Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

win 10 infected all browsers newpoptab tradeadexchange


  • This topic is locked This topic is locked
11 replies to this topic

#1 newlaptop

newlaptop

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:35 AM

Posted 26 November 2015 - 03:36 AM

Hello,

 

I accidentally hit install on some popup ad a while back and it attempted to download something, but i hit cancel download

 

. It must have let something through because my Firefox browser began giving me popups and redirects to newpoptab, tradeadexchange, gamb.67, windows pc repair and other annoying popups.

 

I removed all the extensions/history/favorites, deleted all of the extra junk from add/remove and even removed firefox and installed chrome instead. Now chrome is suffering from the same problem. I have done everything i know how to do myself to rid my system of the problem and yet it persists. After a lot of google searches it appears that this is a powerful new virus affecting a lot of people right now and it looks like your methods here are having some success.

 

So far i have run full system scans from 

 

Malwarebytes current free trial version which removed -

 

:Hijack.Autoconfig.ShrtCln, HKU\S-1-5-21-3446089022-584940005-864541517-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|AutoConfigUrl, http://get-access.me/wpad.dat?0bba124608d5f5b76b5921171aea55b01875508, Quarantined, [132583fff69575c13f29ffd5e221837d]

 

Zone Alarm current free version which found nothing

 

malwarebytes anti rootkit current beta version which found nothing

 

ad aware version 11 which found nothing

 

 AdwCleaner v5.022 - Logfile created 25/11/2015 at 23:03:38
# Updated 22/11/2015 by Xplode
# Database : 2015-11-22.2 [Server]
# Operating system : Windows 10 Home  (x64)
# Username : User - TOSHIBA
# Running from : C:\Users\User\Downloads\AdwCleaner (1).exe
# Option : Cleaning
 
***** [ Services ] *****
 
***** [ Folders ] *****
 
***** [ Files ] *****
 
***** [ DLLs ] *****
 
***** [ Shortcuts ] *****
 
***** [ Scheduled tasks ] ****
 
***** [ Registry ] *****
 
[-] Key Deleted : HKCU\Software\AppDataLow\Software\adawarebp
 
***** [ Web browsers ] *****
 
[-] [C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : aol.com
[-] [C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : ask.com
 
*************************
 
:: "Tracing" keys removed
:: Winsock settings cleared
 
########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [943 bytes] ##########

 

 

And ran a scan from Farbar FRST 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:25-11-2015 01
Ran by User (administrator) on TOSHIBA (25-11-2015 23:58:47)
Running from C:\Users\User\Downloads
Loaded Profiles: User (Available Profiles: User)
Platform: Windows 10 Home (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
 
recovery-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(AMD) C:\Windows\System32\atiesrxx.exe
(Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\tbaseprovisioning.exe
(AMD) C:\Windows\System32\atieclxx.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Check Point Software Technologies, Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.662.8718\AdAwareService.exe
() C:\Program Files\ATI Technologies\ATI.ACE\a4\AdaptiveSleepService.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\Utilities\KeNotify.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be 
 
moved.)
 
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [3363544 2015-09-25] (ELAN Microelectronics Corp.)
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2556768 2013-10-08] (TOSHIBA Corporation)
HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe
HKLM\...\Run: [TSSSrv] => C:\Program Files (x86)\TOSHIBA\System Setting\TSSSrv.exe [296008 2013-10-21] (TOSHIBA 
 
Corporation)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareTray.exe [9574112 2015-11-19] ()
HKLM-x32\...\Run: [KeNotify] => C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe [34160 2013-08-05] (TOSHIBA 
 
CORPORATION)
HKLM-x32\...\Run: [ZoneAlarm] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [134792 2015-11-07] (Check Point 
 
Software Technologies Ltd.)
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{e14d1627-9167-4c8e-809d-79960d14d947}: [DhcpNameServer] 75.75.75.75 75.75.76.76
 
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com/?pc=TNJB
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
HKU\S-1-5-21-3446089022-584940005-864541517-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
 
hxxp://toshiba13.msn.com/?pc=TNJB
HKU\S-1-5-21-3446089022-584940005-864541517-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = 
 
hxxp://mystart.toshiba.com
HKU\S-1-5-21-3446089022-584940005-864541517-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = 
 
hxxp://mystart.toshiba.com
SearchScopes: HKU\S-1-5-21-3446089022-584940005-864541517-1001 -> DefaultScope {398AD872-7519-4BD2-A47C-04BE792C1CE1} URL 
 
= hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie=
 
{inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKU\S-1-5-21-3446089022-584940005-864541517-1001 -> {0BE19D86-99C3-47DD-9CEA-1D060D10880C} URL = 
SearchScopes: HKU\S-1-5-21-3446089022-584940005-864541517-1001 -> {398AD872-7519-4BD2-A47C-04BE792C1CE1} URL = 
 
hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie=
 
{inputEncoding?}&oe={outputEncoding?}
 
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_245.dll [2015-11-21] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_245.dll [2015-11-21] ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update
 
\1.3.28.15\npGoogleUpdate3.dll [2015-11-24] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update
 
\1.3.28.15\npGoogleUpdate3.dll [2015-11-24] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-05-08] (Adobe Systems 
 
Inc.)
 
Chrome: 
=======
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions
 
\aapocclcgogkmnckokdopfmhonfmgoek [2015-11-24]
CHR Extension: (Google Docs) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions
 
\aohghmighlieiainnegkcijnfilokake [2015-11-24]
CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions
 
\apdfllckaahabafndbhieahigkjlhalf [2015-11-24]
CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions
 
\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-24]
CHR Extension: (Google Search) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions
 
\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-24]
CHR Extension: (Google Sheets) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions
 
\felcaaldnbdncclmgdcncolpebgiejap [2015-11-24]
CHR Extension: (Google Docs Offline) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions
 
\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-25]
CHR Extension: (Chrome Web Store Payments) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions
 
\nmmhkkegccagdldgiimedpiccmgmieda [2015-11-24]
CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions
 
\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-24]
 
==================== Services (Whitelisted) ========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed 
 
separately.)
 
R2 AdaptiveSleepService; C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe [140288 2014-04-22] () 
 
[File not signed]
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [156384 2015-09-25] (ELAN Microelectronics Corp.)
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareService.exe [712432 2015-11-19] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 tbaseprovisioning; C:\Windows\SysWOW64\tbaseprovisioning.exe [60432 2015-06-23] (Advanced Micro Devices, Inc.)
S2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [3722912 2015-11-07] (Check Point Software Technologies 
 
Ltd.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-09] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-09] (Microsoft Corporation)
R2 ZAPrivacyService; C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZaPrivacyService.exe [96272 2015-10-19] (Check Point 
 
Software Technologies, Ltd.)
 
===================== Drivers (Whitelisted) ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed 
 
separately.)
 
R3 AmdAS4; C:\Windows\System32\drivers\AmdAS4.sys [17640 2013-10-24] (Advanced Micro Devices, INC.)
S3 amdkmcsp; C:\Windows\system32\DRIVERS\amdkmcsp.sys [101104 2015-06-23] (Advanced Micro Devices, Inc. )
R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36608 2013-12-14] (Advanced Micro Devices, Inc.)
R0 amdpsp; C:\Windows\System32\DRIVERS\amdpsp.sys [277240 2015-06-23] (Advanced Micro Devices, Inc. )
R3 athr; C:\Windows\System32\drivers\athw10x.sys [4342936 2015-09-21] (Qualcomm Atheros Communications, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWT6.sys [102912 2015-05-28] (Advanced Micro Devices)
S3 DIRECTIO; C:\Program Files\PerformanceTest\DirectIo64.sys [31376 2015-03-10] ()
R3 ETDSMBus; C:\Windows\System32\drivers\ETDSMBus.sys [40016 2015-09-25] (ELAN Microelectronic Corp.)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [478392 2015-11-03] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [30328 2015-11-03] (Kaspersky Lab)
R3 klflt; C:\Windows\system32\DRIVERS\klflt.sys [172920 2015-11-03] (AO Kaspersky Lab)
R1 klhk; C:\Windows\system32\DRIVERS\klhk.sys [227512 2015-11-03] (AO Kaspersky Lab)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [917880 2015-11-03] (AO Kaspersky Lab)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2015-11-25] (Malwarebytes)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [310528 2015-06-09] (Realtek Semiconductor Corp.)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [54424 2015-07-29] (Toshiba Corporation)
S3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [452040 2015-01-22] (BitDefender S.R.L.)
S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-09] ()
R2 Vsdatant; C:\Windows\system32\DRIVERS\vsdatant.sys [462304 2015-11-07] (Check Point Software Technologies Ltd.)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-07-09] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [291680 2015-07-09] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-09] (Microsoft Corporation)
S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed 
 
separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-11-25 23:58 - 2015-11-25 23:59 - 00012180 _____ C:\Users\User\Downloads\FRST.txt
2015-11-25 23:15 - 2015-11-25 23:52 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-11-25 23:14 - 2015-11-25 23:52 - 00000000 ____D C:\Users\User\Downloads\mbar
2015-11-25 23:13 - 2015-11-25 23:13 - 16563352 _____ (Malwarebytes Corp.) C:\Users\User\Downloads\mbar-1.09.3.1001.exe
2015-11-25 23:05 - 2015-11-25 23:05 - 00016148 _____ C:\WINDOWS\system32\TOSHIBA_User_HistoryPrediction.bin
2015-11-25 23:00 - 2015-11-25 23:00 - 01733632 _____ C:\Users\User\Downloads\AdwCleaner (1).exe
2015-11-25 22:55 - 2015-11-25 23:03 - 00000000 ____D C:\AdwCleaner
2015-11-25 11:20 - 2015-11-25 23:58 - 00000000 ____D C:\FRST
2015-11-25 11:20 - 2015-11-25 11:20 - 02348544 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe
2015-11-25 10:26 - 2015-11-25 23:58 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-11-25 10:25 - 2015-11-25 23:14 - 00109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-11-25 10:25 - 2015-11-25 10:33 - 00001176 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-11-25 10:25 - 2015-11-25 10:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes 
 
