Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Ransom:Win32/Crowti (and more) - Labeled SEVERE


  • This topic is locked This topic is locked
8 replies to this topic

#1 yaddow

yaddow

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:09:06 PM

Posted 03 September 2015 - 08:40 PM

Yep, got a good nasty one here.    maybe a bunch.

 

Using Win7 / 64 bit.  I am able to boot - but Microsoft Security Essentials keeps popping up to say that it has found a problem and detected threats are being fixed it and no further action is necessary.

 

I also ran MalwareBytes (professional version) and it found nothing.

 

I've tried rolling back and that's not working. 

I have NOT opened any of the MANY HELP_DECRYPT.HTML / TXT / JPG etc files.

 

I did run FRST64.exe and here are my logs from FRST and ADDITION :

 

I await further instructions.

 

Hope you all have a nice Labor Day weekend!

 

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:31-08-2015
Ran by Test (administrator) on Yaddow-E6430 (03-09-2015 21:13:59)
Running from E:\
Loaded Profiles: Test (Available Profiles: Test & HomeGroupUser$)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 10 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Marvell Semiconductor, Inc.) C:\Program Files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
() C:\Program Files\Everything\Everything.exe
(Seagate) C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedhlp.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(TechSmith Corporation) C:\Program Files (x86)\TechSmith\SnagIt 8\SnagIt32.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Caphyon) C:\Program Files (x86)\Caphyon\Advanced Web Ranking\Scheduler.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Intel® Corporation) C:\Program Files\Intel\CAM\bin\CAMService.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Projector\Epson USB Display V1.6\EMP_UDSA.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.13\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.13\GoogleCrashHandler64.exe
() C:\Program Files\Everything\Everything.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(MadeForNet.com) C:\Program Files (x86)\HTTP Debugger\HTTPDebuggerSvc.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(TechSmith Corporation) C:\Program Files (x86)\TechSmith\SnagIt 8\TscHelp.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Apple Inc.) C:\Program Files (x86)\AirPort\APAgent.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe
(Intuit) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
(j2 Global Communications, Inc.) C:\Program Files (x86)\eFax Messenger 4.4\J2GDllCmd.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Acronis International GmbH) C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Seagate) C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedul2.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Updater\Updater.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe
() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(TechSmith Corporation) C:\Program Files (x86)\TechSmith\SnagIt 8\SnagPriv.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AESTFltr] => %SystemRoot%\system32\AESTFl64.exe /NoDlg
HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [708952 2013-07-08] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-08-16] (IDT, Inc.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)
HKLM\...\Run: [PrnStatusMX] => C:\Program Files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe [1240064 2012-07-04] (Marvell Semiconductor, Inc.)
HKLM\...\Run: [IntelPROSet] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [4876496 2014-06-18] (Intel® Corporation)
HKLM\...\Run: [Everything] => C:\Program Files\Everything\Everything.exe [1441792 2014-08-05] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500936 2015-07-22] (Adobe Systems Incorporated)
HKLM\...\Run: [Seagate Scheduler2 Service] => C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedhlp.exe [400384 2015-03-12] (Seagate)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170280 2015-06-29] (Apple Inc.)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [570152 2014-08-14] (Acronis)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [AirPort Base Station Agent] => C:\Program Files (x86)\AirPort\APAgent.exe [771360 2009-11-11] (Apple Inc.)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe [3499896 2014-05-08] (Adobe Systems Inc.)
HKLM-x32\...\Run: [Intuit SyncManager] => C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe [3776824 2015-03-17] (Intuit Inc. All rights reserved.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-05-15] (Apple Inc.)
HKLM-x32\...\Run: [eFax 4.4] => C:\Program Files (x86)\eFax Messenger 4.4\J2GDllCmd.exe [95744 2012-08-29] (j2 Global Communications, Inc.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)
HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150016 2008-08-20] (Hewlett-Packard)
HKLM-x32\...\Run: [EPSON_UD_START] => C:\Program Files (x86)\EPSON Projector\Epson USB Display V1.6\EMP_UD.exe [536168 2013-05-31] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2303152 2015-07-23] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-06-08] (Oracle Corporation)
HKLM-x32\...\Run: [DiscWizardMonitor.exe] => "C:\Program Files (x86)\Seagate\DiscWizard\DiscWizardMonitor.exe"
HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [691056 2015-07-20] (Acronis International GmbH)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [5343664 2015-07-20] (Acronis)
HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\Run: [GoogleChromeAutoLaunch_E1D46C574EBA950FEDF46817FE573EFA] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [863560 2015-08-18] (Google Inc.)
HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\Run: [Google Update] => C:\Users\Test\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-08-27] (Google Inc.)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-06-14] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-07-22] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-07-22] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-07-22] ()
ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SnagIt 8.lnk [2014-09-06]
ShortcutTarget: SnagIt 8.lnk -> C:\Program Files (x86)\TechSmith\SnagIt 8\SnagIt32.exe (TechSmith Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: [S-1-5-21-3105234330-458141651-3949311147-1000] => :0
Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{5F59AC16-0D1B-42A4-A9F0-131475B7CA05}: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{817251EC-EE0C-4769-A974-CDFE86A9ECAD}: [DhcpNameServer] 75.75.75.75 75.75.76.76

Internet Explorer:
==================
HKU\S-1-5-21-3105234330-458141651-3949311147-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
HKU\S-1-5-21-3105234330-458141651-3949311147-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3105234330-458141651-3949311147-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?ocid=U218DHP&pc=U218
SearchScopes: HKU\S-1-5-21-3105234330-458141651-3949311147-1000 -> Comcast URL = hxxp://search.xfinity.com/?cat=subweb&con=mmchrome&q={searchTerms}&cid=xfstart_tech_search
BHO: SnagIt Toolbar Loader -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> C:\Program Files (x86)\TechSmith\SnagIt 8\DLLx64\SnagItBHO64.dll [2007-05-01] (TechSmith Corporation)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_51\bin\ssv.dll [2015-07-31] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-07-31] (Oracle Corporation)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
BHO-x32: SnagIt Toolbar Loader -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> C:\Program Files (x86)\TechSmith\SnagIt 8\SnagItBHO.dll [2007-05-01] (TechSmith Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\SnagIt 8\SnagItIEAddin.dll [2007-05-01] (TechSmith Corporation)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab
Handler-x32: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\BelarcAdvisor\System\BAVoilaX.dll [2013-04-16] (Belarc, Inc.)
Handler-x32: intu-help-qb8 - {CD17C364-2EC8-4929-91A9-C4839A20E909} - C:\Program Files (x86)\Intuit\QuickBooks 2015\HelpAsyncPluggableProtocol.dll [2015-03-17] (Intuit, Inc.)
Handler-x32: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\SysWOW64\mscoree.dll [2010-11-04] (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Test\AppData\Roaming\Mozilla\Firefox\Profiles\2kmoi98h.default-1434756000445
FF DefaultSearchEngine.US: Google
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-11] ()
FF Plugin: @java.com/DTPlugin,version=11.51.2 -> C:\Program Files\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll [2015-07-31] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.51.2 -> C:\Program Files\Java\jre1.8.0_51\bin\plugin2\npjp2.dll [2015-07-31] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2015-07-23] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-11] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1217157.dll [2015-02-16] (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-01-06] ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-27] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-27] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll [2014-05-08] (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2015-07-23] (Adobe Systems)
FF Plugin HKU\S-1-5-21-3105234330-458141651-3949311147-1000: @citrixonline.com/appdetectorplugin -> C:\Users\Test\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2014-08-06] (Citrix Online)
FF Plugin HKU\S-1-5-21-3105234330-458141651-3949311147-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\Test\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)
FF Plugin HKU\S-1-5-21-3105234330-458141651-3949311147-1000: @talk.google.com/O1DPlugin -> C:\Users\Test\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-04-17] (Google)
FF Plugin HKU\S-1-5-21-3105234330-458141651-3949311147-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Test\AppData\Local\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-27] (Google Inc.)
FF Plugin HKU\S-1-5-21-3105234330-458141651-3949311147-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Test\AppData\Local\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-27] (Google Inc.)
FF Plugin HKU\S-1-5-21-3105234330-458141651-3949311147-1000: google.com/WidevineMediaOptimizer -> C:\Users\Test\AppData\Roaming\IDM\bin\npwidevinemediaoptimizer.dll [2014-06-09] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Test\AppData\Roaming\mozilla\plugins\npatgpc.dll [2015-06-23] (Cisco WebEx LLC)
FF Plugin ProgramFiles/Appdata: C:\Users\Test\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Test\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-04-17] (Google)
FF Extension: HTML5 YouTube Everywhere - C:\Users\Test\AppData\Roaming\Mozilla\Firefox\Profiles\2kmoi98h.default-1434756000445\Extensions\jid1-b2ybw6mPlFZm6Q@jetpack.xpi [2015-06-24]
FF Extension: Pin It button - C:\Users\Test\AppData\Roaming\Mozilla\Firefox\Profiles\2kmoi98h.default-1434756000445\Extensions\jid1-YcMV6ngYmQRA2w@jetpack.xpi [2015-07-07]
FF Extension: NoScript - C:\Users\Test\AppData\Roaming\Mozilla\Firefox\Profiles\2kmoi98h.default-1434756000445\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2015-07-14]
FF Extension: Adblock Plus - C:\Users\Test\AppData\Roaming\Mozilla\Firefox\Profiles\2kmoi98h.default-1434756000445\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-06-20]
FF Extension: Textise Add-On v3.0 - C:\Users\Test\AppData\Roaming\Mozilla\Firefox\Profiles\2kmoi98h.default-1434756000445\Extensions\{d358dc61-498f-3de1-4d99-deacebaa276f}.xpi [2015-06-24]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-05-01]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2015-01-09]

