents\Playrific_brands_and_tags_for_Apps_20150811.xlsx
2015-08-15 18:13 - 2015-08-15 18:13 - 233447836 _____ C:\Users\Test\Documents\playrific_sf_crawl_full_20150815.seospider
2015-08-15 12:01 - 2015-08-16 15:37 - 34813491 _____ C:\Users\Test\Documents\PLAYRIFIC_SF_internal_all_20150805_for_Tag_count_20150815.xlsx
2015-08-15 10:43 - 2015-08-15 10:43 - 113898365 _____ C:\Users\Test\Documents\Playrific_SF_Partial_crawl_20150815.seospider
2015-08-15 09:34 - 2015-08-15 09:34 - 00895014 _____ C:\Users\Test\Documents\soundconstruction_internal_all_SF_20150815_still_slow_odd_404s.xlsx
2015-08-14 19:54 - 2015-08-14 19:54 - 00000000 _RSHD C:\acroldr
2015-08-14 19:36 - 2015-08-14 19:36 - 00000000 ____D C:\Users\Test\AppData\Roaming\Acronis
2015-08-14 19:31 - 2015-08-14 19:31 - 00296736 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\file_tracker.sys
2015-08-14 19:31 - 2015-08-14 19:31 - 00248648 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\tib_mounter.sys
2015-08-14 19:30 - 2015-08-14 19:30 - 00001258 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acronis True Image 2015.lnk
2015-08-14 19:30 - 2015-08-14 19:30 - 00001246 _____ C:\Users\Public\Desktop\Acronis True Image 2015.lnk
2015-08-14 19:30 - 2015-08-14 19:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acronis
2015-08-14 19:29 - 2015-08-14 19:29 - 00000000 ____D C:\Program Files (x86)\Acronis
2015-08-14 19:26 - 2015-08-14 19:31 - 352768000 _____ C:\Users\Test\Downloads\AcronisTrueImage2015_ur_en-US.msi
2015-08-14 19:25 - 2015-08-14 19:25 - 01782936 _____ (Acronis) C:\Users\Test\Downloads\AcronisTrueImage2015_web_en-US.exe
2015-08-14 18:55 - 2015-08-14 19:31 - 01058632 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\tib.sys
2015-08-14 18:55 - 2015-08-14 19:30 - 00304416 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\snapman.sys
2015-08-14 18:55 - 2015-08-14 19:30 - 00134432 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\fltsrv.sys
2015-08-14 18:55 - 2015-08-14 18:55 - 01462560 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\tdrpman.sys
2015-08-14 18:52 - 2015-08-14 18:53 - 266045952 _____ C:\Users\Test\Downloads\DiscWizardSetup-1605861.en.exe
2015-08-14 10:16 - 2015-08-14 10:16 - 00023895 _____ C:\Users\Test\Documents\Playrific_AdWords_Copy_Historic.xlsx
2015-08-14 10:10 - 2015-08-14 10:16 - 00029913 _____ C:\Users\Test\Documents\Playrific_BIRT_SHOWING_SPONSORS_20150813.xlsx
2015-08-13 12:04 - 2015-08-16 15:39 - 00013288 _____ C:\Users\Test\Documents\playrific-building-structure-for-wpg-keywords-for-kids_20150814.xlsx
2015-08-12 16:48 - 2015-08-17 11:12 - 00254284 _____ C:\Users\Test\Documents\FDP_JUL_RESULTS_AND_DELTAS_START.xlsx