Anti-Malware
2015-11-25 10:25 - 2015-11-25 10:25 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-11-25 10:25 - 2015-11-25 10:25 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-11-25 10:25 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-11-25 10:25 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2015-11-25 10:23 - 2015-11-25 10:24 - 22908888 _____ (Malwarebytes ) C:\Users\User\Downloads\mbam-setup-2.2.0.1024.exe
2015-11-25 09:21 - 2015-11-25 09:21 - 00105270 _____ C:\WINDOWS\ntbtlog.txt
2015-11-25 09:21 - 2015-11-25 09:21 - 00000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2015-11-24 22:35 - 2015-11-25 23:40 - 00000910 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-11-24 22:35 - 2015-11-25 23:05 - 00000906 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-11-24 22:35 - 2015-11-25 10:33 - 00002337 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-11-24 22:35 - 2015-11-24 22:36 - 00000000 ____D C:\Users\User\AppData\Local\Google
2015-11-24 22:35 - 2015-11-24 22:35 - 00003968 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-11-24 22:35 - 2015-11-24 22:35 - 00003736 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-11-24 22:35 - 2015-11-24 22:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-11-24 22:35 - 2015-11-24 22:35 - 00000000 ____D C:\Program Files (x86)\Google
2015-11-24 22:34 - 2015-11-24 22:34 - 00929872 _____ (Google Inc.) C:\Users\User\Downloads\ChromeSetup.exe
2015-11-24 01:21 - 2015-11-24 01:21 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2015-11-23 22:47 - 2015-11-23 22:47 - 00000000 ____D C:\Users\User\AppData\LocalLow\Temp
2015-11-23 01:07 - 2015-11-23 01:07 - 00000000 ___RD C:\Users\User\3D Objects
2015-11-22 23:45 - 2015-11-22 23:45 - 00000000 ____D C:\Users\User\AppData\Roaming\Lavasoft
2015-11-22 23:43 - 2015-11-25 23:06 - 00002413 _____ C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2015-11-22 23:43 - 2015-11-22 23:43 - 00000000 ____D C:\Users\User\AppData\Roaming\LavasoftStatistics
2015-11-22 23:43 - 2015-11-22 23:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2015-11-22 23:43 - 2015-11-22 23:43 - 00000000 ____D C:\Program Files\Lavasoft
2015-11-22 23:39 - 2015-11-22 23:39 - 00000000 ____D C:\Program Files\Common Files\Lavasoft
2015-11-22 23:38 - 2015-11-22 23:38 - 00000000 ____D C:\ProgramData\Lavasoft
2015-11-22 22:44 - 2015-11-22 22:45 - 00000000 ____D C:\Users\User\AppData\Local\MicrosoftEdge
2015-11-22 22:38 - 2015-11-25 10:34 - 00002340 _____ C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
 
\OneDrive.lnk
2015-11-22 22:38 - 2015-11-22 22:38 - 00000000 ___RD C:\Users\User\OneDrive
2015-11-22 22:29 - 2015-11-22 22:29 - 00000000 ____D C:\Users\User\AppData\Local\Publishers
2015-11-22 22:27 - 2015-11-22 22:29 - 00000000 ____D C:\Users\User\AppData\Local\Comms
2015-11-22 22:26 - 2015-11-22 22:26 - 00000020 ___SH C:\Users\User\ntuser.ini
2015-11-22 22:26 - 2015-11-22 22:26 - 00000000 ____D C:\Users\User\AppData\Local\TileDataLayer
2015-11-22 22:20 - 2015-11-22 22:20 - 00022744 _____ C:\WINDOWS\system32\emptyregdb.dat
2015-11-22 22:19 - 2015-11-23 21:41 - 00875126 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-11-22 22:07 - 2015-11-25 10:33 - 00001540 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media 
 
Player.lnk
2015-11-22 22:02 - 2015-11-22 22:02 - 00000000 ____D C:\WINDOWS\system32\config\bbimigrate
2015-11-22 22:00 - 2015-11-22 22:00 - 00000000 _SHDL C:\Users\User\My Documents
2015-11-22 22:00 - 2015-11-22 22:00 - 00000000 _SHDL C:\Users\User\Documents\My Videos
2015-11-22 22:00 - 2015-11-22 22:00 - 00000000 _SHDL C:\Users\User\Documents\My Pictures
2015-11-22 22:00 - 2015-11-22 22:00 - 00000000 _SHDL C:\Users\User\Documents\My Music
2015-11-22 21:57 - 2015-11-25 23:04 - 00065536 _____ C:\WINDOWS\system32\spu_storage.bin
2015-11-22 21:57 - 2015-11-22 21:57 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_amdpsp_01011.Wdf
2015-11-22 21:57 - 2015-11-22 21:57 - 00000000 _____ C:\WINDOWS\ativpsrm.bin
2015-11-22 21:56 - 2015-11-22 21:56 - 00001527 _____ C:\WINDOWS\system32\Drivers\rtkhdasetting.zip
2015-11-22 21:56 - 2015-11-22 21:56 - 00000000 ____H C:\ProgramData\DP45977C.lfl
2015-11-22 21:56 - 2015-11-22 21:56 - 00000000 ____D C:\Program Files\Common Files\ATI Technologies
2015-11-22 21:56 - 2015-11-22 21:56 - 00000000 ____D C:\Program Files\AMD
2015-11-22 21:55 - 2015-11-22 21:55 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_ETD_01009.Wdf
2015-11-22 21:55 - 2015-11-22 21:55 - 00000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2015-11-22 21:55 - 2015-11-22 21:55 - 00000000 ____D C:\Program Files\Realtek
2015-11-22 21:55 - 2015-11-22 21:55 - 00000000 ____D C:\Program Files\Elantech
2015-11-22 21:54 - 2015-11-22 21:54 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2015-11-22 21:51 - 2015-11-23 00:00 - 00000000 ___DC C:\WINDOWS\Panther
2015-11-22 21:46 - 2015-11-22 21:46 - 00000000 ____D C:\Windows.old
2015-11-22 21:44 - 2015-11-22 21:44 - 24597504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 22322624 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 21873664 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 20858360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 19326464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 18803712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 16708608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 13027840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 12504064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 11262976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 08020832 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-11-22 21:44 - 2015-11-22 21:44 - 07569408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 07523840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 07055872 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 06572032 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 06487248 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 06101504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 05454848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 05120056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 05079552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 04792320 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 03781120 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 03621248 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 03587072 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2015-11-22 21:44 - 2015-11-22 21:44 - 03580416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 03248128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02987520 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02878512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02824248 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02740224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02675200 _____ (Microsoft Corporation) C:\WINDOWS
 
\system32\Windows.StateRepository.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02660864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02647040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02639872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02573768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02494712 _____ C:\WINDOWS\system32\CoreUIComponents.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02464216 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02446648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02432336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2015-11-22 21:44 - 2015-11-22 21:44 - 02418688 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02236416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02228736 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02226688 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02207232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02180608 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02156400 _____ (Microsoft Corporation) C:\WINDOWS\system32\hevcdecoder.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02154808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02093056 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02049536 _____ (Microsoft Corporation) C:\WINDOWS
 
\SysWOW64\Windows.StateRepository.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01997336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01983824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2015-11-22 21:44 - 2015-11-22 21:44 - 01918976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01895568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hevcdecoder.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01871360 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01844736 _____ (Microsoft Corporation) C:\WINDOWS\system32\workfolderssvc.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01812480 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnidui.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01795072 _____ (Microsoft Corporation) C:\WINDOWS
 
\system32\AppXDeploymentExtensions.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01766952 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01602560 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01601536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01594368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01563472 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpmde.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01563392 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01423872 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01392480 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01383936 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2015-11-22 21:44 - 2015-11-22 21:44 - 01380864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01357888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01331200 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCore.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01295712 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpx.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01294352 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2015-11-22 21:44 - 2015-11-22 21:44 - 01290240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01276416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01216512 _____ (Microsoft Corporation) C:\WINDOWS\system32\netcenter.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01213440 _____ (Microsoft Corporation) C:\WINDOWS\system32\RemoteNaturalLanguage.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01205248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01203712 _____ (Microsoft Corporation) C:\WINDOWS
 
\system32\Windows.Devices.Bluetooth.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01181696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01171456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netcenter.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01168736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2015-11-22 21:44 - 2015-11-22 21:44 - 01162240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01123400 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2015-11-22 21:44 - 2015-11-22 21:44 - 01104384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCore.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01083072 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01068032 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01018568 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2015-11-22 21:44 - 2015-11-22 21:44 - 01015808 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2015-11-22 21:44 - 2015-11-22 21:44 - 00966416 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00961376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00949760 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00928256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00928256 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpMapControl.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00910848 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModel.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00899584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RemoteNaturalLanguage.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00894256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Wdf01000.sys
2015-11-22 21:44 - 2015-11-22 21:44 - 00869376 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00859136 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00858408 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2015-11-22 21:44 - 2015-11-22 21:44 - 00856576 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00856576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContactApis.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00832512 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00828928 _____ (Microsoft Corporation) C:\WINDOWS
 