Chrome:
=======
CHR Profile: C:\Users\Test\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Page Analytics (by Google)) - C:\Users\Test\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnbdnhhicmebfgdgglcdacdapkcihcoh [2015-09-01]
CHR Extension: (Tag Assistant (by Google)) - C:\Users\Test\AppData\Local\Google\Chrome\User Data\Default\Extensions\kejbdjndbnbjgmefkgdddjlbokphdefk [2015-09-02]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Test\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-04]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Test\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-01]
CHR HKU\S-1-5-21-3105234330-458141651-3949311147-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nfedoihopcjdfjihhhojdclnfdgomdho] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2014-05-08]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-05-01]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [680112 2015-07-22] (Adobe Systems Incorporated)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)
R2 AWRScheduler; C:\Program Files (x86)\Caphyon\Advanced Web Ranking\Scheduler.exe [166304 2014-05-27] (Caphyon) [File not signed]
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)
R2 CAMService; C:\Program Files\Intel\CAM\bin\CAMService.exe [1243344 2014-06-18] (Intel® Corporation)
R2 EMP_UDSA; C:\Program Files (x86)\EPSON Projector\Epson USB Display V1.6\EMP_UDSA.exe [157696 2013-05-31] (SEIKO EPSON CORPORATION) [File not signed]
R2 Everything; C:\Program Files\Everything\Everything.exe [1441792 2014-08-05] () [File not signed]
S3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [248832 2009-05-18] (Hewlett-Packard Co.) [File not signed]
R2 HTTPDebugger; C:\Program Files (x86)\HTTP Debugger\HTTPDebuggerSvc.exe [336936 2014-08-04] (MadeForNet.com)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319376 2014-10-01] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [265936 2014-06-18] ()
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)
S2 O2FLASH; C:\Windows\system32\o2flash.exe [244328 2011-11-16] (O2Micro International)
S2 O2SDIOAssist; C:\Windows\SysWOW64\srvany.exe [8192 2003-04-18] () [File not signed]
R2 QBCFMonitorService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe [45056 2015-03-17] (Intuit) [File not signed]
S3 QBFCService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [65536 2014-12-06] (Intuit Inc.) [File not signed]
R2 QBVSS; C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe [1248256 2014-12-06] (Intuit Inc.) [File not signed]
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5491984 2015-05-20] (TeamViewer GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3816656 2014-06-18] (Intel® Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S1 EMP_MIRRUD; C:\Windows\System32\DRIVERS\EMP_MirrUD.sys [5632 2013-05-31] (Windows ® Codename Longhorn DDK provider)
R3 eppvad_simple; C:\Windows\System32\drivers\EMP_UDAU.sys [23040 2013-05-31] (SEIKO EPSON CORPORATION)
R0 file_tracker; C:\Windows\System32\DRIVERS\file_tracker.sys [296736 2015-08-14] (Acronis International GmbH)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-09-03] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
R1 netfilter2; C:\Windows\System32\drivers\netfilter2.sys [48408 2014-08-04] (Windows ® Win 7 DDK provider)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [300320 2013-12-04] (NVIDIA Corporation)
S4 snapman380; C:\Windows\System32\DRIVERS\snman380.sys [237600 2014-07-20] (Acronis)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1058632 2015-08-14] (Acronis International GmbH)
R2 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [248648 2015-08-14] (Acronis International GmbH)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-09-03 20:03 - 2015-09-03 20:03 - 00055168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\zonvbdnt.sys
2015-09-03 19:11 - 2015-09-03 19:11 - 00008678 _____ C:\Users\Test\AppData\HELP_DECRYPT.HTML
2015-09-03 19:10 - 2015-09-03 19:10 - 00008678 _____ C:\Users\Test\AppData\Local\HELP_DECRYPT.HTML
2015-09-03 19:09 - 2015-09-03 19:09 - 00004282 _____ C:\Users\images\HELP_DECRYPT.TXT
2015-09-03 19:09 - 2015-09-03 19:09 - 00000320 _____ C:\Users\images\HELP_DECRYPT.URL
2015-09-03 18:51 - 2015-09-03 18:51 - 00008678 _____ C:\ProgramData\HELP_DECRYPT.HTML
2015-09-03 16:06 - 2015-09-03 19:11 - 00004282 _____ C:\Users\Test\AppData\Roaming\HELP_DECRYPT.TXT
2015-09-03 16:06 - 2015-09-03 19:11 - 00004282 _____ C:\Users\Test\AppData\HELP_DECRYPT.TXT
2015-09-03 16:06 - 2015-09-03 19:11 - 00000320 _____ C:\Users\Test\AppData\Roaming\HELP_DECRYPT.URL
2015-09-03 16:06 - 2015-09-03 19:11 - 00000320 _____ C:\Users\Test\AppData\HELP_DECRYPT.URL
2015-09-03 16:04 - 2015-09-03 19:10 - 00004282 _____ C:\Users\Test\AppData\Local\HELP_DECRYPT.TXT
2015-09-03 16:04 - 2015-09-03 19:10 - 00000320 _____ C:\Users\Test\AppData\Local\HELP_DECRYPT.URL
2015-09-03 16:00 - 2015-09-03 16:00 - 00004282 _____ C:\Users\Test\AppData\Local\Apps\HELP_DECRYPT.TXT
2015-09-03 16:00 - 2015-09-03 16:00 - 00000320 _____ C:\Users\Test\AppData\Local\Apps\HELP_DECRYPT.URL
2015-09-03 15:59 - 2015-09-03 15:59 - 00004282 _____ C:\Users\Public\HELP_DECRYPT.TXT
2015-09-03 15:59 - 2015-09-03 15:59 - 00004282 _____ C:\Users\Public\Documents\HELP_DECRYPT.TXT
2015-09-03 15:59 - 2015-09-03 15:59 - 00000320 _____ C:\Users\Public\HELP_DECRYPT.URL
2015-09-03 15:59 - 2015-09-03 15:59 - 00000320 _____ C:\Users\Public\Documents\HELP_DECRYPT.URL
2015-09-03 15:52 - 2015-09-03 15:52 - 00000496 _____ C:\Users\Test\Documents\LIST_FOR_KYLE_20150903_ALSO_GGSG_NOTES.txt
2015-09-03 15:43 - 2015-09-03 18:51 - 00004282 _____ C:\ProgramData\HELP_DECRYPT.TXT
2015-09-03 15:43 - 2015-09-03 18:51 - 00000320 _____ C:\ProgramData\HELP_DECRYPT.URL
2015-09-03 15:41 - 2015-09-03 20:10 - 00000000 ___HD C:\c6ad4dd5
5-08-24 13:45 - 00001380 _____ C:\Users\Test\Documents\TEXT_SITEMAP_ASF_FROM_20150811.txt
2015-08-24 13:41 - 2015-08-24 13:41 - 00000002 _____ C:\Users\Test\Documents\Copy of ASF-sitemap-filtered portfolio-revised.txt
2015-08-24 13:27 - 2015-08-24 13:27 - 00000165 ____H C:\Users\Test\Documents\~$ASF_DELIVERABLE_20150820-back-from-scott.xlsx
2015-08-24 12:11 - 2015-08-24 12:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-08-24 01:42 - 2015-07-22 20:06 - 05568960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-08-24 01:42 - 2015-07-22 20:06 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-08-24 01:42 - 2015-07-22 20:06 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-08-24 01:42 - 2015-07-22 20:03 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-08-24 01:42 - 2015-07-22 20:03 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-08-24 01:42 - 2015-07-22 20:03 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-08-24 01:42 - 2015-07-22 20:03 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-08-24 01:42 - 2015-07-22 20:03 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 01390592 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-08-24 01:42 - 2015-07-22 20:02 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-08-24 01:42 - 2015-07-22 20:02 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-08-24 01:42 - 2015-07-22 20:02 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-08-24 01:42 - 2015-07-22 20:01 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-08-24 01:42 - 2015-07-22 20:01 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-08-24 01:42 - 2015-07-22 20:01 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-08-24 01:42 - 2015-07-22 19:58 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-08-24 01:42 - 2015-07-22 19:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 19:51 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-08-24 01:42 - 2015-07-22 13:57 - 03989952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-08-24 01:42 - 2015-07-22 13:57 - 03934656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-08-24 01:42 - 2015-07-22 13:54 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-08-24 01:42 - 2015-07-22 13:53 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-08-24 01:42 - 2015-07-22 13:52 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-08-24 01:42 - 2015-07-22 13:52 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-08-24 01:42 - 2015-07-22 13:52 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-08-24 01:42 - 2015-07-22 13:52 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-08-24 01:42 - 2015-07-22 13:52 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-08-24 01:42 - 2015-07-22 13:52 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-08-24 01:42 - 2015-07-22 13:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-08-24 01:42 - 2015-07-22 13:47 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-08-24 01:42 - 2015-07-22 13:46 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 13:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 12:48 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-08-24 01:42 - 2015-07-22 12:45 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-08-24 01:42 - 2015-07-22 12:44 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-08-24 01:42 - 2015-07-22 12:44 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-08-24 01:42 - 2015-07-22 12:34 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-08-24 01:42 - 2015-07-22 12:34 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-08-24 01:42 - 2015-07-22 12:31 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 12:31 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 12:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-08-24 01:42 - 2015-07-22 12:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-08-24 01:42 - 2015-06-25 06:06 - 00115136 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-08-24 01:42 - 2015-06-25 06:01 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-08-24 01:42 - 2015-06-25 06:01 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-08-24 01:42 - 2015-06-25 05:44 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-08-24 01:37 - 2015-08-13 08:34 - 19292160 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-08-24 01:37 - 2015-08-13 07:02 - 14383616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-08-24 01:37 - 2015-08-13 06:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-08-24 01:37 - 2015-08-13 06:44 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-08-24 01:13 - 2015-08-24 01:13 - 25527544 _____ C:\Users\Test\Downloads\SeaToolsforWindowsSetup.exe
2015-08-24 01:13 - 2015-08-24 01:13 - 00001442 _____ C:\Users\Public\Desktop\SeaTools for Windows.lnk
2015-08-23 19:33 - 2015-07-30 09:13 - 00124624 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-08-23 19:33 - 2015-07-30 09:13 - 00103120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-08-23 19:15 - 2015-08-23 19:15 - 00001266 _____ C:\Users\Test\Desktop\Windows Update.lnk
2015-08-23 18:32 - 2015-07-30 14:06 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2015-08-23 18:32 - 2015-07-30 14:06 - 01648128 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-08-23 18:32 - 2015-07-30 14:06 - 01180160 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-08-23 18:32 - 2015-07-30 14:06 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-08-23 18:32 - 2015-07-30 14:06 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-08-23 18:32 - 2015-07-30 14:06 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-08-23 18:32 - 2015-07-30 14:06 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-08-23 18:32 - 2015-07-30 13:57 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2015-08-23 18:32 - 2015-07-30 13:57 - 01251328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-08-23 18:32 - 2015-07-30 13:57 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-08-23 18:32 - 2015-07-30 13:57 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-08-23 18:32 - 2015-07-30 13:57 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-08-23 18:32 - 2015-07-30 13:55 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-08-23 18:32 - 2015-07-30 12:56 - 03208192 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-08-23 18:32 - 2015-07-30 12:52 - 00372736 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-08-23 18:32 - 2015-07-30 12:49 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-08-23 18:32 - 2015-07-16 15:12 - 06131200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-08-23 18:32 - 2015-07-16 15:12 - 00856064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2015-08-23 18:32 - 2015-07-16 15:12 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2015-08-23 18:32 - 2015-07-16 15:11 - 07077376 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-08-23 18:32 - 2015-07-16 15:11 - 01057792 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2015-08-23 18:32 - 2015-07-16 15:11 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2015-08-23 18:32 - 2015-07-15 14:15 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-08-23 18:32 - 2015-07-15 14:10 - 01743360 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2015-08-23 18:32 - 2015-07-15 14:10 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-08-23 18:32 - 2015-07-14 23:19 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\basesrv.dll
2015-08-23 18:32 - 2015-07-11 09:15 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2015-08-23 18:32 - 2015-07-01 16:49 - 00260096 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2015-08-23 18:32 - 2015-07-01 16:48 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2015-08-23 18:32 - 2015-07-01 16:30 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2015-08-23 18:32 - 2015-07-01 16:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2015-08-23 18:31 - 2015-07-25 19:18 - 02239488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-08-23 18:31 - 2015-07-25 19:18 - 01409024 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-08-23 18:31 - 2015-07-25 19:18 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-08-23 18:31 - 2015-07-25 19:18 - 00601600 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-08-23 18:31 - 2015-07-25 19:18 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-08-23 18:31 - 2015-07-25 19:18 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-08-23 18:31 - 2015-07-25 19:18 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-08-23 18:31 - 2015-07-25 19:17 - 15415808 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-08-23 18:31 - 2015-07-25 19:17 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-08-23 18:31 - 2015-07-25 19:17 - 02657280 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-08-23 18:31 - 2015-07-25 19:17 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-08-23 18:31 - 2015-07-25 19:17 - 00856064 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-08-23 18:31 - 2015-07-25 19:17 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-08-23 18:31 - 2015-07-25 19:17 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-08-23 18:31 - 2015-07-25 19:17 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-08-23 18:31 - 2015-07-25 19:17 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-08-23 18:31 - 2015-07-25 19:17 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2015-08-23 18:31 - 2015-07-25 19:17 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-08-23 18:31 - 2015-07-25 19:17 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-08-23 18:31 - 2015-07-25 19:17 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-08-23 18:31 - 2015-07-25 16:24 - 01763328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-08-23 18:31 - 2015-07-25 16:24 - 01181696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-08-23 18:31 - 2015-07-25 16:24 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-08-23 18:31 - 2015-07-25 16:24 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-08-23 18:31 - 2015-07-25 16:24 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-08-23 18:31 - 2015-07-25 16:24 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 13774848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 02865664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 02056704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 01441280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-08-23 18:31 - 2015-07-25 16:23 - 00690176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-08-23 18:31 - 2015-07-25 16:23 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-08-23 18:31 - 2015-07-25 14:17 - 00361984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-08-23 18:31 - 2015-07-25 14:09 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-08-23 18:31 - 2015-07-25 13:52 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2015-08-23 18:31 - 2015-07-25 13:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2015-08-23 15:49 - 2015-07-28 16:09 - 00017344 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-08-23 15:49 - 2015-07-28 16:05 - 01116672 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-08-23 15:49 - 2015-07-28 16:05 - 00774656 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-08-23 15:49 - 2015-07-28 16:05 - 00743424 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-08-23 15:49 - 2015-07-28 16:05 - 00437760 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-08-23 15:49 - 2015-07-28 16:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-08-23 15:49 - 2015-07-28 16:05 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-08-23 15:49 - 2015-07-28 15:55 - 01148416 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-08-23 15:49 - 2015-07-14 23:19 - 02004992 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2015-08-23 15:49 - 2015-07-14 23:19 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-08-23 15:49 - 2015-07-14 23:14 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2015-08-23 15:49 - 2015-07-14 23:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-08-23 15:49 - 2015-07-14 22:55 - 01390592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2015-08-23 15:49 - 2015-07-14 22:55 - 01241088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-08-23 15:49 - 2015-07-14 22:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2015-08-23 15:49 - 2015-07-14 22:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-08-23 15:49 - 2015-07-10 13:51 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-08-23 15:49 - 2015-07-10 13:34 - 12875776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-08-23 15:49 - 2015-07-09 13:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\notepad.exe
2015-08-23 15:49 - 2015-07-09 13:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\notepad.exe
2015-08-23 15:49 - 2015-07-09 13:42 - 00179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
2015-08-23 15:44 - 2015-07-20 14:12 - 03154944 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-08-23 15:44 - 2015-07-20 14:12 - 02606080 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-08-23 15:44 - 2015-07-20 14:12 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-08-23 15:44 - 2015-07-20 14:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-08-23 15:44 - 2015-07-20 14:12 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-08-23 15:44 - 2015-07-20 14:12 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-08-23 15:44 - 2015-07-20 14:12 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-08-23 15:44 - 2015-07-20 14:12 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-08-23 15:44 - 2015-07-20 14:12 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-08-23 15:44 - 2015-07-20 14:12 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-08-23 15:44 - 2015-07-20 14:12 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-08-23 15:44 - 2015-07-20 13:56 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-08-23 15:44 - 2015-07-20 13:56 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-08-23 15:44 - 2015-07-20 13:56 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-08-23 15:44 - 2015-07-20 13:56 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-08-23 15:44 - 2015-07-20 13:56 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-08-23 14:18 - 2015-07-14 23:17 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-08-23 14:18 - 2015-07-14 22:54 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2015-08-23 14:18 - 2015-07-09 13:58 - 01632256 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-08-23 14:18 - 2015-07-09 13:58 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2015-08-23 14:18 - 2015-07-09 13:42 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-08-23 14:18 - 2015-07-09 13:42 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2015-08-23 00:34 - 2015-08-23 00:34 - 00000000 ____D C:\Users\Test\Downloads\openhardwaremonitor-v0.7.1-beta
2015-08-23 00:33 - 2015-08-23 00:33 - 00511764 _____ C:\Users\Test\Downloads\openhardwaremonitor-v0.7.1-beta.zip
2015-08-21 11:45 - 2015-08-21 11:45 - 00352326 _____ C:\Users\Test\Documents\bugreport.txt
2015-08-21 10:18 - 2015-08-21 10:18 - 00000000 _____ C:\Users\Test\Documents\flagrestart.dat
2015-08-21 09:36 - 2015-08-23 15:28 - 00000000 ____D C:\Users\Test\Documents\Configuration
2015-08-21 09:36 - 2015-08-23 15:28 - 00000000 ____D C:\Users\Test\Documents\Addons
2015-08-21 09:36 - 2015-08-21 11:45 - 00000000 ____D C:\Users\Test\Documents\Harvester_Sessions
2015-08-21 09:36 - 2015-08-21 09:36 - 00000000 ____D C:\Users\Test\Documents\TempFolder
2015-08-21 09:36 - 2015-08-21 09:36 - 00000000 ____D C:\Users\Test\Documents\Plugins
2015-08-21 09:36 - 2015-08-21 09:36 - 00000000 ____D C:\Users\Test\Documents\Grabbed Emails
2015-08-21 09:36 - 2015-08-21 09:36 - 00000000 ____D C:\Users\Test\Documents\Grabbed Data
2015-08-21 09:36 - 2015-08-21 09:36 - 00000000 ____D C:\Users\Test\Documents\Favorite Automator Jobs
2015-08-21 09:36 - 2015-08-21 09:36 - 00000000 ____D C:\Users\Test\Documents\Addon_Sessions
2015-08-21 09:26 - 2015-08-21 09:26 - 00000000 ____D C:\Users\Test\Documents\Microsys
2015-08-21 09:26 - 2015-08-21 09:26 - 00000000 ____D C:\Users\Test\AppData\Roaming\Microsys
2015-08-21 09:25 - 2015-08-21 09:25 - 00000000 ____D C:\Program Files\Microsys
2015-08-14 19:54 - 2015-08-14 19:54 - 00000000 _RSHD C:\acroldr
2015-08-14 19:36 - 2015-08-14 19:36 - 00000000 ____D C:\Users\Test\AppData\Roaming\Acronis
2015-08-14 19:31 - 2015-08-14 19:31 - 00296736 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\file_tracker.sys
2015-08-14 19:31 - 2015-08-14 19:31 - 00248648 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\tib_mounter.sys
2015-08-14 19:30 - 2015-08-14 19:30 - 00001258 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acronis True Image 2015.lnk
2015-08-14 19:30 - 2015-08-14 19:30 - 00001246 _____ C:\Users\Public\Desktop\Acronis True Image 2015.lnk
2015-08-14 19:30 - 2015-08-14 19:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acronis
2015-08-14 19:29 - 2015-08-14 19:29 - 00000000 ____D C:\Program Files (x86)\Acronis
2015-08-14 19:26 - 2015-08-14 19:31 - 352768000 _____ C:\Users\Test\Downloads\AcronisTrueImage2015_ur_en-US.msi
2015-08-14 19:25 - 2015-08-14 19:25 - 01782936 _____ (Acronis) C:\Users\Test\Downloads\AcronisTrueImage2015_web_en-US.exe
2015-08-14 18:55 - 2015-08-14 19:31 - 01058632 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\tib.sys
2015-08-14 18:55 - 2015-08-14 19:30 - 00304416 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\snapman.sys
2015-08-14 18:55 - 2015-08-14 19:30 - 00134432 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\fltsrv.sys
2015-08-14 18:55 - 2015-08-14 18:55 - 01462560 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\tdrpman.sys
2015-08-14 18:52 - 2015-08-14 18:53 - 266045952 _____ C:\Users\Test\Downloads\DiscWizardSetup-1605861.en.exe
2015-08-11 14:02 - 2015-08-11 14:02 - 09284296 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2015-08-10 18:08 - 2015-09-03 16:07 - 00000000 ___RD C:\Users\Test\Creative Cloud Files
2015-08-10 10:14 - 2015-08-10 12:05 - 00378509 ____H C:\Users\Test\Documents\~WRL3254.tmp
2015-08-09 18:39 - 2015-08-26 17:57 - 00002225 _____ C:\Users\Test\Desktop\Kindle.lnk