2015-08-11 14:02 - 2015-08-11 14:02 - 09284296 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2015-08-11 11:55 - 2015-08-15 14:52 - 13241732 _____ C:\Users\Test\Documents\Playrific_brands_20150811.xlsx
2015-08-10 18:08 - 2015-08-24 09:51 - 00000000 ___RD C:\Users\Test\Creative Cloud Files
2015-08-10 15:09 - 2015-08-10 16:27 - 00017287 _____ C:\Users\Test\Documents\BHFE__PESCPE_COMPETITIVE_ANALYSIS_20150701.xlsx
2015-08-10 15:09 - 2015-08-10 16:27 - 00000165 ____H C:\Users\Test\Documents\~$BHFE__PESCPE_COMPETITIVE_ANALYSIS_20150701.xlsx
2015-08-10 12:10 - 2015-08-11 11:45 - 00086888 _____ C:\Users\Test\Documents\Playrific_More_Keyword_Discovery_for_kids_20150809.xlsx
2015-08-10 12:10 - 2015-08-10 12:10 - 00000165 ____H C:\Users\Test\Documents\~$Playrific_More_Keyword_Discovery_for_kids_20150809.xlsx
2015-08-10 10:14 - 2015-08-10 12:05 - 00378509 ____H C:\Users\Test\Documents\~WRL3254.tmp
2015-08-09 18:39 - 2015-08-09 18:39 - 00002225 _____ C:\Users\Test\Desktop\Kindle.lnk
2015-08-09 17:09 - 2015-08-09 17:09 - 00067138 _____ C:\Users\Test\Documents\FDP_AUG_DWELL_REPORT_20150809.xlsx
2015-08-09 17:09 - 2015-08-09 17:09 - 00000165 ____H C:\Users\Test\Documents\~$FDP_AUG_DWELL_REPORT_20150809.xlsx
2015-08-09 11:24 - 2015-08-09 11:24 - 00013414 _____ C:\Users\Test\Documents\KIDS_WMM_TOOL_5380965.txt
2015-08-07 12:57 - 2015-08-07 12:57 - 00034225 _____ C:\Users\Test\Desktop\Playrific-songs-for-kids-page-last-page-178.htm
2015-08-07 12:57 - 2015-08-07 12:57 - 00000000 ____D C:\Users\Test\Desktop\Playrific-songs-for-kids-page-last-page-178_files
2015-08-07 12:56 - 2015-08-07 12:56 - 00034694 _____ C:\Users\Test\Desktop\Playrific-songs-for-kids-page-2.htm
2015-08-07 12:56 - 2015-08-07 12:56 - 00000000 ____D C:\Users\Test\Desktop\Playrific-songs-for-kids-page-2_files
2015-08-07 08:57 - 2015-08-07 08:57 - 00706719 _____ C:\Users\Test\Documents\SCS_BK_internal_all_SF_20150806.xlsx
2015-08-07 08:03 - 2015-08-07 17:29 - 246319073 _____ C:\Users\Test\Documents\scs_sf_crawl_20150805.seospider
2015-08-06 23:39 - 2015-08-06 23:39 - 00695629 _____ C:\Users\Test\Documents\SCS_BK_internal_all_SF_20150805.xlsx
2015-08-06 18:14 - 2015-08-06 18:23 - 00082866 _____ C:\Users\Test\Documents\Former_Plaveb_internal_links_from_GWMT_20150805_Pre_new_BK_Site.xlsx
2015-08-06 08:50 - 2015-08-06 18:41 - 02370917 _____ C:\Users\Test\Documents\PLAYRIFIC_EARLY_AKO_2013_20K_UNLINKED_Analytics www.playrific.com Organic Search Traffic 20130101-20130409.xlsx
2015-08-05 21:28 - 2015-08-05 21:28 - 00020990 _____ C:\Users\Test\Downloads\download (1).htm
2015-08-05 17:18 - 2015-08-05 17:18 - 00008898 _____ C:\Users\Test\Documents\Custom-Consoles-linking-to-SCS-404-external_all_20150805.xlsx