\SysWOW64\Windows.Devices.Bluetooth.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00826880 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00809352 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00796160 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00784136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00781976 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfds.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00780288 _____ (Microsoft Corporation) C:\WINDOWS
 
\system32\Windows.ApplicationModel.Store.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00771072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00767488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00762888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00757760 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00752640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChatApis.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\EmailApis.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00701952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JpMapControl.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00690688 _____ (Microsoft Corporation) C:\WINDOWS\system32\CellularAPI.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS
 
\system32\Windows.Security.Authentication.Web.Core.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00685568 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppointmentApis.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00677888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlCore.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00671232 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUDFx02000.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00658528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfds.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00650240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00646672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00627712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00625152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContactApis.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00621056 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00613376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00607408 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2015-11-22 21:44 - 2015-11-22 21:44 - 00599552 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnapps.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00591360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\MessagingDataModel2.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00587264 _____ (Microsoft Corporation) C:\WINDOWS
 
\SysWOW64\Windows.ApplicationModel.Store.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00584656 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00579584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentApis.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2015-11-22 21:44 - 2015-11-22 21:44 - 00577888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys
2015-11-22 21:44 - 2015-11-22 21:44 - 00576000 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00574464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00570880 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApi.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ChatApis.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00555768 _____ (Microsoft Corporation) C:\WINDOWS\system32\directmanipulation.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00553808 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2015-11-22 21:44 - 2015-11-22 21:44 - 00541024 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcupdate_GenuineIntel.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00539728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2015-11-22 21:44 - 2015-11-22 21:44 - 00537080 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWanAPI.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00526336 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00525312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EmailApis.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00521728 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00517632 _____ (Microsoft Corporation) C:\WINDOWS
 
\system32\NotificationController.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00516448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2015-11-22 21:44 - 2015-11-22 21:44 - 00515072 _____ (Microsoft Corporation) C:\WINDOWS\system32\internetmail.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00513536 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcsvc.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00512000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00508248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00505696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2015-11-22 21:44 - 2015-11-22 21:44 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\system32\DataSenseHandlers.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00503808 _____ (Microsoft Corporation) C:\WINDOWS\system32\tileobjserver.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00502272 _____ (Microsoft Corporation) C:\WINDOWS\system32\dlnashext.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00501008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00498016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys
2015-11-22 21:44 - 2015-11-22 21:44 - 00494592 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00483328 _____ (Microsoft Corporation) C:\WINDOWS
 
\system32\OneDriveSettingSyncProvider.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00480256 _____ (Microsoft Corporation) C:\WINDOWS
 
\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00476760 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFCaptureEngine.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00473088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpnapps.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00467968 _____ (Microsoft Corporation) C:\WINDOWS\system32\MBMediaManager.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00466432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MessagingDataModel2.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00465920 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanconn.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00464896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00459104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys
2015-11-22 21:44 - 2015-11-22 21:44 - 00454656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MbaeApi.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00454512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\directmanipulation.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00453120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Usb.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00446976 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00441344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dlnashext.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00441168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2015-11-22 21:44 - 2015-11-22 21:44 - 00439296 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationWebproxy.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00434376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFCaptureEngine.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00428128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWanAPI.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00421888 _____ (Microsoft Corporation) C:\WINDOWS
 
\system32\Windows.Internal.Bluetooth.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00408064 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredProvDataModel.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00407608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00406864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS
2015-11-22 21:44 - 2015-11-22 21:44 - 00403456 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00395088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2015-11-22 21:44 - 2015-11-22 21:44 - 00387584 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppBroker.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00378368 _____ (Microsoft Corporation) C:\WINDOWS
 
\system32\SystemEventsBrokerServer.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00371712 _____ (Microsoft Corporation) C:\WINDOWS
 
\SysWOW64\OneDriveSettingSyncProvider.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00371712 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00366592 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00347136 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptprov.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngccredprov.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00342016 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationGeofences.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00336384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredProvDataModel.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00333312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00332624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fastfat.sys
2015-11-22 21:44 - 2015-11-22 21:44 - 00328704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS
 
\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00320000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\portcls.sys
2015-11-22 21:44 - 2015-11-22 21:44 - 00317440 _____ (Microsoft Corporation) C:\WINDOWS\system32\configmanager2.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00313856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppBroker.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00312832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsApi.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00311808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00311296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Usb.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00288256 _____ (Microsoft Corporation) C:\WINDOWS\system32\PimIndexMaintenance.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00281600 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEEventDispatcher.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00278352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2015-11-22 21:44 - 2015-11-22 21:44 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\syncutil.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00273920 _____ (Microsoft Corporation) C:\WINDOWS
 
\system32\Windows.ApplicationModel.LockScreen.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00269312 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptprov.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationFramework.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00267776 _____ (Microsoft Corporation) C:\WINDOWS
 
\system32\Windows.Internal.Management.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataAccountApis.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00253440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SensorsApi.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00247808 _____ (Microsoft Corporation) C:\WINDOWS
 
\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00243760 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00224256 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneCallHistoryApis.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationPeWiFi.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00217088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEEventDispatcher.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00215552 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationCrowdsource.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationPeCell.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00202240 _____ (Microsoft Corporation) C:\WINDOWS\system32\accountaccessor.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00195072 _____ (Microsoft Corporation) C:\WINDOWS
 
\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00193024 _____ (Microsoft Corporation) C:\WINDOWS
 
\SysWOW64\Windows.Internal.Management.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00187904 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00186880 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00185344 _____ (Microsoft Corporation) C:\WINDOWS\system32\psmsrv.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00176640 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationPeIP.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhoneCallHistoryApis.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00169984 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmmigrator.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\CallHistoryClient.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\SubscriptionMgr.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00154624 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcertinst.exe
2015-11-22 21:44 - 2015-11-22 21:44 - 00149504 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00145920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mdmregistration.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00143360 _____ (Microsoft Corporation) C:\WINDOWS\system32\provops.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEStoreEventHandlers.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00131072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CallHistoryClient.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00121856 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcsps.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00120832 _____ (Microsoft Corporation) C:\WINDOWS\system32\omadmclient.exe
2015-11-22 21:44 - 2015-11-22 21:44 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCsp.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00116064 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tdx.sys
2015-11-22 21:44 - 2015-11-22 21:44 - 00106496 _____ (Microsoft Corporation) C:\WINDOWS
 
\system32\KeywordDetectorMsftSidAdapter.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00102304 _____ (Microsoft Corporation) C:\WINDOWS\system32\omadmapi.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00099664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2015-11-22 21:44 - 2015-11-22 21:44 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationWiFiAdapter.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00088384 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngckeyenum.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAppInstaller.exe
2015-11-22 21:44 - 2015-11-22 21:44 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceEnroller.exe
2015-11-22 21:44 - 2015-11-22 21:44 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\HttpsDataSource.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00078528 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00074880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00073728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwancfg.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00068096 _____ (Microsoft Corporation) C:\WINDOWS
 
\system32\EnterpriseDesktopAppMgmtCSP.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usoapi.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Speech.Pal.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00041472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Speech.Pal.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00036352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers
 
\buttonconverter.sys
2015-11-22 21:44 - 2015-11-22 21:44 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\syncmlhook.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00026624 _____ (Microsoft Corporation) C:\WINDOWS
 
\system32\LicenseManagerShellext.exe
2015-11-22 21:44 - 2015-11-22 21:44 - 00025280 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2015-11-22 21:34 - 2015-11-22 21:34 - 00008192 _____ C:\WINDOWS\system32\config\userdiff
2015-11-22 21:30 - 2015-11-22 21:30 - 00000000 ____D C:\Program Files\Reference Assemblies
2015-11-22 21:30 - 2015-11-22 21:30 - 00000000 ____D C:\Program Files\MSBuild
2015-11-22 21:30 - 2015-11-22 21:30 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies
2015-11-22 21:30 - 2015-11-22 21:30 - 00000000 ____D C:\Program Files (x86)\MSBuild
2015-11-22 21:29 - 2015-06-17 18:10 - 01166520 _____ (Microsoft Corporation) C:\WINDOWS
 
\system32\PresentationNative_v0300.dll
2015-11-22 21:29 - 2015-06-17 18:10 - 00124112 _____ (Microsoft Corporation) C:\WINDOWS
 
\system32\PresentationCFFRasterizerNative_v0300.dll
2015-11-22 21:29 - 2015-06-17 18:10 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2015-11-22 21:29 - 2015-05-29 21:07 - 00778936 _____ (Microsoft Corporation) C:\WINDOWS
 
\SysWOW64\PresentationNative_v0300.dll
2015-11-22 21:29 - 2015-05-29 21:07 - 00102608 _____ (Microsoft Corporation) C:\WINDOWS
 
