Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows 8.1 Black Screen after Ransomware Ad was shown


  • This topic is locked This topic is locked
14 replies to this topic

#1 sdockery

sdockery

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:02:34 AM

Posted 11 October 2015 - 08:58 AM

I finally got the command prompt and was able to use regedit to pull up the registry. When I tried to restore the PC it says that my computer is locked. Can anyone help me please?



BC AdBot (Login to Remove)

 


#2 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,079 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:09:34 AM

Posted 11 October 2015 - 09:02 AM

Greetings and :welcome: to BleepingComputer,
My name is xXToffeeXx, but feel free to call me Toffee if it is easier for you. I will be helping you with your malware problems.
 
A few points to cover before we start:

  • Do not run any tools without being instructed to as this makes my job much harder in trying to figure out what you have done.
  • Make sure to read my instructions fully before attempting a step.
  • If you have problems or questions with any of the steps, feel free to ask me. I will be happy to answer any questions you have.
  • Please follow the topic by clicking on the "Follow this topic" button, and make sure a tick is in the "receive notifications" and is set to "Instantly". Any replies should be made in this topic by clicking the "Reply to this topic" button.
  • Important information in my posts will often be in bold, make sure to take note of these.
  • I will attempt to reply as soon as possible, and normally within 24 hours of your reply. If this is not possible or I have a delay then I will let you know.
  • I will bump a topic after 3 days of no activity, and then will give you another 2 days to reply before a topic is closed. If you need more time than this please let me know.
  • Let's get going now :thumbup2:

==========================
 
Hi sdockery,
 
FRST Scan from Safe Mode with Command Prompt

On a clean machine, please download Farbar Recovery Scan Tool and save it to a flash drive.
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Enter Safe Mode with Command Prompt:

  • Restart your computer
  • As your computer loads, repeatedly tap F8 before the Windows logo appears
  • A menu should appear with different options, use the up and down arrow keys to highlight Safe Mode with Command Prompt
  • Press Enter and Windows will begin to load, there will be a lot of text on the screen, let this part run
  • Once loaded, log into the computer like you normally would, a window saying command prompt should appear.
  • In that window type explorer, press enter and the desktop-type interface should load
  • Then type exit and press enter

Running FRST

  • Click on the Windows logo at the bottom of the screen and then click on computer.
  • You should see your main drive which is likely C, you should also see your USB drive.
  • Click on your USB and locate the files named FRST. Try both of them, only one will work successful without an error message
  • When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make two logs (FRST.txt and Addition.txt) on the flash drive. Please copy and paste it to your reply.

--------------

To recap, in your next reply I would like to see the following. Make sure to copy & paste them unless I ask otherwise:

  • FRST.txt
  • Addition.txt

xXToffeeXx~ 


~If I am helping you and you have not had a reply from me in two days, please send me a PM~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~


#3 sdockery

sdockery
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:02:34 AM

Posted 11 October 2015 - 10:43 AM

I was only able to run frst64 from notepad through the command prompt. I can not go into safe mode. There was no Addition.txt
Here is frst64:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:11-10-2015 01
Ran by SYSTEM on MININT-8RHLSSN (11-10-2015 10:17:13)
Running from F:\Fix Tools
Platform: Windows 8.1 (X64) Language: English (United States)
Internet Explorer Version 11
Boot Mode: Recovery
Default: ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-08-12] (Apple Inc.)
HKLM-x32\...\Run: [BingDesktop] => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2368736 2014-06-03] (Microsoft Corp.)
HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [475448 2014-03-26] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-04-10] (CyberLink Corp.)
HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1284680 2014-03-25] (CANON INC.)
HKLM-x32\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [449168 2012-03-26] (CANON INC.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-05-15] (Apple Inc.)
HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [896632 2015-07-22] (BlueStack Systems, Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-08-06] (Apple Inc.)
HKLM\...\RunOnce: [*Restore] => C:\WINDOWS\System32\rstrui.exe [273920 2014-10-28] (Microsoft Corporation)
HKU\Stephanie\...\Run: [Amazon Music] => C:\Users\Stephanie\AppData\Local\Amazon Music\Amazon Music Helper.exe [3356480 2014-07-22] ()
HKU\Stephanie\...\Run: [Copy] => C:\Users\Stephanie\AppData\Roaming\Copy\CopyAgent.exe [15410832 2015-04-22] (Barracuda Networks, Inc.)
HKU\Stephanie\...\Run: [GoogleChromeAutoLaunch_15A09AB4B2860ED1D468C1D57628C0D5] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [815944 2015-09-23] (Google Inc.)
HKU\Stephanie\...\Run: [Adobe Reader Synchronizer] => C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe [876728 2015-07-02] (Adobe Systems Incorporated)
HKU\Stephanie\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\Bubbles.scr [788480 2014-10-28] (Microsoft Corporation)

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)
S2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173792 2014-06-03] (Microsoft Corp.)
S3 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [433784 2015-06-16] (BlueStack Systems, Inc.)
S2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [413304 2015-06-16] (BlueStack Systems, Inc.)
S2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [831096 2015-07-21] (BlueStack Systems, Inc.)
S2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [349728 2015-08-13] (WildTangent)
S2 HPWMISVC; c:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [469304 2014-03-26] (Hewlett-Packard Development Company, L.P.)
S2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [140456 2011-09-06] ()
S2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [239176 2013-03-04] (Realtek Semiconductor)
S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2014-07-02] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3880448 2013-11-12] (Qualcomm Atheros Communications, Inc.)
S3 AtiDCM; C:\AMD\WU-CCC2\ccc2_install\Support64\atdcm64a.sys [28416 2014-03-13] (Advanced Micro Devices, Inc.)
S3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [94208 2013-02-14] (Advanced Micro Devices)
S2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [145528 2015-06-16] (BlueStack Systems)
S1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [136408 2015-07-29] (Malwarebytes Corporation)
S3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [290520 2014-09-01] (Realtek Semiconductor Corp.)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [28400 2013-03-08] (Synaptics Incorporated)
S3 SmbDrvI; C:\Windows\System32\drivers\Smb_driver_Intel.sys [33008 2013-03-08] (Synaptics Incorporated)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
S3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2012-08-31] (Hewlett-Packard Development Company, L.P.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-10-10 13:19 - 2015-10-10 13:19 - 00000000 ____D C:\Program Files (x86)\ESET
2015-10-10 12:53 - 2015-10-10 12:54 - 02587988 _____ C:\Users\Stephanie\Downloads\AR (1).zip
2015-10-10 12:46 - 2015-10-10 12:49 - 02587988 _____ C:\Users\Stephanie\Downloads\AR.zip
2015-10-10 12:31 - 2015-10-10 12:32 - 03562278 _____ C:\Users\Stephanie\Downloads\WPAutoFunnel-Plugin+ManualV2.zip
2015-10-10 11:59 - 2015-10-10 12:13 - 00000000 ____D C:\Users\Stephanie\Downloads\Spin Rewriter Bonus
2015-10-10 11:43 - 2015-10-10 11:43 - 00000000 ____D C:\Users\Stephanie\Downloads\Blackout-Firesale-part-1
2015-10-10 11:31 - 2015-10-10 11:32 - 01372978 _____ C:\Users\Stephanie\Downloads\Autoresponder Independence.zip
2015-10-10 11:05 - 2015-10-10 11:07 - 00000000 ____D C:\Users\Stephanie\Downloads\The-Simple-Traffic-Giant-System
2015-10-09 16:25 - 2015-10-07 07:56 - 00005138 _____ C:\Users\Public\Documents\Gobbledegook.txt
2015-09-18 12:44 - 2015-10-04 15:35 - 00000368 _____ C:\Windows\Tasks\HPCeeScheduleForStephanie.job
2015-09-18 12:44 - 2015-09-18 12:44 - 00003190 _____ C:\Windows\System32\Tasks\HPCeeScheduleForStephanie
2015-09-11 05:28 - 2015-09-11 05:28 - 00002447 ____N C:\Users\Public\Desktop\WildTangent Games App - hp.lnk
2015-09-11 04:26 - 2015-09-11 04:27 - 00000000 ____D C:\Users\Stephanie\AppData\Roaming\WildTangent

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-10-10 17:08 - 2013-08-22 06:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-10-10 16:28 - 2015-01-14 14:54 - 01970138 _____ C:\Windows\WindowsUpdate.log
2015-10-10 16:27 - 2015-01-15 08:50 - 00039000 _____ C:\Windows\PFRO.log
2015-10-10 15:55 - 2015-07-22 17:54 - 00001182 _____ C:\Windows\setupact.log
2015-10-10 15:54 - 2014-07-21 02:09 - 00000000 ____D C:\users\Stephanie
2015-10-10 15:53 - 2015-04-24 11:54 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-10-10 15:53 - 2015-04-24 11:54 - 00000000 ___SD C:\Windows\System32\GWX
2015-10-10 15:53 - 2013-08-22 07:36 - 00000000 ___RD C:\Users\Public\Libraries
2015-10-10 15:53 - 2013-08-22 07:36 - 00000000 ____D C:\Windows\System32\sru
2015-10-10 15:53 - 2013-08-22 05:36 - 00000000 ____D C:\Windows\System32\Sysprep
2015-10-10 15:53 - 2012-07-25 23:59 - 00000000 ____D C:\Windows\CbsTemp
2015-10-10 15:52 - 2015-05-02 05:19 - 00000000 ____D C:\Users\Stephanie\Downloads\Rocket Piano
2015-10-10 15:52 - 2015-04-29 18:39 - 00000000 ____D C:\Users\Stephanie\Downloads\CountdownPageGenerator
2015-10-10 15:52 - 2015-03-30 04:52 - 00000000 ____D C:\Users\Stephanie\Downloads\JDownloader1 Setup
2015-10-10 15:52 - 2015-03-28 19:55 - 00000000 ____D C:\Users\Stephanie\Downloads\Keyword Cash
2015-10-10 15:52 - 2015-02-01 00:13 - 00000000 ____D C:\Users\Stephanie\Downloads\New & Used Espresso Machines Stuff
2015-10-10 15:52 - 2015-01-16 21:52 - 00000000 ____D C:\Users\Stephanie\Downloads\Springly
2015-10-10 15:52 - 2015-01-15 14:12 - 00000000 ____D C:\Users\Stephanie\Downloads\PublishingPro
2015-10-10 15:52 - 2015-01-13 12:12 - 00000000 ____D C:\Users\Stephanie\Downloads\coolarticlecreator-321 (1)
2015-10-10 15:52 - 2015-01-01 06:27 - 00000000 ____D C:\Users\Stephanie\Downloads\Browsers
2015-10-10 15:52 - 2014-12-31 10:08 - 00000000 ____D C:\Users\Stephanie\Downloads\youtube_d
2015-10-10 15:52 - 2014-12-23 19:48 - 00000000 ____D C:\Users\Stephanie\Downloads\shexview-x64
2015-10-10 15:52 - 2014-12-20 22:13 - 00000000 ____D C:\Users\Stephanie\Downloads\Lead Hunter
2015-10-10 15:52 - 2014-12-17 12:34 - 00000000 ____D C:\Users\Stephanie\Downloads\Easy.Sketch.Pro.v2
2015-10-10 15:52 - 2014-12-17 05:41 - 00000000 ____D C:\Users\Stephanie\Downloads\Explanidio
2015-10-10 15:52 - 2014-12-04 22:35 - 00000000 ____D C:\Users\Stephanie\Downloads\Traffic With Anthony
2015-10-10 15:52 - 2014-12-01 16:56 - 00000000 ____D C:\Users\Stephanie\Downloads\SEO Elite
2015-10-10 15:52 - 2014-11-23 12:13 - 00000000 ____D C:\Users\Stephanie\Downloads\Make Millions Blogging Site Stuff
2015-10-10 15:52 - 2014-11-21 12:36 - 00000000 ____D C:\Users\Stephanie\Downloads\Lifestuff Site Stuff
2015-10-10 15:52 - 2014-11-11 19:37 - 00000000 ____D C:\Users\Stephanie\Downloads\Heart's Garden Clip Art
2015-10-10 15:52 - 2014-10-01 04:41 - 00000000 ____D C:\Users\Stephanie\Downloads\Rapid Content Wizard+Lightning Version
2015-10-10 15:52 - 2014-10-01 04:02 - 00000000 ____D C:\Users\Stephanie\Downloads\Software
2015-10-10 15:51 - 2015-06-15 07:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-10-10 15:51 - 2015-05-30 07:37 - 00000000 ____D C:\Users\Stephanie\Downloads\60mpup_files
2015-10-10 15:51 - 2015-04-24 13:39 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-10-10 15:51 - 2014-07-24 07:32 - 00000000 ____D C:\Users\Stephanie\Documents\Youcam
2015-10-10 15:51 - 2014-07-10 08:01 - 00000000 ____D C:\Users\Public\CyberLink
2015-10-10 15:51 - 2014-07-10 01:43 - 00000000 ____D C:\Users\Public\Documents\YouCam
2015-10-10 15:31 - 2015-05-03 17:09 - 00000000 ____D C:\Users\Stephanie\Downloads\Ultimate Traffic Monster V2
2015-10-10 15:31 - 2015-05-02 10:14 - 00000000 ____D C:\Users\Stephanie\Downloads\Video Motion Pro v2.4-180-DVT
2015-10-10 15:31 - 2015-05-02 08:39 - 00000000 ____D C:\Users\Stephanie\Downloads\Yoast.SEO.Premium.v1.5.3
2015-10-10 15:31 - 2015-05-02 08:37 - 00000000 ____D C:\Users\Stephanie\Downloads\WPeddit_v1.6
2015-10-10 15:31 - 2015-05-02 08:37 - 00000000 ____D C:\Users\Stephanie\Downloads\WP-autopost v3.6.1
2015-10-10 15:31 - 2015-05-02 08:35 - 00000000 ____D C:\Users\Stephanie\Downloads\wp-auto-spinner-v3.0.0
2015-10-10 15:31 - 2015-04-29 18:59 - 00000000 ____D C:\Users\Stephanie\Downloads\Uncle Ben - Auto Pilot
2015-10-10 15:31 - 2015-04-29 18:58 - 00000000 ____D C:\Users\Stephanie\Downloads\upandsell-pro-1.0.1_cleaned
2015-10-10 15:31 - 2015-04-24 12:57 - 00000000 ____D C:\Users\Stephanie\Downloads\WP-rating-plugin-awesome-taqyeem-1.1.4
2015-10-10 15:31 - 2015-04-21 15:18 - 00000000 ____D C:\Users\Stephanie\Downloads\VIDEO RANKER REVOLUTION
2015-10-10 15:31 - 2015-04-09 12:45 - 00000000 ____D C:\Users\Stephanie\Downloads\Windows Kits
2015-10-10 15:31 - 2015-01-02 23:45 - 00000000 ____D C:\Users\Stephanie\Downloads\Video Cash Volcano
2015-10-10 15:30 - 2015-09-07 12:03 - 00000000 ____D C:\Users\Stephanie\Downloads\Plugin Blueprint
2015-10-10 15:30 - 2015-05-02 18:13 - 00000000 ____D C:\Users\Stephanie\Downloads\PLR PROFITS MASTERY
2015-10-10 15:30 - 2015-05-02 13:58 - 00000000 ____D C:\Users\Stephanie\Downloads\Steal My Funnel V1 & V2
2015-10-10 15:30 - 2015-05-02 08:36 - 00000000 ____D C:\Users\Stephanie\Downloads\sab
2015-10-10 15:30 - 2015-04-29 19:12 - 00000000 ____D C:\Users\Stephanie\Downloads\PLR Graphics Products OTO
2015-10-10 15:30 - 2015-03-29 05:27 - 00000000 ____D C:\Users\Stephanie\Downloads\SalezPress Pro
2015-10-10 15:30 - 2015-02-10 22:38 - 00000000 ____D C:\Users\Stephanie\Downloads\Rapid Cash Income
2015-10-10 15:30 - 2015-01-31 23:37 - 00000000 ____D C:\Users\Stephanie\Downloads\Solar Power Bundle
2015-10-10 15:30 - 2015-01-31 20:12 - 00000000 ____D C:\Users\Stephanie\Downloads\TTS Video Maker
2015-10-10 15:30 - 2015-01-16 14:21 - 00000000 ____D C:\Users\Stephanie\Downloads\Submitter Pro
2015-10-10 15:30 - 2015-01-04 15:20 - 00000000 ____D C:\Users\Stephanie\Downloads\Tom Yevsikov-Solo Ad Monetizer + Bonuses
2015-10-10 15:30 - 2015-01-01 19:38 - 00000000 ____D C:\Users\Stephanie\Downloads\Rogue-ClickBank-Profits-Plugin
2015-10-10 15:30 - 2015-01-01 11:09 - 00000000 ____D C:\Users\Stephanie\Downloads\SalesFunnelNinja_mrr
2015-10-10 15:30 - 2015-01-01 08:59 - 00000000 ____D C:\Users\Stephanie\Downloads\Traffic Mice Plus Bonus
2015-10-10 15:30 - 2014-12-10 04:37 - 00000000 ____D C:\Users\Stephanie\Downloads\Thank You & Squeeze Page Examples
2015-10-10 15:30 - 2014-12-07 20:14 - 00000000 ____D C:\Users\Stephanie\Downloads\The Funnel Cash Frenzy
2015-10-10 15:30 - 2014-10-31 12:19 - 00000000 ____D C:\Users\Stephanie\Downloads\Prepper's Paradise
2015-10-10 15:30 - 2014-10-01 05:01 - 00000000 ____D C:\Users\Stephanie\Downloads\PLR
2015-10-10 15:30 - 2014-09-27 18:29 - 00000000 ____D C:\Users\Stephanie\Downloads\PLR Cash System Pro
2015-10-10 15:29 - 2015-07-07 12:34 - 00000000 ____D C:\Users\Stephanie\Downloads\JVZoo Sales Maximizer
2015-10-10 15:29 - 2015-05-10 18:31 - 00000000 ____D C:\Users\Stephanie\Downloads\Instant Guru Toolkit
2015-10-10 15:29 - 2015-03-29 08:26 - 00000000 ____D C:\Users\Stephanie\Downloads\Infographics Motivation Graphics Pack
2015-10-10 15:29 - 2015-02-03 15:21 - 00000000 ____D C:\Users\Stephanie\Downloads\Magic Article Rewriter
2015-10-10 15:29 - 2015-01-17 10:00 - 00000000 ____D C:\Users\Stephanie\Downloads\OMG Machines
2015-10-10 15:29 - 2015-01-12 22:49 - 00000000 ____D C:\Users\Stephanie\Downloads\Monkey Marketing Mastermind
2015-10-10 15:29 - 2015-01-09 10:43 - 00000000 ____D C:\Users\Stephanie\Downloads\Lead Generation Mastery-PLR
2015-10-10 15:29 - 2015-01-07 10:36 - 00000000 ____D C:\Users\Stephanie\Downloads\KontentMachine.3.26.16.91
2015-10-10 15:29 - 2015-01-06 08:07 - 00000000 ____D C:\Users\Stephanie\Downloads\Online Income Formula
2015-10-10 15:29 - 2015-01-03 12:40 - 00000000 ____D C:\Users\Stephanie\Downloads\Perpetual List Money Machine
2015-10-10 15:29 - 2015-01-01 17:11 - 00000000 ____D C:\Users\Stephanie\Downloads\Matt Bacak
2015-10-10 15:29 - 2014-12-31 10:33 - 00000000 ____D C:\Users\Stephanie\Downloads\MY NEW LIST STUFF
2015-10-10 15:29 - 2014-12-21 19:24 - 00000000 ____D C:\Users\Stephanie\Downloads\Lee Murry's Simple Email Profits
2015-10-10 15:29 - 2014-12-20 14:18 - 00000000 ____D C:\Users\Stephanie\Downloads\Misc. Excellent
2015-10-10 15:29 - 2014-12-19 21:48 - 00000000 ____D C:\Users\Stephanie\Downloads\List Profit Generator
2015-10-10 15:29 - 2014-12-03 15:17 - 00000000 ____D C:\Users\Stephanie\Downloads\My Monthly Membership
2015-10-10 15:28 - 2015-06-12 07:36 - 00000000 ____D C:\Users\Stephanie\Downloads\explosivedynamictraffic_MRR
2015-10-10 15:28 - 2015-05-02 08:38 - 00000000 ____D C:\Users\Stephanie\Downloads\infinite-seo-1.6.7
2015-10-10 15:28 - 2015-04-24 14:39 - 00000000 ____D C:\Users\Stephanie\Downloads\Indeed Smart PopUp for WordPress
2015-10-10 15:28 - 2015-03-28 20:30 - 00000000 ____D C:\Users\Stephanie\Downloads\Fresh Key
2015-10-10 15:28 - 2015-01-20 10:26 - 00000000 ____D C:\Users\Stephanie\Downloads\GoogleTopperV2
2015-10-10 15:28 - 2015-01-05 08:32 - 00000000 ____D C:\Users\Stephanie\Downloads\G Plus Hangout Local Video Marketer Process
2015-10-10 15:28 - 2015-01-01 19:43 - 00000000 ____D C:\Users\Stephanie\Downloads\FreeCashGenerator
2015-10-10 15:28 - 2014-12-10 13:04 - 00000000 ____D C:\Users\Stephanie\Downloads\IM Guru 2.0
2015-10-10 15:28 - 2014-12-01 19:39 - 00000000 ____D C:\Users\Stephanie\Downloads\EZ Hit Songs
2015-10-10 15:28 - 2014-11-21 15:54 - 00000000 ____D C:\Users\Stephanie\Downloads\Google Sniper 2 & 3 Update
2015-10-10 15:27 - 2015-06-13 12:04 - 00000000 ____D C:\Users\Stephanie\Downloads\Affilio Traffic Roadmap
2015-10-10 15:27 - 2015-06-13 06:51 - 00000000 ____D C:\Users\Stephanie\Downloads\Amazon_NSP
2015-10-10 15:27 - 2015-05-03 19:58 - 00000000 ____D C:\Users\Stephanie\Downloads\Aaron Danker-Super Sales System
2015-10-10 15:27 - 2015-05-01 16:42 - 00000000 ____D C:\Users\Stephanie\Downloads\canvas590
2015-10-10 15:27 - 2015-04-30 19:35 - 00000000 ____D C:\Users\Stephanie\Downloads\CPA AFFILIATE MASTERMIND JV Stuff
2015-10-10 15:27 - 2015-04-30 18:01 - 00000000 ____D C:\Users\Stephanie\Downloads\CPA Arbitrage
2015-10-10 15:27 - 2015-04-30 16:06 - 00000000 ____D C:\Users\Stephanie\Downloads\Download Page-Page Files
2015-10-10 15:27 - 2015-04-22 10:46 - 00000000 ____D C:\Users\Stephanie\Downloads\Elegant Themes + Plugin
2015-10-10 15:27 - 2015-03-29 08:29 - 00000000 ____D C:\Users\Stephanie\Downloads\BonusGo & Bonuses
2015-10-10 15:27 - 2015-02-27 20:32 - 00000000 ____D C:\Users\Stephanie\Downloads\BrandableReportAndInstructions
2015-10-10 15:27 - 2015-02-10 22:44 - 00000000 ____D C:\Users\Stephanie\Downloads\Blog Network 2015 Secret Sauce
2015-10-10 15:27 - 2015-01-13 11:05 - 00000000 ____D C:\Users\Stephanie\Downloads\Easy VSL Affiliate Bonuses
2015-10-10 15:27 - 2015-01-03 18:58 - 00000000 ____D C:\Users\Stephanie\Downloads\CB Online Jobs Bonanza PLR Pack
2015-10-10 15:27 - 2014-12-31 11:37 - 00000000 ____D C:\Users\Stephanie\Downloads\easydbss
2015-10-10 15:27 - 2014-12-29 16:45 - 00000000 ____D C:\Users\Stephanie\Downloads\CodeCanyon - Cpanel Email Signup and Login v1.5 - (Update)
2015-10-10 15:27 - 2014-12-04 12:33 - 00000000 ____D C:\Users\Stephanie\Downloads\Alex Jeffreys
2015-10-10 15:27 - 2014-10-01 04:38 - 00000000 ____D C:\Users\Stephanie\Downloads\Authority Spy & Bonuses
2015-10-10 15:27 - 2014-09-27 19:38 - 00000000 ____D C:\Users\Stephanie\Downloads\EASY Niche Membership Sites
2015-10-10 15:26 - 2015-05-10 09:07 - 00000000 ____D C:\Users\Stephanie\Downloads\7 Steps To Massive Lists
2015-10-10 15:26 - 2015-02-27 20:36 - 00000000 ____D C:\Users\Stephanie\Documents\Empire Builder
2015-10-10 15:26 - 2015-01-16 16:58 - 00000000 ____D C:\Users\Stephanie\Downloads\5 CPA landing pagesBBHF
2015-10-10 15:26 - 2015-01-04 00:58 - 00000000 ____D C:\Users\Stephanie\Documents\CoffeeCup Software
2015-10-10 15:26 - 2015-01-02 02:14 - 00000000 ____D C:\Users\Stephanie\Downloads\100k dl Page Files
2015-10-10 15:26 - 2014-09-23 06:25 - 00000000 ____D C:\Users\Stephanie\Documents\CyberLink
2015-10-10 13:07 - 2014-07-21 05:17 - 00000000 ___DO C:\Users\Stephanie\OneDrive
2015-10-10 12:57 - 2015-04-22 11:03 - 00000000 ____D C:\Users\Stephanie\Downloads\Lead Magnets V2
2015-10-10 11:44 - 2014-07-18 12:12 - 10321920 ___SH C:\Users\Stephanie\Downloads\Thumbs.db
2015-10-10 11:14 - 2015-04-19 15:14 - 00000000 ____D C:\Users\Stephanie\Downloads\Jeremy Reeves-The Funnel Formula
2015-10-10 11:11 - 2014-11-04 14:44 - 00000000 ____D C:\Users\Stephanie\Downloads\PayPal Business Info
2015-10-10 11:11 - 2014-10-17 09:15 - 00000000 ____D C:\Users\Stephanie\Downloads\Ok & Federal Tax
2015-10-09 16:42 - 2013-08-22 07:36 - 00000000 ____D C:\Windows\System32\NDF
2015-10-09 07:24 - 2014-07-18 07:24 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2015-10-07 07:56 - 2014-10-01 14:10 - 00005138 _____ C:\Users\Stephanie\Documents\Gobbledegook.txt
2015-10-04 15:46 - 2014-07-10 06:08 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4183873686-4129548010-1378792923-1002
2015-10-04 15:37 - 2014-11-13 17:24 - 00000000 __SHD C:\Users\Stephanie\AppData\LocalLow\EmieBrowserModeList
2015-10-04 15:37 - 2014-09-22 21:49 - 00000000 ____D C:\Users\Stephanie\AppData\Roaming\Copy
2015-10-04 15:37 - 2014-09-01 15:59 - 00000000 __SHD C:\Users\Stephanie\AppData\LocalLow\EmieUserList
2015-10-04 15:37 - 2014-07-21 09:13 - 00000000 __SHD C:\Users\Stephanie\AppData\LocalLow\EmieSiteList
2015-10-04 15:34 - 2013-08-22 05:25 - 00524288 ___SH C:\Windows\System32\config\BBI
2015-10-04 15:22 - 2014-07-10 05:33 - 00003946 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{8EE8F043-932C-462D-B023-395A8A613918}
2015-10-04 12:59 - 2015-04-28 07:48 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-09-26 07:17 - 2015-04-28 10:55 - 00002210 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-09-24 10:11 - 2014-08-05 08:21 - 00000000 ____D C:\ProgramData\CanonIJPLM
2015-09-21 17:08 - 2015-04-28 07:48 - 00003718 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-09-18 12:51 - 2013-08-22 07:36 - 00000000 ____D C:\Windows\rescache
2015-09-14 17:18 - 2015-05-17 00:24 - 00812008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-09-14 17:18 - 2015-05-17 00:24 - 00178152 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-09-14 11:12 - 2015-04-28 10:44 - 00003898 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-09-14 11:12 - 2015-04-28 10:44 - 00000926 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-09-14 11:12 - 2015-04-28 10:44 - 00000922 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-09-14 11:12 - 2015-02-05 02:59 - 00003662 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-09-13 10:25 - 2014-07-10 06:15 - 00000000 ____D C:\Users\Stephanie\AppData\Local\Google
2015-09-11 05:32 - 2013-04-02 16:17 - 00000000 ____D C:\ProgramData\WildTangent
2015-09-11 05:24 - 2013-04-02 16:17 - 00000000 ____D C:\Program Files (x86)\WildTangent Games
2015-09-11 04:41 - 2015-04-27 03:15 - 00220672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dplayx.dll
2015-09-11 04:41 - 2015-04-27 03:15 - 00046592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpwsockx.dll
2015-09-11 04:41 - 2015-04-27 02:59 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpmodemx.dll
2015-09-11 04:41 - 2015-04-27 02:53 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dplaysvr.exe
2015-09-11 04:41 - 2013-08-22 03:22 - 00461312 _____ (Microsoft Corporation) C:\Windows\System32\dpnet.dll
2015-09-11 04:41 - 2013-08-22 03:22 - 00034304 _____ (Microsoft Corporation) C:\Windows\System32\dpnsvr.exe
2015-09-11 04:41 - 2013-08-22 03:17 - 00066560 _____ (Microsoft Corporation) C:\Windows\System32\dpnathlp.dll
2015-09-11 04:41 - 2013-08-22 03:17 - 00009216 _____ (Microsoft Corporation) C:\Windows\System32\dpnhupnp.dll
2015-09-11 04:41 - 2013-08-22 03:17 - 00009216 _____ (Microsoft Corporation) C:\Windows\System32\dpnhpast.dll
2015-09-11 04:41 - 2013-08-21 19:56 - 00377856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnet.dll
2015-09-11 04:41 - 2013-08-21 19:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnsvr.exe
2015-09-11 04:41 - 2013-08-21 19:51 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnathlp.dll
2015-09-11 04:41 - 2013-08-21 19:51 - 00009216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnhupnp.dll
2015-09-11 04:41 - 2013-08-21 19:51 - 00009216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnhpast.dll