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-09-04 01:06 - 2014-07-15 13:50 - 00000000 ____D C:\Users\HomeGroupUser$
2015-09-04 01:06 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\registration
2015-09-03 21:14 - 2014-11-18 16:49 - 00000000 ____D C:\FRST
2015-09-03 21:13 - 2015-07-09 14:53 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-09-03 21:13 - 2015-04-28 12:03 - 00000000 ____D C:\Users\Test\AppData\Local\CrashDumps
2015-09-03 21:13 - 2014-08-06 15:04 - 00000556 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3105234330-458141651-3949311147-1000.job
2015-09-03 21:12 - 2014-07-01 19:58 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-09-03 21:12 - 2014-06-21 22:23 - 00000441 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2015-09-03 21:12 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-09-03 21:12 - 2009-07-14 00:51 - 00023371 _____ C:\Windows\setupact.log
2015-09-03 21:10 - 2014-07-06 18:21 - 00000000 ____D C:\Users\Test\AppData\Roaming\Everything
2015-09-03 21:08 - 2014-05-01 14:31 - 00000000 ____D C:\Users\Test
2015-09-03 20:17 - 2014-05-01 17:18 - 01186378 _____ C:\Windows\WindowsUpdate.log
2015-09-03 20:17 - 2010-05-17 16:13 - 00000000 ____D C:\Users\images
2015-09-03 20:14 - 2009-07-14 00:45 - 00026560 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-09-03 20:14 - 2009-07-14 00:45 - 00026560 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-09-03 20:07 - 2014-07-01 19:58 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-09-03 20:07 - 2009-07-14 01:13 - 00785942 _____ C:\Windows\system32\PerfStringBackup.INI
2015-09-03 20:05 - 2014-12-25 12:03 - 00000904 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3105234330-458141651-3949311147-1000UA.job
2015-09-03 20:05 - 2014-12-25 12:03 - 00000852 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3105234330-458141651-3949311147-1000Core.job
2015-09-03 20:04 - 2015-02-22 14:22 - 00000000 ____D C:\3243a3b1e153c37b8e3c2a
2015-09-03 20:04 - 2014-06-11 17:15 - 00000000 ____D C:\Users\Test\AppData\Roaming\Adobe
2015-09-03 20:04 - 2014-06-11 17:11 - 00000000 ____D C:\Users\Test\AppData\Roaming\Mozilla
2015-09-03 20:04 - 2014-05-10 17:41 - 00000000 ____D C:\AdwCleaner
2015-09-03 20:04 - 2014-05-01 14:55 - 00000000 ____D C:\Dell
2015-09-03 20:04 - 2012-09-26 21:23 - 00000000 ____D C:\bluescreenview
2015-09-03 20:03 - 2015-03-27 16:29 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-09-03 19:11 - 2015-02-04 15:08 - 00000000 ____D C:\Users\Test\AppData\Roaming\Skype
2015-09-03 19:10 - 2015-02-24 11:16 - 00000000 ____D C:\Users\Test\AppData\Local\Aviator
2015-09-03 19:10 - 2014-07-01 19:57 - 00000000 ____D C:\Users\Test\AppData\Local\Google
2015-09-03 19:10 - 2014-06-30 19:10 - 00000000 ____D C:\Users\Test\AppData\Local\Adobe
2015-09-03 19:09 - 2014-09-06 10:54 - 00000000 ____D C:\UPS
2015-09-03 19:06 - 2011-03-14 13:28 - 00000000 ____D C:\sj673
2015-09-03 19:05 - 2011-03-14 15:16 - 00000000 ____D C:\SCANJET
2015-09-03 18:51 - 2014-09-06 10:55 - 00000000 ____D C:\ProgramData\UPS
2015-09-03 18:51 - 2014-07-19 20:48 - 00000000 ____D C:\ProgramData\Sophos
2015-09-03 18:50 - 2015-04-11 12:19 - 00000000 ____D C:\ProgramData\HP
2015-09-03 18:50 - 2014-09-25 18:26 - 00000000 ____D C:\ProgramData\HTTPDebugger
2015-09-03 18:49 - 2015-03-19 00:49 - 00000000 ____D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-09-03 18:49 - 2015-03-10 15:18 - 00000000 ____D C:\ProgramData\EPSON
2015-09-03 18:49 - 2014-07-20 09:20 - 00000000 ____D C:\ProgramData\Acronis
2015-09-03 18:49 - 2014-06-29 10:16 - 00000000 ____D C:\ProgramData\Adobe
2015-09-03 18:49 - 2014-05-01 14:51 - 00000000 ____D C:\ProgramData\Dell
2015-09-03 18:49 - 2014-01-07 12:52 - 00000000 ____D C:\My Web Sites
2015-09-03 18:49 - 2013-03-05 13:26 - 00000000 ____D C:\OPEN_OFFICE_FILES
2015-09-03 18:49 - 2012-03-29 11:38 - 00000000 ____D C:\Office Samples
2015-09-03 18:30 - 2012-08-14 17:10 - 00000000 ____D C:\hp_CLJ_CP1215_Full_Solution
2015-09-03 18:21 - 2014-11-18 14:08 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-09-03 18:18 - 2013-11-27 15:36 - 00000000 ____D C:\dessy_XML
2015-09-03 16:25 - 2015-05-30 12:27 - 00000652 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-3105234330-458141651-3949311147-1000.job
2015-09-03 16:07 - 2015-06-23 10:00 - 00000000 ____D C:\Users\Test\AppData\Roaming\webex
2015-09-03 16:07 - 2014-09-02 10:29 - 00000000 ____D C:\Users\Test\AppData\Roaming\PFStaticIP
2015-09-03 16:07 - 2014-09-02 10:12 - 00000000 ____D C:\Users\Test\AppData\Roaming\PortForward.com
2015-09-03 16:07 - 2014-07-17 20:22 - 00000000 ____D C:\Users\Test\AppData\Roaming\OpenOffice
2015-09-03 16:07 - 2014-06-12 14:50 - 00000000 ____D C:\Users\Test\AppData\Roaming\TeamViewer
2015-09-03 16:07 - 2010-01-13 19:50 - 00000000 ____D C:\Users\Test\CS4Crack
2015-09-03 16:06 - 2015-04-11 12:29 - 00000000 ____D C:\Users\Test\AppData\Roaming\HP
2015-09-03 16:06 - 2014-09-05 17:52 - 00000000 ____D C:\Users\Test\AppData\Roaming\GoPro
2015-09-03 16:06 - 2014-05-16 11:20 - 00000000 ____D C:\Users\Test\AppData\Roaming\Intel
2015-09-03 16:05 - 2015-02-12 19:24 - 00000000 ____D C:\Users\Test\AppData\Roaming\FileZilla
2015-09-03 16:05 - 2015-02-04 15:08 - 00000000 ____D C:\Users\Test\AppData\Local\Skype
2015-09-03 16:05 - 2014-08-16 08:42 - 00000000 ____D C:\Users\Test\AppData\Roaming\Google
2015-09-03 16:05 - 2014-08-01 11:28 - 00000000 ____D C:\Users\Test\AppData\Roaming\eFax Messenger
2015-09-03 16:02 - 2015-04-11 12:30 - 00000000 ____D C:\Users\Test\AppData\Local\HP
2015-09-03 16:02 - 2014-09-06 11:54 - 00000000 ____D C:\Users\Test\AppData\Local\GoPro
2015-09-03 16:01 - 2015-07-11 10:40 - 00000000 ____D C:\Users\Test\AppData\Local\Caphyon
2015-09-03 16:01 - 2015-03-31 23:59 - 00000000 ____D C:\Users\Test\AppData\Local\Apps\Windows 7 USB DVD Download Tool
2015-09-03 16:01 - 2014-12-17 20:24 - 00000000 ____D C:\Users\Test\AppData\Local\FreeEditorEditTemp
2015-09-03 16:01 - 2014-10-28 11:00 - 00000000 ____D C:\Users\Test\AppData\Local\Barracuda
2015-09-03 16:01 - 2014-08-06 15:04 - 00000000 ____D C:\Users\Test\AppData\Local\Citrix
2015-09-03 16:01 - 2014-07-20 22:32 - 00000000 ____D C:\Users\Test\AppData\Local\Apple Computer
2015-09-03 16:01 - 2014-05-01 14:51 - 00000000 ____D C:\Users\Test\AppData\Local\Dell
2015-09-03 16:00 - 2014-12-10 11:09 - 00000000 ____D C:\Users\Test\AppData\Local\Amazon
2015-09-03 16:00 - 2014-06-14 10:16 - 00000000 ____D C:\Users\Test\AppData\Local\Akamai
2015-09-03 16:00 - 2012-03-20 10:53 - 00000000 ____D C:\Users\Test\AMP_VIBRAM
2015-09-03 16:00 - 2011-07-18 18:25 - 00000000 ____D C:\Users\Test\.ScreamingFrogSEOSpider
2015-09-03 15:59 - 2015-01-05 16:14 - 00000000 ____D C:\Users\Public\Documents\Intuit
2015-09-03 15:59 - 2012-04-09 18:47 - 00000000 ____D C:\Users\Public\Philips
2015-09-03 15:58 - 2014-07-15 13:49 - 00000000 ____D C:\Users\Public\Documents\Bella_2014
2015-09-03 15:58 - 2014-03-19 22:25 - 00000000 ____D C:\Users\Public\Documents\HOBOware Public Files
2015-09-03 15:45 - 2014-07-19 12:39 - 00000000 ____D C:\Users\Test\Documents\Outlook Files
2015-09-03 15:43 - 2015-07-25 15:48 - 00000000 ____D C:\ProgramData\PassMark
2015-09-03 15:43 - 2015-01-05 16:11 - 00000000 ____D C:\ProgramData\INTUIT
2015-09-03 15:43 - 2014-06-21 19:46 - 00000000 ____D C:\Users\Public\Documents\1evbg968.default-1385573340064
2015-09-03 15:42 - 2014-08-06 12:45 - 00000000 ____D C:\ProgramData\Apple Computer
2015-09-02 14:05 - 2015-05-30 12:27 - 00003686 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-3105234330-458141651-3949311147-1000
2015-09-02 14:05 - 2014-08-06 15:04 - 00003590 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-3105234330-458141651-3949311147-1000
2015-08-30 23:59 - 2015-06-01 16:48 - 00000000 ____D C:\Users\Test\AppData\Roaming\vlc
2015-08-30 20:16 - 2009-07-13 22:37 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2015-08-30 20:14 - 2014-11-18 16:47 - 02188288 _____ (Farbar) C:\Users\Test\Downloads\FRST64.exe
2015-08-30 12:35 - 2015-03-27 18:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-08-30 12:35 - 2014-05-01 14:57 - 00218322 _____ C:\Windows\PFRO.log
2015-08-30 10:26 - 2015-06-24 13:32 - 00000499 _____ C:\Users\Test\Documents\sitemapindex.xml
2015-08-28 17:02 - 2009-07-14 01:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2015-08-28 12:20 - 2014-11-18 14:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-08-27 20:00 - 2014-12-25 12:03 - 00003872 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3105234330-458141651-3949311147-1000UA
2015-08-27 20:00 - 2014-12-25 12:03 - 00003476 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3105234330-458141651-3949311147-1000Core
2015-08-27 15:02 - 2014-07-01 19:58 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-08-27 15:02 - 2014-07-01 19:58 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-08-26 20:06 - 2014-12-10 11:10 - 00000000 ____D C:\Users\Test\Documents\My Kindle Content
2015-08-24 12:12 - 2015-02-04 15:07 - 00000000 ____D C:\ProgramData\Skype
2015-08-24 12:11 - 2015-02-04 15:07 - 00002697 _____ C:\Users\Public\Desktop\Skype.lnk
2015-08-24 12:11 - 2015-02-04 15:07 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-08-24 11:42 - 2014-11-18 16:50 - 00088029 _____ C:\Users\Test\Downloads\FRST.txt
2015-08-24 07:18 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\rescache
2015-08-24 01:13 - 2014-07-20 09:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seagate
2015-08-24 01:13 - 2014-07-20 09:20 - 00000000 ____D C:\Program Files (x86)\Seagate
2015-08-24 01:13 - 2014-05-16 11:18 - 00000000 ____D C:\ProgramData\Package Cache
2015-08-23 22:02 - 2015-03-27 21:54 - 00002224 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-08-23 21:07 - 2014-06-16 07:45 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-08-23 21:07 - 2009-07-14 00:45 - 00457744 _____ C:\Windows\system32\FNTCACHE.DAT
2015-08-23 21:06 - 2014-06-16 07:45 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-08-23 21:05 - 2014-12-11 08:21 - 00000000 ____D C:\Windows\system32\appraiser
2015-08-23 21:05 - 2014-06-16 08:57 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-08-23 19:33 - 2014-06-16 07:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-08-23 19:31 - 2014-06-16 06:10 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-08-23 19:26 - 2009-07-13 22:34 - 00000478 _____ C:\Windows\win.ini
2015-08-23 19:25 - 2014-05-16 13:48 - 00000000 ____D C:\Windows\system32\MRT
2015-08-23 19:19 - 2014-05-16 13:48 - 132483416 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-08-23 15:28 - 2015-04-07 16:56 - 00000000 ___SD C:\Windows\system32\GWX
2015-08-23 15:28 - 2015-03-27 21:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-08-23 15:28 - 2014-07-17 16:22 - 00000000 ____D C:\Users\Test\AppData\Roaming\IrfanView
2015-08-23 15:28 - 2014-06-16 06:10 - 00000000 ____D C:\Users\Test\AppData\Local\Microsoft Help
2015-08-23 15:28 - 2009-07-13 23:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2015-08-23 00:19 - 2015-07-08 08:48 - 00000334 _____ C:\Users\Test\Documents\movies_2015.txt
2015-08-19 20:28 - 2015-02-12 19:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2015-08-19 20:28 - 2015-02-12 19:22 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client
2015-08-14 18:58 - 2014-07-20 09:26 - 00000000 ____D C:\ProgramData\Seagate
2015-08-14 18:56 - 2014-07-20 09:29 - 00000000 ____D C:\Users\Test\AppData\Roaming\Seagate
2015-08-11 14:02 - 2015-03-27 16:29 - 00778440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-08-11 14:02 - 2015-03-27 16:29 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-08-11 14:02 - 2015-03-27 16:29 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-08-09 08:12 - 2015-04-14 13:24 - 00000000 ____D C:\Users\Test\Documents\CODECANYON_CODE_LOCKER
2015-08-07 13:06 - 2015-01-09 21:00 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2015-08-06 20:08 - 2015-08-03 14:38 - 00001153 _____ C:\Users\Test\Documents\bnb_2015.txt
2015-08-05 16:32 - 2014-07-20 11:58 - 00002360 _____ C:\Users\Test\Desktop\Latitude-Hardwire.RDP