2015-08-05 16:07 - 2015-08-12 08:47 - 24368701 _____ C:\Users\Test\Documents\PLAYRIFIC_SF_internal_all_20150805.xlsx
2015-08-05 16:05 - 2015-08-05 16:05 - 243969746 _____ C:\Users\Test\Documents\playrific_sf_crawl_20150805.seospider
2015-08-05 11:03 - 2015-08-06 20:06 - 00000291 _____ C:\Users\Test\Documents\tony.txt
2015-08-05 10:09 - 2015-08-06 20:05 - 00001159 _____ C:\Users\Test\Documents\BEETEN_20150805.txt
2015-08-04 12:52 - 2015-08-04 12:55 - 00509685 _____ C:\Users\Test\Documents\Playrific_Number_of_Downloads_7_Days_est_20150706.xlsx
2015-08-04 12:11 - 2015-08-04 20:34 - 00251199 _____ C:\Users\Test\Documents\For_Gary_Playrific_20150804.pptx
2015-08-04 11:59 - 2015-08-16 13:15 - 05708448 _____ C:\Users\Test\Documents\Playrific_Slash_Data_for_Gary_showing_z_plus_m_media_pages_20150804.xlsx
2015-08-03 20:11 - 2015-08-03 20:11 - 00026205 _____ C:\Users\Test\Documents\fdp_internal_all_more_404_Jul.xlsx
2015-08-03 20:04 - 2015-08-04 07:01 - 00061082 _____ C:\Users\Test\Documents\FDP_MAY_404_for_outbound_Links_internal_all_20150803.xlsx
2015-08-03 17:35 - 2015-08-03 17:35 - 00187983 _____ C:\Users\Test\Documents\FDP_FOR_ASHLEY_JUN_2015_DRAFT_For_Improvements.xlsx
2015-08-03 15:07 - 2015-08-04 07:11 - 00003976 _____ C:\Users\Test\Documents\playrific_gary_20150803.txt
2015-08-03 14:38 - 2015-08-06 20:08 - 00001153 _____ C:\Users\Test\Documents\bnb_2015.txt
2015-08-03 10:33 - 2015-08-03 11:55 - 00010857 _____ C:\Users\Test\Documents\FDP_EXTRA_CONVERSION_COUNTING_JUNE_2015.xlsx
2015-08-02 02:11 - 2015-08-02 02:28 - 00009606 _____ C:\Users\Test\Documents\SRBTC_2015_BROOKIES.wlmp
2015-08-02 01:11 - 2015-08-02 01:59 - 00000000 ____D C:\Users\Test\Desktop\GOPRO_JULY_2015
2015-08-01 09:43 - 2015-08-02 11:34 - 00000333 _____ C:\Users\Test\Documents\WCAI_WHELK.txt
2015-07-31 16:08 - 2015-07-31 18:50 - 00000292 _____ C:\Users\Test\Documents\focus-levesque-20150731.txt
2015-07-31 15:38 - 2015-07-31 15:43 - 00015480 _____ C:\Users\Test\Documents\ASF_DELIVERABLE_20150820-back-from-scott.xlsx
2015-07-31 13:27 - 2015-07-31 15:19 - 00000628 _____ C:\Users\Test\Documents\bix_garson_20150731.txt
2015-07-31 13:13 - 2015-07-31 15:16 - 00107946 _____ C:\Users\Test\Documents\Lori_Day_Consulting_AdWords_MSQ_for_Negatives_20150731.xlsx
2015-07-31 00:44 - 2015-07-31 15:16 - 00052045 _____ C:\Users\Test\Documents\Playrific_Placements_for_Adwords_GDN_20150730.xlsx
2015-07-30 15:45 - 2015-07-31 00:41 - 00122526 _____ C:\Users\Test\Documents\GDN_www_internal_all_20150730.xlsx
2015-07-30 15:43 - 2015-07-31 00:41 - 00085237 _____ C:\Users\Test\Documents\GDN_NON_www_internal_all_20150730.xlsx
2015-07-28 20:06 - 2015-07-28 20:06 - 00001190 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk
2015-07-28 20:06 - 2015-07-28 20:06 - 00001178 _____ C:\Users\Public\Desktop\Adobe Creative Cloud.lnk
2015-07-28 19:41 - 2015-07-28 19:41 - 00037568 _____ C:\Users\Test\Documents\Playrific-pages-loaded-by-social-media-for-screaming-frog-testAnalytics www.playrific.com All Traffic 20120101-20150727.xlsx
2015-07-28 08:17 - 2015-07-28 08:17 - 00026450 _____ C:\Users\Test\Downloads\Analytics www.playrific.com All Traffic 20120101-20150727.csv
2015-07-27 16:26 - 2015-07-27 16:26 - 00018936 _____ C:\Users\Test\Documents\FDP_Report_Jun_2015.xlsx
2015-07-27 16:24 - 2015-07-27 16:25 - 00018587 _____ C:\Users\Test\Documents\FDP_Report_May_2015.xlsx
2015-07-27 13:36 - 2015-07-27 13:36 - 00004870 _____ C:\Users\Test\Downloads\Analytics www.playrific.com Channels 20150101-20150727.csv
2015-07-27 11:38 - 2015-07-27 13:43 - 00112383 _____ C:\Users\Test\Documents\PLAYRIFIC_dailyregistration_FROM_BIRT_20150727.xlsx
2015-07-27 11:38 - 2015-07-27 11:38 - 00006004 _____ C:\Users\Test\Documents\Playrific_Daily_Reg_From_BRIT.csv
2015-07-27 09:11 - 2015-07-27 13:39 - 00419825 _____ C:\Users\Test\Documents\Playrific_App_Annie_Main_App_Historical_Downloads.xlsx
2015-07-27 09:03 - 2015-07-27 09:03 - 00694401 _____ C:\Users\Test\Documents\Playrific_Page_Delta_why_the_Big_drop_April_2014_Analytics www.playrific.com Channels 20140411-20140420 20140401-20140410.xlsx
2015-07-27 07:28 - 2015-07-27 09:02 - 00106792 _____ C:\Users\Test\Documents\FDP_FOR_JONO_REVIEW_JUN_2015_.xlsx
2015-07-26 09:25 - 2015-07-26 09:25 - 00959871 _____ C:\Users\Test\Downloads\Analytics www.playrific.com Channels 20140411-20140420 20140401-20140410.csv
2015-07-25 15:48 - 2015-07-25 15:48 - 00997360 _____ (PassMark Software ) C:\Users\Test\Downloads\batmon.exe
2015-07-25 15:48 - 2015-07-25 15:48 - 00001072 _____ C:\Users\Public\Desktop\BatteryMon.lnk
2015-07-25 15:48 - 2015-07-25 15:48 - 00000000 ____D C:\Users\Test\Documents\PassMark
2015-07-25 15:48 - 2015-07-25 15:48 - 00000000 ____D C:\ProgramData\PassMark
2015-07-25 15:48 - 2015-07-25 15:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BatteryMon
2015-07-25 15:48 - 2015-07-25 15:48 - 00000000 ____D C:\Program Files (x86)\BatteryMon
2015-07-25 15:05 - 2015-07-25 15:05 - 00001794 _____ C:\Users\Public\Desktop\iTunes.lnk
2015-07-25 15:05 - 2015-07-25 15:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-07-25 15:04 - 2015-07-25 15:05 - 00000000 ____D C:\Program Files\iTunes
2015-07-25 15:04 - 2015-07-25 15:04 - 00000000 ____D C:\Program Files\iPod
2015-07-25 15:04 - 2015-07-25 15:04 - 00000000 ____D C:\Program Files (x86)\iTunes
2015-07-25 10:52 - 2015-07-25 10:52 - 00000058 _____ C:\Users\Test\Documents\stormsurge-yeat.txt