Some files in TEMP:
====================
C:\Users\Stephanie\AppData\Local\Temp\Quarantine.exe
C:\Users\Stephanie\AppData\Local\Temp\sqlite3.dll


==================== Known DLLs (Whitelisted) =========================


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe
[2015-04-27 03:07] - [2014-10-28 17:22] - 0572416 ____A (Microsoft Corporation) EC498BAE1F0D3E0E401C963F8D76C437

C:\Windows\System32\wininit.exe
[2015-04-27 02:59] - [2014-10-28 17:25] - 0145920 ____A (Microsoft Corporation) A570A64292214C43E0BA50E6A72A6380

C:\Windows\explorer.exe
[2015-03-25 18:14] - [2015-01-27 15:47] - 2501368 ____A (Microsoft Corporation) C10A66189DC8C090E7C84873EDCEBC88

C:\Windows\SysWOW64\explorer.exe
[2015-03-25 18:13] - [2015-01-27 15:41] - 2207488 ____A (Microsoft Corporation) 91E24273FCA076EA9E65DAFA98901225

C:\Windows\System32\svchost.exe
[2015-04-27 02:52] - [2014-10-28 20:11] - 0038792 ____A (Microsoft Corporation) E3A2AD05E24105B35E986CF9CB38EC47

C:\Windows\SysWOW64\svchost.exe
[2015-04-27 02:53] - [2014-10-28 19:17] - 0033088 ____A (Microsoft Corporation) D0ABC231C0B3E88C6B612B28ABBF734D

C:\Windows\System32\services.exe
[2015-05-12 14:37] - [2015-04-08 14:55] - 0410128 ____A (Microsoft Corporation) E0C7813A97CA7947FF5C18A8F3B61A45

C:\Windows\System32\User32.dll
[2015-04-27 03:15] - [2014-10-28 20:00] - 1540696 ____A (Microsoft Corporation) 25026E350BC3BE37631634EC72B10BD5

C:\Windows\SysWOW64\User32.dll
[2015-04-27 03:15] - [2014-10-28 17:04] - 1376256 ____A (Microsoft Corporation) 76C5CF09F53A3B089B5581B9938F8CAE

C:\Windows\System32\userinit.exe
[2015-04-27 01:57] - [2014-10-28 17:28] - 0026112 ____A (Microsoft Corporation) 5C131534A3EA4A461A793FB507A8004F

C:\Windows\SysWOW64\userinit.exe
[2015-04-27 02:00] - [2014-10-28 17:05] - 0022528 ____A (Microsoft Corporation) D10643FC0095434C819316CA6CD748C0

C:\Windows\System32\rpcss.dll
[2015-04-27 03:13] - [2014-10-28 17:19] - 0817664 ____A (Microsoft Corporation) A6F17C299A03BAFEFB9257C462A19E00

C:\Windows\System32\dnsapi.dll
[2014-12-28 14:10] - [2014-11-04 17:44] - 0657920 ____A (Microsoft Corporation) 0B082D6D7A53D91678E7409DD145E89C

C:\Windows\SysWOW64\dnsapi.dll
[2014-12-28 14:10] - [2014-11-04 17:20] - 0498688 ____A (Microsoft Corporation) 205BDB00F4C032AF45A6BFD18EA7886C

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points =========================

Restore point date: 2015-09-22 19:39:20
Restore point date: 2015-09-30 08:38:53
Restore point date: 2015-10-04 23:13:32
Restore point date: 2015-10-10 15:11:42

==================== Memory info ===========================

Percentage of memory in use: 19%
Total physical RAM: 3682.26 MB
Available physical RAM: 2976.92 MB
Total Virtual: 3682.26 MB
Available Virtual: 3002.04 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:275.14 GB) (Free:14.5 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive d: (RECOVERY) (Fixed) (Total:21.74 GB) (Free:2.2 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive f: (FLASH DRIVE) (Removable) (Total:7.46 GB) (Free:0.39 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.25 GB) (Free:0.25 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298.1 GB) (Disk ID: 901E28C9)

Partition: GPT.

========================================================
Disk: 1 (Size: 7.5 GB) (Disk ID: 500A0DFF)
No partition Table on disk 1.


LastRegBack: 2015-10-10 13:49

==================== End of FRST.txt ============================


Edited by xXToffeeXx, 11 October 2015 - 11:09 AM.
Removed code box for my ease~


#4 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,079 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:09:34 AM

Posted 11 October 2015 - 11:32 AM

Hi sdockery,
 
When you try to boot the computer up normally, do you get a message or is there just a black screen?
 
xXToffeeXx~


~If I am helping you and you have not had a reply from me in two days, please send me a PM~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~


#5 sdockery

sdockery
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:02:34 AM

Posted 11 October 2015 - 11:53 AM

I can boot to where the bios is. Otherwise just a black screen. I am now using the command prompt and following a similar problem where I discovered: I have 4 new partitions added to my PC in which four are hidden. Is there any way that I can make disks C and D readable again and get rid of the other four volumes that are hidden? I have Volume 1 thru 6 where 1 and 2 are C and D. The new drive which is called Boot X: the X: is in parentheses.



#6 sdockery

sdockery
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:02:34 AM

Posted 11 October 2015 - 12:16 PM

The article I am following is: http://www.bleepingcomputer.com/forums/t/487747/laptop-boots-from-random-x-drive-instead-of-c-help-please/ I just don't know where to go from here.



#7 sdockery

sdockery
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:02:34 AM

Posted 11 October 2015 - 12:33 PM

I am also looking at: http://www.sevenforums.com/tutorials/26203-convert-gpt-disk-mbr-disk.html My disks are marked GPT now. Therefore unusable. Right?



#8 sdockery

sdockery
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:02:34 AM

Posted 11 October 2015 - 12:54 PM

I Put services.exe in the search on FRST64 and here is the file: 

Farbar Recovery Scan Tool (x64) Version:11-10-2015 01
Ran by SYSTEM (2015-10-11 12:38:26)
Running from F:\Fix Tools
Boot Mode: Recovery

================== Search Files: "services.exe" =============

C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_6.3.9600.17794_none_2fcc465dd0a27017\services.exe
[2015-05-12 14:37][2015-04-08 14:55] 0410128 ____A (Microsoft Corporation) E0C7813A97CA7947FF5C18A8F3B61A45

C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_6.3.9600.17415_none_3023c055d060b271\services.exe
[2015-04-27 03:10][2015-05-17 02:46] 0073764 ____A () AB48952896280CE4CF1048334F6463DC

C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_6.3.9600.17084_none_2fd708ffd09a6815\services.exe
[2014-07-21 04:25][2015-04-28 05:06] 0099046 ____A () 6B5BDEEB170D0DA2C56753F0347809DD

C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_6.3.9600.16384_none_2fd72579d09a45e9\services.exe
[2013-08-22 05:25][2014-08-03 04:50] 0082895 ____A () 892D1838D0C77D4734F7E21F064CD06C

C:\Windows\System32\services.exe
[2015-05-12 14:37][2015-04-08 14:55] 0410128 ____A (Microsoft Corporation) E0C7813A97CA7947FF5C18A8F3B61A45

C:\$Windows.~BT\Sources\SafeOS\SafeOS.Mount\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.10240.16384_none_4719371d97508a19\services.exe
[2015-07-10 02:30][2015-07-10 02:30] 0446336 ___AL () D41D8CD98F00B204E9800998ECF8427E

C:\$Windows.~BT\Sources\SafeOS\SafeOS.Mount\Windows\System32\services.exe
[2015-07-10 02:30][2015-07-10 02:30] 0446336 ___AL () D41D8CD98F00B204E9800998ECF8427E

X:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_6.2.9200.16384_none_97e26cd38667756c\services.exe
[2012-07-25 21:26][2012-07-25 21:26] 0410624 ____A (Microsoft Corporation) 754A2CC1F32107EA87CBD305ABE3E618

X:\Windows\System32\services.exe
[2012-07-25 21:26][2012-07-25 21:26] 0410624 ____A (Microsoft Corporation) 754A2CC1F32107EA87CBD305ABE3E618

====== End of Search ======


#9 sdockery

sdockery
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:02:34 AM

Posted 11 October 2015 - 01:00 PM

And a new FRST with all boxes selected:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:11-10-2015 01
Ran by SYSTEM on MININT-8RHLSSN (11-10-2015 12:54:44)
Running from F:\Fix Tools
Platform: Windows 8.1 (X64) Language: English (United States)
Internet Explorer Version 11
Boot Mode: Recovery
Default: ControlSet001
[b]ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.[/b]

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-08-12] (Apple Inc.)
HKLM-x32\...\Run: [BingDesktop] => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2368736 2014-06-03] (Microsoft Corp.)
HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [475448 2014-03-26] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-04-10] (CyberLink Corp.)
HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1284680 2014-03-25] (CANON INC.)
HKLM-x32\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [449168 2012-03-26] (CANON INC.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-05-15] (Apple Inc.)
HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [896632 2015-07-22] (BlueStack Systems, Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-08-06] (Apple Inc.)
HKLM\...\RunOnce: [*Restore] => C:\WINDOWS\System32\rstrui.exe [273920 2014-10-28] (Microsoft Corporation)
HKU\Stephanie\...\Run: [Amazon Music] => C:\Users\Stephanie\AppData\Local\Amazon Music\Amazon Music Helper.exe [3356480 2014-07-22] ()
HKU\Stephanie\...\Run: [Copy] => C:\Users\Stephanie\AppData\Roaming\Copy\CopyAgent.exe [15410832 2015-04-22] (Barracuda Networks, Inc.)
HKU\Stephanie\...\Run: [GoogleChromeAutoLaunch_15A09AB4B2860ED1D468C1D57628C0D5] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [815944 2015-09-23] (Google Inc.)
HKU\Stephanie\...\Run: [Adobe Reader Synchronizer] => C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe [876728 2015-07-02] (Adobe Systems Incorporated)
HKU\Stephanie\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\Bubbles.scr [788480 2014-10-28] (Microsoft Corporation)

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)
S2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173792 2014-06-03] (Microsoft Corp.)
S3 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [433784 2015-06-16] (BlueStack Systems, Inc.)
S2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [413304 2015-06-16] (BlueStack Systems, Inc.)
S2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [831096 2015-07-21] (BlueStack Systems, Inc.)
S2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [349728 2015-08-13] (WildTangent)
S2 HPWMISVC; c:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [469304 2014-03-26] (Hewlett-Packard Development Company, L.P.)
S2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [140456 2011-09-06] ()
S2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [239176 2013-03-04] (Realtek Semiconductor)
S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2014-07-02] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3880448 2013-11-12] (Qualcomm Atheros Communications, Inc.)
S3 AtiDCM; C:\AMD\WU-CCC2\ccc2_install\Support64\atdcm64a.sys [28416 2014-03-13] (Advanced Micro Devices, Inc.)
S3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [94208 2013-02-14] (Advanced Micro Devices)
S2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [145528 2015-06-16] (BlueStack Systems)
S1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [136408 2015-07-29] (Malwarebytes Corporation)
S3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [290520 2014-09-01] (Realtek Semiconductor Corp.)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [28400 2013-03-08] (Synaptics Incorporated)
S3 SmbDrvI; C:\Windows\System32\drivers\Smb_driver_Intel.sys [33008 2013-03-08] (Synaptics Incorporated)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
S3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2012-08-31] (Hewlett-Packard Development Company, L.P.)