==================== Files in the root of some directories =======

2013-12-29 23:46 - 2013-12-29 23:46 - 2174976 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\Common Files\atimpenc.dll
2015-09-03 16:06 - 2015-09-03 19:11 - 0045905 _____ () C:\Users\Test\AppData\Roaming\HELP_DECRYPT.PNG
2015-09-03 16:06 - 2015-09-03 19:11 - 0004282 _____ () C:\Users\Test\AppData\Roaming\HELP_DECRYPT.TXT
2015-09-03 16:06 - 2015-09-03 19:11 - 0000320 _____ () C:\Users\Test\AppData\Roaming\HELP_DECRYPT.URL
2014-10-06 21:53 - 2014-12-01 01:39 - 0003584 _____ () C:\Users\Test\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-09-03 16:04 - 2015-09-03 19:10 - 0045905 _____ () C:\Users\Test\AppData\Local\HELP_DECRYPT.PNG
2015-09-03 16:04 - 2015-09-03 19:10 - 0004282 _____ () C:\Users\Test\AppData\Local\HELP_DECRYPT.TXT
2015-09-03 16:04 - 2015-09-03 19:10 - 0000320 _____ () C:\Users\Test\AppData\Local\HELP_DECRYPT.URL
2014-06-13 14:01 - 2015-03-12 16:46 - 0007618 _____ () C:\Users\Test\AppData\Local\Resmon.ResmonCfg
2015-09-03 15:43 - 2015-09-03 18:51 - 0045905 _____ () C:\ProgramData\HELP_DECRYPT.PNG
2015-09-03 15:43 - 2015-09-03 18:51 - 0004282 _____ () C:\ProgramData\HELP_DECRYPT.TXT
2015-09-03 15:43 - 2015-09-03 18:51 - 0000320 _____ () C:\ProgramData\HELP_DECRYPT.URL
2015-04-11 12:20 - 2015-04-11 12:29 - 0000364 _____ () C:\ProgramData\hpzinstall.log
2015-05-22 09:11 - 2015-05-22 09:11 - 0010266 _____ () C:\ProgramData\regid.2015-05.exe.textpad_83F5EF12-C2F9-4C11-A5C5-57A7B2D7AD25.swidtag

Files to move or delete:
====================
C:\Users\Test\MGtools.exe


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-09-03 13:45

==================== End of FRST.txt ============================


Additional scan result of Farbar Recovery Scan Tool (x64) Version:31-08-2015
Ran by Test (2015-09-03 21:15:43)
Running from E:\
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3105234330-458141651-3949311147-500 - Administrator - Disabled)
Guest (S-1-5-21-3105234330-458141651-3949311147-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-3105234330-458141651-3949311147-1004 - Limited - Enabled) => C:\Users\HomeGroupUser$
Test (S-1-5-21-3105234330-458141651-3949311147-1000 - Administrator - Enabled) => C:\Users\Test