\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-11-22 21:29 - 2015-05-29 21:07 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2015-11-22 20:24 - 2015-11-22 22:22 - 00009528 _____ C:\WINDOWS\diagwrn.xml
2015-11-22 20:24 - 2015-11-22 22:22 - 00009528 _____ C:\WINDOWS\diagerr.xml
2015-11-22 20:24 - 2015-11-22 21:02 - 00000000 ___HD C:\$Windows.~BT
2015-11-22 20:19 - 2015-11-22 20:19 - 00000000 ____D C:\ESD
2015-11-22 19:22 - 2015-11-22 19:22 - 00000000 ___HD C:\$Windows.~WS
2015-11-21 02:36 - 2015-11-21 02:37 - 00000000 ____D C:\Users\User\AppData\Local\Adobe
2015-11-20 23:30 - 2015-11-20 23:30 - 00000000 ____D C:\Users\User\AppData\Roaming\OpenOffice
2015-11-20 21:25 - 2015-11-20 21:25 - 00000000 ____D C:\Users\User\AppData\Local\Macromedia
2015-11-19 13:14 - 2015-11-19 13:14 - 00000000 ____D C:\Users\User\AppData\Roaming\WinBatch
2015-11-19 11:23 - 2015-11-25 09:37 - 00000000 ____D C:\Users\User\AppData\Local\ElevatedDiagnostics
2015-11-19 10:46 - 2015-11-24 23:27 - 00007599 _____ C:\Users\User\AppData\Local\Resmon.ResmonCfg
2015-11-19 04:38 - 2015-11-19 04:43 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-11-19 04:38 - 2015-10-27 18:43 - 145617392 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-11-19 00:37 - 2015-11-25 10:33 - 00001005 _____ C:\Users\User\Desktop\PerformanceTest.lnk
2015-11-19 00:37 - 2015-11-22 22:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PerformanceTest
2015-11-19 00:37 - 2015-11-19 00:37 - 00000000 ____D C:\Users\User\Documents\PassMark
2015-11-19 00:37 - 2015-11-19 00:37 - 00000000 ____D C:\Users\User\AppData\Local\PassMark
2015-11-19 00:37 - 2015-11-19 00:37 - 00000000 ____D C:\ProgramData\Passmark
2015-11-19 00:37 - 2015-11-19 00:37 - 00000000 ____D C:\Program Files\PerformanceTest
2015-11-18 22:58 - 2015-11-18 22:59 - 00000000 ____D C:\Users\User\AppData\Roaming\vlc
2015-11-18 20:22 - 2015-11-25 10:33 - 00001122 _____ C:\Users\Public\Desktop\OpenOffice 4.1.2.lnk
2015-11-18 20:22 - 2015-11-22 22:09 - 00000000 ___SD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.1.2
2015-11-18 20:21 - 2015-11-18 20:22 - 00000000 ____D C:\Program Files (x86)\OpenOffice 4
2015-11-18 20:09 - 2015-11-22 22:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2015-11-18 20:09 - 2015-11-18 20:09 - 00000000 ____D C:\Program Files\7-Zip
2015-11-18 19:42 - 2015-11-25 10:33 - 00001047 _____ C:\Users\Public\Desktop\VLC media player.lnk
2015-11-18 19:42 - 2015-11-22 22:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2015-11-18 19:41 - 2015-11-18 19:41 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2015-11-18 15:30 - 2015-07-22 06:19 - 00041984 _____ (Microsoft Corporation) C:\WINDOWS\system32\UtcResources.dll
2015-11-18 15:29 - 2015-11-18 15:29 - 00000000 ____D C:\Program Files (x86)\Lame For Audacity
2015-11-18 15:11 - 2014-10-30 19:23 - 00733696 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveTelemetry.dll
2015-11-18 15:05 - 2015-11-21 00:43 - 00000000 ____D C:\Users\User\Documents\REAPER Media
2015-11-18 14:58 - 2014-10-28 17:54 - 00408576 _____ (Microsoft Corporation) C:\WINDOWS\system32\DfpCommon.dll
2015-11-18 14:53 - 2014-10-28 17:59 - 00032256 _____ (Microsoft Corporation) C:\WINDOWS\system32\dfp.exe
2015-11-18 14:47 - 2015-11-20 23:00 - 00000000 ____D C:\Users\User\AppData\Roaming\Audacity
2015-11-18 14:46 - 2015-11-25 10:33 - 00000990 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
2015-11-18 14:46 - 2015-11-25 10:33 - 00000984 _____ C:\Users\Public\Desktop\Audacity.lnk
2015-11-18 14:46 - 2015-11-18 14:47 - 00000000 ____D C:\Program Files (x86)\Audacity
2015-11-18 14:41 - 2015-11-25 10:33 - 00000889 _____ C:\Users\Public\Desktop\REAPER (x64).lnk
2015-11-18 14:41 - 2015-11-22 22:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\REAPER (x64)
2015-11-18 14:41 - 2015-11-21 01:34 - 00000000 ____D C:\Users\User\AppData\Roaming\REAPER
2015-11-18 14:41 - 2015-11-18 14:41 - 00000000 ____D C:\Program Files\Common Files\Propellerhead Software
2015-11-18 14:40 - 2015-11-18 14:41 - 00000000 ____D C:\Program Files\REAPER (x64)
2015-11-18 14:28 - 2015-11-03 06:42 - 00478392 _____ (Kaspersky Lab ZAO) C:\WINDOWS\system32\Drivers\kl1.sys
2015-11-18 14:28 - 2015-11-03 06:42 - 00227512 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klhk.sys
2015-11-18 14:23 - 2015-11-25 10:33 - 00000772 _____ C:\Users\Public\Desktop\ZoneAlarm Security.lnk
2015-11-18 14:23 - 2015-11-22 22:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Check Point
2015-11-18 14:23 - 2015-11-18 14:25 - 00430818 _____ C:\WINDOWS\system32\Drivers\vsconfig.xml
2015-11-18 14:22 - 2015-11-18 14:23 - 00000000 ____D C:\Program Files (x86)\CheckPoint
2015-11-18 14:21 - 2015-11-18 14:21 - 00000000 ____D C:\ProgramData\CheckPoint
2015-11-18 14:04 - 2015-11-18 14:04 - 00000013 __RSH C:\WINDOWS\system32\Drivers\fbd.sys
2015-11-18 13:59 - 2015-11-19 13:00 - 00000000 __SHD C:\Users\User\AppData\LocalLow\EmieUserList
2015-11-18 13:59 - 2015-11-19 13:00 - 00000000 __SHD C:\Users\User\AppData\LocalLow\EmieSiteList
2015-11-18 13:59 - 2015-11-19 13:00 - 00000000 __SHD C:\Users\User\AppData\Local\EmieUserList
2015-11-18 13:59 - 2015-11-19 13:00 - 00000000 __SHD C:\Users\User\AppData\Local\EmieSiteList
2015-11-18 13:44 - 2015-08-22 05:42 - 00066400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-private-
 
l1-1-0.dll
2015-11-18 13:44 - 2015-08-22 05:42 - 00022368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-math-l1-1
 
-0.dll
2015-11-18 13:44 - 2015-08-22 05:42 - 00019808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-
 
multibyte-l1-1-0.dll
2015-11-18 13:44 - 2015-08-22 05:42 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-string-l1
 
-1-0.dll
2015-11-18 13:44 - 2015-08-22 05:42 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-stdio-l1-
 
1-0.dll
2015-11-18 13:44 - 2015-08-22 05:42 - 00016224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-runtime-
 
l1-1-0.dll
2015-11-18 13:44 - 2015-08-22 05:42 - 00015712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-convert-
 
l1-1-0.dll
2015-11-18 13:44 - 2015-08-22 05:42 - 00014176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-time-l1-1
 
-0.dll
2015-11-18 13:44 - 2015-08-22 05:42 - 00013664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-
 
filesystem-l1-1-0.dll
2015-11-18 13:44 - 2015-08-22 05:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-process-
 
l1-1-0.dll
2015-11-18 13:44 - 2015-08-22 05:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-heap-l1-1
 
-0.dll
2015-11-18 13:44 - 2015-08-22 05:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-conio-l1-
 
1-0.dll
2015-11-18 13:44 - 2015-08-22 05:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-utility-
 
l1-1-0.dll
2015-11-18 13:44 - 2015-08-22 05:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-locale-l1
 
-1-0.dll
2015-11-18 13:44 - 2015-08-22 05:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-
 
environment-l1-1-0.dll
2015-11-18 13:44 - 2015-08-22 05:35 - 00063840 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-private-
 
l1-1-0.dll
2015-11-18 13:44 - 2015-08-22 05:35 - 00020832 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-math-l1-1
 
-0.dll
2015-11-18 13:44 - 2015-08-22 05:35 - 00019808 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-
 
multibyte-l1-1-0.dll
2015-11-18 13:44 - 2015-08-22 05:35 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-string-l1
 
-1-0.dll
2015-11-18 13:44 - 2015-08-22 05:35 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-stdio-l1-
 
1-0.dll
2015-11-18 13:44 - 2015-08-22 05:35 - 00016224 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-runtime-
 
l1-1-0.dll
2015-11-18 13:44 - 2015-08-22 05:35 - 00015712 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-convert-
 
l1-1-0.dll
2015-11-18 13:44 - 2015-08-22 05:35 - 00014176 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-time-l1-1
 
-0.dll
2015-11-18 13:44 - 2015-08-22 05:35 - 00013664 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-
 
filesystem-l1-1-0.dll
2015-11-18 13:44 - 2015-08-22 05:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-process-
 
l1-1-0.dll
2015-11-18 13:44 - 2015-08-22 05:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-heap-l1-1
 
-0.dll
2015-11-18 13:44 - 2015-08-22 05:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-conio-l1-
 
1-0.dll
2015-11-18 13:44 - 2015-08-22 05:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-utility-
 
l1-1-0.dll
2015-11-18 13:44 - 2015-08-22 05:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-locale-l1
 