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-08-24 10:21 - 2014-11-18 16:50 - 00030122 _____ C:\Users\Test\Downloads\FRST.txt
2015-08-24 10:21 - 2014-11-18 16:49 - 00000000 ____D C:\FRST
2015-08-24 10:05 - 2014-08-06 15:04 - 00000556 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3105234330-458141651-3949311147-1000.job
2015-08-24 10:02 - 2015-03-27 16:29 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-08-24 10:01 - 2014-07-01 19:58 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-08-24 09:59 - 2014-12-25 12:03 - 00000904 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3105234330-458141651-3949311147-1000UA.job
2015-08-24 09:56 - 2009-07-14 00:45 - 00026560 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-08-24 09:56 - 2009-07-14 00:45 - 00026560 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-08-24 09:51 - 2014-06-30 19:10 - 00000000 ____D C:\Users\Test\AppData\Local\Adobe
2015-08-24 09:51 - 2014-05-01 17:18 - 01583963 _____ C:\Windows\WindowsUpdate.log
2015-08-24 09:50 - 2015-07-09 14:53 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-08-24 09:50 - 2014-06-21 22:23 - 00000441 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2015-08-24 09:49 - 2014-07-01 19:58 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-08-24 09:49 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-08-24 09:49 - 2009-07-14 00:51 - 00022017 _____ C:\Windows\setupact.log
2015-08-24 09:47 - 2014-07-19 12:39 - 00000000 ____D C:\Users\Test\Documents\Outlook Files
2015-08-24 09:47 - 2014-07-06 18:21 - 00000000 ____D C:\Users\Test\AppData\Roaming\Everything
2015-08-24 08:31 - 2015-05-30 12:27 - 00000652 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-3105234330-458141651-3949311147-1000.job
2015-08-24 07:18 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\rescache
2015-08-24 01:55 - 2009-07-14 01:13 - 00785942 _____ C:\Windows\system32\PerfStringBackup.INI
2015-08-24 01:13 - 2014-07-20 09:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seagate
2015-08-24 01:13 - 2014-07-20 09:20 - 00000000 ____D C:\Program Files (x86)\Seagate
2015-08-24 01:13 - 2014-05-16 11:18 - 00000000 ____D C:\ProgramData\Package Cache
2015-08-23 23:54 - 2015-02-12 19:24 - 00000000 ____D C:\Users\Test\AppData\Roaming\FileZilla
2015-08-23 22:02 - 2015-03-27 21:54 - 00002224 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-08-23 21:07 - 2014-06-16 07:45 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-08-23 21:07 - 2009-07-14 00:45 - 00457744 _____ C:\Windows\system32\FNTCACHE.DAT
2015-08-23 21:06 - 2014-06-16 07:45 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-08-23 21:05 - 2014-12-11 08:21 - 00000000 ____D C:\Windows\system32\appraiser
2015-08-23 21:05 - 2014-06-16 08:57 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-08-23 19:33 - 2014-06-16 07:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-08-23 19:31 - 2014-06-16 06:10 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-08-23 19:26 - 2009-07-13 22:34 - 00000478 _____ C:\Windows\win.ini
2015-08-23 19:25 - 2014-05-16 13:48 - 00000000 ____D C:\Windows\system32\MRT
2015-08-23 19:19 - 2014-05-16 13:48 - 132483416 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-08-23 19:10 - 2015-06-22 07:24 - 00015108 _____ C:\Users\Test\Documents\Playrific_Google_SERP_Count_for_Ted_20150622.xlsx
2015-08-23 18:50 - 2015-05-30 12:27 - 00003686 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-3105234330-458141651-3949311147-1000
2015-08-23 18:50 - 2014-08-06 15:04 - 00003590 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-3105234330-458141651-3949311147-1000
2015-08-23 15:59 - 2014-12-25 12:03 - 00000852 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3105234330-458141651-3949311147-1000Core.job
2015-08-23 15:32 - 2014-05-01 14:31 - 00000000 ____D C:\Users\Test
2015-08-23 15:29 - 2014-07-15 13:50 - 00000000 ____D C:\Users\HomeGroupUser$
2015-08-23 15:28 - 2015-04-07 16:56 - 00000000 ___SD C:\Windows\system32\GWX
2015-08-23 15:28 - 2015-03-27 21:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-08-23 15:28 - 2014-08-16 08:42 - 00000000 ____D C:\Users\Test\AppData\Roaming\Google
2015-08-23 15:28 - 2014-07-17 16:22 - 00000000 ____D C:\Users\Test\AppData\Roaming\IrfanView
2015-08-23 15:28 - 2014-06-16 06:10 - 00000000 ____D C:\Users\Test\AppData\Local\Microsoft Help
2015-08-23 15:28 - 2011-07-18 18:25 - 00000000 ____D C:\Users\Test\.ScreamingFrogSEOSpider