========================== Drivers MD5 =======================

C:\Windows\System32\drivers\1394ohci.sys E1832BD9FD7E0FC2DC9FA5935DE3E8C1
C:\Windows\System32\drivers\3ware.sys AD508A1A46EC21B740AB31C28EFDFDB1
C:\Windows\System32\drivers\ACPI.sys E796AE43DDD1844281DB4D57294D17C0
C:\Windows\System32\Drivers\acpiex.sys AC8279D229398BCF05C3154ADCA86813
C:\Windows\System32\drivers\acpipagr.sys A8970D9BF23CD309E0403978A1B58F3F
C:\Windows\System32\drivers\acpipmi.sys 111A89C99C5B4F1A7BCE5F643DD86F65
C:\Windows\System32\drivers\acpitime.sys 5758387D68A20AE7D3245011B07E36E7
C:\Windows\System32\drivers\ADP80XX.SYS 7C1FDF1B48298CBA7CE4BDD4978951AD
C:\Windows\system32\drivers\afd.sys 374E27295F0A9DCAA8FC96370F9BEEA5
C:\Windows\System32\drivers\agp440.sys 7DFAEBA9AD62D20102B576D5CAC45EC8
C:\Windows\System32\DRIVERS\ahcache.sys FE14D249D39368CA62D8DA6BC94AC694
C:\Windows\System32\drivers\amdk8.sys 7589DE749DB6F71A68489DCE04158729
C:\Windows\system32\DRIVERS\atikmdag.sys 71F8D8B977ACC5973FA042BF906E709F
C:\Windows\system32\DRIVERS\atikmpag.sys 4AA027F91A8093B1CDF453B5394F6715
C:\Windows\System32\drivers\amdppm.sys B46D2D89AFF8A9490FA8C98C7A5616E3
C:\Windows\System32\drivers\amdsata.sys D2BF2F94A47D332814910FD47C6BBCD2
C:\Windows\System32\drivers\amdsbs.sys A8E04943C7BBA7219AA50400272C3C6E
C:\Windows\System32\drivers\amdxata.sys CEA5F4F27CFC08E3A44D576811B35F50
C:\Windows\System32\drivers\amd_sata.sys 0E6F9683928F99DF16E0E7924E4807D9
C:\Windows\System32\drivers\amd_xata.sys F9254DE6FA0A2782A4810726F2D677EF
C:\Windows\system32\drivers\appid.sys 415DD71628795197F7AFC176CBADC74E
C:\Windows\System32\drivers\arcsas.sys 65045784366F7EC5FB4E71BCF923187B
C:\Windows\system32\DRIVERS\asyncmac.sys 3DB7721F06BC2FEDB25029EA23AB27DA
C:\Windows\System32\drivers\atapi.sys 74B14192CF79A72F7536B27CB8814FBD
C:\Windows\system32\DRIVERS\athwbx.sys 7ABEEA176A840449BFA7A766DFE1085E
C:\AMD\WU-CCC2\ccc2_install\Support64\atdcm64a.sys EF2EC92C4E449CD065B9E892E05D47BE
C:\Windows\system32\drivers\AtihdW86.sys 005D1AA28FFAA7FB327842B3CAFF726E
C:\Windows\System32\drivers\bxvbda.sys A4A73F631FE2AA2826FBE4A399B04DEF
C:\Windows\System32\drivers\BasicDisplay.sys 8CC7F7E4AFCBA605921B137ED7992C68
C:\Windows\System32\drivers\BasicRender.sys 38A82F4EE8C416A6744B6D30381ED768
C:\Windows\System32\drivers\bcmfn2.sys C1ABB0F7E3BEA48A0417BDF6FF14AB21
C:\Windows\System32\Drivers\Beep.sys EC19013E4CF87609534165DF897274D6
C:\Windows\System32\DRIVERS\bowser.sys 6B4FFFDDC618FCF64473CAA86E305697
C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys 6A4D927BDEE8D9944FAA0012AF7AD232
C:\Windows\System32\drivers\BthAvrcpTg.sys A8F23D453A424FF4DE04989C4727ECC7
C:\Windows\System32\drivers\bthhfenum.sys 272A62B660A48AEF366F8A1836CED19F
C:\Windows\System32\drivers\BthHFHid.sys 71FE2A48E4C93DDB9798C024880B6C07
C:\Windows\System32\drivers\bthmodem.sys 66B791F6B11DC4303DD18A224A501542
C:\Windows\System32\DRIVERS\cdfs.sys 2FA6510E33F7DEFEC03658B74101A9B9
C:\Windows\System32\drivers\cdrom.sys C6796EA22B513E3457514D92DCDB1A3D
C:\Windows\System32\drivers\circlass.sys BE9936EDD3267FAAFF94A7835867F00B
C:\Windows\System32\drivers\CLFS.sys 8EB7E70C2D348FE2476A2E3F2D585E3D
C:\Windows\system32\DRIVERS\CLVirtualDrive.sys 075CCE75090786F124573A788C8656E6
C:\Windows\System32\drivers\CmBatt.sys EF6EF85DADC3184A10D8F2F7159973CB
C:\Windows\System32\Drivers\cng.sys 5E5AB950693F2C6D6ACBEE3A74697ED7
C:\Windows\System32\drivers\CompositeBus.sys 03AAED827C36F35D70900558B8274905
C:\Windows\System32\drivers\condrv.sys A1FF7DFBFBE164CF92603C651D304DD2
C:\Windows\System32\drivers\dam.sys 389C998C64319CD97625B0550E52ECFA
C:\Windows\System32\Drivers\dfsc.sys A03F362C5557E238CBFA914689C77248
C:\Windows\System32\drivers\disk.sys 4D40C9B33F738797CF50E77CB7C53E85
C:\Windows\System32\drivers\dmvsc.sys EB70A894708D1BC176AFD690FF06085F
C:\Windows\system32\drivers\drmkaud.sys 00C594D5A1DBD22AD8B2902B9F6EFF94
C:\Windows\System32\drivers\dxgkrnl.sys E1BB0B6F00F470B451AB45EA13EBA0B3
C:\Windows\System32\drivers\evbda.sys 114BCFDF367FF37C3F1B0A96AF542E4D
C:\Windows\System32\drivers\EhStorClass.sys 43531A5993380CC5113242C29D265FD9
C:\Windows\System32\drivers\EhStorTcgDrv.sys 6F8E738A9505A388B1157FDDE7B3101B
C:\Windows\System32\drivers\errdev.sys DFFFAE1442BA4076E18EED5E406FA0D3
C:\Windows\System32\Drivers\exfat.sys 7729D294A555C7AEB281ED8E4D0E01E4
C:\Windows\System32\Drivers\fastfat.sys 7C4E0D5900B2A1D11EDD626D6DDB937B
C:\Windows\System32\drivers\fdc.sys 5D8402613E778B3BD45E687A8372710B
C:\Windows\System32\drivers\fileinfo.sys BCFD8B149B3ADF92D0DB1E909CAF0265
C:\Windows\System32\drivers\filetrace.sys A1A66C4FDAFD6B0289523232AFB7D8AF
C:\Windows\System32\drivers\flpydisk.sys BE743083CF7063C486A4398E3AEFE59A
C:\Windows\System32\drivers\fltmgr.sys C1FB505A73FA2E9019D32444AB33B75A
C:\Windows\System32\drivers\FsDepends.sys A7C31B168F371E8E6796219F23E354DB
C:\Windows\System32\Drivers\Fs_Rec.sys 09F460AFEDCA03F3BF6E07D1CCC9AC42
C:\Windows\System32\DRIVERS\fvevol.sys F152D55E497E12256290C43B31C7D0CE
C:\Windows\System32\drivers\fxppm.sys 9591D0B9351ED489EAFD9D1CE52A8015
C:\Windows\System32\drivers\gagp30kx.sys FC3EF65EE20D39F8749C2218DBA681CA
C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 8E98D21EE06192492A5671A6144D092F
C:\Windows\System32\drivers\vmgencounter.sys 0BF5CAD281E25F1418E5B8875DC5ADD1
C:\Windows\System32\Drivers\msgpioclx.sys 8DF1254093B5C354CE725EB6B9B0DE19
C:\Windows\System32\drivers\HDAudBus.sys D4B7ED39C7900384D9E5C1283F1E7926
C:\Windows\System32\drivers\HidBatt.sys 10A70BC1871CD955D85CD88372724906
C:\Windows\System32\drivers\hidbth.sys 42F88B57CAE42FC10059C887B3FCFCEA
C:\Windows\System32\drivers\hidi2c.sys C241A8BAFBBFC90176EA0F5240EACC17
C:\Windows\System32\drivers\hidir.sys 9BDDEE26255421017E161CCB9D5EDA95
C:\Windows\System32\drivers\hidusb.sys 8DB8EAB9D0C6A5DF0BDCADEA239220B4
C:\Windows\System32\drivers\HpSAMD.sys A6AACEA4C785789BDA5912AD1FEDA80D
C:\Windows\System32\drivers\HTTP.sys E87A6D3B8FECD5B93BC0CFBB48C27970
C:\Windows\System32\drivers\hwpolicy.sys 90656C0B3864804B090434EFC582404F
C:\Windows\System32\drivers\hyperkbd.sys 6D6F9E3BF0484967E52F7E846BFF1CA1
C:\Windows\system32\DRIVERS\HyperVideo.sys 907C870F8C31F8DDD6F090857B46AB25
C:\Windows\System32\drivers\i8042prt.sys 49EE0AE9E5B64FFBBD06D55C4984B598
C:\Windows\System32\drivers\iaLPSSi_GPIO.sys 5D90E32E36CE5D4C535D17CE08AEAF05
C:\Windows\System32\drivers\iaLPSSi_I2C.sys DD05E7E80F52ADE9AEB292819920F32C
C:\Windows\System32\drivers\iaStorA.sys 6C91E425ACE29594BD574DE38AC9B76D
C:\Windows\System32\drivers\iaStorAV.sys 08BFE413B0B4AA8DFA4B5684CE06D3DC
C:\Windows\System32\drivers\iaStorV.sys A2200C3033FA4EF249FC096A7A7D02A2
C:\Windows\system32\drivers\RTKVHD64.sys 6C7970A8E0546A4D9466E0045C7DB199
C:\Windows\System32\drivers\intelide.sys 4E448FCFFD00E8D657CD9E48D3E47157
C:\Windows\System32\drivers\intelpep.sys 7AA01AB1C110916825E6E1389F1B9AF2
C:\Windows\System32\drivers\intelppm.sys 47E74A8E53C7C24DCE38311E1451C1D9
C:\Windows\System32\DRIVERS\ipfltdrv.sys 9DB76D7F9E4E53EFE5DD8C53DE837514
C:\Windows\System32\drivers\IPMIDrv.sys 9C096BF5E10CA8BFA56F32522A89FAF1
C:\Windows\System32\drivers\ipnat.sys B7342B3C58E91107F6E946A93D9D4EFD
C:\Windows\System32\drivers\irenum.sys AE44C526AB5F8A487D941CEB57B10C97
C:\Windows\System32\drivers\isapnp.sys 8AFEEA3955AA43616A60F133B1D25F21
C:\Windows\System32\drivers\msiscsi.sys D90AB68D0FAC9F357F663670FDBB511E
C:\Windows\System32\drivers\kbdclass.sys 5917AFE4A3F695A54B99C1849C8207FE
C:\Windows\System32\drivers\kbdhid.sys 8CD840A062F6BDF41DDE3ACB96164B72
C:\Windows\system32\DRIVERS\kdnic.sys 813871C7D402A05F2E3A7075F9584A05
C:\Windows\System32\Drivers\ksecdd.sys 4E829B18D5BAEC29893792A3C671A847
C:\Windows\System32\Drivers\ksecpkg.sys 46711F40D0F9E63F786ED23F9BD5215E
C:\Windows\system32\drivers\ksthunk.sys 11AFB527AA370B1DAFD5C36F35F6D45F
C:\Windows\system32\DRIVERS\lltdio.sys C09010B3680860131631F53E8FE7BAD8
C:\Windows\System32\drivers\lsi_sas.sys C755AE4635457AA2A11F79C0DF857ABC
C:\Windows\System32\drivers\lsi_sas2.sys ADAC09CBE7A2040B7F68B5E5C9A75141
C:\Windows\System32\drivers\lsi_sas3.sys 04D1274BB9BBCCF12BD12374002AA191
C:\Windows\System32\drivers\lsi_sss.sys 327469EEF3833D0C584B7E88A76AEC0C
C:\Windows\system32\drivers\luafv.sys DDEE191AB32DFC22C6465002ECDF5EE4
C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys E9CD058C79EA15B4AA93E259FA713B07
C:\Windows\System32\drivers\megasas.sys EB5C03A070F30D64A6DF80E53B22F53F
C:\Windows\System32\drivers\megasr.sys F6F13533196DE7A582D422B0241E4363
C:\Windows\System32\drivers\modem.sys 8B38C44F69259987C95135C9627E2378
C:\Windows\System32\drivers\monitor.sys 601589000CC90F0DF8DA2CC254A3CCC9
C:\Windows\System32\drivers\mouclass.sys 08374E4E5B8914DE6067CBA99F61E930
C:\Windows\System32\drivers\mouhid.sys 5FCBAB60598AE119E02B4C27DE6B99EA
C:\Windows\System32\drivers\mountmgr.sys 9A788037D768809DFD677F4BA08A224A
C:\Windows\System32\drivers\mpsdrv.sys 6FC047578785B0435F4E2660946D1ADC
C:\Windows\system32\drivers\mrxdav.sys DB32958F0E704EFBF7F15161A569E39F
C:\Windows\System32\DRIVERS\mrxsmb.sys 6FBDF2B1B025A8E6E069234362FFFFB7
C:\Windows\System32\DRIVERS\mrxsmb10.sys BCBD64220AD85C26823453FF1DC3EFBD
C:\Windows\System32\DRIVERS\mrxsmb20.sys 57C2473D501331211D6885FD59F3E44B
C:\Windows\system32\DRIVERS\bridge.sys F3C060444777A59FC63D920719E43CCD
C:\Windows\System32\Drivers\Msfs.sys D13329FBF8345B28AB30F44CC247DC08
C:\Windows\System32\drivers\msgpiowin32.sys C6B474E46F9E543B875981ED3FFE6ADD
C:\Windows\System32\drivers\mshidkmdf.sys 65C92EB9D08DB5C69F28C7FFD4E84E31
C:\Windows\System32\drivers\mshidumdf.sys 52299F086AC2DAFD100DD5DC4A8614BA
C:\Windows\System32\drivers\msisadrv.sys 36D92AF3343C3A3E57FEF11C449AEA4C
C:\Windows\system32\drivers\MSKSSRV.sys A9BBBD2BAE6142253B9195E949AC2E8D
C:\Windows\system32\DRIVERS\mslldp.sys 51B3AC0560848CD6D65AC2033E293113
C:\Windows\system32\drivers\MSPCLOCK.sys 7B2128EB875DCBC006E6A913211006D6
C:\Windows\system32\drivers\MSPQM.sys 1E88171579B218115C7A772F8DE04BD8
C:\Windows\System32\Drivers\MsRPC.sys BBE2A455053E63BECBF42C2F9B21FAE0
C:\Windows\System32\drivers\mssmbios.sys 8D6B7D515C5CBCDB75B928A0B73C3C5E
C:\Windows\system32\drivers\MSTEE.sys 115019AE01E0EB9C048530D2928AB4A2
C:\Windows\System32\drivers\MTConfig.sys 96D604A35070360F0DD4A7A8AF410B5E
C:\Windows\System32\Drivers\mup.sys 619CA29326B82372621DB2C0964D8365
C:\Windows\System32\drivers\mvumis.sys B8C35C94DCB2DFEAF03BB42131F2F77F
C:\Windows\system32\DRIVERS\nwifi.sys 008F7CED69FD5B30CBDE1E03C6F36A27
C:\Windows\System32\drivers\ndis.sys 97DC5967F65503213FD1F1B3E4A6F983
C:\Windows\system32\DRIVERS\ndiscap.sys 8CECC8DA55F3274181FD1EA28AD76664
C:\Windows\system32\DRIVERS\NdisImPlatform.sys 269882812E9A68FFF1AFE1283D428322
C:\Windows\system32\DRIVERS\ndistapi.sys DC1D9F692C2AD84C214584C28501C1F7
C:\Windows\system32\DRIVERS\ndisuio.sys B832B35055BA2B7B4181861FF94D8E59
C:\Windows\System32\drivers\NdisVirtualBus.sys 1F58E48EF75F34C35D8E93A0DC535CFE
C:\Windows\system32\DRIVERS\ndiswan.sys DEC29080202D4F9F17F55E18BCFCC41A
C:\Windows\system32\DRIVERS\ndiswan.sys DEC29080202D4F9F17F55E18BCFCC41A
C:\Windows\System32\Drivers\NDProxy.sys 0BBE2FA30BAD58C9ADC01E4F84A3D2A1
C:\Windows\System32\drivers\Ndu.sys 3083926D1CC5B56EA0786527B557DD1B
C:\Windows\System32\DRIVERS\netbios.sys 42FF4975D032CAE558AE4BB8448F6E5A
C:\Windows\System32\DRIVERS\netbt.sys 0217532E19A748F0E5D569307363D5FD
C:\Windows\System32\drivers\netvsc63.sys D4DCE03870314D3354F3501F9DDD4123
C:\Windows\System32\Drivers\Npfs.sys 8F44A2F57C9F1A19AC9C6288C10FB351
C:\Windows\System32\drivers\npsvctrig.sys CBDB4F0871C88DF930FC0E8588CA67FC
C:\Windows\System32\drivers\nsiproxy.sys 0E046FF5823B95326D10CF1B4AF23541
C:\Windows\System32\Drivers\Ntfs.sys 7F68063A5A0461E02BC860CE0E6BFDDC
C:\Windows\System32\Drivers\Null.sys EF1B290FC9F0E47CC0B537292BEE5904
C:\Windows\System32\drivers\nvraid.sys BC6B5942AFF25EBAF62DE43C3807EDF8
C:\Windows\System32\drivers\nvstor.sys 1F43ABFFAC3D6CA356851D517392966E
C:\Windows\System32\drivers\nv_agp.sys 6934A936A7369DFE37B7DBA93F5E5E49
C:\Windows\System32\drivers\parport.sys 764B1121867B2D9B31C491668AC72B2B
C:\Windows\System32\drivers\partmgr.sys BAFF6122CFC9F95CA175AD8C348179A4
C:\Windows\System32\drivers\pci.sys 91ED124E261EA8FAA1C0FFDF2A71B0C4
C:\Windows\System32\drivers\pciide.sys 346E38FCC6859A727DD28AFAD1F0AFF4
C:\Windows\System32\drivers\pcmcia.sys 4D3BDCC1C7B40C9D7B6AD990E6DEC397
C:\Windows\System32\drivers\pcw.sys BF28771D1436C88BE1D297D3098B0F7D
C:\Windows\System32\drivers\pdc.sys ED54A75050211DC77F9B98C41E026858
C:\Windows\System32\drivers\peauth.sys 0ECEE590F2E2EF969FB74A6FC583A1E6
C:\Windows\system32\DRIVERS\raspptp.sys E075CC071022BD4E9BE7C024717C0E0A
C:\Windows\System32\drivers\processr.sys ECD373F9571C745894367CC2635EA44F
C:\Windows\system32\DRIVERS\pacer.sys FC0141B4A5AD6D637D883C1A89FC45C5
C:\Windows\system32\drivers\qwavedrv.sys 83868EB2924E6BC21A54337C65D614D1
C:\Windows\System32\DRIVERS\rasacd.sys B337B1F1E82A83E20A1743E008E25C0F
C:\Windows\system32\DRIVERS\AgileVpn.sys 3EE5097945A7F680E320953271EB2D4F
C:\Windows\system32\DRIVERS\rasl2tp.sys 1BD3022FD6E450B00DE560265638FD2A
C:\Windows\system32\DRIVERS\raspppoe.sys 5247F308C4103CDC4FE12AE1D235800A
C:\Windows\system32\DRIVERS\rassstp.sys 41F631007A158FEBB67F0E2AD1601BBA
C:\Windows\System32\DRIVERS\rdbss.sys A1A5E79C0D1352AFDC08328A623DA051
C:\Windows\System32\drivers\rdpbus.sys 6B21EBF892CD8CACB71669B35AB5DE32
C:\Windows\System32\drivers\rdpdr.sys 680C1DAE268B6FB67FA21B389A8B79EF
C:\Windows\System32\drivers\rdpvideominiport.sys BC8A79C625568DDB7DCA49D0C2741A64
C:\Windows\System32\drivers\rdyboost.sys A26AEC49F318FEE141DDDB2C5F99B3E6
C:\Windows\System32\Drivers\ReFS.sys 615DFD97DEA56CE1C3A52185A3038FF8
C:\Windows\system32\DRIVERS\RtsP2Stor.sys 04080F8C8FBCF3F269348B92AEA7A30D
C:\Windows\system32\DRIVERS\rspndr.sys 2D05A5508F4685412F2B89E8C2189ABC
C:\Windows\system32\DRIVERS\Rt630x64.sys CFE738C524F35B6E523A4D0F54840C30
C:\Windows\System32\drivers\vms3cap.sys 1A063730F221B2746FF00457AE17E4F0
C:\Windows\System32\drivers\sbp2port.sys C624A1B32211C3166EDB3F4AB02A30B7
C:\Windows\System32\DRIVERS\scfilter.sys 13BEA6C882D4D877A5A85CA149C86BC1
C:\Windows\System32\drivers\sdbus.sys C54B6B2170BF628FD42F799A66956D75
C:\Windows\System32\drivers\sdstor.sys 0B1E929D11A8E358106955603FAC65E8
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\SerCx.sys DB2FF24CE0BDD15FE75870AFE312BA89
C:\Windows\System32\drivers\SerCx2.sys 0044B31F93946D5D41982314381FE431
C:\Windows\System32\drivers\serenum.sys 3CD600C089C1251BEEB4CD4CD5164F9E
C:\Windows\System32\drivers\serial.sys D864381BC9C725FAB01D94C060660166
C:\Windows\System32\drivers\sermouse.sys 148195AE95D9BC7375A08846439FDAC1
C:\Windows\System32\drivers\sfloppy.sys 472B7A5AC181C050888DB454663DD764
C:\Windows\System32\drivers\SiSRaid2.sys 2F518D13DD6F3053837FE606F1A2EA1F
C:\Windows\System32\drivers\sisraid4.sys 1AC9A200A9C49C4508F04AAFFCA34A3F
C:\Windows\System32\drivers\Smb_driver_AMDASF.sys DB7D9758171898BC31D6147F41B17D9E
C:\Windows\System32\drivers\Smb_driver_Intel.sys 99A76D83444026619CA36744F2A468C5
C:\Windows\System32\drivers\spaceport.sys D24B1945ED1F9C96DA786DBBF1E983CE
C:\Windows\System32\drivers\SpbCx.sys F337BE11071818FC3F5DC2940B6BDE34
C:\Windows\System32\DRIVERS\srv.sys 6416E79A58A8FCC33A447A4DDDD3BF04
C:\Windows\System32\DRIVERS\srv2.sys 00D8AC8E3053290BDE6EA2FB6810D2FC
C:\Windows\System32\DRIVERS\srvnet.sys D047CD668E6277FD80F0C613946F034C
C:\Windows\System32\drivers\stexstor.sys 366DEA74BBA65B362BCCFC6FC2ADFD8B
C:\Windows\System32\drivers\storahci.sys 0ED2E318ABB68C1A35A8B8038BDB4C90
C:\Windows\System32\drivers\vmstorfl.sys 8B9486B64E5FC17FB9CC04CA10B77A34
C:\Windows\System32\drivers\stornvme.sys 6B06E2D11E604BE2B1A406C4CB3B90DE
C:\Windows\System32\drivers\storvsc.sys 548759755BC73DAD663250239D7E0B9F
C:\Windows\System32\drivers\swenum.sys 65454187E0F8B6C0DCECB0287D06EC43
C:\Windows\system32\DRIVERS\SynTP.sys A78C5D17CA7AD6E28107A2B280D38C58
C:\Windows\System32\drivers\tcpip.sys 746DDF7D59AB8D721C88D48434597E8D
C:\Windows\system32\DRIVERS\tcpip.sys 746DDF7D59AB8D721C88D48434597E8D
C:\Windows\System32\drivers\tcpipreg.sys 41CF802064F72E55F50CA0A221FD36D4
C:\Windows\system32\DRIVERS\tdx.sys FFF28F9F6823EB1756C60F1649560BBF
C:\Windows\System32\drivers\terminpt.sys 232D185D2337F141311D0CF1983E1431
C:\Windows\system32\drivers\tpm.sys 82F909359600D3603FE852DB7F135626
C:\Windows\System32\drivers\tsusbflt.sys BF8F54CA37E9C9D6582C31C5761F8C93
C:\Windows\System32\drivers\TsUsbGD.sys 20185BEB7512EDE4EFECDFA148AC9F99
C:\Windows\system32\DRIVERS\tunnel.sys C8E0E78B5D284C2FF59BDFFDAF997242
C:\Windows\System32\drivers\uagp35.sys F6EEAD052943B5A3104C1405BB856C54
C:\Windows\System32\drivers\uaspstor.sys FE6067B1FD4E63650C667B33D080565B
C:\Windows\System32\drivers\ucx01000.sys 807F8CF3E973305FC435C61CBBEE2A49
C:\Windows\System32\DRIVERS\udfs.sys C61EAF8E1E4B2F62BA4FDF457440B2C6
C:\Windows\System32\drivers\UEFI.sys 9578691F297E1B1F519970FE6D47CB21
C:\Windows\System32\drivers\uliagpkx.sys 5EAB5117DDB24FC4D39E6FFFCF1837B9
C:\Windows\System32\drivers\umbus.sys DA34C39A18E60E7C3FA0630566408034
C:\Windows\System32\drivers\umpass.sys AE8294875E5446E359B1E8035D40C05E
C:\Windows\system32\drivers\usbaudio.sys DF355EB0199198728027962DCFCDE5FB
C:\Windows\System32\drivers\usbccgp.sys FF78D053A05E5A394F4E3C1816CC65A8
C:\Windows\System32\drivers\usbcir.sys 0139248F6B95CF0D837B5B46A2722D40
C:\Windows\System32\drivers\usbehci.sys 48BA326A3DBA5B5BEB5F2777F4618696
C:\Windows\system32\DRIVERS\usbfilter.sys 504901430B6E03B99EBB6BF26E0868C6
C:\Windows\System32\drivers\usbhub.sys FEF0BC107812B36849741C3211BA6B60
C:\Windows\System32\drivers\UsbHub3.sys 95B0179BDA907252025DEEA183699FB3
C:\Windows\System32\drivers\usbohci.sys 3019097FB6C985EF24C058090FF3BDBD
C:\Windows\System32\drivers\usbprint.sys 4D655E3B684BE9B0F7FFD8A2935C348C
C:\Windows\System32\drivers\usbscan.sys 0F030491BA4A27BD46F8B8ACEEE83F1A
C:\Windows\System32\drivers\USBSTOR.SYS 66732C13628BDB1AB0D6FD46027327C2
C:\Windows\System32\drivers\usbuhci.sys 064260B3A5868AC894A4943543BC7AB7
C:\Windows\System32\Drivers\usbvideo.sys 5C8F604F6DC74177CDD8372D7B1ADFF0
C:\Windows\System32\drivers\USBXHCI.SYS 44603DA5A87FB491EF59C889EBBB4DDB
C:\Windows\System32\drivers\vdrvroot.sys FEB26E3B8345A7E8D62F945C4AE86562
C:\Windows\System32\drivers\VerifierExt.sys A026EDEAA5EECAE0B08E2748B616D4BD
C:\Windows\System32\drivers\vhdmp.sys F6ECFD6128A16A4851CFE98D4E01B011
C:\Windows\System32\drivers\viaide.sys 06D38968028E9AB19DE9B618C7B6D199
C:\Windows\System32\drivers\vmbus.sys 511AD3FF957A0127E6BD336FF6F89C38
C:\Windows\System32\drivers\VMBusHID.sys DA40BEA0A863CE768C940CA9723BF81F
C:\Windows\System32\drivers\volmgr.sys 55D7D963DE85162F1C49721E502F9744
C:\Windows\System32\drivers\volmgrx.sys CCB9E901F7254BF96D28EB1B0E5329B7
C:\Windows\System32\drivers\volsnap.sys 64CA2B4A49A8EAF495E435623ECCE7DB
C:\Windows\System32\drivers\vpci.sys EF31713EE4C7CCFE4049F7E7F15645A2
C:\Windows\System32\drivers\vsmraid.sys 4539F45F9F4C9757A86A56C949421E07
C:\Windows\System32\drivers\vstxraid.sys 0849B7260F26FE05EA56DED0672E2F4B
C:\Windows\System32\drivers\vwifibus.sys BE970C369E43B509C1EDA2B8FA7CECB0
C:\Windows\system32\DRIVERS\vwififlt.sys 35BF5C5F5E3C9902C98978C7640574DA
C:\Windows\system32\DRIVERS\vwifimp.sys 65ED7B9CFEA893DF7748D5FF692690DE
C:\Windows\System32\drivers\wacompen.sys 0910AB9ED404C1434E2D0376C2AD5D8B
C:\Windows\system32\DRIVERS\wanarp.sys B41F3E5780D97CFD44A717153AD9CF2C
C:\Windows\system32\DRIVERS\wanarp.sys B41F3E5780D97CFD44A717153AD9CF2C
C:\Windows\System32\drivers\WdBoot.sys 81285DDC994F03379DB46419300B2DCB
C:\Windows\System32\drivers\Wdf01000.sys CB6C63FF8342B467E2EF76E98D5B934D
C:\Windows\System32\drivers\WdFilter.sys 26B8FED3F3B85F5F0C4BD03FD00B9941
C:\Windows\System32\Drivers\WdNisDrv.sys CE67080F00E0AF32755096CEA6430ABA
C:\Windows\System32\DRIVERS\wfplwfs.sys 715ABA3DD164D06457A2A3C92F6EA9D5
C:\Windows\System32\drivers\wimmount.sys 5F66B7BB330AA80067FC66149A692620
C:\Windows\System32\drivers\WirelessButtonDriver64.sys 4F2A80D65AE6F845776E2F06AE6782ED
C:\Windows\System32\drivers\wmiacpi.sys 2834D9D3B4F554A39C72F00EA3F0E128
C:\Windows\System32\Drivers\Wof.sys 7FC5667DF73D4B04AA457CC3A4180E09
C:\Windows\System32\DRIVERS\wpcfltr.sys A2468CC3509394A33C4C32F99563D845
C:\Windows\System32\drivers\WpdUpFltr.sys 9F2904B55F6CECCD1A8D986B5CE2609A
C:\Windows\system32\drivers\ws2ifsl.sys AE072B0339D0A18E455DC21666CAD572
C:\Windows\System32\drivers\WSDPrint.sys F586F3F1BF962FE9AE4316E0D896B22F
C:\Windows\System32\drivers\WSDScan.sys 58035FD3369879E02D65989C44D27450
C:\Windows\System32\drivers\WudfPf.sys 481286719402E4BAEFEA0604AB1B5113
C:\Windows\System32\drivers\WUDFRd.sys D7B4859227B02BCC1055B279A63C937F
C:\Windows\System32\drivers\WUDFRd.sys D7B4859227B02BCC1055B279A63C937F
C:\Windows\System32\drivers\WUDFRd.sys D7B4859227B02BCC1055B279A63C937F