-1-0.dll
2015-11-18 13:44 - 2015-08-22 05:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-
 
environment-l1-1-0.dll
2015-11-18 13:20 - 2015-11-18 13:20 - 00000000 ____D C:\Users\User\AppData\Roaming\Macromedia
2015-11-18 13:20 - 2015-11-18 13:20 - 00000000 ____D C:\Users\User\AppData\Local\GWX
2015-11-18 13:16 - 2015-11-22 22:20 - 00003706 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-
 
3446089022-584940005-864541517-1001
2015-11-18 13:16 - 2015-11-18 13:16 - 00000000 ____D C:\Users\User\AppData\Roaming\ATI
2015-11-18 13:16 - 2015-11-18 13:16 - 00000000 ____D C:\Users\User\AppData\Local\ATI
2015-11-18 13:11 - 2015-11-19 13:00 - 00000000 ____D C:\Users\User\AppData\Local\TOSHIBA
2015-11-18 13:10 - 2015-11-23 21:39 - 00000000 ____D C:\Users\User\AppData\Local\Packages
2015-11-18 13:10 - 2015-11-18 13:10 - 00000000 ____D C:\Users\User\AppData\Roaming\Adobe
2015-11-18 13:10 - 2015-11-18 13:10 - 00000000 ____D C:\Users\User\AppData\Local\VirtualStore
2015-11-18 13:02 - 2015-03-13 17:51 - 00015360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wu.upgrade.ps.dll
2015-11-18 12:51 - 2015-11-19 09:49 - 00000000 ____D C:\Users\User\Documents\Camera Roll
2015-11-18 12:44 - 2015-10-20 08:14 - 00156265 _____ C:\Users\User\Documents\jeremy insurance.pdf
2015-11-18 12:44 - 2015-07-27 11:20 - 00008779 _____ C:\Users\User\Documents\budget.xlsx
2015-11-18 12:44 - 2015-07-18 17:03 - 00008658 _____ C:\Users\User\Documents\barbershop.ods
2015-11-18 12:44 - 2015-03-31 09:40 - 00005522 _____ C:\Users\User\Documents\Untitled 1.ods
2015-11-18 12:44 - 2014-03-12 10:23 - 00005536 _____ C:\Users\User\Documents\Untitled 1 (Autosaved).ods
2015-11-07 02:36 - 2015-11-07 02:36 - 00462304 _____ (Check Point Software Technologies Ltd.) C:\WINDOWS\system32\Drivers
 
\vsdatant.sys
2015-11-03 06:42 - 2015-11-03 06:42 - 00917880 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klif.sys
2015-11-03 06:42 - 2015-11-03 06:42 - 00172920 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klflt.sys
2015-11-03 06:42 - 2015-11-03 06:42 - 00030328 _____ (Kaspersky Lab) C:\WINDOWS\system32\Drivers\klelam.sys
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-11-25 23:58 - 2015-01-06 13:32 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-11-25 23:08 - 2015-07-30 14:42 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-11-25 23:06 - 2015-01-06 13:00 - 00603061 _____ C:\WINDOWS\SysWOW64\rootpa.e2e
2015-11-25 23:04 - 2015-07-30 13:52 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-11-25 23:04 - 2015-07-10 01:05 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2015-11-25 22:33 - 2015-07-10 01:47 - 00000000 ____D C:\Windows
2015-11-25 19:47 - 2015-07-30 14:42 - 00000000 ___HD C:\Program Files\WindowsApps
2015-11-25 11:22 - 2015-07-30 14:40 - 00000000 ____D C:\WINDOWS\INF
2015-11-25 10:33 - 2014-12-01 21:23 - 00002445 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 
 
XI.lnk
2015-11-24 23:06 - 2014-12-01 21:22 - 00000000 ____D C:\Program Files\TOSHIBA
2015-11-24 00:39 - 2015-07-30 14:25 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-11-23 06:23 - 2015-07-30 14:42 - 00000000 ____D C:\WINDOWS\appcompat
2015-11-22 22:49 - 2015-07-30 14:42 - 00000000 ____D C:\WINDOWS\system32\WinBioDatabase
2015-11-22 22:32 - 2015-07-30 13:49 - 00235552 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-11-22 22:26 - 2015-09-09 21:42 - 00000000 __RHD C:\Users\Public\AccountPictures
2015-11-22 22:25 - 2015-07-30 14:42 - 00000000 ____D C:\WINDOWS\rescache
2015-11-22 22:21 - 2015-07-30 14:42 - 00000000 ____D C:\WINDOWS\Registration
2015-11-22 22:20 - 2015-01-06 13:32 - 00003828 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-11-22 22:20 - 2015-01-06 13:03 - 00003240 _____ C:\WINDOWS\System32\Tasks\RTKCPL
2015-11-22 22:20 - 2015-01-06 12:50 - 00003702 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-
 
3446089022-584940005-864541517-500
2015-11-22 22:15 - 2015-07-30 14:42 - 00000000 __RHD C:\Users\Public\Libraries
2015-11-22 22:09 - 2015-09-09 21:05 - 00000000 ____D C:\WINDOWS\SysWOW64\sysprep
2015-11-22 22:09 - 2015-07-10 01:05 - 00032768 ___SH C:\WINDOWS\system32\config\ELAM
2015-11-22 22:09 - 2015-01-06 12:57 - 00000000 ____D C:\Program Files (x86)\ATI Technologies
2015-11-22 22:09 - 2014-12-01 21:43 - 00000000 ____D C:\ProgramData\regid.2009-07.com.mymusiccloud
2015-11-22 22:07 - 2013-08-22 05:36 - 00000000 ____D C:\Users\Default.migrated
2015-11-22 22:04 - 2015-07-30 14:42 - 00000000 ____D C:\WINDOWS\SysWOW64\lv-LV
2015-11-22 22:04 - 2015-07-30 14:42 - 00000000 ____D C:\WINDOWS\SysWOW64\lt-LT
2015-11-22 22:04 - 2015-07-30 14:42 - 00000000 ____D C:\WINDOWS\SysWOW64\et-EE
2015-11-22 22:04 - 2015-07-30 14:42 - 00000000 ____D C:\WINDOWS\SysWOW64\en-GB
2015-11-22 22:04 - 2015-07-30 14:42 - 00000000 ____D C:\WINDOWS\system32\oobe
2015-11-22 22:04 - 2015-07-30 14:42 - 00000000 ____D C:\WINDOWS\system32\lv-LV
2015-11-22 22:04 - 2015-07-30 14:42 - 00000000 ____D C:\WINDOWS\system32\lt-LT
2015-11-22 22:04 - 2015-07-30 14:42 - 00000000 ____D C:\WINDOWS\system32\InputMethod
2015-11-22 22:04 - 2015-07-30 14:42 - 00000000 ____D C:\WINDOWS\system32\et-EE
2015-11-22 22:04 - 2015-07-30 14:42 - 00000000 ____D C:\WINDOWS\system32\en-GB
2015-11-22 22:04 - 2015-01-06 13:08 - 00000000 ____D C:\WINDOWS\SysWOW64\sda
2015-11-22 22:04 - 2014-12-01 21:43 - 00000000 __SHD C:\WINDOWS\SysWOW64\AI_RecycleBin
2015-11-22 22:04 - 2013-08-22 07:36 - 00000000 ____D C:\WINDOWS\system32\WindowsInternal.Inbox.Shared
2015-11-22 22:04 - 2013-08-22 07:36 - 00000000 ____D C:\WINDOWS\system32\WindowsInternal.Inbox.Media.Shared
2015-11-22 22:02 - 2015-07-30 14:42 - 00000000 ____D C:\WINDOWS\InputMethod
2015-11-22 22:02 - 2015-07-30 14:42 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-11-22 22:02 - 2015-01-06 12:58 - 00000000 ____D C:\Program Files (x86)\AMD AVT
2015-11-22 22:02 - 2014-12-01 21:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TOSHIBA
2015-11-22 22:02 - 2013-08-22 07:36 - 00000000 ____D C:\WINDOWS\MediaViewer
2015-11-22 22:02 - 2013-08-22 07:36 - 00000000 ____D C:\WINDOWS\ADFS
2015-11-22 21:59 - 2015-07-10 01:47 - 00000000 ____D C:\WINDOWS\system32\Sysprep
2015-11-22 21:51 - 2015-07-30 14:42 - 00028672 _____ C:\WINDOWS\system32\config\BCD-Template
2015-11-22 21:46 - 2015-07-30 14:42 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12
2015-11-22 21:46 - 2015-07-30 14:42 - 00000000 ___SD C:\WINDOWS\system32\F12
2015-11-22 21:46 - 2015-07-30 14:42 - 00000000 ___RD C:\WINDOWS\PurchaseDialog
2015-11-22 21:46 - 2015-07-30 14:42 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2015-11-22 21:46 - 2015-07-30 14:42 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2015-11-22 21:46 - 2015-07-30 14:42 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-11-22 21:46 - 2015-07-30 14:42 - 00000000 ____D C:\WINDOWS\Provisioning
2015-11-22 21:46 - 2015-07-30 14:42 - 00000000 ____D C:\WINDOWS\L2Schemas
2015-11-21 21:43 - 2014-12-01 21:24 - 00000000 ____D C:\Program Files (x86)\Toshiba
2015-11-19 22:38 - 2014-12-01 21:24 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-11-19 22:19 - 2014-12-01 21:25 - 00000000 ____D C:\ProgramData\Toshiba
2015-11-19 13:16 - 2015-01-06 13:07 - 00000000 ____D C:\Program Files (x86)\Atheros
2015-11-19 12:45 - 2013-08-22 07:36 - 00000000 ___RD C:\WINDOWS\ToastData
2015-11-18 13:36 - 2014-12-01 21:45 - 00000000 ____D C:\ProgramData\CyberLink
2015-11-18 13:13 - 2015-01-06 12:58 - 00000000 ____D C:\ProgramData\AMD
2015-11-03 10:20 - 2015-07-30 14:43 - 00810488 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-11-03 10:20 - 2015-07-30 14:43 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS
 