2015-08-23 15:28 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\registration
2015-08-23 15:28 - 2009-07-13 23:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2015-08-23 15:27 - 2015-02-04 15:08 - 00000000 ____D C:\Users\Test\AppData\Roaming\Skype
2015-08-23 00:19 - 2015-07-08 08:48 - 00000334 _____ C:\Users\Test\Documents\movies_2015.txt
2015-08-22 13:21 - 2015-06-28 11:47 - 00985672 _____ C:\Users\Test\Documents\Playrific_b2b_keyword_discovery_20150628.xlsx
2015-08-22 11:00 - 2014-04-27 15:04 - 00028135 _____ C:\Users\Test\Documents\HENRY_BI101_EMAILS_YEAT.xlsx
2015-08-19 20:37 - 2015-04-28 12:03 - 00000000 ____D C:\Users\Test\AppData\Local\CrashDumps
2015-08-19 20:28 - 2015-02-12 19:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2015-08-19 20:28 - 2015-02-12 19:22 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client
2015-08-18 16:44 - 2015-03-27 18:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-08-18 16:44 - 2014-05-01 14:57 - 00217716 _____ C:\Windows\PFRO.log
2015-08-18 15:40 - 2015-07-11 10:13 - 00000110 _____ C:\Users\Test\Documents\SCREAMING-FROG-EXCLUDES-Images-regex-filters-etc.txt
2015-08-17 16:37 - 2014-11-18 14:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-08-17 10:43 - 2015-05-30 16:53 - 00003547 _____ C:\Users\Test\Documents\playrific_beth_marcus_20150530.txt
2015-08-17 09:18 - 2009-07-14 01:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2015-08-16 15:39 - 2015-07-06 09:42 - 00549262 _____ C:\Users\Test\Documents\Ranking_for_BHFE_MASTER_Historic_20150701.xlsx
2015-08-16 15:39 - 2015-01-19 22:32 - 00627996 _____ C:\Users\Test\Documents\BHFE_RANKING_STATE_CPA_CPE_W_ABBREVIATIONS.xlsx
2015-08-14 19:54 - 2014-12-29 13:08 - 00054529 _____ C:\Users\Test\Documents\yeat-yeat-yeat-2015.xlsx
2015-08-14 19:51 - 2014-07-20 09:20 - 00000000 ____D C:\ProgramData\Acronis
2015-08-14 18:58 - 2014-07-20 09:26 - 00000000 ____D C:\ProgramData\Seagate
2015-08-14 18:56 - 2014-07-20 09:29 - 00000000 ____D C:\Users\Test\AppData\Roaming\Seagate
2015-08-13 11:54 - 2015-06-18 14:57 - 00425923 _____ C:\Users\Test\Documents\Playrific_first_SEOSHEER_RANKING_REPORT_20150618.xlsx
2015-08-11 14:02 - 2015-03-27 16:29 - 00778440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-08-11 14:02 - 2015-03-27 16:29 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-08-11 14:02 - 2015-03-27 16:29 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-08-10 18:08 - 2015-07-09 14:53 - 00000000 ___RD C:\Users\Test\gday@searunbrookie.org Creative Cloud Files
2015-08-09 18:38 - 2014-12-10 11:09 - 00000000 ____D C:\Users\Test\AppData\Local\Amazon
2015-08-09 08:12 - 2015-04-14 13:24 - 00000000 ____D C:\Users\Test\Documents\CODECANYON_CODE_LOCKER
2015-08-08 13:24 - 2014-11-18 14:08 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-08-07 13:06 - 2015-01-09 21:00 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2015-08-06 18:41 - 2015-03-20 13:28 - 00091752 _____ C:\Users\Test\Documents\HWA_ALL_TIME_2013_ADWORDS_CONVERSION_REPORT_BY_MONTH_YEAR_EOY_W_2014_2015_DATA.xlsx
2015-08-05 16:32 - 2014-07-20 11:58 - 00002360 _____ C:\Users\Test\Desktop\Latitude-Hardwire.RDP
2015-08-03 13:37 - 2015-07-23 10:19 - 00187950 _____ C:\Users\Test\Documents\FDP_FOR_PRINTING_JUN_2015_DRAFT.xlsx
2015-07-31 19:06 - 2014-09-04 12:18 - 00000000 ____D C:\ProgramData\Oracle
2015-07-31 19:05 - 2015-05-31 08:52 - 00110688 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2015-07-31 19:04 - 2015-05-31 08:51 - 00000000 ____D C:\Program Files\Java
2015-07-29 17:36 - 2014-07-01 19:57 - 00000000 ____D C:\Users\Test\AppData\Local\Google
2015-07-28 20:05 - 2014-06-29 10:17 - 00000000 ____D C:\Program Files (x86)\Adobe
2015-07-28 19:43 - 2015-07-24 18:31 - 00053639 _____ C:\Users\Test\Documents\Henry_404_REWORKING_20150724.xlsx
2015-07-28 19:40 - 2011-02-25 19:44 - 00043676 _____ C:\Users\Test\Documents\yeat_SRBTC.xlsx
2015-07-27 13:39 - 2015-07-07 11:13 - 00035088 _____ C:\Users\Test\Documents\Playrific_Happy_Meal_Stats_Started_20150707.xlsx
2015-07-25 15:04 - 2015-03-19 00:45 - 00000000 ____D C:\Program Files\Common Files\Apple
2015-07-25 15:03 - 2015-03-19 00:49 - 00000000 ____D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-07-25 14:49 - 2015-07-11 10:40 - 00000000 ____D C:\Users\Test\Documents\AWR User Data
2015-07-25 14:49 - 2015-07-11 10:40 - 00000000 ____D C:\Users\Test\AppData\Local\Caphyon