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Three Months Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-10-10 13:19 - 2015-10-10 13:19 - 00000000 ____D C:\Program Files (x86)\ESET
2015-10-10 12:53 - 2015-10-10 12:54 - 02587988 _____ C:\Users\Stephanie\Downloads\AR (1).zip
2015-10-10 12:46 - 2015-10-10 12:49 - 02587988 _____ C:\Users\Stephanie\Downloads\AR.zip
2015-10-10 12:31 - 2015-10-10 12:32 - 03562278 _____ C:\Users\Stephanie\Downloads\WPAutoFunnel-Plugin+ManualV2.zip
2015-10-10 11:59 - 2015-10-10 12:13 - 00000000 ____D C:\Users\Stephanie\Downloads\Spin Rewriter Bonus
2015-10-10 11:43 - 2015-10-10 11:43 - 00000000 ____D C:\Users\Stephanie\Downloads\Blackout-Firesale-part-1
2015-10-10 11:31 - 2015-10-10 11:32 - 01372978 _____ C:\Users\Stephanie\Downloads\Autoresponder Independence.zip
2015-10-10 11:05 - 2015-10-10 11:07 - 00000000 ____D C:\Users\Stephanie\Downloads\The-Simple-Traffic-Giant-System
2015-10-09 16:25 - 2015-10-07 07:56 - 00005138 _____ C:\Users\Public\Documents\Gobbledegook.txt
2015-09-18 12:44 - 2015-10-04 15:35 - 00000368 _____ C:\Windows\Tasks\HPCeeScheduleForStephanie.job
2015-09-18 12:44 - 2015-09-18 12:44 - 00003190 _____ C:\Windows\System32\Tasks\HPCeeScheduleForStephanie
2015-09-11 05:28 - 2015-09-11 05:28 - 00002447 ____N C:\Users\Public\Desktop\WildTangent Games App - hp.lnk
2015-09-11 04:26 - 2015-09-11 04:27 - 00000000 ____D C:\Users\Stephanie\AppData\Roaming\WildTangent
2015-09-08 18:32 - 2015-09-08 18:32 - 00000000 ____D C:\ProgramData\Riot Games
2015-09-08 17:47 - 2015-09-08 17:47 - 00001625 _____ C:\Users\Public\Desktop\League of Legends.lnk
2015-09-08 17:47 - 2015-09-08 17:47 - 00000000 ___DC C:\Riot Games
2015-09-08 17:47 - 2008-07-31 07:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2015-09-08 17:47 - 2008-07-31 07:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2015-09-08 17:47 - 2008-07-12 05:18 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2015-09-08 17:47 - 2008-07-12 05:18 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2015-09-08 17:47 - 2008-07-12 05:18 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2015-09-08 17:45 - 2015-09-08 17:48 - 00000000 ____D C:\Users\Stephanie\AppData\Roaming\Riot Games
2015-09-08 17:28 - 2015-09-08 17:40 - 27864920 _____ (Riot Games) C:\Users\Stephanie\Downloads\LeagueofLegends_NA_Installer_9_15_2014.exe
2015-09-08 13:02 - 2015-08-22 10:19 - 25188352 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2015-09-08 13:02 - 2015-08-22 09:22 - 19856384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-09-08 13:02 - 2015-08-22 08:41 - 14451712 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2015-09-08 13:02 - 2015-08-22 08:22 - 12857344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-09-08 13:01 - 2015-08-22 09:35 - 02886144 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2015-09-08 13:01 - 2015-08-22 09:34 - 00585216 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2015-09-08 13:01 - 2015-08-22 09:21 - 00817664 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2015-09-08 13:01 - 2015-08-22 09:20 - 05923840 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2015-09-08 13:01 - 2015-08-22 08:55 - 00504832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-09-08 13:01 - 2015-08-22 08:50 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-09-08 13:01 - 2015-08-22 08:50 - 01032704 _____ (Microsoft Corporation) C:\Windows\System32\inetcomm.dll
2015-09-08 13:01 - 2015-08-22 08:45 - 00665600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-09-08 13:01 - 2015-08-22 08:44 - 00262144 _____ (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2015-09-08 13:01 - 2015-08-22 08:41 - 00801280 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2015-09-08 13:01 - 2015-08-22 08:41 - 00720384 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2015-09-08 13:01 - 2015-08-22 08:41 - 00374784 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2015-09-08 13:01 - 2015-08-22 08:39 - 02126336 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2015-09-08 13:01 - 2015-08-22 08:28 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-09-08 13:01 - 2015-08-22 08:26 - 02427392 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2015-09-08 13:01 - 2015-08-22 08:23 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-09-08 13:01 - 2015-08-22 08:20 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-09-08 13:01 - 2015-08-22 08:18 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-09-08 13:01 - 2015-08-22 08:18 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-09-08 13:01 - 2015-08-22 08:18 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-09-08 13:01 - 2015-08-22 08:14 - 01545728 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2015-09-08 13:01 - 2015-08-22 08:01 - 00800768 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2015-09-08 13:01 - 2015-08-22 08:00 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-09-08 13:01 - 2015-08-22 07:56 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-09-08 13:01 - 2015-08-22 07:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-09-08 12:56 - 2015-09-01 18:56 - 04175872 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2015-09-08 12:56 - 2015-09-01 18:55 - 00358912 _____ (Adobe Systems Incorporated) C:\Windows\System32\atmfd.dll
2015-09-08 12:56 - 2015-09-01 18:50 - 00044032 _____ (Adobe Systems) C:\Windows\System32\atmlib.dll
2015-09-08 12:56 - 2015-09-01 18:17 - 00301568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-09-08 12:56 - 2015-09-01 18:13 - 00035840 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-09-08 12:46 - 2015-09-02 18:18 - 02531400 _____ (Microsoft Corporation) C:\Windows\System32\msxml6.dll
2015-09-08 12:46 - 2015-09-02 18:17 - 01903848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2015-09-08 12:46 - 2015-09-02 10:48 - 02345472 _____ (Microsoft Corporation) C:\Windows\System32\msxml3.dll
2015-09-08 12:46 - 2015-09-02 09:09 - 01556992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-09-08 12:45 - 2015-08-26 18:48 - 00136904 _____ (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2015-09-08 12:45 - 2015-08-26 10:00 - 00721920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-09-08 12:45 - 2015-08-26 10:00 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-09-08 12:45 - 2015-08-26 10:00 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-09-08 12:45 - 2015-08-26 10:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-09-08 12:45 - 2015-08-26 06:46 - 03705344 _____ (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2015-09-08 12:45 - 2015-08-26 06:29 - 02240512 _____ (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2015-09-08 12:45 - 2015-08-26 06:27 - 00891904 _____ (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2015-09-08 12:45 - 2015-08-26 06:27 - 00409088 _____ (Microsoft Corporation) C:\Windows\System32\WUSettingsProvider.dll
2015-09-08 12:45 - 2015-08-26 06:26 - 00140288 _____ (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2015-09-08 12:45 - 2015-08-26 06:26 - 00095744 _____ (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2015-09-08 12:45 - 2015-08-26 06:26 - 00035840 _____ (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2015-09-08 12:45 - 2015-07-22 06:19 - 00041984 _____ (Microsoft Corporation) C:\Windows\System32\UtcResources.dll
2015-09-08 12:45 - 2015-07-22 05:52 - 01633792 _____ (Microsoft Corporation) C:\Windows\System32\diagtrack.dll
2015-09-08 12:45 - 2015-07-17 06:15 - 00951296 _____ (Microsoft Corporation) C:\Windows\System32\tdh.dll
2015-09-08 12:45 - 2015-07-17 06:10 - 00749568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-09-08 12:44 - 2015-07-30 09:18 - 00268288 _____ (Microsoft Corporation) C:\Windows\System32\InkEd.dll
2015-09-08 12:44 - 2015-07-30 08:22 - 00230912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-09-08 12:44 - 2015-06-27 03:47 - 00118616 _____ (Microsoft Corporation) C:\Windows\System32\consent.exe
2015-09-08 12:38 - 2015-07-03 13:51 - 01380056 _____ (Microsoft Corporation) C:\Windows\System32\gdi32.dll
2015-09-08 12:38 - 2015-07-03 06:00 - 01097216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-09-08 12:37 - 2015-06-19 09:07 - 02819072 _____ (Microsoft Corporation) C:\Windows\System32\SettingsHandlers.dll
2015-09-08 12:36 - 2015-07-22 06:34 - 02775552 _____ (Microsoft Corporation) C:\Windows\System32\authui.dll
2015-09-08 12:36 - 2015-07-22 06:33 - 01728000 _____ (Microsoft Corporation) C:\Windows\System32\Windows.UI.Immersive.dll
2015-09-08 12:36 - 2015-07-22 06:25 - 02461184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-09-08 12:36 - 2015-07-22 06:25 - 01546752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Immersive.dll
2015-09-08 12:36 - 2015-07-18 10:31 - 00194048 _____ (Microsoft Corporation) C:\Windows\System32\shacct.dll
2015-09-08 12:36 - 2015-07-18 10:29 - 00655872 _____ (Microsoft Corporation) C:\Windows\System32\SettingSync.dll
2015-09-08 12:36 - 2015-07-18 10:29 - 00148480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shacct.dll
2015-09-08 12:36 - 2015-07-18 10:27 - 00520192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSync.dll
2015-09-08 12:31 - 2015-08-03 13:15 - 00074928 _____ (Microsoft Corporation) C:\Windows\System32\appidapi.dll
2015-09-08 12:31 - 2015-08-03 13:15 - 00065600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-09-08 12:31 - 2015-08-01 06:22 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\appidsvc.dll
2015-09-08 12:31 - 2015-07-31 19:47 - 00229376 _____ (Microsoft Corporation) C:\Windows\System32\schtasks.exe
2015-09-08 12:31 - 2015-07-31 19:45 - 00182784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schtasks.exe
2015-09-08 12:31 - 2015-07-31 19:38 - 01265152 _____ (Microsoft Corporation) C:\Windows\System32\schedsvc.dll
2015-09-08 12:31 - 2015-07-31 19:37 - 00468992 _____ (Microsoft Corporation) C:\Windows\System32\taskeng.exe
2015-09-08 12:31 - 2015-07-31 19:37 - 00359936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskeng.exe
2015-09-08 12:31 - 2015-07-13 11:10 - 00411455 _____ C:\Windows\System32\ApnDatabase.xml
2015-09-08 12:31 - 2015-07-09 08:14 - 00228864 _____ (Microsoft Corporation) C:\Windows\System32\profsvc.dll
2015-09-08 12:30 - 2015-07-13 19:27 - 00063488 _____ (Microsoft Corporation) C:\Windows\System32\tzsync.exe
2015-09-07 17:09 - 2015-09-07 17:14 - 21604952 _____ C:\Users\Stephanie\Downloads\WebVideoProduction.zip
2015-09-07 17:07 - 2015-09-07 17:07 - 00650128 _____ C:\Users\Stephanie\Downloads\VideoPatrol.zip
2015-09-07 12:58 - 2015-09-07 17:51 - 524288000 _____ C:\Users\Stephanie\Downloads\Blackout-Firesale-part-1.rar
2015-09-07 12:55 - 2015-09-07 12:55 - 00000000 ____D C:\Users\Stephanie\Downloads\Blackout Firesale
2015-09-07 12:03 - 2015-10-10 15:30 - 00000000 ____D C:\Users\Stephanie\Downloads\Plugin Blueprint
2015-09-07 04:57 - 2015-09-07 09:45 - 524288000 _____ C:\Users\Stephanie\Downloads\Leo Babauta & Mary Jaksch - A-List Blogging Bootcamps - Skyrocket Your Subscriber Count.part3.rar
2015-09-07 04:55 - 2015-09-07 06:06 - 442719684 _____ C:\Users\Stephanie\Downloads\DigitalGraphicsFsale1_pdev.zip
2015-09-06 14:36 - 2015-09-06 14:37 - 00663720 _____ C:\Users\Stephanie\Downloads\VideoMarketingHack_mrrg.zip
2015-09-06 14:36 - 2015-09-06 14:36 - 00935131 _____ C:\Users\Stephanie\Downloads\CampVideoSiteBldr_mrrg.zip
2015-09-06 09:41 - 2015-09-07 04:54 - 00000000 ____D C:\Users\Stephanie\Downloads\A-List Blogging
2015-09-06 07:32 - 2015-09-06 07:33 - 01529340 _____ C:\Users\Stephanie\Downloads\BEA.tmp
2015-09-06 07:27 - 2015-09-07 12:41 - 00000000 ____D C:\Users\Stephanie\Downloads\Blackout USA
2015-09-06 07:25 - 2015-09-06 07:39 - 13803265 _____ C:\Users\Stephanie\Downloads\IMpluginProVideo.zip
2015-08-24 10:36 - 2015-08-24 10:36 - 00000000 ____D C:\Users\Stephanie\Downloads\New folder
2015-08-23 08:15 - 2015-08-23 08:15 - 00001864 _____ C:\Users\Public\Desktop\QuickTime Player.lnk
2015-08-18 08:26 - 2015-08-18 08:26 - 00001661 _____ C:\Users\Stephanie\Desktop\JRT.txt
2015-08-17 08:58 - 2015-07-30 06:04 - 00124624 _____ (Microsoft Corporation) C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll
2015-08-17 08:58 - 2015-07-30 05:48 - 00103120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-08-17 07:59 - 2015-08-17 08:00 - 00000000 ___DC C:\a340ceb15f6f9dd22b535e3f
2015-08-17 07:14 - 2015-08-17 07:14 - 00001772 _____ C:\Users\Public\Desktop\iTunes.lnk
2015-08-17 07:12 - 2015-08-17 07:14 - 00000000 ___DC C:\Program Files\iTunes
2015-08-17 07:12 - 2015-08-17 07:12 - 00000000 ___DC C:\Program Files\iPod
2015-08-17 07:12 - 2015-08-17 07:12 - 00000000 ____D C:\Program Files (x86)\iTunes
2015-08-13 16:11 - 2015-08-13 16:11 - 00000000 ____D C:\Users\Stephanie\.android
2015-08-13 15:22 - 2015-08-13 15:22 - 00001883 _____ C:\Users\Public\Desktop\Apps.lnk
2015-08-13 15:22 - 2015-08-13 15:22 - 00001826 _____ C:\Users\Public\Desktop\Start BlueStacks.lnk
2015-08-13 15:18 - 2015-08-17 08:29 - 00000000 ____D C:\Program Files (x86)\BlueStacks
2015-08-13 15:18 - 2015-08-13 15:20 - 00000000 ____D C:\ProgramData\BlueStacks
2015-08-13 11:41 - 2015-08-17 08:38 - 00000000 ____D C:\ProgramData\BlueStacksSetup
2015-08-13 11:41 - 2015-08-13 11:41 - 00000000 ____D C:\Users\Stephanie\AppData\Local\Bluestacks
2015-08-13 11:33 - 2015-08-13 11:37 - 14246072 _____ (BlueStack Systems Inc.) C:\Users\Stephanie\Downloads\BlueStacks-ThinInstaller.exe
2015-08-13 10:00 - 2015-07-16 12:36 - 00417792 _____ (Microsoft Corporation) C:\Windows\System32\html.iec
2015-08-13 10:00 - 2015-07-16 12:23 - 00615936 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2015-08-13 10:00 - 2015-07-16 11:53 - 00145408 _____ (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2015-08-13 10:00 - 2015-07-16 11:50 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-08-13 10:00 - 2015-07-16 11:41 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-08-13 10:00 - 2015-07-16 11:14 - 02880000 _____ (Microsoft Corporation) C:\Windows\System32\actxprxy.dll
2015-08-13 10:00 - 2015-07-16 10:52 - 01048576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2015-08-13 09:38 - 2015-07-15 16:29 - 07458648 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2015-08-13 09:38 - 2015-07-15 16:29 - 01735000 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll
2015-08-13 09:38 - 2015-07-15 16:29 - 00101720 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\mountmgr.sys
2015-08-13 09:38 - 2015-07-15 16:28 - 01499920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-08-13 09:38 - 2015-07-10 09:54 - 01217024 _____ (Microsoft Corporation) C:\Windows\System32\sysmain.dll
2015-08-13 09:38 - 2015-06-12 09:03 - 18823680 _____ (Microsoft Corporation) C:\Windows\System32\Windows.UI.Xaml.dll