\SysWOW64\FlashPlayerCPLApp.cpl
 
==================== Files in the root of some directories =======
 
2015-11-19 10:46 - 2015-11-24 23:27 - 0007599 _____ () C:\Users\User\AppData\Local\Resmon.ResmonCfg
2015-11-22 21:56 - 2015-11-22 21:56 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-12-01 21:44 - 2014-12-01 21:44 - 0000123 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.64.bc
 
Some files in TEMP:
====================
C:\Users\User\AppData\Local\Temp\sqlite3.dll
 
 
==================== Bamital & volsnap =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2015-11-22 21:52
 
==================== End of FRST.txt ============================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version:25-11-2015 01
Ran by User (2015-11-25 23:59:52)
Running from C:\Users\User\Downloads
Windows 10 Home (X64) (2015-11-23 06:26:25)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-3446089022-584940005-864541517-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-3446089022-584940005-864541517-503 - Limited - Disabled)
Guest (S-1-5-21-3446089022-584940005-864541517-501 - Limited - Disabled)
User (S-1-5-21-3446089022-584940005-864541517-1001 - Administrator - Enabled) => C:\Users\User
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Ad-Aware Antivirus (Disabled - Out of date) {B0CC18C6-E527-6EE6-874C-9D19920E5619}
AV: ZoneAlarm Free Firewall Antivirus (Disabled - Up to date) {23B6D20A-C2DE-B3F5-C67D-07ECD854E6A9}
AS: ZoneAlarm Free Firewall Anti-Spyware (Disabled - Up to date) {98D733EE-E4E4-BC7B-FCCD-3C9EA3D3AC14}
AS: Ad-Aware Antivirus (Disabled - Out of date) {0BADF922-C31D-6168-BDFC-A66BE9891CA4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: ZoneAlarm Free Firewall Firewall (Disabled) {1B8D532F-88B1-B2AD-ED22-AED92687A1D2}
FW: Ad-Aware Firewall (Disabled) {88F799E3-AF48-6FBE-AC13-342C6CDD1162}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be 
 
uninstalled manually.)
 
7-Zip 15.11 beta (x64) (HKLM\...\7-Zip) (Version: 15.11 - Igor Pavlov)
Ad-Aware Antivirus (HKLM\...\{30B9595A-D4B5-4198-8F3C-2219C78590C9}_AdAwareUpdater) (Version: 11.9.662.8718 - Lavasoft)
AdAwareInstaller (Version: 11.9.662.8718 - Lavasoft) Hidden
AdAwareUpdater (Version: 11.9.662.8718 - Lavasoft) Hidden
Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.245 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07)  MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems 
 
Incorporated)
AMD Catalyst Install Manager (HKLM\...\{99213849-249E-7726-EBA7-ADFCA48E2246}) (Version: 8.0.916.0 - Advanced Micro 
 
Devices, Inc.)
AntimalwareEngine (Version: 3.0.98.0 - Lavasoft) Hidden
Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Atheros)
Audacity 2.1.1 (HKLM-x32\...\Audacity®_is1) (Version: 2.1.1 - Audacity Team)
ELAN Touchpad 15.8.8.2_X64_WHQL (HKLM\...\Elantech) (Version: 15.8.8.2 - ELAN Microelectronic Corp.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 46.0.2490.86 - Google Inc.)
Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version:  - )
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - 
 
Malwarebytes)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - 
 
Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 
 
9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 
 
9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) 
 
(Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) 
 
(Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) 
 
(Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 
 
10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) 
 
(Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) 
 
(Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) 
 
(Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - 
 
Microsoft Corporation)
OpenOffice 4.1.2 (HKLM-x32\...\{E6AD67BB-1C33-4AB3-A387-E0D48137AB70}) (Version: 4.12.9782 - Apache Software Foundation)
PerformanceTest v8.0 (HKLM\...\PerformanceTest 8_is1) (Version: 8.0.1052.0 - Passmark Software)
PSP Application (Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.29075 - Realtek Semiconductor 
 
Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.24.1218.2013 - 
 
Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7592 - Realtek 
 
Semiconductor Corp.)
REAPER (x64) (HKLM\...\REAPER) (Version:  - )
TOSHIBA Application Installer (HKLM\...\{21A63CA3-75C0-4E56-B602-B7CD2EF6B621}) (Version: 9.0.2.6 - Toshiba Corporation)
TOSHIBA Flash Cards Support Utility (HKLM-x32\...\InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}) (Version: 
 
1.51.81.2C - TOSHIBA CORPORATION)
TOSHIBA Function Key (HKLM\...\{1844CFE2-EBA3-490A-8A5E-9BFC646342FD}) (Version: 1.1.5.6402 - Toshiba Corporation)
TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 3.2.00.56006005 - Toshiba 
 
Corporation)
TOSHIBA Service Station (HKLM\...\{BFE4C813-4DD4-4B1C-97F4-76A459055C8D}) (Version: 2.6.13 - Toshiba Corporation)
TOSHIBA System Driver (HKLM-x32\...\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0033 - Toshiba Corporation)
TOSHIBA System Settings (HKLM-x32\...\{4D57ED72-6B01-40BD-9CA9-012B8FC09CEB}) (Version: 2.0.1.32003 - Toshiba Corporation)
Utility Common Driver (x32 Version: 1.0.53.4 - Compal) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.1 - VideoLAN)
ZoneAlarm Antivirus (x32 Version: 14.1.011.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Firewall (x32 Version: 14.1.011.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Free Firewall (HKLM-x32\...\ZoneAlarm Free Firewall) (Version: 14.1.011.000 - Check Point)
ZoneAlarm Security (x32 Version: 14.1.011.000 - Check Point Software Technologies Ltd.) Hidden
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed 
 
separately.)
 
CustomCLSID: HKU\S-1-5-21-3446089022-584940005-864541517-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-
 
CD5B54EB93FD}\localserver32 -> C:\Users\User\AppData\Local\Microsoft\OneDrive\17.3.6201.1019\FileCoAuth.exe (Microsoft 
 
Corporation)
 
==================== Restore Points =========================
 
ATTENTION: System Restore is disabled
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2013-08-22 05:25 - 2013-08-22 05:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
 
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed 
 
separately.)
 
Task: {05324606-B74B-4579-B73B-AE9FB7F180F6} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== 
 
ATTENTION
Task: {0E6580F6-310A-48FE-8621-E8D6D2E899B2} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {200D4DAB-AE54-44CC-8DC6-6F0AB4CB4D92} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== 
 
ATTENTION
Task: {723AA496-A438-4333-8949-68562DC95021} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google
 
\Update\GoogleUpdate.exe [2015-11-24] (Google Inc.)
Task: {79BAF0E3-932A-499F-A824-3172E1C5AB81} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows
 
\system32\MRT.exe [2015-10-27] (Microsoft Corporation)
Task: {7C91BBC4-1D24-4710-8837-5BE62F9239E4} - System32\Tasks\RTKCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe 
 
[2015-09-15] (Realtek Semiconductor)
Task: {7F63C980-5660-429F-934C-B974E182A271} - System32\Tasks\Microsoft\Windows\SetupSQMTask => C:\WINDOWS\SYSTEM32\OOBE
 
\SETUPSQM.EXE [2015-07-09] (Microsoft Corporation)
Task: {8680B442-A76E-4798-9D23-FF9A89B418B3} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== 
 
ATTENTION
Task: {894BC60A-B906-43EC-BA67-1A813BA5C097} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed
 
\Flash\FlashPlayerUpdateService.exe [2015-11-21] (Adobe Systems Incorporated)
Task: {A3115E8B-996E-41A7-9927-1B73A2BA7F9F} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {A4102C43-5355-405F-A1C6-29AFBD51738C} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {BFC0540B-642E-46F9-A377-F2AAB936DF51} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== 
 
ATTENTION
Task: {C3340E4B-23C9-4BC5-9D6F-58C885435540} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {D0C53FD4-BBEF-476E-BC7F-00574F1180A5} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== 
 
ATTENTION
Task: {DA11C842-0FC4-44B3-A259-03C2E72AB4AB} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {DC4F358A-8ABD-4058-91BC-B003E69BFE60} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files 
 
(x86)\Google\Update\GoogleUpdate.exe [2015-11-24] (Google Inc.)
Task: {EA5186A8-B769-4940-B4AC-D3DAF47A2F24} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== 
 
ATTENTION
Task: {EB565D31-689F-4E57-992B-0D0C9D28428C} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba 
 
Service Station\ToshibaServiceStation.exe [2013-09-24] (TOSHIBA Corporation)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will 
 
not be moved.)
 
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 
==================== Shortcuts =============================
 
(The entries could be listed to be restored or removed.)
 