==================== Files in the root of some directories =======

2013-12-29 23:46 - 2013-12-29 23:46 - 2174976 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\Common Files\atimpenc.dll
2014-10-06 21:53 - 2014-12-01 01:39 - 0003584 _____ () C:\Users\Test\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-06-13 14:01 - 2015-03-12 16:46 - 0007618 _____ () C:\Users\Test\AppData\Local\Resmon.ResmonCfg
2015-07-20 14:09 - 2014-05-03 06:12 - 0010240 _____ () C:\Users\Test\AppData\Local\Z@!-886e45e3-0068-456d-8575-fae59649a1e6.tmp
2015-07-20 14:09 - 2014-05-03 06:12 - 0009216 _____ () C:\Users\Test\AppData\Local\Z@S!-c6d0ce44-22ba-4f25-8dc3-8c48ca3040bc.tmp
2015-04-11 12:20 - 2015-04-11 12:29 - 0000364 _____ () C:\ProgramData\hpzinstall.log

Files to move or delete:
====================
C:\Users\Test\MGtools.exe


Some files in TEMP:
====================
C:\Users\Test\AppData\Local\Temp\917b0b87-3358-4e79-93de-3dfc2fc99ed0.exe
C:\Users\Test\AppData\Local\Temp\AAMHelper.exe
C:\Users\Test\AppData\Local\Temp\AdobeApplicationManager.exe
C:\Users\Test\AppData\Local\Temp\jre-8u51-windows-au.exe
C:\Users\Test\AppData\Local\Temp\ose00000.exe


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-08-22 20:19

==================== End of log ============================



BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 39,512 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:03:56 PM

Posted 25 August 2015 - 08:12 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Press the windows key Windows_Logo_key.gif+ r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.
Please copy the entire contents of the code box below to the a new file.


start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

HKLM-x32\...\Run: [] => [X]
Winlogon\Notify\igfxcui: igfxdev.dll [X]
GroupPolicyScripts: Group Policy detected <======= ATTENTION
GroupPolicyScripts\User: Group Policy detected <======= ATTENTION
HKU\S-1-5-21-3105234330-458141651-3949311147-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
SearchScopes: HKU\S-1-5-21-3105234330-458141651-3949311147-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
S3 AESTAud; system32\drivers\AESTAu64.sys [X]
C:\Users\Test\AppData\Local\Temp\917b0b87-3358-4e79-93de-3dfc2fc99ed0.exe
C:\Users\Test\AppData\Local\Temp\AAMHelper.exe
C:\Users\Test\AppData\Local\Temp\AdobeApplicationManager.exe
C:\Users\Test\AppData\Local\Temp\jre-8u51-windows-au.exe
C:\Users\Test\AppData\Local\Temp\ose00000.exe
C:\Users\Test\AppData\Local\Z@!-886e45e3-0068-456d-8575-fae59649a1e6.tmp
C:\Users\Test\AppData\Local\Z@S!-c6d0ce44-22ba-4f25-8dc3-8c48ca3040bc.tmp

End
Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Any remaining issues?

#3 nasdaq

nasdaq

  • Malware Response Team
  • 39,512 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:03:56 PM

Posted 30 August 2015 - 07:35 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.

#4 nasdaq

nasdaq

  • Malware Response Team
  • 39,512 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:03:56 PM

Posted 31 August 2015 - 06:51 AM

This topic has been re-opened at the request of the person who originally posted.

Copied from the PM message.

thanks so much - sorry to be out of the loop for so long - here's the result file.

Fix result of Farbar Recovery Scan Tool (x64) Version:30-08-2015
Ran by Test (2015-08-30 20:16:25) Run:1
Running from C:\Users\Test\Downloads
Loaded Profiles: Test (Available Profiles: Test & HomeGroupUser$)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

HKLM-x32\...\Run: [] => [X]
Winlogon\Notify\igfxcui: igfxdev.dll [X]
GroupPolicyScripts: Group Policy detected <======= ATTENTION
GroupPolicyScripts\User: Group Policy detected <======= ATTENTION
HKU\S-1-5-21-3105234330-458141651-3949311147-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
SearchScopes: HKU\S-1-5-21-3105234330-458141651-3949311147-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
S3 AESTAud; system32\drivers\AESTAu64.sys [X]
C:\Users\Test\AppData\Local\Temp\917b0b87-3358-4e79-93de-3dfc2fc99ed0.exe
C:\Users\Test\AppData\Local\Temp\AAMHelper.exe
C:\Users\Test\AppData\Local\Temp\AdobeApplicationManager.exe
C:\Users\Test\AppData\Local\Temp\jre-8u51-windows-au.exe
C:\Users\Test\AppData\Local\Temp\ose00000.exe
C:\Users\Test\AppData\Local\Z@!-886e45e3-0068-456d-8575-fae59649a1e6.tmp
C:\Users\Test\AppData\Local\Z@S!-c6d0ce44-22ba-4f25-8dc3-8c48ca3040bc.tmp