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Acronis True Image 2015 (HKLM-x32\...\{35CFA5F4-EE2D-4B13-AAED-BC643B6874B5}Visible) (Version: 18.0.6613 - Acronis)
Acronis True Image 2015 (x32 Version: 18.0.6613 - Acronis) Hidden
Adobe Acrobat XI Pro (HKLM-x32\...\{AC76BA86-1033-FFFF-7760-000000000006}) (Version: 11.0.07 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.1.0.5790 - Adobe Systems Inc.)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 3.2.0.129 - Adobe Systems Incorporated)
Adobe Dreamweaver CC 2015 (HKLM-x32\...\{EE2A0AA8-0386-11E5-8603-BC82F5DB1A71}) (Version: 16.0.1 - Adobe Systems Incorporated)
Adobe Flash Player 18 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Media Player (HKLM-x32\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.1 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.12) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.7.157 - Adobe Systems, Inc.)
Advanced Web Ranking (HKLM-x32\...\{3085BC32-0349-49E3-ACE9-C58A66FC1AEF}) (Version: 11.1 - Caphyon)
AdWords Editor (HKLM-x32\...\{7690724C-0329-4830-97DE-F765D5AD7705}) (Version: 11.1.2 - Google)
AirPort (HKLM-x32\...\{AA68AAAE-41F0-40B5-8896-5947F5FD6889}) (Version: 5.6.1.2 - Apple Inc.)
Akamai NetSession Interface (HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\Akamai) (Version:  - Akamai Technologies, Inc)
Amazon Kindle (HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\Amazon Kindle) (Version:  - Amazon)
Apple Application Support (32-bit) (HKLM-x32\...\{7FE25256-B7C1-480D-B736-10A67A833AEA}) (Version: 3.2 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{B255D495-4734-4E9B-B4F5-96702FD4A7B9}) (Version: 3.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{5D61F006-168C-4B8B-B7FD-F113C10AE0E4}) (Version: 8.2.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Aviator (HKLM-x32\...\{B0E4AA1D-76A7-48B5-AAA1-D68BDBB1FF99}) (Version: 2.6 - WhiteHat Security, Inc.)
Barracuda Spam Firewall Outlook Add-In 6.1.15.0 (HKLM-x32\...\{77586C6C-C0F6-4575-854D-9473A71BBD57}) (Version: 6.1.15.0 - Barracuda Networks)
BatteryMon V2.1 (HKLM-x32\...\BatteryMon_is1) (Version:  - PassMark Software)
Belarc Advisor 8.4 (HKLM-x32\...\Belarc Advisor) (Version: 8.4.0.0 - Belarc Inc.)
BlackArmor Backup (HKLM-x32\...\{9DF6EC22-733E-4EDC-AC88-54CAD4BF4E7B}) (Version: 12.1.9768 - Seagate)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
BufferChm (x32 Version: 130.0.327.000 - Hewlett-Packard) Hidden
Cisco WebEx Meetings (HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\ActiveTouchMeetingClient) (Version:  - Cisco WebEx LLC)
Citrix Online Launcher (HKLM-x32\...\{DB014C85-A264-4BCA-A66F-6DD1FCF8EC36}) (Version: 1.0.335 - Citrix)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 8.1200.101.134 - ALPS ELECTRIC CO., LTD.)
Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden
DocProc (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
eFax Messenger (HKLM-x32\...\{DF6DA606-904D-4C18-823F-A4CFC3035E53}) (Version: 4.4.2.533 - j2 Global)
Epson USB Display (HKLM-x32\...\{7650F538-6274-44EA-8F50-843479073333}) (Version: 1.62.000 - SEIKO EPSON CORPORATION)
EPSON WF-7520 Series Printer Uninstall (HKLM\...\EPSON WF-7520 Series) (Version:  - SEIKO EPSON Corporation)
Everything 1.3.4.686 (x64) (HKLM\...\Everything) (Version:  - )
FileZilla Client 3.13.0 (HKLM-x32\...\FileZilla Client) (Version: 3.13.0 - Tim Kosse)
Free Editor (HKLM\...\{1BF14E04-85DE-480C-9A04-EB36744C66B4}_is1) (Version: 2.5 - Blue Labs, LLC)
Google AdWords Editor (HKLM-x32\...\{14069A87-872C-41E6-9D36-B1BE3870C35A}) (Version: 10.6.0 - Google)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 44.0.2403.157 - Google Inc.)
Google Earth Pro (HKLM-x32\...\{44FC61F0-2F8A-11E3-8CAE-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Talk Plugin (HKLM-x32\...\{CA3DD97D-1FD7-37A7-BD5C-FC4430C8B8E6}) (Version: 5.41.2.0 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.28.13 - Google Inc.) Hidden
GoToMeeting 7.2.5.3356 (HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\GoToMeeting) (Version: 7.2.5.3356 - CitrixOnline)
GPBaseService2 (x32 Version: 130.0.367.000 - Hewlett-Packard) Hidden
Hex Color Finder (HKLM-x32\...\{B26AEDA3-B044-4FC0-B243-871FDAA6D2B6}) (Version:  - )
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
HP Scanjet G3010 (HKLM\...\{3B3FA519-42F3-4534-B867-960481329CFC}) (Version: 13.0 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM-x32\...\{7059BDA7-E1DB-442C-B7A1-6144596720A4}) (Version: 4.000.011.006 - Hewlett-Packard)
hpg3010 (x32 Version: 14.0.0.0 - Hewlett-Packard) Hidden
HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 130.0.367.000 - Hewlett-Packard) Hidden
HTTP Debugger 6.4 (HKLM-x32\...\HTTP Debugger) (Version: 6.4 - MadeForNet)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6491.0 - IDT)
InstallVC90Support (x32 Version: 1.01.0000 - Novatel Wireless) Hidden
Intel® Network Connections 18.1.59.00 (HKLM\...\PROSetDX) (Version: 18.1.59.00 - Intel)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3958 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{7a06df8f-4c5a-4207-aa9e-019406e3a46d}) (Version: 17.1.0 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
iTunes (HKLM\...\{4046F74A-28F8-48C6-A5D3-2AFC472574C1}) (Version: 12.2.0.145 - Apple Inc.)
Java 8 Update 51 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418051F0}) (Version: 8.0.510 - Oracle Corporation)
Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft ASP.NET MVC 2 (HKLM-x32\...\{DD8FF2F3-0D97-4CF3-AF78-FA0E1B242244}) (Version: 2.0.60926.0 - Microsoft Corporation)
Microsoft Expression Encoder 4 (HKLM-x32\...\Encoder_4.0.4276.0) (Version: 4.0.4276.0 - Microsoft Corporation)
Microsoft Expression Encoder 4 Screen Capture Codec (HKLM-x32\...\{64C12304-7010-43F3-A25B-BDC38DE41E46}) (Version: 4.0.4276.0 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Power Query for Excel (HKLM-x32\...\{693CDEF2-D183-4AD9-A052-C1A06A3BA2CD}) (Version: 2.13.3688.242 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Native Client (HKLM\...\{9ACF3FDB-C8E6-444C-8C64-13A221F7BFFD}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft SQL Server Setup Support Files (English) (HKLM-x32\...\{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{B636C9B9-A3F2-4DCE-ADCC-72E095018385}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 40.0.3 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 40.0.3 (x86 en-US)) (Version: 40.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 40.0.3.5716 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Netwaiting (HKLM-x32\...\{3F92ABBB-6BBF-11D5-B229-002078017FBF}) (Version: 2.5.59 - BVRP Software, Inc)
NovaBench 3.0.4 (HKLM-x32\...\{88603FC0-6B3C-442D-981E-E3D49F083548}_is1) (Version:  - Novawave Inc.)
O2Micro Flash Memory Card Windows Driver (HKLM-x32\...\InstallShield_{D535FC73-1F63-4347-896A-C97A45F11E9C}) (Version: 3.0.07.44 - O2Micro International LTD.)
O2Micro Flash Memory Card Windows Driver (x32 Version: 3.0.07.44 - O2Micro International LTD.) Hidden
OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP)
OpenOffice 4.1.0 (HKLM-x32\...\{C87EF11D-36E9-479D-9898-7541EA1E8A6A}) (Version: 4.10.9764 - Apache Software Foundation)
paint.net (HKLM\...\{19BD2C33-16A8-4ED1-B9EA-D9E35B21EC42}) (Version: 4.0.5 - dotPDN LLC)
PowerGREP 4 DEMO 4.6.2 (HKLM\...\PowerGREP 4) (Version: DEMO 4.6.2 - Just Great Software)
QuickBooks (x32 Version: 25.0.4006.2506 - Intuit Inc.) Hidden
QuickBooks Premier: Nonprofit Edition 2015 (HKLM-x32\...\{3307A394-6031-409D-87C9-2FDF8F4DB76C}) (Version: 25.0.4005.2506 - Intuit Inc.)
QuickBooks Runtime Redistributable (HKLM\...\{F2A4F809-2DE6-4D27-888B-4D2BB8DAF20E}) (Version: 1.00.0000 - Intuit Inc.)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.30.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.30.0 - Renesas Electronics Corporation) Hidden
Scan (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
Screaming Frog SEO Spider (HKLM-x32\...\Screaming Frog SEO Spider) (Version: 4.1 - Screaming Frog Ltd)
SeaTools for Windows 1.4.0.2 (HKLM-x32\...\SeaTools for Windows) (Version: 1.4.0.2 - Seagate Technology)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.4.0.9058 - Microsoft Corporation)
Skypeâ„¢ 7.8 (HKLM-x32\...\{6A0549A9-1B96-498C-ACBC-3943001FEB19}) (Version: 7.8.102 - Skype Technologies S.A.)
SnagIt 8 (HKLM-x32\...\{DA0BF7AB-88EB-4675-8FA1-531EAD938821}) (Version: 8.2.3 - TechSmith Corporation)
SolutionCenter (x32 Version: 130.0.369.000 - Hewlett-Packard) Hidden
Sophos Virus Removal Tool (HKLM-x32\...\{B829E117-D072-41EA-9606-9826A38D34C1}) (Version: 2.5.1 - Sophos Limited)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
System Requirements Lab for Intel (HKLM-x32\...\{04C4B49D-45D9-4A28-9ED1-B45CBD99B8C7}) (Version: 4.5.24.0 - Husdawg, LLC)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.42849 - TeamViewer)
TextPad 7 (HKLM\...\{D5CA0106-90CE-4842-8194-A6D4A46FAA0E}) (Version: 7.5.1 - Helios)
UPSVC2008MM (x32 Version: 1.00.0000 - UPS) Hidden
UPSVCMM (x32 Version: 12.00.0000 - UPS) Hidden
VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden
VC12X64Redist (HKLM\...\{B573CC21-AE24-4BC5-9B0B-15CF29A3F982}) (Version: 1.00.0000 - Intuit Inc.)
VC12X86Redist (HKLM-x32\...\{EA9886ED-21F8-4867-A049-CE6817291EE6}) (Version: 1.00.0000 - Intuit Inc.)
Visual Studio Tools for the Office system 3.0 Runtime (HKLM-x32\...\Visual Studio Tools for the Office system 3.0 Runtime) (Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (HKLM-x32\...\{8FB53850-246A-3507-8ADE-0060093FFEA6}.KB949258) (Version: 1 - Microsoft Corporation)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.1 - VideoLAN)
WebReg (x32 Version: 130.0.128.017 - Hewlett-Packard) Hidden
Widevine Media Optimizer IE 6.0.0 (HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\optimizer_ie) (Version: 6.0.0.12757 - Widevine Technologies)
WinCDEmu (HKLM-x32\...\WinCDEmu) (Version: 3.6 - Bazis)
Windows 7 USB/DVD Download Tool (HKLM-x32\...\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
Windows Driver Package - Dell Inc (DellRbtn) HIDClass  (07/31/2012 1.4) (HKLM\...\DFFC4013304EDB1027D2BAEBE06DF2A4BD2608D3) (Version: 07/31/2012 1.4 - Dell Inc)
Windows Driver Package - GoPro (WinUSB) Universal Serial Bus devices  (03/07/2012 ) (HKLM\...\0B624A43DD66DBF5CF3EDFA9741A364E688062A4) (Version: 03/07/2012  - GoPro)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinHTTrack Website Copier 3.48-21 (x64) (HKLM\...\WinHTTrack Website Copier_is1) (Version: 3.48.21 - HTTrack)
Xenu's Link Sleuth (HKLM-x32\...\Xenu's Link Sleuth) (Version: 1.3.8 - Tilman Hausherr)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3105234330-458141651-3949311147-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-3105234330-458141651-3949311147-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\Test\AppData\Local\Citrix\GoToMeeting\1468\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)
CustomCLSID: HKU\S-1-5-21-3105234330-458141651-3949311147-1000_Classes\CLSID\{8A791F0C-C63C-4EC5-B97F-FBCE74EDBC54}\InprocServer32 -> C:\Program Files\TextPad 7\System\shellext64.dll ()
CustomCLSID: HKU\S-1-5-21-3105234330-458141651-3949311147-1000_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)

==================== Restore Points =========================

31-08-2015 19:49:04 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030
31-08-2015 19:51:43 Removed DeskBar
03-09-2015 15:41:51 Microsoft Antimalware Checkpoint
03-09-2015 20:12:53 Restore Operation
03-09-2015 20:17:32 Windows Update