2015-08-13 09:38 - 2015-06-12 08:36 - 15159296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll
2015-08-13 09:37 - 2015-07-07 01:40 - 00270168 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\WdFilter.sys
2015-08-13 09:37 - 2015-07-07 01:40 - 00114520 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\WdNisDrv.sys
2015-08-13 09:37 - 2015-07-07 01:40 - 00044560 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\WdBoot.sys
2015-08-13 09:36 - 2015-07-28 15:24 - 00025776 _____ (Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
2015-08-13 09:36 - 2015-07-28 06:24 - 01148416 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2015-08-13 09:36 - 2015-07-28 06:24 - 01116160 _____ (Microsoft Corporation) C:\Windows\System32\appraiser.dll
2015-08-13 09:36 - 2015-07-28 06:24 - 00774144 _____ (Microsoft Corporation) C:\Windows\System32\invagent.dll
2015-08-13 09:36 - 2015-07-28 06:24 - 00743424 _____ (Microsoft Corporation) C:\Windows\System32\generaltel.dll
2015-08-13 09:36 - 2015-07-28 06:24 - 00437248 _____ (Microsoft Corporation) C:\Windows\System32\devinv.dll
2015-08-13 09:36 - 2015-07-28 06:24 - 00069120 _____ (Microsoft Corporation) C:\Windows\System32\acmigration.dll
2015-08-13 09:36 - 2015-07-01 14:19 - 00228864 _____ (Microsoft Corporation) C:\Windows\System32\WebClnt.dll
2015-08-13 09:36 - 2015-07-01 14:16 - 00104448 _____ (Microsoft Corporation) C:\Windows\System32\davclnt.dll
2015-08-13 09:36 - 2015-07-01 13:37 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2015-08-13 09:36 - 2015-07-01 13:35 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2015-08-13 09:31 - 2015-07-13 11:46 - 00059392 _____ (Microsoft Corporation) C:\Windows\System32\csrsrv.dll
2015-08-13 09:31 - 2015-07-13 11:45 - 00059392 _____ (Microsoft Corporation) C:\Windows\System32\basesrv.dll
2015-08-13 09:30 - 2015-07-14 13:59 - 01113944 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ndis.sys
2015-08-13 09:30 - 2015-07-14 13:59 - 00487256 _____ (Microsoft Corporation) C:\Windows\System32\netcfgx.dll
2015-08-13 09:30 - 2015-07-14 13:59 - 00393560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcfgx.dll
2015-08-13 09:29 - 2015-07-10 09:13 - 07032320 _____ (Microsoft Corporation) C:\Windows\System32\mstscax.dll
2015-08-13 09:29 - 2015-07-09 09:13 - 00221184 _____ (Microsoft Corporation) C:\Windows\System32\notepad.exe
2015-08-13 09:29 - 2015-07-09 09:13 - 00221184 _____ (Microsoft Corporation) C:\Windows\notepad.exe
2015-08-13 09:29 - 2015-07-09 08:30 - 00212992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
2015-08-13 09:29 - 2015-06-11 12:12 - 02476376 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2015-08-13 09:29 - 2015-06-11 12:12 - 00428888 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\FWPKCLNT.SYS
2015-08-13 09:29 - 2015-05-11 16:24 - 00536920 _____ (Microsoft Corporation) C:\Windows\System32\mcupdate_GenuineIntel.dll
2015-08-13 09:28 - 2015-07-10 10:19 - 01101824 _____ (Microsoft Corporation) C:\Windows\System32\rdvidcrl.dll
2015-08-13 09:28 - 2015-07-10 09:14 - 00856064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2015-08-13 09:28 - 2015-07-10 08:31 - 06213120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-08-13 08:59 - 2015-07-29 06:37 - 01994752 _____ (Microsoft Corporation) C:\Windows\System32\DWrite.dll
2015-08-13 08:59 - 2015-07-29 06:30 - 01381888 _____ (Microsoft Corporation) C:\Windows\System32\FntCache.dll
2015-08-13 08:59 - 2015-07-29 06:23 - 01559552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-08-12 18:22 - 2015-08-12 18:35 - 00000000 ____D C:\Users\Stephanie\Downloads\CopyMyTemplate
2015-08-12 18:14 - 2015-08-12 18:15 - 00042018 _____ C:\Users\Stephanie\Downloads\jack_jacker.zip
2015-08-12 17:57 - 2015-08-12 17:58 - 01017427 _____ C:\Users\Stephanie\Downloads\clickbar.zip
2015-08-12 17:15 - 2015-08-12 17:15 - 00000000 ____D C:\Users\Stephanie\Downloads\WP Fan Machine
2015-08-11 10:26 - 2015-08-11 10:26 - 00000000 ____D C:\Users\Stephanie\Downloads\Box Sync Dlds
2015-08-09 22:55 - 2015-08-10 02:48 - 00000000 ____D C:\Users\Stephanie\Downloads\Snap Affiliate Profits + OTOs
2015-08-06 08:43 - 2015-08-06 08:43 - 00094208 _____ (Apple Inc.) C:\Windows\SysWOW64\QuickTimeVR.qtx
2015-08-06 08:43 - 2015-08-06 08:43 - 00069632 _____ (Apple Inc.) C:\Windows\SysWOW64\QuickTime.qts
2015-08-05 13:18 - 2015-09-05 09:39 - 00000000 ____D C:\Windows\Panther
2015-08-04 07:31 - 2015-08-04 07:47 - 70188475 _____ C:\Users\Stephanie\Downloads\7 Squeeze Page Templates.zip
2015-08-04 07:31 - 2015-08-04 07:38 - 19055680 _____ C:\Users\Stephanie\Downloads\63 Hand-Drawn Graphics.zip
2015-08-04 07:31 - 2015-08-04 07:35 - 08537807 _____ C:\Users\Stephanie\Downloads\OfflineBusiness Logo V1.zip
2015-08-04 06:52 - 2015-08-04 07:22 - 187527074 _____ C:\Users\Stephanie\Downloads\dld_wow_presentation2_2015-01-20.zip
2015-08-03 15:08 - 2015-08-03 18:29 - 858017810 _____ C:\Users\Stephanie\Downloads\VideoMarketingBlueprintPLRUpgrade.zip
2015-08-03 15:04 - 2015-08-03 15:07 - 00000000 ____D C:\Users\Stephanie\Downloads\Email Promo Club
2015-08-03 14:44 - 2015-08-03 14:47 - 03799818 _____ C:\Users\Stephanie\Downloads\viewpumper.zip
2015-08-03 14:23 - 2015-08-03 14:23 - 07089318 _____ C:\Users\Stephanie\Downloads\Untapped 4 in 1.zip
2015-08-03 14:04 - 2015-08-03 15:00 - 35054197 _____ C:\Users\Stephanie\Downloads\Mass Video Blaster Pro v1.89 Original Crack by Hotcrack.rar
2015-08-03 13:26 - 2015-08-03 17:24 - 607500843 _____ C:\Users\Stephanie\Downloads\AffiliateMarketingReviews.zip
2015-08-03 13:25 - 2015-08-03 13:25 - 02547218 _____ C:\Users\Stephanie\Downloads\Scripts.zip
2015-08-03 13:25 - 2015-08-03 13:25 - 00581102 _____ C:\Users\Stephanie\Downloads\SoundEffects.zip
2015-08-03 13:24 - 2015-08-03 13:24 - 00018155 _____ C:\Users\Stephanie\Downloads\vts-white-label-sales-copy (1).zip
2015-08-03 12:34 - 2015-08-12 16:42 - 00000000 ____D C:\Users\Stephanie\Downloads\Video Overplay Plugin
2015-08-03 12:04 - 2015-08-12 17:17 - 00000000 ____D C:\Users\Stephanie\Downloads\WPFanMachine Pro
2015-08-03 12:04 - 2015-08-03 12:04 - 00000500 _____ C:\Users\Stephanie\Downloads\PersonalLicenseWPFM.txt
2015-08-03 12:03 - 2015-08-03 12:04 - 00827427 _____ C:\Users\Stephanie\Downloads\WPFanMachinePro.zip
2015-08-03 11:44 - 2015-08-03 11:46 - 04586740 _____ C:\Users\Stephanie\Downloads\The Retargeting Playbook - AdRoll [2014].rar
2015-08-03 11:39 - 2015-08-03 11:39 - 00000000 ____D C:\Users\Stephanie\Downloads\InstaLead
2015-08-03 11:28 - 2015-08-03 11:35 - 13121029 _____ C:\Users\Stephanie\Downloads\Quote+Graphics+Free.zip
2015-08-03 10:59 - 2015-08-03 12:29 - 211412711 _____ C:\Users\Stephanie\Downloads\CoffeeShop.zip
2015-08-03 10:42 - 2015-08-03 11:13 - 56835074 _____ C:\Users\Stephanie\Downloads\ArticleBuddyUpdate.zip
2015-08-03 10:42 - 2015-08-03 10:53 - 22344432 _____ C:\Users\Stephanie\Downloads\Article-Buddy-Pro.zip
2015-08-03 10:25 - 2015-08-03 10:40 - 25542029 _____ C:\Users\Stephanie\Downloads\ArticleBuddy_2015_07_30_with_ABEditor.zip
2015-08-03 10:14 - 2015-08-03 10:15 - 00018155 _____ C:\Users\Stephanie\Downloads\vts-white-label-sales-copy.zip
2015-08-03 10:14 - 2015-08-03 10:14 - 00323326 _____ C:\Users\Stephanie\Downloads\sf-video-turbo_whitelabel-1000_1.02.zip
2015-07-31 14:18 - 2015-08-02 05:38 - 00000000 ___HD C:\ProgramData\CanonIJMIG
2015-07-29 11:22 - 2015-07-29 11:23 - 01798176 _____ (Malwarebytes Corporation) C:\Users\Stephanie\Desktop\JRT.exe
2015-07-25 07:51 - 2015-07-25 08:00 - 09133272 _____ C:\Users\Stephanie\Downloads\FE-735-SourceFiles.zip
2015-07-25 07:50 - 2015-07-25 09:03 - 195910017 _____ C:\Users\Stephanie\Downloads\FE-735-TurnkeyWebsite.zip
2015-07-25 07:25 - 2015-07-25 08:34 - 103073533 _____ C:\Users\Stephanie\Downloads\Watch How I Tweak The PPC Campaign.zip
2015-07-24 08:08 - 2015-06-26 15:21 - 00227328 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2015-07-22 17:54 - 2015-10-10 15:55 - 00001182 _____ C:\Windows\setupact.log
2015-07-22 17:54 - 2015-07-22 17:54 - 00000000 _____ C:\Windows\setuperr.log
2015-07-21 15:00 - 2015-07-21 15:00 - 00001109 _____ C:\Users\Stephanie\Documents\Maintenance (1).prn
2015-07-21 14:59 - 2015-07-21 14:59 - 00001101 _____ C:\Users\Stephanie\Documents\Maintenance.prn
2015-07-21 13:31 - 2015-07-21 13:31 - 00000000 ____D C:\Users\Stephanie\AppData\Local\CEF
2015-07-21 09:30 - 2015-07-21 09:30 - 00122565 _____ C:\Users\Stephanie\Downloads\securedoc_20150720T160934 (1).html
2015-07-21 09:29 - 2015-07-21 09:29 - 00122565 _____ C:\Users\Stephanie\Downloads\securedoc_20150720T160934.html
2015-07-20 10:22 - 2015-07-20 10:23 - 447077821 _____ C:\Users\Stephanie\Downloads\JVZ Sales Maximizer Reseller Package.zip
2015-07-20 09:52 - 2015-07-20 09:52 - 00118444 _____ C:\Users\Stephanie\Downloads\securedoc_20150604T193422.html
2015-07-19 22:14 - 2015-06-15 14:38 - 00088064 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2015-07-19 22:14 - 2015-06-15 14:02 - 00087552 _____ (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2015-07-19 22:14 - 2015-06-15 13:58 - 00199680 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2015-07-19 22:14 - 2015-06-15 13:57 - 00092160 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2015-07-19 22:14 - 2015-06-15 13:55 - 00316928 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2015-07-19 22:14 - 2015-06-15 13:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-07-19 22:14 - 2015-06-15 12:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2015-07-19 22:14 - 2015-06-15 12:44 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-07-19 22:14 - 2015-06-15 12:43 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-07-19 22:14 - 2015-06-15 12:42 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-07-19 22:14 - 2015-06-15 12:41 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-07-19 21:45 - 2015-05-03 07:07 - 07784448 _____ (Microsoft Corporation) C:\Windows\System32\Windows.Data.Pdf.dll
2015-07-19 21:45 - 2015-05-03 06:57 - 05264384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Data.Pdf.dll
2015-07-19 21:44 - 2015-07-09 10:40 - 00359936 _____ (Microsoft Corporation) C:\Windows\System32\WinSetupUI.dll
2015-07-19 21:44 - 2015-06-26 19:08 - 00066048 _____ (Microsoft Corporation) C:\Windows\System32\wups.dll
2015-07-19 21:44 - 2015-06-26 19:08 - 00052224 _____ (Microsoft Corporation) C:\Windows\System32\wups2.dll
2015-07-19 21:44 - 2015-06-26 18:14 - 00027136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-07-19 21:44 - 2015-04-29 15:22 - 00130048 _____ (Microsoft Corporation) C:\Windows\System32\WiFiDisplay.dll
2015-07-19 21:43 - 2015-06-27 21:07 - 00442712 _____ (Microsoft Corporation) C:\Windows\System32\msv1_0.dll
2015-07-19 21:43 - 2015-06-27 21:07 - 00178008 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2015-07-19 21:43 - 2015-06-27 21:06 - 01311960 _____ (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll
2015-07-19 21:43 - 2015-06-27 21:06 - 00332120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-07-19 21:43 - 2015-06-27 08:42 - 00747520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-07-19 21:43 - 2015-06-26 19:13 - 00202240 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb20.sys
2015-07-19 21:43 - 2015-06-26 19:12 - 00401408 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb.sys
2015-07-19 21:43 - 2015-06-26 19:12 - 00284672 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb10.sys
2015-07-19 21:43 - 2015-06-26 18:40 - 00445440 _____ (Microsoft Corporation) C:\Windows\System32\certcli.dll
2015-07-19 21:43 - 2015-06-26 18:05 - 01441792 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2015-07-19 21:43 - 2015-06-26 18:00 - 00989184 _____ (Microsoft Corporation) C:\Windows\System32\kerberos.dll
2015-07-19 21:43 - 2015-06-26 17:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-07-19 21:43 - 2015-06-26 17:26 - 00802816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-07-19 21:43 - 2015-05-07 07:21 - 00522240 _____ (Microsoft Corporation) C:\Windows\System32\GeofenceMonitorService.dll
2015-07-19 21:43 - 2015-05-07 07:05 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GeofenceMonitorService.dll
2015-07-19 21:42 - 2015-06-15 14:41 - 00065024 _____ (Microsoft Corporation) C:\Windows\System32\msiexec.exe
2015-07-19 21:42 - 2015-06-15 14:24 - 03320320 _____ (Microsoft Corporation) C:\Windows\System32\msi.dll
2015-07-19 21:42 - 2015-06-15 13:16 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-07-19 21:42 - 2015-06-15 13:09 - 03607552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-07-19 21:42 - 2015-05-30 13:18 - 00037888 _____ (Microsoft Corporation) C:\Windows\System32\werdiagcontroller.dll
2015-07-19 21:42 - 2015-05-30 11:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\System32\AudioEndpointBuilder.dll
2015-07-19 21:42 - 2015-05-30 11:35 - 00911360 _____ (Microsoft Corporation) C:\Windows\System32\audiosrv.dll
2015-07-19 21:42 - 2015-05-07 09:50 - 22292672 _____ (Microsoft Corporation) C:\Windows\System32\shell32.dll
2015-07-19 21:42 - 2015-05-07 09:00 - 03109376 _____ (Microsoft Corporation) C:\Windows\System32\ExplorerFrame.dll
2015-07-19 21:42 - 2015-05-07 08:53 - 19734960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-07-19 21:42 - 2015-05-07 08:12 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2015-07-19 21:40 - 2015-04-24 18:25 - 00020992 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usb8023.sys
2015-07-19 21:35 - 2015-05-03 07:09 - 00274944 _____ (Microsoft Corporation) C:\Windows\System32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-07-19 21:35 - 2015-05-03 06:58 - 00210944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-07-19 21:35 - 2015-05-03 06:55 - 00971776 _____ (Microsoft Corporation) C:\Windows\System32\WSShared.dll
2015-07-19 21:35 - 2015-05-03 06:49 - 00811008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2015-07-19 21:12 - 2015-06-15 21:36 - 01661576 _____ (Microsoft Corporation) C:\Windows\System32\ole32.dll
2015-07-19 21:12 - 2015-06-15 21:36 - 01212248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-07-19 21:12 - 2015-05-11 08:34 - 00332800 _____ (Microsoft Corporation) C:\Windows\System32\fhcpl.dll
2015-07-19 21:12 - 2015-04-28 05:13 - 00513480 _____ C:\Windows\SysWOW64\locale.nls
2015-07-19 21:12 - 2015-04-28 05:13 - 00513480 _____ C:\Windows\System32\locale.nls
2015-07-19 21:12 - 2015-04-23 07:47 - 03084288 _____ (Microsoft Corporation) C:\Windows\System32\msftedit.dll
2015-07-19 21:12 - 2015-04-23 07:16 - 02471424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2015-07-19 21:08 - 2015-05-07 08:47 - 00564224 _____ (Microsoft Corporation) C:\Windows\System32\apphelp.dll
2015-07-19 21:05 - 2015-05-12 05:19 - 00294912 _____ (Microsoft Corporation) C:\Windows\System32\SystemEventsBrokerServer.dll