==================== Loaded Modules (Whitelisted) ==============
 
2015-09-09 21:08 - 2015-09-09 21:08 - 00032768 _____ () C:\WINDOWS\SYSTEM32\licensemanagerapi.dll
2015-09-09 21:08 - 2015-09-09 21:08 - 00404480 _____ () C:\WINDOWS\System32\diagtrack_wininternal.dll
2015-11-19 11:55 - 2015-11-19 11:55 - 00712432 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareService.exe
2015-11-19 11:59 - 2015-11-19 11:59 - 00025856 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\boost_system-vc120-mt-1_57.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 00123656 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\boost_filesystem-vc120-mt-1_57.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 00057096 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\boost_date_time-vc120-mt-1_57.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 11670776 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareServiceKernel.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 03549904 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\RCF.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 00911616 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\boost_regex-vc120-mt-1_57.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 00107776 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\boost_thread-vc120-mt-1_57.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 00035072 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\boost_chrono-vc120-mt-1_57.dll
2015-11-19 11:58 - 2015-11-19 11:58 - 00709360 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareActivation.dll
2015-11-19 11:58 - 2015-11-19 11:58 - 00474368 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareApplicationUpdater.dll
2015-11-19 11:58 - 2015-11-19 11:58 - 00847600 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareGamingMode.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 00101096 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareReset.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 00123104 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareTime.dll
2015-11-19 11:58 - 2015-11-19 11:58 - 01011968 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareDefinitionsUpdater.dll
2015-11-19 11:58 - 2015-11-19 11:58 - 00905488 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareDefinitionsUpdaterScheduler.dll
2015-11-19 11:58 - 2015-11-19 11:58 - 01146608 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareIgnoreList.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 00243440 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareQuarantine.dll
2015-11-19 11:58 - 2015-11-19 11:58 - 01570048 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareAntiMalwareEngine.dll
2015-11-19 11:58 - 2015-11-19 11:58 - 00206080 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareAntiRootkitEngine.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 01210616 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareScannerHistory.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 01373416 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareScanner.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 00036096 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\boost_timer-vc120-mt-1_57.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 01019128 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareScannerScheduler.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 01190656 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareRealTimeProtection.dll
2015-11-19 11:58 - 2015-11-19 11:58 - 02489592 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareIncompatibles.dll
2015-11-19 11:58 - 2015-11-19 11:58 - 01466600 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareAntiSpam.dll
2015-11-19 11:58 - 2015-11-19 11:58 - 01415408 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareAntiPhishing.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 03263736 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareParentalControl.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 02995960 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareWebProtection.dll
2015-11-19 11:58 - 2015-11-19 11:58 - 01325816 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareEmailProtection.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 00059656 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\boost_iostreams-vc120-mt-1_57.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 01856768 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareNetworkProtection.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 01013992 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwarePromo.dll
2015-11-19 11:58 - 2015-11-19 11:58 - 00365288 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareFeedback.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 02958592 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareThreatWorkAlliance.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 01261800 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwarePinCode.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 01014504 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareNotice.dll
2015-11-19 11:58 - 2015-11-19 11:58 - 01541360 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareAvcEngine.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 01222416 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareRealTimeProtectionHistory.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 00469744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareStatistics.dll
2014-04-22 22:48 - 2014-04-22 22:48 - 00140288 _____ () C:\Program Files\ATI Technologies\ATI.ACE
 
\A4\AdaptiveSleepService.exe
2015-11-22 21:44 - 2015-11-22 21:44 - 02494712 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02494712 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2015-11-19 11:59 - 2015-11-19 11:59 - 02794744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus
 
\11.9.662.8718\AdAwareShellExtension.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy
 
\QuickActions.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy
 
\CortanaApi.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy
 
\Cortana.Core.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy
 
\Cortana.BackgroundTask.dll
2015-11-22 21:44 - 2015-11-22 21:44 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy
 
\RemindersUI.dll
2012-07-18 18:38 - 2012-07-18 18:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll
2015-11-24 22:35 - 2015-11-06 20:46 - 01908040 _____ () C:\Program Files (x86)\Google\Chrome\Application
 
\46.0.2490.86\libglesv2.dll
2015-11-24 22:35 - 2015-11-06 20:46 - 00093512 _____ () C:\Program Files (x86)\Google\Chrome\Application
 
\46.0.2490.86\libegl.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 
==================== EXE Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-3446089022-584940005-864541517-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Innovation
 
\Waterfall - West Iceland.jpg
DNS Servers: 75.75.75.75 - 75.75.76.76
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) 
 
(ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
(Currently there is no automatic fix for this section.)
 
HKLM\...\StartupApproved\Run: => "AdAwareTray"
HKU\S-1-5-21-3446089022-584940005-864541517-1001\...\StartupApproved\Run: => "OneDrive"
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed 
 
separately.)
 
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{7903B209-DAC6-4EE5-9681-1B2BEDCF31B1}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{FE03F8B0-EF2D-4883-A82C-DD9D89D3B909}] => (Allow) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
FirewallRules: [{AEB42967-181F-4A7C-80F3-E8CE2F3E9D2F}] => (Allow) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
FirewallRules: [{127735FF-449D-458C-B681-65EBD110970C}] => (Allow) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
FirewallRules: [{1BFF6DCE-F215-4730-9335-E3010DB5EBE3}] => (Allow) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
FirewallRules: [{71560ED7-A557-4D1E-AC74-304EE757DB12}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{80622DC5-D444-473C-9ACA-3DF6945A723D}] => (Allow) C:\Program Files (x86)\Spotify\Data
 
\SpotifyWebHelper.exe
FirewallRules: [{ED3D2C93-5761-4CEB-B826-99485026B7E5}] => (Allow) C:\Program Files (x86)\Spotify\Data
 
\SpotifyWebHelper.exe
FirewallRules: [{E8DA552F-5E4B-4608-98C8-D3F1A303CED2}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe
FirewallRules: [{E09207C6-CA2E-4CA2-9EB8-8AB56DD6E504}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe
FirewallRules: [{31B039D7-D720-4248-884C-CAFAE3C53283}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application
 
\chrome.exe
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (11/25/2015 09:36:20 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Toshiba)
Description: Activation of app 
 
windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy:microsoft.windows.immersivecontrolpanel failed with 
 
error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (11/25/2015 09:21:58 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Toshiba)
Description: Activation of app 
 
Microsoft.Getstarted_2.5.6.0_x64__8wekyb3d8bbwe:App.AppX7mv0s3r0wanj0n66dy6vax24ps6avzvz.mca failed with error: -
 
2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (11/25/2015 09:18:13 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Toshiba)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927141 See the 
 
Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (11/24/2015 11:06:19 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Toshiba)
Description: Application or service 'TOSHIBA eco Utility Service' could not be restarted.
 
Error: (11/24/2015 11:06:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: SystemSettings.exe, version: 10.0.10240.16384, time stamp: 0x559f39ae
Faulting module name: SettingsHandlers_StorageSense.dll, version: 10.0.10240.16384, time stamp: 0x559f3d87
Exception code: 0xc0000005
Fault offset: 0x00000000000174b9
Faulting process id: 0x1aac
Faulting application start time: 0xSystemSettings.exe0
Faulting application path: SystemSettings.exe1
Faulting module path: SystemSettings.exe2
Report Id: SystemSettings.exe3
Faulting package full name: SystemSettings.exe4
Faulting package-relative application ID: SystemSettings.exe5
 
Error: (11/24/2015 11:05:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: TecoService.exe, version: 2.0.0.25, time stamp: 0x536c9af7
Faulting module name: TecoPower.dll, version: 2.0.0.6, time stamp: 0x53475b39
Exception code: 0xc0000005
Fault offset: 0x000000000000ecf5
Faulting process id: 0xa48
Faulting application start time: 0xTecoService.exe0
Faulting application path: TecoService.exe1
Faulting module path: TecoService.exe2
Report Id: TecoService.exe3
Faulting package full name: TecoService.exe4
Faulting package-relative application ID: TecoService.exe5
 
Error: (11/23/2015 09:37:11 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Toshiba)
Description: Activation of app Microsoft.WindowsPhone_8wekyb3d8bbwe!CompanionApp.App failed with error: -2147024770 See 
 
the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (11/23/2015 09:28:16 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Toshiba)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927141 See the 
 
Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (11/23/2015 01:14:09 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Toshiba)
Description: Activation of app Microsoft.Windows.Photos_8wekyb3d8bbwe!App failed with error: -2144927141 See the 
 
Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (11/22/2015 10:52:22 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Toshiba)
Description: Activation of app EnnovaResearch.ToshibaPlaces_3s2an63h56yee!Places.Tapas.UI.Main failed with error: -
 
2147024770 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
 
System errors:
=============
Error: (11/25/2015 11:04:13 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Sync Host_Session1 service terminated unexpectedly.  It has done this 1 time(s).  The following 
 
corrective action will be taken in 10000 milliseconds: Restart the service.
 
Error: (11/25/2015 11:03:38 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Ad-Aware Service 11 service terminated unexpectedly.  It has done this 1 time(s).
 
Error: (11/25/2015 11:03:38 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The MBAMScheduler service terminated unexpectedly.  It has done this 1 time(s).
 
Error: (11/25/2015 11:03:38 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The MBAMService service terminated unexpectedly.  It has done this 1 time(s).
 
Error: (11/25/2015 11:03:38 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The TMachInfo service terminated unexpectedly.  It has done this 1 time(s).
 
Error: (11/25/2015 11:03:37 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Search service terminated unexpectedly.  It has done this 1 time(s).  The following corrective 
 
action will be taken in 30000 milliseconds: Restart the service.
 
Error: (11/25/2015 11:03:37 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Elan Service service terminated unexpectedly.  It has done this 1 time(s).
 
Error: (11/25/2015 11:03:37 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The ZoneAlarm Privacy Service service terminated unexpectedly.  It has done this 1 time(s).  The following 
 
corrective action will be taken in 60000 milliseconds: Restart the service.
 