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 22:34 - 2009-06-10 17:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {37980731-94A9-43CD-BB28-2B064F392258} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {401AC99D-0A5C-4C6E-BBCE-50A08A9CEFB5} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3105234330-458141651-3949311147-1000Core => C:\Users\Test\AppData\Local\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)
Task: {5293FB37-4173-4A99-9D54-BB3A7114B923} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)
Task: {59C238F1-4158-465C-AED5-CADC7F4EEC4F} - System32\Tasks\G2MUpdateTask-S-1-5-21-3105234330-458141651-3949311147-1000 => C:\Users\Test\AppData\Local\Citrix\GoToMeeting\3356\g2mupdate.exe [2015-09-02] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {5F4C6BBE-C57E-4252-BA23-EE5FE26445CE} - System32\Tasks\AviatorUpdateTask => Wscript.exe "C:\Program Files (x86)\WhiteHat\Aviator\Update\BatchLauncher.vbs" "C:\Program Files (x86)\WhiteHat\Aviator\Update\AviatorAutoUpdate.exe"
Task: {7BDD93E6-EC7E-450A-9585-0596BDF847F0} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiser
Task: {84647FCE-36EF-4507-8DCC-FAC320176B12} - System32\Tasks\{66E948A9-38A3-48B8-9FFE-7635B12F9D9E} => pcalua.exe -a C:\Users\Test\Desktop\6430\Audio\IDT_92HD93-HD-AUDIO_RPG74_A06_2_SETUP_ZPE.exe -d C:\Users\Test\Desktop\6430\Audio
Task: {961FCA93-7148-43B6-850C-5B16DEE4256F} - System32\Tasks\AdobeAAMUpdater-1.0-YADDOW-E6430-Test => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2015-07-22] (Adobe Systems Incorporated)
Task: {AB19A3CA-4CE4-4131-A7B1-632628886296} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3105234330-458141651-3949311147-1000UA => C:\Users\Test\AppData\Local\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)
Task: {C14A0FD9-F678-41B7-AD87-E1F9897E240D} - System32\Tasks\G2MUploadTask-S-1-5-21-3105234330-458141651-3949311147-1000 => C:\Users\Test\AppData\Local\Citrix\GoToMeeting\3356\g2mupload.exe [2015-09-02] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {C57FBE5A-5FB7-41C3-9240-6509C0F98C39} - System32\Tasks\{20D6A9BC-2436-4B47-85D0-877EAFF7CDAE} => pcalua.exe -a "C:\Users\Test\Downloads\Firefox Setup Stub 30.0.exe" -d C:\Users\Test\Desktop
Task: {DBE4DC9C-1F03-4819-ABE3-3670EFCBDFD7} - System32\Tasks\{7A7F1974-D6A4-43F9-9193-01D34F06A2BE} => pcalua.exe -a C:\Users\Test\Downloads\ALPS_MULTI-TOUCH-TOUCHPAD_A05_JXJ2F_SETUP_ZPE.exe -d C:\Users\Test\Desktop
Task: {E3CD06EF-7C17-4252-BFEB-1D3BD3B45D17} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)
Task: {E57565B2-06A3-43F7-BEA5-4340CAEE46C8} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-11] (Adobe Systems Incorporated)
Task: {FB64E97B-E9E6-482B-A6A7-BD8C3B79F7DA} - System32\Tasks\{8EEA9B04-94A9-43DD-BC62-B062FD06ED5A} => pcalua.exe -a "C:\Program Files (x86)\ImTOO\DVD to MP4 Converter\Uninstall.exe"

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3105234330-458141651-3949311147-1000.job => C:\Users\Test\AppData\Local\Citrix\GoToMeeting\3356\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-3105234330-458141651-3949311147-1000.job => C:\Users\Test\AppData\Local\Citrix\GoToMeeting\3356\g2mupload.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3105234330-458141651-3949311147-1000Core.job => C:\Users\Test\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3105234330-458141651-3949311147-1000UA.job => C:\Users\Test\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2014-07-15 12:25 - 2012-08-31 15:03 - 00288768 _____ () C:\Windows\System32\HP1100LM.DLL
2014-07-15 12:25 - 2012-08-31 15:02 - 00074240 _____ () C:\Windows\system32\spool\PRTPROCS\x64\HP1100PP.DLL
2015-07-22 01:02 - 2015-07-22 01:02 - 00803488 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 15:23 - 2010-10-20 15:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2015-08-15 08:42 - 2015-08-15 08:42 - 00043480 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2014-07-06 18:21 - 2014-08-05 21:04 - 01441792 _____ () C:\Program Files\Everything\Everything.exe
2015-02-13 04:20 - 2015-02-13 04:20 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-05-15 16:26 - 2015-05-15 16:26 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-08-23 22:02 - 2015-08-18 01:21 - 01763144 _____ () C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.157\libglesv2.dll
2015-08-23 22:02 - 2015-08-18 01:21 - 00093000 _____ () C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.157\libegl.dll
2015-07-22 01:02 - 2015-07-22 01:02 - 31535264 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 15:45 - 2010-10-20 15:45 - 08801120 _____ () C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2014-08-04 15:32 - 2014-08-04 15:32 - 00107048 _____ () C:\Program Files (x86)\HTTP Debugger\nfapi.dll
2014-08-04 15:32 - 2014-08-04 15:32 - 00348200 _____ () C:\Program Files (x86)\HTTP Debugger\ProtocolFilters.dll
2015-07-22 15:32 - 2015-07-22 15:32 - 36732592 _____ () C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\CEF\libcef.dll
2014-05-01 15:16 - 2003-04-18 18:06 - 00008192 _____ () C:\Windows\SysWOW64\srvany.exe

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Windows\system32\Drivers\zonvbdnt.sys:changelist
AlternateDataStreams: C:\Users\Test\Downloads\noname.eml:OECustomProperty

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\dell.com -> dell.com
IE trusted site: HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\sharepoint.com -> hxxps://interactology.sharepoint.com

IE restricted site: HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-3105234330-458141651-3949311147-1000\...\123simsen.com -> www.123simsen.com

There are 6705 more restricted sites.

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3105234330-458141651-3949311147-1000\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 75.75.75.75 - 75.75.76.76
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^GoPro Importer.lnk => C:\Windows\pss\GoPro Importer.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Intuit Data Protect.lnk => C:\Windows\pss\Intuit Data Protect.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk => C:\Windows\pss\QuickBooks Update Agent.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickBooks_Standard_21.lnk => C:\Windows\pss\QuickBooks_Standard_21.lnk.CommonStartup
MSCONFIG\startupreg: AcronisTimounterMonitor => C:\Program Files (x86)\Seagate\BlackArmorBackup\TimounterMonitor.exe
MSCONFIG\startupreg: BlackArmorBackupMonitor.exe => C:\Program Files (x86)\Seagate\BlackArmorBackup\BlackArmorBackupMonitor.exe
MSCONFIG\startupreg: EPLTarget =>

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [TCP Query User{D0764D0E-756B-4AF4-9E5F-2E63CF1114C2}C:\users\test\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\test\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{86D35F1A-2C54-4815-81BB-A54F2DB7D15A}C:\users\test\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\test\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{A0BC5078-90E0-495B-B42E-7E7E89B21E1C}C:\users\test\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\test\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{218DA07C-E581-464F-A5C2-5C7907EF6683}C:\users\test\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\test\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{5DAC55F2-33B1-4554-97A5-D708EE280B95}C:\program files (x86)\portforward.com\portforward network utilities\pfportchecker.exe] => (Allow) C:\program files (x86)\portforward.com\portforward network utilities\pfportchecker.exe
FirewallRules: [UDP Query User{07A65107-FF6C-46DB-9115-094BC388EC27}C:\program files (x86)\portforward.com\portforward network utilities\pfportchecker.exe] => (Allow) C:\program files (x86)\portforward.com\portforward network utilities\pfportchecker.exe
FirewallRules: [TCP Query User{6D22C3B8-DE50-4081-A96C-FE402739B829}C:\program files (x86)\portforward.com\portforward network utilities\pfportchecker.exe] => (Allow) C:\program files (x86)\portforward.com\portforward network utilities\pfportchecker.exe
FirewallRules: [UDP Query User{3F492AF2-EC9F-47DE-95CD-D5A5BCF4D559}C:\program files (x86)\portforward.com\portforward network utilities\pfportchecker.exe] => (Allow) C:\program files (x86)\portforward.com\portforward network utilities\pfportchecker.exe
FirewallRules: [{CEAED572-C09B-499D-9061-4516C688D4BB}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{B917FD5F-BC87-4CD3-9ED6-09D399EF0A9A}] => (Allow) C:\Program Files (x86)\AirPort\APAgent.exe
FirewallRules: [{F5786E27-36FD-407E-87A7-385970B15848}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{084470E7-465D-4325-9F9E-3B3C8DB772B4}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{049320CF-DE70-4871-B97F-426D5DC6912F}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{1C382CC9-82CF-4A71-9BA8-02E9A0C92959}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [TCP Query User{F08A9CD4-423A-4E41-86E5-717E506B3F1A}C:\program files (x86)\airport\aputil.exe] => (Allow) C:\program files (x86)\airport\aputil.exe
FirewallRules: [UDP Query User{720C7296-0F9F-4248-8F4B-C60B19AAA6C8}C:\program files (x86)\airport\aputil.exe] => (Allow) C:\program files (x86)\airport\aputil.exe
FirewallRules: [{1ACD6FEA-8C8F-4C92-9BCF-DD3F76B867F7}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{5D509489-59E1-4600-9E76-85BED5B1EC5E}] => (Allow) LPort=2869
FirewallRules: [{D8E6FAAD-0E1E-421A-A5D8-393F315E20BE}] => (Allow) LPort=1900
FirewallRules: [{FB928304-2FE9-4B11-B220-9D23DF61E1A1}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{5E0F10BC-EB58-4FCB-AA32-3DC400D046FF}] => (Allow) C:\Program Files (x86)\FileZilla FTP Client\filezilla.exe
FirewallRules: [{0F184439-D064-4749-BF49-13704AD43B24}] => (Allow) C:\Program Files (x86)\FileZilla FTP Client\filezilla.exe
FirewallRules: [{01850589-1540-4711-ADC9-36EF144E6BE3}] => (Allow) C:\Program Files (x86)\FileZilla FTP Client\filezilla.exe
FirewallRules: [{469AE9C8-1910-42AB-AE79-1DBE72043CE7}] => (Allow) C:\Program Files (x86)\FileZilla FTP Client\filezilla.exe
FirewallRules: [{431C761F-9689-473C-BAD0-B8E7532E5786}] => (Allow) C:\Program Files (x86)\AirPort\APAgent.exe
FirewallRules: [{43574157-8F1A-4BCA-B143-9AA7AE963860}] => (Allow) C:\Program Files (x86)\AirPort\APAgent.exe
FirewallRules: [TCP Query User{086C1799-9EB9-4005-B071-08259220106F}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{0753C38A-34E1-4583-9018-407192B1B8A5}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{0AE7D91B-B398-4760-8FD8-B8D8D4B7AB6B}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{E97A9410-9C62-4DBD-A793-2194FDFDD33B}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{4EA046E9-6F03-45EE-A54E-6E55431360E0}C:\program files (x86)\java\jre1.8.0_40\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_40\bin\jp2launcher.exe
FirewallRules: [UDP Query User{08AB2D5C-1A13-40B3-82A3-D46420239497}C:\program files (x86)\java\jre1.8.0_40\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_40\bin\jp2launcher.exe
FirewallRules: [{9D557FDB-C6C8-4B77-93CB-462BBDF54D63}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqkygrp.exe
FirewallRules: [{685EC227-EEE1-4E69-B779-65C26E914211}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpfccopy.exe
FirewallRules: [{4FE760C2-7553-407D-AAB2-422756661B69}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpiscnapp.exe
FirewallRules: [{D1E6F7D6-ABF6-4C5D-BC34-7C6A130A3E1A}] => (Allow) C:\Program Files (x86)\common files\hp\digital imaging\bin\hpqphotocrm.exe
FirewallRules: [{1D6EA8E1-1FA7-4D01-9D00-BD235BDE346A}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqsudi.exe
FirewallRules: [{DA790968-55D6-44A2-B925-3CCEC93352D4}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqpsapp.exe
FirewallRules: [{7306294A-C942-4946-A8E5-ACA63114E1FE}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqpse.exe
FirewallRules: [{E852D1EE-A3A5-4037-AF54-7F79ECF67396}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgplgtupl.exe
FirewallRules: [{39CC2F8A-6941-4DF6-A0ED-5335F50E95B1}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
FirewallRules: [{5B4612B7-A8CA-49D2-B50D-CA23E79C1902}] => (Allow) C:\Program Files (x86)\HP\hp software update\hpwucli.exe
FirewallRules: [{9DF592CF-A27B-42E9-8677-BB5B0D888D76}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{95557A8C-0378-4B8D-8027-AB82BF2063AE}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{47F3F448-D032-48F9-B4A1-C3A2BB40CE14}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{006F37FD-FC53-4D25-B269-DE337653E2DE}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [TCP Query User{5E12BA2C-C581-44AB-99E8-1E503D3BC97D}C:\program files (x86)\videolan\vlc\vlc.exe] => (Allow) C:\program files (x86)\videolan\vlc\vlc.exe
FirewallRules: [UDP Query User{31F1B072-5448-4F47-8496-CD30A35A1E83}C:\program files (x86)\videolan\vlc\vlc.exe] => (Allow) C:\program files (x86)\videolan\vlc\vlc.exe
FirewallRules: [TCP Query User{680D9276-5887-4618-AE43-525E519AC4B4}C:\program files\adobe\adobe dreamweaver cc 2015\dreamweaver.exe] => (Allow) C:\program files\adobe\adobe dreamweaver cc 2015\dreamweaver.exe
FirewallRules: [UDP Query User{B41CCD2B-4AA8-4E60-A587-21EADB2ACD7B}C:\program files\adobe\adobe dreamweaver cc 2015\dreamweaver.exe] => (Allow) C:\program files\adobe\adobe dreamweaver cc 2015\dreamweaver.exe
FirewallRules: [TCP Query User{238BD12C-D0E9-4E39-B7EC-03126CA16BD8}C:\program files\adobe\adobe dreamweaver cc 2015\node\node.exe] => (Allow) C:\program files\adobe\adobe dreamweaver cc 2015\node\node.exe
FirewallRules: [UDP Query User{B30F48E2-7F43-4D59-B0F9-73AA6624A7DC}C:\program files\adobe\adobe dreamweaver cc 2015\node\node.exe] => (Allow) C:\program files\adobe\adobe dreamweaver cc 2015\node\node.exe
FirewallRules: [{172E5AF9-7714-4D9E-A976-99602423CCC2}] => (Allow) C:\Program Files (x86)\Caphyon\Advanced Web Ranking\AdvancedLinkManager.exe
FirewallRules: [{9F8DEB9C-D6AD-4FDF-9883-E77C35007BD3}] => (Allow) C:\Program Files (x86)\Caphyon\Advanced Web Ranking\AdvancedWebRanking.exe
FirewallRules: [{1056309B-4A2A-41C8-89EA-FB08D7655FDB}] => (Allow) C:\Program Files (x86)\Caphyon\Advanced Web Ranking\Scheduler.exe
FirewallRules: [TCP Query User{F6D6D2D3-21F2-4530-B744-27EDC8850F0E}C:\program files\adobe\adobe dreamweaver cc 2015\dreamweaver.exe] => (Allow) C:\program files\adobe\adobe dreamweaver cc 2015\dreamweaver.exe
FirewallRules: [UDP Query User{DE5DD566-4B2C-4021-937B-FED11CE08A31}C:\program files\adobe\adobe dreamweaver cc 2015\dreamweaver.exe] => (Allow) C:\program files\adobe\adobe dreamweaver cc 2015\dreamweaver.exe
FirewallRules: [{6C1425F0-28C0-4C81-881D-3EB28C532FD3}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{2A7D48D1-5443-43CA-8A55-4E737FA0A0D0}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{C27DEEF5-AA93-42FF-B5D5-07C70E0B5D8F}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{FCBCAECF-1A37-4F17-BAB4-3F12B1AF61E3}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{A41A4E2A-7373-4432-B8AE-534061BB2DE9}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{BD76FD13-7A40-4D76-99A9-2A8E72BC30A5}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Intel® 82579LM Gigabit Network Connection
Description: Intel® 82579LM Gigabit Network Connection
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Intel
Service: e1cexpress
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft Virtual WiFi Miniport Adapter
Description: Microsoft Virtual WiFi Miniport Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft Teredo Tunneling Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Microsoft Virtual WiFi Miniport Adapter #2
Description: Microsoft Virtual WiFi Miniport Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Broadcom USH w/swipe sensor
Description: Broadcom USH w/swipe sensor
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: BCM20702A0
Description: BCM20702A0
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Broadcom USH
Description: Broadcom USH
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Universal Serial Bus (USB) Controller
Description: Universal Serial Bus (USB) Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Lexmark X422
Description: Lexmark X422
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Lexmark
Service: usbscan
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Integrated Webcam
Description: USB Video Device
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Microsoft
Service: usbvideo
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (09/03/2015 09:12:53 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: TrueImageMonitor.exe, version: 18.0.0.6613, time stamp: 0x55aca6e9
Faulting module name: TrueImageMonitor.exe, version: 18.0.0.6613, time stamp: 0x55aca6e9
Exception code: 0xc0000005
Fault offset: 0x000268b4
Faulting process id: 0x1280
Faulting application start time: 0xTrueImageMonitor.exe0
Faulting application path: TrueImageMonitor.exe1
Faulting module path: TrueImageMonitor.exe2
Report Id: TrueImageMonitor.exe3