==================== Three Months Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-10-11 12:53 - 2015-04-27 20:19 - 00000000 ___DC C:\FRST
2015-10-10 17:08 - 2013-08-22 06:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-10-10 16:28 - 2015-01-14 14:54 - 01970138 _____ C:\Windows\WindowsUpdate.log
2015-10-10 16:27 - 2015-01-15 08:50 - 00039000 _____ C:\Windows\PFRO.log
2015-10-10 15:54 - 2014-07-21 02:09 - 00000000 ____D C:\users\Stephanie
2015-10-10 15:53 - 2015-04-24 11:54 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-10-10 15:53 - 2015-04-24 11:54 - 00000000 ___SD C:\Windows\System32\GWX
2015-10-10 15:53 - 2013-08-22 07:36 - 00000000 ___RD C:\Users\Public\Libraries
2015-10-10 15:53 - 2013-08-22 07:36 - 00000000 ____D C:\Windows\System32\sru
2015-10-10 15:53 - 2013-08-22 05:36 - 00000000 ____D C:\Windows\System32\Sysprep
2015-10-10 15:53 - 2012-07-25 23:59 - 00000000 ____D C:\Windows\CbsTemp
2015-10-10 15:52 - 2015-05-02 05:19 - 00000000 ____D C:\Users\Stephanie\Downloads\Rocket Piano
2015-10-10 15:52 - 2015-04-29 18:39 - 00000000 ____D C:\Users\Stephanie\Downloads\CountdownPageGenerator
2015-10-10 15:52 - 2015-03-30 04:52 - 00000000 ____D C:\Users\Stephanie\Downloads\JDownloader1 Setup
2015-10-10 15:52 - 2015-03-28 19:55 - 00000000 ____D C:\Users\Stephanie\Downloads\Keyword Cash
2015-10-10 15:52 - 2015-02-01 00:13 - 00000000 ____D C:\Users\Stephanie\Downloads\New & Used Espresso Machines Stuff
2015-10-10 15:52 - 2015-01-16 21:52 - 00000000 ____D C:\Users\Stephanie\Downloads\Springly
2015-10-10 15:52 - 2015-01-15 14:12 - 00000000 ____D C:\Users\Stephanie\Downloads\PublishingPro
2015-10-10 15:52 - 2015-01-13 12:12 - 00000000 ____D C:\Users\Stephanie\Downloads\coolarticlecreator-321 (1)
2015-10-10 15:52 - 2015-01-01 06:27 - 00000000 ____D C:\Users\Stephanie\Downloads\Browsers
2015-10-10 15:52 - 2014-12-31 10:08 - 00000000 ____D C:\Users\Stephanie\Downloads\youtube_d
2015-10-10 15:52 - 2014-12-23 19:48 - 00000000 ____D C:\Users\Stephanie\Downloads\shexview-x64
2015-10-10 15:52 - 2014-12-20 22:13 - 00000000 ____D C:\Users\Stephanie\Downloads\Lead Hunter
2015-10-10 15:52 - 2014-12-17 12:34 - 00000000 ____D C:\Users\Stephanie\Downloads\Easy.Sketch.Pro.v2
2015-10-10 15:52 - 2014-12-17 05:41 - 00000000 ____D C:\Users\Stephanie\Downloads\Explanidio
2015-10-10 15:52 - 2014-12-04 22:35 - 00000000 ____D C:\Users\Stephanie\Downloads\Traffic With Anthony
2015-10-10 15:52 - 2014-12-01 16:56 - 00000000 ____D C:\Users\Stephanie\Downloads\SEO Elite
2015-10-10 15:52 - 2014-11-23 12:13 - 00000000 ____D C:\Users\Stephanie\Downloads\Make Millions Blogging Site Stuff
2015-10-10 15:52 - 2014-11-21 12:36 - 00000000 ____D C:\Users\Stephanie\Downloads\Lifestuff Site Stuff
2015-10-10 15:52 - 2014-11-11 19:37 - 00000000 ____D C:\Users\Stephanie\Downloads\Heart's Garden Clip Art
2015-10-10 15:52 - 2014-10-01 04:41 - 00000000 ____D C:\Users\Stephanie\Downloads\Rapid Content Wizard+Lightning Version
2015-10-10 15:52 - 2014-10-01 04:02 - 00000000 ____D C:\Users\Stephanie\Downloads\Software
2015-10-10 15:51 - 2015-06-15 07:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-10-10 15:51 - 2015-05-30 07:37 - 00000000 ____D C:\Users\Stephanie\Downloads\60mpup_files
2015-10-10 15:51 - 2015-04-24 13:39 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-10-10 15:51 - 2014-07-24 07:32 - 00000000 ____D C:\Users\Stephanie\Documents\Youcam
2015-10-10 15:51 - 2014-07-10 08:01 - 00000000 ____D C:\Users\Public\CyberLink
2015-10-10 15:51 - 2014-07-10 01:43 - 00000000 ____D C:\Users\Public\Documents\YouCam
2015-10-10 15:31 - 2015-05-03 17:09 - 00000000 ____D C:\Users\Stephanie\Downloads\Ultimate Traffic Monster V2
2015-10-10 15:31 - 2015-05-02 10:14 - 00000000 ____D C:\Users\Stephanie\Downloads\Video Motion Pro v2.4-180-DVT
2015-10-10 15:31 - 2015-05-02 08:39 - 00000000 ____D C:\Users\Stephanie\Downloads\Yoast.SEO.Premium.v1.5.3
2015-10-10 15:31 - 2015-05-02 08:37 - 00000000 ____D C:\Users\Stephanie\Downloads\WPeddit_v1.6
2015-10-10 15:31 - 2015-05-02 08:37 - 00000000 ____D C:\Users\Stephanie\Downloads\WP-autopost v3.6.1
2015-10-10 15:31 - 2015-05-02 08:35 - 00000000 ____D C:\Users\Stephanie\Downloads\wp-auto-spinner-v3.0.0
2015-10-10 15:31 - 2015-04-29 18:59 - 00000000 ____D C:\Users\Stephanie\Downloads\Uncle Ben - Auto Pilot
2015-10-10 15:31 - 2015-04-29 18:58 - 00000000 ____D C:\Users\Stephanie\Downloads\upandsell-pro-1.0.1_cleaned
2015-10-10 15:31 - 2015-04-24 12:57 - 00000000 ____D C:\Users\Stephanie\Downloads\WP-rating-plugin-awesome-taqyeem-1.1.4
2015-10-10 15:31 - 2015-04-21 15:18 - 00000000 ____D C:\Users\Stephanie\Downloads\VIDEO RANKER REVOLUTION
2015-10-10 15:31 - 2015-04-09 12:45 - 00000000 ____D C:\Users\Stephanie\Downloads\Windows Kits
2015-10-10 15:31 - 2015-01-02 23:45 - 00000000 ____D C:\Users\Stephanie\Downloads\Video Cash Volcano
2015-10-10 15:30 - 2015-05-02 18:13 - 00000000 ____D C:\Users\Stephanie\Downloads\PLR PROFITS MASTERY
2015-10-10 15:30 - 2015-05-02 13:58 - 00000000 ____D C:\Users\Stephanie\Downloads\Steal My Funnel V1 & V2
2015-10-10 15:30 - 2015-05-02 08:36 - 00000000 ____D C:\Users\Stephanie\Downloads\sab
2015-10-10 15:30 - 2015-04-29 19:12 - 00000000 ____D C:\Users\Stephanie\Downloads\PLR Graphics Products OTO
2015-10-10 15:30 - 2015-03-29 05:27 - 00000000 ____D C:\Users\Stephanie\Downloads\SalezPress Pro
2015-10-10 15:30 - 2015-02-10 22:38 - 00000000 ____D C:\Users\Stephanie\Downloads\Rapid Cash Income
2015-10-10 15:30 - 2015-01-31 23:37 - 00000000 ____D C:\Users\Stephanie\Downloads\Solar Power Bundle
2015-10-10 15:30 - 2015-01-31 20:12 - 00000000 ____D C:\Users\Stephanie\Downloads\TTS Video Maker
2015-10-10 15:30 - 2015-01-16 14:21 - 00000000 ____D C:\Users\Stephanie\Downloads\Submitter Pro
2015-10-10 15:30 - 2015-01-04 15:20 - 00000000 ____D C:\Users\Stephanie\Downloads\Tom Yevsikov-Solo Ad Monetizer + Bonuses
2015-10-10 15:30 - 2015-01-01 19:38 - 00000000 ____D C:\Users\Stephanie\Downloads\Rogue-ClickBank-Profits-Plugin
2015-10-10 15:30 - 2015-01-01 11:09 - 00000000 ____D C:\Users\Stephanie\Downloads\SalesFunnelNinja_mrr
2015-10-10 15:30 - 2015-01-01 08:59 - 00000000 ____D C:\Users\Stephanie\Downloads\Traffic Mice Plus Bonus
2015-10-10 15:30 - 2014-12-10 04:37 - 00000000 ____D C:\Users\Stephanie\Downloads\Thank You & Squeeze Page Examples
2015-10-10 15:30 - 2014-12-07 20:14 - 00000000 ____D C:\Users\Stephanie\Downloads\The Funnel Cash Frenzy
2015-10-10 15:30 - 2014-10-31 12:19 - 00000000 ____D C:\Users\Stephanie\Downloads\Prepper's Paradise
2015-10-10 15:30 - 2014-10-01 05:01 - 00000000 ____D C:\Users\Stephanie\Downloads\PLR
2015-10-10 15:30 - 2014-09-27 18:29 - 00000000 ____D C:\Users\Stephanie\Downloads\PLR Cash System Pro
2015-10-10 15:29 - 2015-07-07 12:34 - 00000000 ____D C:\Users\Stephanie\Downloads\JVZoo Sales Maximizer
2015-10-10 15:29 - 2015-05-10 18:31 - 00000000 ____D C:\Users\Stephanie\Downloads\Instant Guru Toolkit
2015-10-10 15:29 - 2015-03-29 08:26 - 00000000 ____D C:\Users\Stephanie\Downloads\Infographics Motivation Graphics Pack
2015-10-10 15:29 - 2015-02-03 15:21 - 00000000 ____D C:\Users\Stephanie\Downloads\Magic Article Rewriter
2015-10-10 15:29 - 2015-01-17 10:00 - 00000000 ____D C:\Users\Stephanie\Downloads\OMG Machines
2015-10-10 15:29 - 2015-01-12 22:49 - 00000000 ____D C:\Users\Stephanie\Downloads\Monkey Marketing Mastermind
2015-10-10 15:29 - 2015-01-09 10:43 - 00000000 ____D C:\Users\Stephanie\Downloads\Lead Generation Mastery-PLR
2015-10-10 15:29 - 2015-01-07 10:36 - 00000000 ____D C:\Users\Stephanie\Downloads\KontentMachine.3.26.16.91
2015-10-10 15:29 - 2015-01-06 08:07 - 00000000 ____D C:\Users\Stephanie\Downloads\Online Income Formula
2015-10-10 15:29 - 2015-01-03 12:40 - 00000000 ____D C:\Users\Stephanie\Downloads\Perpetual List Money Machine
2015-10-10 15:29 - 2015-01-01 17:11 - 00000000 ____D C:\Users\Stephanie\Downloads\Matt Bacak
2015-10-10 15:29 - 2014-12-31 10:33 - 00000000 ____D C:\Users\Stephanie\Downloads\MY NEW LIST STUFF
2015-10-10 15:29 - 2014-12-21 19:24 - 00000000 ____D C:\Users\Stephanie\Downloads\Lee Murry's Simple Email Profits
2015-10-10 15:29 - 2014-12-20 14:18 - 00000000 ____D C:\Users\Stephanie\Downloads\Misc. Excellent
2015-10-10 15:29 - 2014-12-19 21:48 - 00000000 ____D C:\Users\Stephanie\Downloads\List Profit Generator
2015-10-10 15:29 - 2014-12-03 15:17 - 00000000 ____D C:\Users\Stephanie\Downloads\My Monthly Membership
2015-10-10 15:28 - 2015-06-12 07:36 - 00000000 ____D C:\Users\Stephanie\Downloads\explosivedynamictraffic_MRR
2015-10-10 15:28 - 2015-05-02 08:38 - 00000000 ____D C:\Users\Stephanie\Downloads\infinite-seo-1.6.7
2015-10-10 15:28 - 2015-04-24 14:39 - 00000000 ____D C:\Users\Stephanie\Downloads\Indeed Smart PopUp for WordPress
2015-10-10 15:28 - 2015-03-28 20:30 - 00000000 ____D C:\Users\Stephanie\Downloads\Fresh Key
2015-10-10 15:28 - 2015-01-20 10:26 - 00000000 ____D C:\Users\Stephanie\Downloads\GoogleTopperV2
2015-10-10 15:28 - 2015-01-05 08:32 - 00000000 ____D C:\Users\Stephanie\Downloads\G Plus Hangout Local Video Marketer Process
2015-10-10 15:28 - 2015-01-01 19:43 - 00000000 ____D C:\Users\Stephanie\Downloads\FreeCashGenerator
2015-10-10 15:28 - 2014-12-10 13:04 - 00000000 ____D C:\Users\Stephanie\Downloads\IM Guru 2.0
2015-10-10 15:28 - 2014-12-01 19:39 - 00000000 ____D C:\Users\Stephanie\Downloads\EZ Hit Songs
2015-10-10 15:28 - 2014-11-21 15:54 - 00000000 ____D C:\Users\Stephanie\Downloads\Google Sniper 2 & 3 Update
2015-10-10 15:27 - 2015-06-13 12:04 - 00000000 ____D C:\Users\Stephanie\Downloads\Affilio Traffic Roadmap
2015-10-10 15:27 - 2015-06-13 06:51 - 00000000 ____D C:\Users\Stephanie\Downloads\Amazon_NSP
2015-10-10 15:27 - 2015-05-03 19:58 - 00000000 ____D C:\Users\Stephanie\Downloads\Aaron Danker-Super Sales System
2015-10-10 15:27 - 2015-05-01 16:42 - 00000000 ____D C:\Users\Stephanie\Downloads\canvas590
2015-10-10 15:27 - 2015-04-30 19:35 - 00000000 ____D C:\Users\Stephanie\Downloads\CPA AFFILIATE MASTERMIND JV Stuff
2015-10-10 15:27 - 2015-04-30 18:01 - 00000000 ____D C:\Users\Stephanie\Downloads\CPA Arbitrage
2015-10-10 15:27 - 2015-04-30 16:06 - 00000000 ____D C:\Users\Stephanie\Downloads\Download Page-Page Files
2015-10-10 15:27 - 2015-04-22 10:46 - 00000000 ____D C:\Users\Stephanie\Downloads\Elegant Themes + Plugin
2015-10-10 15:27 - 2015-03-29 08:29 - 00000000 ____D C:\Users\Stephanie\Downloads\BonusGo & Bonuses
2015-10-10 15:27 - 2015-02-27 20:32 - 00000000 ____D C:\Users\Stephanie\Downloads\BrandableReportAndInstructions
2015-10-10 15:27 - 2015-02-10 22:44 - 00000000 ____D C:\Users\Stephanie\Downloads\Blog Network 2015 Secret Sauce
2015-10-10 15:27 - 2015-01-13 11:05 - 00000000 ____D C:\Users\Stephanie\Downloads\Easy VSL Affiliate Bonuses
2015-10-10 15:27 - 2015-01-03 18:58 - 00000000 ____D C:\Users\Stephanie\Downloads\CB Online Jobs Bonanza PLR Pack
2015-10-10 15:27 - 2014-12-31 11:37 - 00000000 ____D C:\Users\Stephanie\Downloads\easydbss
2015-10-10 15:27 - 2014-12-29 16:45 - 00000000 ____D C:\Users\Stephanie\Downloads\CodeCanyon - Cpanel Email Signup and Login v1.5 - (Update)
2015-10-10 15:27 - 2014-12-04 12:33 - 00000000 ____D C:\Users\Stephanie\Downloads\Alex Jeffreys
2015-10-10 15:27 - 2014-10-01 04:38 - 00000000 ____D C:\Users\Stephanie\Downloads\Authority Spy & Bonuses
2015-10-10 15:27 - 2014-09-27 19:38 - 00000000 ____D C:\Users\Stephanie\Downloads\EASY Niche Membership Sites
2015-10-10 15:26 - 2015-05-10 09:07 - 00000000 ____D C:\Users\Stephanie\Downloads\7 Steps To Massive Lists
2015-10-10 15:26 - 2015-02-27 20:36 - 00000000 ____D C:\Users\Stephanie\Documents\Empire Builder
2015-10-10 15:26 - 2015-01-16 16:58 - 00000000 ____D C:\Users\Stephanie\Downloads\5 CPA landing pagesBBHF
2015-10-10 15:26 - 2015-01-04 00:58 - 00000000 ____D C:\Users\Stephanie\Documents\CoffeeCup Software
2015-10-10 15:26 - 2015-01-02 02:14 - 00000000 ____D C:\Users\Stephanie\Downloads\100k dl Page Files
2015-10-10 15:26 - 2014-09-23 06:25 - 00000000 ____D C:\Users\Stephanie\Documents\CyberLink
2015-10-10 13:07 - 2014-07-21 05:17 - 00000000 ___DO C:\Users\Stephanie\OneDrive
2015-10-10 12:57 - 2015-04-22 11:03 - 00000000 ____D C:\Users\Stephanie\Downloads\Lead Magnets V2
2015-10-10 11:44 - 2014-07-18 12:12 - 10321920 ___SH C:\Users\Stephanie\Downloads\Thumbs.db
2015-10-10 11:14 - 2015-04-19 15:14 - 00000000 ____D C:\Users\Stephanie\Downloads\Jeremy Reeves-The Funnel Formula
2015-10-10 11:11 - 2014-11-04 14:44 - 00000000 ____D C:\Users\Stephanie\Downloads\PayPal Business Info
2015-10-10 11:11 - 2014-10-17 09:15 - 00000000 ____D C:\Users\Stephanie\Downloads\Ok & Federal Tax
2015-10-09 16:42 - 2013-08-22 07:36 - 00000000 ____D C:\Windows\System32\NDF
2015-10-09 07:24 - 2014-07-18 07:24 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2015-10-07 07:56 - 2014-10-01 14:10 - 00005138 _____ C:\Users\Stephanie\Documents\Gobbledegook.txt
2015-10-04 15:46 - 2014-07-10 06:08 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4183873686-4129548010-1378792923-1002
2015-10-04 15:37 - 2014-11-13 17:24 - 00000000 __SHD C:\Users\Stephanie\AppData\LocalLow\EmieBrowserModeList
2015-10-04 15:37 - 2014-09-22 21:49 - 00000000 ____D C:\Users\Stephanie\AppData\Roaming\Copy
2015-10-04 15:37 - 2014-09-01 15:59 - 00000000 __SHD C:\Users\Stephanie\AppData\LocalLow\EmieUserList
2015-10-04 15:37 - 2014-07-21 09:13 - 00000000 __SHD C:\Users\Stephanie\AppData\LocalLow\EmieSiteList
2015-10-04 15:34 - 2013-08-22 05:25 - 00524288 ___SH C:\Windows\System32\config\BBI
2015-10-04 15:22 - 2014-07-10 05:33 - 00003946 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{8EE8F043-932C-462D-B023-395A8A613918}
2015-10-04 12:59 - 2015-04-28 07:48 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-09-26 07:17 - 2015-04-28 10:55 - 00002210 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-09-24 10:11 - 2014-08-05 08:21 - 00000000 ____D C:\ProgramData\CanonIJPLM
2015-09-21 17:08 - 2015-04-28 07:48 - 00003718 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-09-18 12:51 - 2013-08-22 07:36 - 00000000 ____D C:\Windows\rescache
2015-09-14 17:18 - 2015-05-17 00:24 - 00812008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-09-14 17:18 - 2015-05-17 00:24 - 00178152 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-09-14 11:12 - 2015-04-28 10:44 - 00003898 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-09-14 11:12 - 2015-04-28 10:44 - 00000926 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-09-14 11:12 - 2015-04-28 10:44 - 00000922 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-09-14 11:12 - 2015-02-05 02:59 - 00003662 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-09-13 10:25 - 2014-07-10 06:15 - 00000000 ____D C:\Users\Stephanie\AppData\Local\Google
2015-09-11 05:32 - 2013-04-02 16:17 - 00000000 ____D C:\ProgramData\WildTangent
2015-09-11 05:24 - 2013-04-02 16:17 - 00000000 ____D C:\Program Files (x86)\WildTangent Games
2015-09-11 04:41 - 2015-04-27 03:15 - 00220672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dplayx.dll
2015-09-11 04:41 - 2015-04-27 03:15 - 00046592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpwsockx.dll
2015-09-11 04:41 - 2015-04-27 02:59 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpmodemx.dll
2015-09-11 04:41 - 2015-04-27 02:53 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dplaysvr.exe
2015-09-11 04:41 - 2013-08-22 03:22 - 00461312 _____ (Microsoft Corporation) C:\Windows\System32\dpnet.dll
2015-09-11 04:41 - 2013-08-22 03:22 - 00034304 _____ (Microsoft Corporation) C:\Windows\System32\dpnsvr.exe
2015-09-11 04:41 - 2013-08-22 03:17 - 00066560 _____ (Microsoft Corporation) C:\Windows\System32\dpnathlp.dll
2015-09-11 04:41 - 2013-08-22 03:17 - 00009216 _____ (Microsoft Corporation) C:\Windows\System32\dpnhupnp.dll
2015-09-11 04:41 - 2013-08-22 03:17 - 00009216 _____ (Microsoft Corporation) C:\Windows\System32\dpnhpast.dll
2015-09-11 04:41 - 2013-08-21 19:56 - 00377856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnet.dll
2015-09-11 04:41 - 2013-08-21 19:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnsvr.exe
2015-09-11 04:41 - 2013-08-21 19:51 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnathlp.dll
2015-09-11 04:41 - 2013-08-21 19:51 - 00009216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnhupnp.dll
2015-09-11 04:41 - 2013-08-21 19:51 - 00009216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnhpast.dll