End
*****************

Restore point was successfully created.
Processes closed successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui" => key removed successfully
C:\Windows\system32\GroupPolicy\Machine => moved successfully
C:\Windows\system32\GroupPolicy\GPT.ini => moved successfully
C:\Windows\system32\GroupPolicy\User => moved successfully
HKU\S-1-5-21-3105234330-458141651-3949311147-1000\Software\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully
"HKU\S-1-5-21-3105234330-458141651-3949311147-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" => key removed successfully
HKCR\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => key not found.
"HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => key removed successfully
"HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE" => key removed successfully
AESTAud => service removed successfully
C:\Users\Test\AppData\Local\Temp\917b0b87-3358-4e79-93de-3dfc2fc99ed0.exe => moved successfully
C:\Users\Test\AppData\Local\Temp\AAMHelper.exe => moved successfully
C:\Users\Test\AppData\Local\Temp\AdobeApplicationManager.exe => moved successfully
C:\Users\Test\AppData\Local\Temp\jre-8u51-windows-au.exe => moved successfully
C:\Users\Test\AppData\Local\Temp\ose00000.exe => moved successfully
C:\Users\Test\AppData\Local\Z@!-886e45e3-0068-456d-8575-fae59649a1e6.tmp => moved successfully
C:\Users\Test\AppData\Local\Z@S!-c6d0ce44-22ba-4f25-8dc3-8c48ca3040bc.tmp => moved successfully
EmptyTemp: => 11.1 GB temporary data Removed.


The system needed a reboot..

Edited by nasdaq, 31 August 2015 - 06:52 AM.


#5 nasdaq

nasdaq

  • Malware Response Team
  • 39,512 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:03:56 PM

Posted 31 August 2015 - 06:53 AM

How is the computer running now?

#6 yaddow

yaddow
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:56 PM

Posted 02 September 2015 - 08:53 AM

Machine seems to be running fairly hot and MS Security Essentials found trojan win32/dorv.b!frn (ouch!)

 

also having weird cloudfront.net problem that may or may not be related.   When trying to read email from certain forums, this message appears in MS Outlook 2010.  

Contacting \\d1avok0lzls2w.cloudfront.net/img_users

 

and it causes the email to delay loading for over a minute.  probably not related as it seems to be associated with that particular (reasonably well regarded) forum.



#7 nasdaq

nasdaq

  • Malware Response Team
  • 39,512 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:03:56 PM

Posted 02 September 2015 - 10:28 AM

Open Firefox and search this string http://d1avok0lzls2w.cloudfront.net/img_users

You will see this error.
This XML file does not appear to have any style information associated with it.


Searching the error I found this page.
https://support.mozilla.org/en-US/questions/954985


Try this
Firefox: Reset Default Browsing settings:
https://support.mozilla.org/en-US/kb/reset-firefox-easily-fix-problems?utm_expid=65912487-41.djHNRQY0RhaLvvtvcd0BQA.2&utm_referrer=https%3A%2F%2Fwww.google.ca%2F

Clean the Firefox Cache.
https://kb.wisc.edu/page.php?id=15141
===

If that fails try some of the other suggested fix on the page I gave you.

===

If the problem persists run this tool.

Temporarily disable your AV program so it does not interfere.
Info on how to disable your security applications How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - Security Mini-Guides.

Download Zeok tool from here

When the download appears, save to the Desktop.
On the Desktop, right-click the Zoek.exe file and select: Run as Administrator
(Give it a few seconds to appear.)

Next, copy/paste the entire script inside the code box below to the input field of Zoek:
createsrpoint;
autoclean;
emptyalltemp;
ipconfig /flushdns;b
Now...
Close any open Browsers.
Click the Run script button, and wait. It takes a few minutes to run all the script.

When the tool finishes, the zoek-results.log is opened in Notepad.
The log is also found on the systemdrive, normally C:\
If a reboot is needed, the log is opened after the reboot.

Please attach the zoek-results.log in your reply.

Also, please provide an update on how the computer is behaving after running the above script.

===

#8 yaddow

yaddow
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:56 PM

Posted 03 September 2015 - 07:37 PM

probably makes sense to end this thread - i think i got a real problem now. 

Now I've got M security essentials saying I've got ransomware.  Lots of help_decrypt.xyx files. 

 

probably from trying to open a microsoft doc attachment.  Ouch.

 

will start over.  Thanks.



#9 nasdaq

nasdaq

  • Malware Response Team
  • 39,512 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:03:56 PM

Posted 04 September 2015 - 08:08 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users