Error: (09/03/2015 09:08:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: TrueImageMonitor.exe, version: 18.0.0.6613, time stamp: 0x55aca6e9
Faulting module name: TrueImageMonitor.exe, version: 18.0.0.6613, time stamp: 0x55aca6e9
Exception code: 0xc0000005
Fault offset: 0x000268b4
Faulting process id: 0x12a8
Faulting application start time: 0xTrueImageMonitor.exe0
Faulting application path: TrueImageMonitor.exe1
Faulting module path: TrueImageMonitor.exe2
Report Id: TrueImageMonitor.exe3

Error: (09/03/2015 08:25:25 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: TrueImageMonitor.exe, version: 18.0.0.6613, time stamp: 0x55aca6e9
Faulting module name: TrueImageMonitor.exe, version: 18.0.0.6613, time stamp: 0x55aca6e9
Exception code: 0xc0000005
Fault offset: 0x000268b4
Faulting process id: 0x1a4c
Faulting application start time: 0xTrueImageMonitor.exe0
Faulting application path: TrueImageMonitor.exe1
Faulting module path: TrueImageMonitor.exe2
Report Id: TrueImageMonitor.exe3

Error: (09/03/2015 08:24:41 PM) (Source: System Restore) (EventID: 8206) (User: )
Description: The restore point selected was damaged or deleted during the restore (Windows Update).

Error: (09/03/2015 08:21:28 PM) (Source: System Restore) (EventID: 8204) (User: )
Description: System restore ended unexpectedly because of power loss or a program error. Additional information: (Removed DeskBar).

Error: (09/03/2015 08:02:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: TrueImageMonitor.exe, version: 18.0.0.6613, time stamp: 0x55aca6e9
Faulting module name: TrueImageMonitor.exe, version: 18.0.0.6613, time stamp: 0x55aca6e9
Exception code: 0xc0000005
Fault offset: 0x000268b4
Faulting process id: 0x110c
Faulting application start time: 0xTrueImageMonitor.exe0
Faulting application path: TrueImageMonitor.exe1
Faulting module path: TrueImageMonitor.exe2
Report Id: TrueImageMonitor.exe3

Error: (09/03/2015 08:01:56 PM) (Source: VSS) (EventID: 13) (User: )
Description: Volume Shadow Copy Service information: The COM Server with CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} and name Coordinator cannot be started. [0x80070005, Access is denied.
]

Error: (09/03/2015 06:20:09 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -Embedding; Description = Configured Microsoft Office Professional Plus 2010; Error = 0x8007043c).

Error: (09/03/2015 06:19:56 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -Embedding; Description = Configured Microsoft Office Professional Plus 2010; Error = 0x8007043c).

Error: (09/03/2015 06:18:24 PM) (Source: VSS) (EventID: 18) (User: )
Description: Volume Shadow Copy Service error: The COM Server with CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} and name Coordinator cannot be started during Safe Mode.
The Volume Shadow Copy service cannot start while in safe mode. [0x8007043c, This service cannot be started in Safe Mode
]


System errors:
=============
Error: (09/03/2015 09:15:07 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: The Acronis Sync Agent Service service terminated with service-specific error %%16843754.

Error: (09/03/2015 09:15:08 PM) (Source: WMPNetworkSvc) (EventID: 14324) (User: )
Description: WMPNetworkSvc0x80004002

Error: (09/03/2015 09:13:48 PM) (Source: WMPNetworkSvc) (EventID: 14324) (User: )
Description: WMPNetworkSvc0x80004002

Error: (09/03/2015 09:13:02 PM) (Source: WMPNetworkSvc) (EventID: 14324) (User: )
Description: WMPNetworkSvc0x80004002

Error: (09/03/2015 09:12:58 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: The HomeGroup Listener service terminated with service-specific error %%-2147467262.

Error: (09/03/2015 09:11:09 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Internet Connection Sharing (ICS) service terminated with the following error:
%%-2147467243

Error: (09/03/2015 09:11:08 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The IPsec Policy Agent service failed to start due to the following error:
%%1069

Error: (09/03/2015 09:11:08 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: The PolicyAgent service was unable to log on as NT Authority\NetworkService with the currently configured password due to the following error:
%%50

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

Error: (09/03/2015 09:11:08 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Computer Browser service failed to start due to the following error:
%%1115

Error: (09/03/2015 09:11:08 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Application Experience service failed to start due to the following error:
%%1115


Microsoft Office:
=========================
Error: (09/03/2015 09:12:53 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: TrueImageMonitor.exe18.0.0.661355aca6e9TrueImageMonitor.exe18.0.0.661355aca6e9c0000005000268b4128001d0e6aec9a9a4cfC:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exeC:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe110be7e9-52a2-11e5-afd8-ade256b40bd1

Error: (09/03/2015 09:08:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: TrueImageMonitor.exe18.0.0.661355aca6e9TrueImageMonitor.exe18.0.0.661355aca6e9c0000005000268b412a801d0e6ae37a155ffC:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exeC:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe7f291382-52a1-11e5-8478-b1fe5ee601da

Error: (09/03/2015 08:25:25 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: TrueImageMonitor.exe18.0.0.661355aca6e9TrueImageMonitor.exe18.0.0.661355aca6e9c0000005000268b41a4c01d0e6a82ba1f199C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exeC:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe6f7de4c1-529b-11e5-a81f-ac4f6bf2333b

Error: (09/03/2015 08:24:41 PM) (Source: System Restore) (EventID: 8206) (User: )
Description: Windows Update

Error: (09/03/2015 08:21:28 PM) (Source: System Restore) (EventID: 8204) (User: )
Description: Removed DeskBar

Error: (09/03/2015 08:02:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: TrueImageMonitor.exe18.0.0.661355aca6e9TrueImageMonitor.exe18.0.0.661355aca6e9c0000005000268b4110c01d0e6a4ec0c62faC:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exeC:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe35a351e8-5298-11e5-9313-ec040c520b3f

Error: (09/03/2015 08:01:56 PM) (Source: VSS) (EventID: 13) (User: )
Description: {e579ab5f-1cc4-44b4-bed9-de0991ff0623}Coordinator0x80070005, Access is denied.

Error: (09/03/2015 06:20:09 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -EmbeddingConfigured Microsoft Office Professional Plus 20100x8007043c

Error: (09/03/2015 06:19:56 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -EmbeddingConfigured Microsoft Office Professional Plus 20100x8007043c

Error: (09/03/2015 06:18:24 PM) (Source: VSS) (EventID: 18) (User: )
Description: {e579ab5f-1cc4-44b4-bed9-de0991ff0623}Coordinator0x8007043c, This service cannot be started in Safe Mode


CodeIntegrity:
===================================
  Date: 2014-05-01 14:53:43.132
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\stwrt64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2014-05-01 14:53:43.132
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\stwrt64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Processor: Intel® Core™ i7-3610QM CPU @ 2.30GHz
Percentage of memory in use: 18%
Total physical RAM: 16263.3 MB
Available physical RAM: 13181.9 MB
Total Virtual: 32524.81 MB
Available Virtual: 29502.29 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:637.7 GB) NTFS
Drive e: () (Removable) (Total:1.88 GB) (Free:0.01 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 628D1835)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 1.9 GB) (Disk ID: 04DD5721)
Partition 1: (Active) - (Size=1.9 GB) - (Type=06)

==================== End of Addition.txt ============================



BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 39,578 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:09:06 PM

Posted 04 September 2015 - 09:48 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

This is the infection read about it - CryptoWall and HELP_DECRYPT Ransomware Information Guide
http://www.bleepingcomputer.com/virus-removal/cryptowall-ransomware-information

Other than paying the ransom if it's not too late there is nothing we can do to restore your files. I hope you have good backup of your important files.
I know one thing I would not trust them, your call.