Some files in TEMP:
====================
C:\Users\Stephanie\AppData\Local\Temp\Quarantine.exe
C:\Users\Stephanie\AppData\Local\Temp\sqlite3.dll


==================== Known DLLs (Whitelisted) =========================


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe
[2015-04-27 03:07] - [2014-10-28 17:22] - 0572416 ____A (Microsoft Corporation) EC498BAE1F0D3E0E401C963F8D76C437

C:\Windows\System32\wininit.exe
[2015-04-27 02:59] - [2014-10-28 17:25] - 0145920 ____A (Microsoft Corporation) A570A64292214C43E0BA50E6A72A6380

C:\Windows\explorer.exe
[2015-03-25 18:14] - [2015-01-27 15:47] - 2501368 ____A (Microsoft Corporation) C10A66189DC8C090E7C84873EDCEBC88

C:\Windows\SysWOW64\explorer.exe
[2015-03-25 18:13] - [2015-01-27 15:41] - 2207488 ____A (Microsoft Corporation) 91E24273FCA076EA9E65DAFA98901225

C:\Windows\System32\svchost.exe
[2015-04-27 02:52] - [2014-10-28 20:11] - 0038792 ____A (Microsoft Corporation) E3A2AD05E24105B35E986CF9CB38EC47

C:\Windows\SysWOW64\svchost.exe
[2015-04-27 02:53] - [2014-10-28 19:17] - 0033088 ____A (Microsoft Corporation) D0ABC231C0B3E88C6B612B28ABBF734D

C:\Windows\System32\services.exe
[2015-05-12 14:37] - [2015-04-08 14:55] - 0410128 ____A (Microsoft Corporation) E0C7813A97CA7947FF5C18A8F3B61A45

C:\Windows\System32\User32.dll
[2015-04-27 03:15] - [2014-10-28 20:00] - 1540696 ____A (Microsoft Corporation) 25026E350BC3BE37631634EC72B10BD5

C:\Windows\SysWOW64\User32.dll
[2015-04-27 03:15] - [2014-10-28 17:04] - 1376256 ____A (Microsoft Corporation) 76C5CF09F53A3B089B5581B9938F8CAE

C:\Windows\System32\userinit.exe
[2015-04-27 01:57] - [2014-10-28 17:28] - 0026112 ____A (Microsoft Corporation) 5C131534A3EA4A461A793FB507A8004F

C:\Windows\SysWOW64\userinit.exe
[2015-04-27 02:00] - [2014-10-28 17:05] - 0022528 ____A (Microsoft Corporation) D10643FC0095434C819316CA6CD748C0

C:\Windows\System32\rpcss.dll
[2015-04-27 03:13] - [2014-10-28 17:19] - 0817664 ____A (Microsoft Corporation) A6F17C299A03BAFEFB9257C462A19E00

C:\Windows\System32\dnsapi.dll
[2014-12-28 14:10] - [2014-11-04 17:44] - 0657920 ____A (Microsoft Corporation) 0B082D6D7A53D91678E7409DD145E89C

C:\Windows\SysWOW64\dnsapi.dll
[2014-12-28 14:10] - [2014-11-04 17:20] - 0498688 ____A (Microsoft Corporation) 205BDB00F4C032AF45A6BFD18EA7886C

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points =========================

Restore point date: 2015-09-22 19:39:20
Restore point date: 2015-09-30 08:38:53
Restore point date: 2015-10-04 23:13:32
Restore point date: 2015-10-10 15:11:42

==================== BCD ================================

Firmware Boot Manager
---------------------
identifier              {fwbootmgr}
displayorder            {bootmgr}
timeout                 0

Windows Boot Manager
--------------------
identifier              {bootmgr}
device                  partition=\Device\HarddiskVolume2
path                    \EFI\Microsoft\Boot\bootmgfw.efi
description             Windows Boot Manager
locale                  en-US
inherit                 {globalsettings}
integrityservices       Enable
default                 {default}
resumeobject            {bc0a7c67-0826-11e4-be73-a4db3037ace5}
displayorder            {default}
toolsdisplayorder       {memdiag}
timeout                 30

Firmware Application (101fffff)
-------------------------------
identifier              {c66a305d-0818-11e4-a03b-d90812304343}
description             USB Drive (UEFI)

Firmware Application (101fffff)
-------------------------------
identifier              {c66a305e-0818-11e4-a03b-d90812304343}
description             Internal CD/DVD ROM Drive (UEFI)

Firmware Application (101fffff)
-------------------------------
identifier              {c66a305f-0818-11e4-a03b-d90812304343}
description             Internal Hard Disk or Solid State Disk

Firmware Application (101fffff)
-------------------------------
identifier              {c66a3060-0818-11e4-a03b-d90812304343}
description             Internal Hard Disk or Solid State Disk

Firmware Application (101fffff)
-------------------------------
identifier              {c66a3061-0818-11e4-a03b-d90812304343}
description             Internal Hard Disk or Solid State Disk

Firmware Application (101fffff)
-------------------------------
identifier              {c66a3062-0818-11e4-a03b-d90812304343}
description             Internal Hard Disk or Solid State Disk

Firmware Application (101fffff)
-------------------------------
identifier              {c66a3063-0818-11e4-a03b-d90812304343}
description             Internal Hard Disk or Solid State Disk

Firmware Application (101fffff)
-------------------------------
identifier              {c66a3064-0818-11e4-a03b-d90812304343}
description             Internal Hard Disk or Solid State Disk

Firmware Application (101fffff)
-------------------------------
identifier              {c66a3065-0818-11e4-a03b-d90812304343}
description             Internal Hard Disk or Solid State Disk

Firmware Application (101fffff)
-------------------------------
identifier              {c66a3066-0818-11e4-a03b-d90812304343}
description             Internal Hard Disk or Solid State Disk

Firmware Application (101fffff)
-------------------------------
identifier              {c66a3067-0818-11e4-a03b-d90812304343}
description             Internal Hard Disk or Solid State Disk

Firmware Application (101fffff)
-------------------------------
identifier              {c66a3068-0818-11e4-a03b-d90812304343}
description             Internal Hard Disk or Solid State Disk

Firmware Application (101fffff)
-------------------------------
identifier              {c66a3069-0818-11e4-a03b-d90812304343}
description             Internal Hard Disk or Solid State Disk

Windows Boot Loader
-------------------
identifier              {bc0a7c64-0826-11e4-be73-a4db3037ace5}
device                  ramdisk=[\Device\HarddiskVolume1]\Recovery\WindowsRE\Winre.wim,{bc0a7c65-0826-11e4-be73-a4db3037ace5}
path                    \windows\system32\winload.efi
description             Windows Recovery Environment
locale                  en-US
inherit                 {bootloadersettings}
displaymessage          Recovery
displaymessageoverride  Recovery
osdevice                ramdisk=[\Device\HarddiskVolume1]\Recovery\WindowsRE\Winre.wim,{bc0a7c65-0826-11e4-be73-a4db3037ace5}
systemroot              \windows
nx                      OptIn
bootmenupolicy          Standard
winpe                   Yes