If you wish us to clean what is not necessary please follow these instructions.

Press the windows key Windows_Logo_key.gif+ r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.
Please copy the entire contents of the code box below to the a new file.


start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

CHR HKU\S-1-5-21-3105234330-458141651-3949311147-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nfedoihopcjdfjihhhojdclnfdgomdho] - https://clients2.google.com/service/update2/crx
C:\Windows\system32\Drivers\zonvbdnt.sys
C:\Users\Test\AppData\HELP_DECRYPT.HTML
C:\Users\Test\AppData\Local\HELP_DECRYPT.HTML
C:\Users\images\HELP_DECRYPT.TXT
C:\Users\images\HELP_DECRYPT.URL
C:\ProgramData\HELP_DECRYPT.HTML
C:\Users\Test\AppData\Roaming\HELP_DECRYPT.TXT
C:\Users\Test\AppData\HELP_DECRYPT.TXT
C:\Users\Test\AppData\Roaming\HELP_DECRYPT.URL
C:\Users\Test\AppData\HELP_DECRYPT.URL
C:\Users\Test\AppData\Local\HELP_DECRYPT.TXT
C:\Users\Test\AppData\Local\HELP_DECRYPT.URL
C:\Users\Test\AppData\Local\Apps\HELP_DECRYPT.TXT
 C:\Users\Test\AppData\Local\Apps\HELP_DECRYPT.URL
C:\Users\Public\HELP_DECRYPT.TXT
 C:\Users\Public\Documents\HELP_DECRYPT.TXT
C:\Users\Public\HELP_DECRYPT.URL
C:\Users\Public\Documents\HELP_DECRYPT.URL
C:\ProgramData\HELP_DECRYPT.TXT
C:\ProgramData\HELP_DECRYPT.URL
C:\Users\Test\Documents\~WRL3254.tmp
C:\Users\Test\AppData\Roaming\HELP_DECRYPT.PNG
C:\Users\Test\AppData\Roaming\HELP_DECRYPT.TXT
C:\Users\Test\AppData\Roaming\HELP_DECRYPT.URL
C:\Users\Test\AppData\Local\HELP_DECRYPT.PNG
C:\Users\Test\AppData\Local\HELP_DECRYPT.TXT
C:\Users\Test\AppData\Local\HELP_DECRYPT.URL
C:\ProgramData\HELP_DECRYPT.PNG
C:\ProgramData\HELP_DECRYPT.TXT
C:\ProgramData\HELP_DECRYPT.URL
AlternateDataStreams: C:\Windows\system32\Drivers\zonvbdnt.sys:changelist
AlternateDataStreams: C:\Users\Test\Downloads\noname.eml:OECustomProperty

End
Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Download to your Desktop the Junkware Removal Tool Download from this link.
http://www.bleepingcomputer.com/download/junkware-removal-tool/

Shutdown your antivirus to avoid any conflicts.
Right click the icon - disable for say 20 mins.
Right-mouse click JRT.exe and select Run as administrator (If using XP just double click on the icon to run it.)
The tool will open and start scanning your system.
Please be patient as this can take a while to complete.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.
======

How is the computer running now?

#3 yaddow

yaddow
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:09:06 PM

Posted 07 September 2015 - 03:37 PM

system appears to be acting normally - i have not opened any of those decrypt files - but overall, with very minor use over the weekend, everything seems normal.

 

files that were encrypted seem to be only useless stuff from years ago.

 

not sure the Ransomware version you mentioned is the same -


fixlog posted here:

 

Fix result of Farbar Recovery Scan Tool (x64) Version:07-09-2015
Ran by Test (2015-09-07 16:21:42) Run:2
Running from E:\
Loaded Profiles: Test (Available Profiles: Test & HomeGroupUser$)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

CHR HKU\S-1-5-21-3105234330-458141651-3949311147-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nfedoihopcjdfjihhhojdclnfdgomdho] - https://clients2.google.com/service/update2/crx
C:\Windows\system32\Drivers\zonvbdnt.sys
C:\Users\Test\AppData\HELP_DECRYPT.HTML
C:\Users\Test\AppData\Local\HELP_DECRYPT.HTML
C:\Users\images\HELP_DECRYPT.TXT
C:\Users\images\HELP_DECRYPT.URL
C:\ProgramData\HELP_DECRYPT.HTML
C:\Users\Test\AppData\Roaming\HELP_DECRYPT.TXT
C:\Users\Test\AppData\HELP_DECRYPT.TXT
C:\Users\Test\AppData\Roaming\HELP_DECRYPT.URL
C:\Users\Test\AppData\HELP_DECRYPT.URL
C:\Users\Test\AppData\Local\HELP_DECRYPT.TXT
C:\Users\Test\AppData\Local\HELP_DECRYPT.URL
C:\Users\Test\AppData\Local\Apps\HELP_DECRYPT.TXT
 C:\Users\Test\AppData\Local\Apps\HELP_DECRYPT.URL
C:\Users\Public\HELP_DECRYPT.TXT
 C:\Users\Public\Documents\HELP_DECRYPT.TXT
C:\Users\Public\HELP_DECRYPT.URL
C:\Users\Public\Documents\HELP_DECRYPT.URL
C:\ProgramData\HELP_DECRYPT.TXT
C:\ProgramData\HELP_DECRYPT.URL
C:\Users\Test\Documents\~WRL3254.tmp
C:\Users\Test\AppData\Roaming\HELP_DECRYPT.PNG
C:\Users\Test\AppData\Roaming\HELP_DECRYPT.TXT
C:\Users\Test\AppData\Roaming\HELP_DECRYPT.URL
C:\Users\Test\AppData\Local\HELP_DECRYPT.PNG
C:\Users\Test\AppData\Local\HELP_DECRYPT.TXT
C:\Users\Test\AppData\Local\HELP_DECRYPT.URL
C:\ProgramData\HELP_DECRYPT.PNG
C:\ProgramData\HELP_DECRYPT.TXT
C:\ProgramData\HELP_DECRYPT.URL
AlternateDataStreams: C:\Windows\system32\Drivers\zonvbdnt.sys:changelist
AlternateDataStreams: C:\Users\Test\Downloads\noname.eml:OECustomProperty

End
*****************

Restore point was successfully created.
Processes closed successfully.
"HKU\S-1-5-21-3105234330-458141651-3949311147-1000\SOFTWARE\Google\Chrome\Extensions\nfedoihopcjdfjihhhojdclnfdgomdho" => key removed successfully
C:\Windows\system32\Drivers\zonvbdnt.sys => moved successfully
"C:\Users\Test\AppData\HELP_DECRYPT.HTML" => File/Folder not found.
"C:\Users\Test\AppData\Local\HELP_DECRYPT.HTML" => File/Folder not found.
C:\Users\images\HELP_DECRYPT.TXT => moved successfully
C:\Users\images\HELP_DECRYPT.URL => moved successfully
"C:\ProgramData\HELP_DECRYPT.HTML" => File/Folder not found.
C:\Users\Test\AppData\Roaming\HELP_DECRYPT.TXT => moved successfully
C:\Users\Test\AppData\HELP_DECRYPT.TXT => moved successfully
C:\Users\Test\AppData\Roaming\HELP_DECRYPT.URL => moved successfully
C:\Users\Test\AppData\HELP_DECRYPT.URL => moved successfully
C:\Users\Test\AppData\Local\HELP_DECRYPT.TXT => moved successfully
C:\Users\Test\AppData\Local\HELP_DECRYPT.URL => moved successfully
C:\Users\Test\AppData\Local\Apps\HELP_DECRYPT.TXT => moved successfully
C:\Users\Test\AppData\Local\Apps\HELP_DECRYPT.URL => moved successfully
C:\Users\Public\HELP_DECRYPT.TXT => moved successfully
C:\Users\Public\Documents\HELP_DECRYPT.TXT => moved successfully
C:\Users\Public\HELP_DECRYPT.URL => moved successfully
C:\Users\Public\Documents\HELP_DECRYPT.URL => moved successfully
C:\ProgramData\HELP_DECRYPT.TXT => moved successfully
C:\ProgramData\HELP_DECRYPT.URL => moved successfully
C:\Users\Test\Documents\~WRL3254.tmp => moved successfully
C:\Users\Test\AppData\Roaming\HELP_DECRYPT.PNG => moved successfully
"C:\Users\Test\AppData\Roaming\HELP_DECRYPT.TXT" => File/Folder not found.
"C:\Users\Test\AppData\Roaming\HELP_DECRYPT.URL" => File/Folder not found.
C:\Users\Test\AppData\Local\HELP_DECRYPT.PNG => moved successfully
"C:\Users\Test\AppData\Local\HELP_DECRYPT.TXT" => File/Folder not found.
"C:\Users\Test\AppData\Local\HELP_DECRYPT.URL" => File/Folder not found.
C:\ProgramData\HELP_DECRYPT.PNG => moved successfully
"C:\ProgramData\HELP_DECRYPT.TXT" => File/Folder not found.
"C:\ProgramData\HELP_DECRYPT.URL" => File/Folder not found.
"C:\Windows\system32\Drivers\zonvbdnt.sys" => ":changelist" ADS not found.
C:\Users\Test\Downloads\noname.eml => ":OECustomProperty" ADS removed successfully.
EmptyTemp: => 520.2 MB temporary data Removed.


The system needed a reboot..

==== End of Fixlog 16:22:25 ====



#4 yaddow

yaddow
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:09:06 PM

Posted 07 September 2015 - 03:44 PM

JRT results here:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.6.0 (08.31.2015:1)
OS: Windows 7 Professional x64
Ran by Test on Mon 09/07/2015 at 16:40:10.19
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_E1D46C574EBA950FEDF46817FE573EFA
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\\SearchAssistant



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] C:\Users\Test\AppData\Roaming\download manager



~~~ Chrome


[C:\Users\Test\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\Test\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\Test\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\Test\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 09/07/2015 at 16:42:57.60
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 



#5 yaddow

yaddow
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:09:06 PM

Posted 07 September 2015 - 03:48 PM

knock on wood - but dare I say it, perhaps Microsoft Security Essentials actually prevented this devil from doing much harm.



#6 nasdaq

nasdaq

  • Malware Response Team
  • 39,578 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:09:06 PM

Posted 08 September 2015 - 07:25 AM

If all is well.

To learn more about how to protect yourself while on the internet read this little guide best security practices keep safe.
http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/
===

#7 yaddow

yaddow
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:09:06 PM

Posted 11 September 2015 - 05:41 PM

Thank you for the best practices list.  It is one of the best I've read.

 

Here's a question - despite getting a clean bill of health, what if this thing is still randomly moving through my machine encrypting files unbenownst to me?

 

Today I'm finding many older files are totally hosed.  Amazing that this thing digs so deep and doesn't change file dates!

 

What would you recommend??

 

If you are curious, I'm pretty sure what file (a word doc attachment) that caused the problem and I would send it to you if you would like to analyze it.

 

Surely there's a lab that is curious.  Pls refer me along if you aren't it.

 

Just by chance, I'm sort of one of the lucky ones, as I have numerous GOOD backups and it appears the damage is extremely limited.

 

But you never know.

 

I happened to have upgraded my hard disk just a couple of weeks before the exploit by cloning it over to a new SSD drive.

 

So theoretically, all old content is 100% isolated.

Meanwhile, I am considering strategies to double down on various security measures I follow after reading the above best practices document.

Here's another couple of best practice to add. 

* Don't just back up files, back up systems and have redundant machines handy in the event of an exploit.

 

* Keep a Linux machine handy just in case.  I've got Ubuntu running on an inexpensive laptop and it's been a virtual life saver.

* Get to know your local hardware service vendors.  You never know when you're going to need some local assistance.

let me know if you have any advice.

 

Thanks!



#8 nasdaq

nasdaq

  • Malware Response Team
  • 39,578 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:09:06 PM

Posted 12 September 2015 - 07:21 AM


Here's a question - despite getting a clean bill of health, what if this thing is still randomly moving through my machine encrypting files unbenownst to me?

The malware program and all it's traces are removed after the infection.

This is the infection read about it - CryptoWall and HELP_DECRYPT Ransomware Information Guide
http://www.bleepingcomputer.com/virus-removal/cryptowall-ransomware-information


You may want to protect agains future Cryptowall infection.
Refer to the link above and read this section.
How to use the CryptoPrevent Tool:

Unless you have the key no one can repair the files.

Hope it helps

#9 nasdaq

nasdaq

  • Malware Response Team
  • 39,578 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:09:06 PM

Posted 17 September 2015 - 09:46 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users