Windows Boot Loader
-------------------
identifier              {default}
device                  partition=C:
path                    \WINDOWS\system32\winload.efi
description             Windows 8.1
locale                  en-US
inherit                 {bootloadersettings}
recoverysequence        {bc0a7c69-0826-11e4-be73-a4db3037ace5}
integrityservices       Enable
recoveryenabled         Yes
isolatedcontext         Yes
allowedinmemorysettings 0x15000075
osdevice                partition=C:
systemroot              \WINDOWS
resumeobject            {bc0a7c67-0826-11e4-be73-a4db3037ace5}
nx                      OptIn
bootmenupolicy          Standard

Windows Boot Loader
-------------------
identifier              {bc0a7c69-0826-11e4-be73-a4db3037ace5}
device                  ramdisk=[\Device\HarddiskVolume5]\Recovery\WindowsRE\Winre.wim,{bc0a7c6a-0826-11e4-be73-a4db3037ace5}
path                    \windows\system32\winload.efi
description             Windows Recovery Environment
locale                  en-US
inherit                 {bootloadersettings}
displaymessage          Recovery
osdevice                ramdisk=[\Device\HarddiskVolume5]\Recovery\WindowsRE\Winre.wim,{bc0a7c6a-0826-11e4-be73-a4db3037ace5}
systemroot              \windows
nx                      OptIn
bootmenupolicy          Standard
winpe                   Yes

Resume from Hibernate
---------------------
identifier              {bc0a7c67-0826-11e4-be73-a4db3037ace5}
device                  partition=C:
path                    \WINDOWS\system32\winresume.efi
description             Windows Resume Application
locale                  en-US
inherit                 {resumeloadersettings}
recoverysequence        {bc0a7c69-0826-11e4-be73-a4db3037ace5}
recoveryenabled         Yes
isolatedcontext         Yes
allowedinmemorysettings 0x15000075
filedevice              partition=C:
filepath                \hiberfil.sys
bootmenupolicy          Standard
debugoptionenabled      No

Resume from Hibernate
---------------------
identifier              {c66a306b-0818-11e4-a03b-d90812304343}
device                  partition=C:
path                    \Windows\system32\winresume.efi
description             Windows Resume Application
locale                  en-US
inherit                 {resumeloadersettings}
recoverysequence        {bc0a7c64-0826-11e4-be73-a4db3037ace5}
recoveryenabled         Yes
isolatedcontext         Yes
allowedinmemorysettings 0x15000075
filedevice              partition=C:
filepath                \hiberfil.sys
bootmenupolicy          Standard
debugoptionenabled      No

Windows Memory Tester
---------------------
identifier              {memdiag}
device                  partition=\Device\HarddiskVolume2
path                    \EFI\Microsoft\Boot\memtest.efi
description             Windows Memory Diagnostic
locale                  en-US
inherit                 {globalsettings}
badmemoryaccess         Yes

EMS Settings
------------
identifier              {emssettings}
bootems                 No

Debugger Settings
-----------------
identifier              {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200

RAM Defects
-----------
identifier              {badmemory}

Global Settings
---------------
identifier              {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}

Boot Loader Settings
--------------------
identifier              {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}

Hypervisor Settings
-------------------
identifier              {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200

Resume Loader Settings
----------------------
identifier              {resumeloadersettings}
inherit                 {globalsettings}

Device options
--------------
identifier              {bc0a7c65-0826-11e4-be73-a4db3037ace5}
description             Windows Recovery
ramdisksdidevice        partition=\Device\HarddiskVolume1
ramdisksdipath          \Recovery\WindowsRE\boot.sdi

Device options
--------------
identifier              {bc0a7c66-0826-11e4-be73-a4db3037ace5}
description             Windows Setup
ramdisksdidevice        partition=C:
ramdisksdipath          \$WINDOWS.~BT\Sources\SafeOS\boot.sdi

Device options
--------------
identifier              {bc0a7c6a-0826-11e4-be73-a4db3037ace5}
description             Windows Recovery
ramdisksdidevice        partition=\Device\HarddiskVolume5
ramdisksdipath          \Recovery\WindowsRE\boot.sdi


==================== Memory info =========================== 

Percentage of memory in use: 25%
Total physical RAM: 3682.26 MB
Available physical RAM: 2748.2 MB
Total Virtual: 3682.26 MB
Available Virtual: 2839.41 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:275.14 GB) (Free:14.52 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive d: (RECOVERY) (Fixed) (Total:21.74 GB) (Free:2.2 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive f: (FLASH DRIVE) (Removable) (Total:7.46 GB) (Free:0.39 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.25 GB) (Free:0.25 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298.1 GB) (Disk ID: 901E28C9)

Partition: GPT.

========================================================
Disk: 1 (Size: 7.5 GB) (Disk ID: 500A0DFF)
No partition Table on disk 1.


LastRegBack: 2015-10-10 13:49

==================== End of FRST.txt ============================


#10 sdockery

sdockery
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:02:34 AM

Posted 11 October 2015 - 01:02 PM

Please don't give up on me!



#11 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,079 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:09:34 AM

Posted 11 October 2015 - 01:02 PM

Hi sdockery,
 

The new drive which is called Boot X: the X: is in parentheses.

The X drive is part of windows, and it is what you boot into to get the command prompt.
 
Lets have a look at the partitions anyway:
 
Download ListParts to your USB flash drive using your clean computer. Plug the USB drive into the infected machine.
 
Boot your computer into Recovery Environment:

  • Restart the computer and press F8 repeatedly until the Advanced Options Menu appears.
  • Select Repair your computer.
  • Select Language and click Next
  • Enter password (if necessary) and click OK, you should now see the screen below ...

W7InstallDisk2.png

  • Select the Command Prompt option.
  • A command window will open.
  • Type notepad then hit Enter.
  • Notepad will open.
  • Click File > Open then select Computer.
  • Note down the drive letter for your USB Drive.
  • Close Notepad.

Back in the command window ....

  • Type e:\listparts.exe and hit Enter (where e: is replaced by the drive letter for your USB drive which you found out during the notepad steps).
  • ListParts will start to run.
  • Press the Scan button.
  • When finished scanning it will make a log Result.txt on the flash drive.
  • Close the command window and then shutdown the computer.
  • Plug the USB into your clean computer, then copy and paste the result.txt log in your next reply.

xXToffeeXx~


~If I am helping you and you have not had a reply from me in two days, please send me a PM~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~


#12 sdockery

sdockery
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:02:34 AM

Posted 11 October 2015 - 01:27 PM

Here it is:

ListParts by Farbar Version: 31-07-2014
Ran by SYSTEM (administrator) on 11-10-2015 at 13:25:16
Windows 8 (X64)
Running From: E:\
Language: English (United States)
************************************************************

========================= Memory info ====================== 

Percentage of memory in use: 14%
Total physical RAM: 3682.26 MB
Available physical RAM: 3138.7 MB
Total Pagefile: 3682.26 MB
Available Pagefile: 3140.06 MB
Total Virtual: 8192 MB
Available Virtual: 8191.91 MB

======================= Partitions =========================

1 Drive c: (Windows) (Fixed) (Total:275.14 GB) (Free:14.52 GB) NTFS ==>[System with boot components (obtained from reading drive)]
2 Drive d: (RECOVERY) (Fixed) (Total:21.74 GB) (Free:2.2 GB) NTFS ==>[System with boot components (obtained from reading drive)]
3 Drive e: (FLASH DRIVE) (Removable) (Total:7.46 GB) (Free:0.39 GB) FAT32
5 Drive x: (Boot) (Fixed) (Total:0.25 GB) (Free:0.25 GB) NTFS


  Disk ###  Status         Size     Free     Dyn  Gpt
  --------  -------------  -------  -------  ---  ---
  Disk 0    Online          298 GB      0 B        *
  Disk 1    Online         7650 MB      0 B         

Partitions of Disk 0:
===============


Disk ID: {BF0F7900-796D-499D-9895-6AB51F54E71D}

  Partition ###  Type              Size     Offset
  -------------  ----------------  -------  -------
  Partition 1    Recovery           400 MB  1024 KB
  Partition 2    System (partition with boot components)             260 MB   401 MB
  Partition 3    Reserved           128 MB   661 MB
  Partition 4    Primary            275 GB   789 MB
  Partition 5    Recovery           450 MB   275 GB
  Partition 6    Primary             21 GB   276 GB

======================================================================================================

Disk: 0
Partition 1
Type    : de94bba4-06d1-4d40-a16a-bfd50179d6ac
Hidden  : Yes
Required: Yes
Attrib  : 0X8000000000000001

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 3         WINRE        NTFS   Partition    400 MB  Healthy    Hidden  

======================================================================================================

Disk: 0
Partition 2
Type    : c12a7328-f81f-11d2-ba4b-00a0c93ec93b
Hidden  : Yes
Required: No
Attrib  : 0X8000000000000000

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 4                      FAT32  Partition    260 MB  Healthy    Hidden  

======================================================================================================

Disk: 0
Partition 3
Type    : e3c9e316-0b5c-4db8-817d-f92df00215ae
Hidden  : Yes
Required: No
Attrib  : 0X8000000000000000

There is no volume associated with this partition.

======================================================================================================

Disk: 0
Partition 4
Type    : ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
Hidden  : No
Required: No
Attrib  : 0000000000000000

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 1     C   Windows      NTFS   Partition    275 GB  Healthy            

======================================================================================================

Disk: 0
Partition 5
Type    : de94bba4-06d1-4d40-a16a-bfd50179d6ac
Hidden  : Yes
Required: Yes
Attrib  : 0X8000000000000001

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 5                      NTFS   Partition    450 MB  Healthy    Hidden  

======================================================================================================

Disk: 0
Partition 6
Type    : ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
Hidden  : No
Required: Yes
Attrib  : 0X0000000000000001

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 7     D   RECOVERY     NTFS   Partition     21 GB  Healthy    Hidden  

======================================================================================================

Partitions of Disk 1:
===============


Disk ID: 00000001

  Partition ###  Type              Size     Offset
  -------------  ----------------  -------  -------
* Partition 1    Primary           7650 MB      0 B

======================================================================================================

Disk: 1
There is no partition selected.

There is no partition selected.
Please select a partition and try again.

======================================================================================================
============================== MBR Partition Table ==================

==============================
Partitions of Disk 0:
===============
Disk ID: 901E28C9

Partition : GPT Partition Type
==============================
Partitions of Disk 1:
===============
Disk ID: 500A0DFF
Partition 1: (Not Active) - (Size=812 GB) - (Type=6E)
Partition 2: (Not Active) - (Size=0) - (Type=74)
Partition 4: (Not Active) - (Size=221 KB) - (Type=00)


Firmware Boot Manager
---------------------
identifier              {fwbootmgr}
displayorder            {bootmgr}
timeout                 0

Windows Boot Manager
--------------------
identifier              {bootmgr}
device                  partition=\Device\HarddiskVolume2
path                    \EFI\Microsoft\Boot\bootmgfw.efi
description             Windows Boot Manager
locale                  en-US
inherit                 {globalsettings}
integrityservices       Enable
default                 {default}
resumeobject            {bc0a7c67-0826-11e4-be73-a4db3037ace5}
displayorder            {default}
toolsdisplayorder       {memdiag}
timeout                 30

Firmware Application (101fffff)
-------------------------------
identifier              {c66a305d-0818-11e4-a03b-d90812304343}
description             USB Drive (UEFI)

Firmware Application (101fffff)
-------------------------------
identifier              {c66a305e-0818-11e4-a03b-d90812304343}
description             Internal CD/DVD ROM Drive (UEFI)

Firmware Application (101fffff)
-------------------------------
identifier              {c66a305f-0818-11e4-a03b-d90812304343}
description             Internal Hard Disk or Solid State Disk

Firmware Application (101fffff)
-------------------------------
identifier              {c66a3060-0818-11e4-a03b-d90812304343}
description             Internal Hard Disk or Solid State Disk

Firmware Application (101fffff)
-------------------------------
identifier              {c66a3061-0818-11e4-a03b-d90812304343}
description             Internal Hard Disk or Solid State Disk

Firmware Application (101fffff)
-------------------------------
identifier              {c66a3062-0818-11e4-a03b-d90812304343}
description             Internal Hard Disk or Solid State Disk

Firmware Application (101fffff)
-------------------------------
identifier              {c66a3063-0818-11e4-a03b-d90812304343}
description             Internal Hard Disk or Solid State Disk

Firmware Application (101fffff)
-------------------------------
identifier              {c66a3064-0818-11e4-a03b-d90812304343}
description             Internal Hard Disk or Solid State Disk

Firmware Application (101fffff)
-------------------------------
identifier              {c66a3065-0818-11e4-a03b-d90812304343}
description             Internal Hard Disk or Solid State Disk

Firmware Application (101fffff)
-------------------------------
identifier              {c66a3066-0818-11e4-a03b-d90812304343}
description             Internal Hard Disk or Solid State Disk

Firmware Application (101fffff)
-------------------------------
identifier              {c66a3067-0818-11e4-a03b-d90812304343}
description             Internal Hard Disk or Solid State Disk

Firmware Application (101fffff)
-------------------------------
identifier              {c66a3068-0818-11e4-a03b-d90812304343}
description             Internal Hard Disk or Solid State Disk

Firmware Application (101fffff)
-------------------------------
identifier              {c66a3069-0818-11e4-a03b-d90812304343}
description             Internal Hard Disk or Solid State Disk

Windows Boot Loader
-------------------
identifier              {bc0a7c64-0826-11e4-be73-a4db3037ace5}
device                  ramdisk=[\Device\HarddiskVolume1]\Recovery\WindowsRE\Winre.wim,{bc0a7c65-0826-11e4-be73-a4db3037ace5}
path                    \windows\system32\winload.efi
description             Windows Recovery Environment
locale                  en-US
inherit                 {bootloadersettings}
displaymessage          Recovery
displaymessageoverride  Recovery
osdevice                ramdisk=[\Device\HarddiskVolume1]\Recovery\WindowsRE\Winre.wim,{bc0a7c65-0826-11e4-be73-a4db3037ace5}
systemroot              \windows
nx                      OptIn
bootmenupolicy          Standard
winpe                   Yes

Windows Boot Loader
-------------------
identifier              {default}
device                  partition=C:
path                    \WINDOWS\system32\winload.efi
description             Windows 8.1
locale                  en-US
inherit                 {bootloadersettings}
recoverysequence        {bc0a7c69-0826-11e4-be73-a4db3037ace5}
integrityservices       Enable
recoveryenabled         Yes
isolatedcontext         Yes
allowedinmemorysettings 0x15000075
osdevice                partition=C:
systemroot              \WINDOWS
resumeobject            {bc0a7c67-0826-11e4-be73-a4db3037ace5}
nx                      OptIn
bootmenupolicy          Standard

Windows Boot Loader
-------------------
identifier              {bc0a7c69-0826-11e4-be73-a4db3037ace5}
device                  ramdisk=[\Device\HarddiskVolume5]\Recovery\WindowsRE\Winre.wim,{bc0a7c6a-0826-11e4-be73-a4db3037ace5}
path                    \windows\system32\winload.efi
description             Windows Recovery Environment
locale                  en-US
inherit                 {bootloadersettings}
displaymessage          Recovery
osdevice                ramdisk=[\Device\HarddiskVolume5]\Recovery\WindowsRE\Winre.wim,{bc0a7c6a-0826-11e4-be73-a4db3037ace5}
systemroot              \windows
nx                      OptIn
bootmenupolicy          Standard
winpe                   Yes

Resume from Hibernate
---------------------
identifier              {bc0a7c67-0826-11e4-be73-a4db3037ace5}
device                  partition=C:
path                    \WINDOWS\system32\winresume.efi
description             Windows Resume Application
locale                  en-US
inherit                 {resumeloadersettings}
recoverysequence        {bc0a7c69-0826-11e4-be73-a4db3037ace5}
recoveryenabled         Yes
isolatedcontext         Yes
allowedinmemorysettings 0x15000075
filedevice              partition=C:
filepath                \hiberfil.sys
bootmenupolicy          Standard
debugoptionenabled      No

Resume from Hibernate
---------------------
identifier              {c66a306b-0818-11e4-a03b-d90812304343}
device                  partition=C:
path                    \Windows\system32\winresume.efi
description             Windows Resume Application
locale                  en-US
inherit                 {resumeloadersettings}
recoverysequence        {bc0a7c64-0826-11e4-be73-a4db3037ace5}
recoveryenabled         Yes
isolatedcontext         Yes
allowedinmemorysettings 0x15000075
filedevice              partition=C:
filepath                \hiberfil.sys
bootmenupolicy          Standard
debugoptionenabled      No

Windows Memory Tester
---------------------
identifier              {memdiag}
device                  partition=\Device\HarddiskVolume2
path                    \EFI\Microsoft\Boot\memtest.efi
description             Windows Memory Diagnostic
locale                  en-US
inherit                 {globalsettings}
badmemoryaccess         Yes

EMS Settings
------------
identifier              {emssettings}
bootems                 No

Debugger Settings
-----------------
identifier              {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200

RAM Defects
-----------
identifier              {badmemory}

Global Settings
---------------
identifier              {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}

Boot Loader Settings
--------------------
identifier              {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}

Hypervisor Settings
-------------------
identifier              {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200

Resume Loader Settings
----------------------
identifier              {resumeloadersettings}
inherit                 {globalsettings}

Device options
--------------
identifier              {bc0a7c65-0826-11e4-be73-a4db3037ace5}
description             Windows Recovery
ramdisksdidevice        partition=\Device\HarddiskVolume1
ramdisksdipath          \Recovery\WindowsRE\boot.sdi

Device options
--------------
identifier              {bc0a7c66-0826-11e4-be73-a4db3037ace5}
description             Windows Setup
ramdisksdidevice        partition=C:
ramdisksdipath          \$WINDOWS.~BT\Sources\SafeOS\boot.sdi

Device options
--------------
identifier              {bc0a7c6a-0826-11e4-be73-a4db3037ace5}
description             Windows Recovery
ramdisksdidevice        partition=\Device\HarddiskVolume5
ramdisksdipath          \Recovery\WindowsRE\boot.sdi


****** End Of Log ****** 


#13 sdockery

sdockery
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:02:34 AM

Posted 12 October 2015 - 11:09 AM

I did a factory restore and it cured my PC. I couldn't see any way around it, I lost all of my info but, I wasn't gonna pay the ransom to unlock my own PC. I wish there was a free antivirus to prevent this crap.



#14 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,079 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:09:34 AM

Posted 12 October 2015 - 01:03 PM

Hi sdockery,
 
Yes, unfortunately a factory restore is usually a quicker solution for malware like this.
 

I wish there was a free antivirus to prevent this crap.

The problem is that a lot of antivirus rely on signature detection rather than detection based on behaviour for some types of malware.
 
Anything else I can help you with?
 
xXToffeeXx~


~If I am helping you and you have not had a reply from me in two days, please send me a PM~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~


#15 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,079 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:09:34 AM

Posted 18 October 2015 - 06:12 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.

~If I am helping you and you have not had a reply from me in two days, please send me a PM~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users