Error: (11/25/2015 11:03:37 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The AdaptiveSleepService service terminated unexpectedly.  It has done this 1 time(s).
 
Error: (11/25/2015 11:03:37 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Adobe Acrobat Update Service service terminated unexpectedly.  It has done this 1 time(s).
 
 
==================== Memory info =========================== 
 
Processor: AMD A8-6410 APU with AMD Radeon R5 Graphics 
Percentage of memory in use: 57%
Total physical RAM: 3518.88 MB
Available physical RAM: 1506.15 MB
Total Virtual: 4158.88 MB
Available Virtual: 1742.52 MB
 
==================== Drives ================================
 
Drive c: (TI10707800A) (Fixed) (Total:919.44 GB) (Free:862.66 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 00000000)
 
Partition: GPT.
 
==================== End of Addition.txt ============================


BC AdBot (Login to Remove)

 


#2 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 38,149 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:08:35 AM

Posted 27 November 2015 - 04:38 PM

Greetings newlaptop and :welcome: to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

If you would allow me to call you by your first name I would prefer to do that.

===================================================

Ground Rules:
  • First, I would like to inform you that most of us here at Bleeping Computer offer our expert assistance out of the goodness of our hearts. Please try to match our commitment to you with your patience toward us. If this was easy we would never have met.
  • Please do not run any tools or take any steps other than those I will provide for you while we work on your computer together. I need to be certain about the state of your computer in order to provide appropriate and effective steps for you to take. Most often "well intentioned" (and usually panic driven!) independent efforts can make things much worse for both of us. If at any point you would prefer to take your own steps please let me know, I will not be offended. I would be happy to focus on the many others who are waiting in line for assistance.
  • Please perform all steps in the order they are listed in each set of instructions. Some steps may be a bit complicated. If things are not clear, be sure to stop and let me know. We need to work on this together with confidence.
  • Please copy and paste all logs into your post unless directed otherwise. Please do not re-run any programs I suggest. If you encounter problems simply stop and tell me.
  • When you post your reply, use the Replytopic.jpg button instead.
  • In the upper right hand corner of the topic you will see the Followtopic.jpg button. Click on this then choose Immediate E-Mail notification and then Proceed and you will be sent an email once I have posted a response.
  • If you do not reply to your topic after 5 days we assume it has been abandoned and I will close it.
  • When your computer is clean I will alert you of such. I will also provide for you detailed information about how you can combat future infections.
  • I would like to remind you to make no further changes to your computer unless I direct you to do so.
  • Now let's get started
===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and post that information so that I know you are still with me. Unfortunately, there are many people waiting to be assisted and not enough of us at BleepingComputer to go around. I appreciate your understanding and diligence.

Thank you for your patience thus far. Please do this.

===================================================

Multiple Antivirus Programs

-------------------

I do not recommend that you have more than one anti virus product installed on your computer at a time. The reason for this is that if both products have their automatic (Real-Time) protection switched on, then those products which do not encrypt the virus strings within them can cause other anti virus products to cause "false alarms". It can also lead to a clash as both products fight for access to files which are opened again this is the resident/automatic protection. In general terms, the two programs may conflict and cause:
  • False Alarms: When the anti virus software tells you that your PC has a virus when it actually doesn't.
  • System Performance Problems: Your system may lock up due to both products attempting to access the same file at the same time.
Therefore please remove all but one of the Antivirus programs currently on your computer, even if only one is running. You can do this via Add/Remove Programs, or Programs and Features in the Control Panel.
 

Ad-Aware Antivirus
oneAlarm Free Firewall Antivirus


===================================================

Farbar's Recovery Scan Tool - Run Fix in Normal or Safe Mode

--------------------
  • Press the Windows key Windows_Logo_key.gif + r on your keyboard at the same time. Type in notepad and press Enter
  • Please copy and paste the contents of the below code box into the open notepad and save it to your desktop (<<<Important) as fixlist.txt
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
SearchScopes: HKU\S-1-5-21-3446089022-584940005-864541517-1001 -> {0BE19D86-99C3-47DD-9CEA-1D060D10880C} URL = 
SearchScopes: HKU\S-1-5-21-3446089022-584940005-864541517-1001 -> {398AD872-7519-4BD2-A47C-04BE792C1CE1} URL = 
S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]
2015-11-18 13:59 - 2015-11-19 13:00 - 00000000 __SHD C:\Users\User\AppData\LocalLow\EmieUserList
2015-11-18 13:59 - 2015-11-19 13:00 - 00000000 __SHD C:\Users\User\AppData\LocalLow\EmieSiteList
2015-11-18 13:59 - 2015-11-19 13:00 - 00000000 __SHD C:\Users\User\AppData\Local\EmieUserList
2015-11-18 13:59 - 2015-11-19 13:00 - 00000000 __SHD C:\Users\User\AppData\Local\EmieSiteList
Task: {05324606-B74B-4579-B73B-AE9FB7F180F6} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent
Task: {0E6580F6-310A-48FE-8621-E8D6D2E899B2} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d
Task: {200D4DAB-AE54-44CC-8DC6-6F0AB4CB4D92} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d
Task: {8680B442-A76E-4798-9D23-FF9A89B418B3} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d
Task: {A3115E8B-996E-41A7-9927-1B73A2BA7F9F} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d
Task: {A4102C43-5355-405F-A1C6-29AFBD51738C} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent
Task: {BFC0540B-642E-46F9-A377-F2AAB936DF51} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B
Task: {C3340E4B-23C9-4BC5-9D6F-58C885435540} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig
Task: {D0C53FD4-BBEF-476E-BC7F-00574F1180A5} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d
Task: {DA11C842-0FC4-44B3-A259-03C2E72AB4AB} - \Microsoft\Windows\Setup\gwx\launchtrayprocess
ask: {EA5186A8-B769-4940-B4AC-D3DAF47A2F24} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd
  • Launch FRST and press the Fix button just once and wait, the program will automatically launch fixlist.txt.
  • The tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
===================================================

Zoek by Smeenk

--------------------
  • Download Zoek and save it to your Desktop
  • Right click the icon, select Run as Admistrator, and wait for the Program to appear on your Desktop (may take 15 seconds or so)
  • Copy and paste the following into the main box

createsrpoint;
autoclean;

  • Verify Scan All Users is selected then click Run Script
  • Do not use your computer while the scan is running
  • Copy and paste C:\zoek-results.txt in your reply
===================================================

RogueKiller by Tigzy

--------------------
  • Download RogueKiller and save it to your desktop
  • Close all running programs
  • Right click on the icon and select Run as Administrator
  • For Windows XP simply double click on the icon
  • The program will conduct a prescan and when finished you wlll see Prescan Finished. Please hit the scan button
  • Click Scan
  • If, during the scan, you receive a request to upload a file to Virustotal please click Yes
  • A report should open and a copy of the report will be placed on your desktop. If not, hit the Report button.
  • If RogueKiller has been blocked, do not hesitate to try a few times more. If it really won't run, rename it winlogon.exe (or winlogon.com) and try again
  • Copy and paste the contents of the report in your reply
===================================================

System Summary Information

--------------------
  • Press the windows key Windows_Logo_key.gif + r on your keyboard at the same time
  • Type msinfo32 and press Enter
  • Left click on System Summary
  • Click File, Save, and name the file Summary
  • Zip and attach the file to your reply
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Fixlog
  • Zoek log
  • RogueKiller log
  • System Summary Information
  • Update on computer performance

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#3 newlaptop

newlaptop
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:35 AM

Posted 27 November 2015 - 05:47 PM

Thank you for taking the case :) My name is Jer. I will do my best to follow the instructions quickly and keep you informed of the status.

 

I removed all the antivirus except malwarebytes and ran the fixlist.txt

 

I am preparing to run zoek and rogue today

 

Fix result of Farbar Recovery Scan Tool (x64) Version:25-11-2015 01
Ran by User (2015-11-27 14:36:52) Run:1
Running from C:\Users\User\Downloads
Loaded Profiles: User (Available Profiles: User)
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
SearchScopes: HKU\S-1-5-21-3446089022-584940005-864541517-1001 -> {0BE19D86-99C3-47DD-9CEA-1D060D10880C} URL = 
SearchScopes: HKU\S-1-5-21-3446089022-584940005-864541517-1001 -> {398AD872-7519-4BD2-A47C-04BE792C1CE1} URL = 
S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]
2015-11-18 13:59 - 2015-11-19 13:00 - 00000000 __SHD C:\Users\User\AppData\LocalLow\EmieUserList
2015-11-18 13:59 - 2015-11-19 13:00 - 00000000 __SHD C:\Users\User\AppData\LocalLow\EmieSiteList
2015-11-18 13:59 - 2015-11-19 13:00 - 00000000 __SHD C:\Users\User\AppData\Local\EmieUserList
2015-11-18 13:59 - 2015-11-19 13:00 - 00000000 __SHD C:\Users\User\AppData\Local\EmieSiteList
Task: {05324606-B74B-4579-B73B-AE9FB7F180F6} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent
Task: {0E6580F6-310A-48FE-8621-E8D6D2E899B2} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d
Task: {200D4DAB-AE54-44CC-8DC6-6F0AB4CB4D92} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d
Task: {8680B442-A76E-4798-9D23-FF9A89B418B3} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d
Task: {A3115E8B-996E-41A7-9927-1B73A2BA7F9F} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d
Task: {A4102C43-5355-405F-A1C6-29AFBD51738C} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent
Task: {BFC0540B-642E-46F9-A377-F2AAB936DF51} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B
Task: {C3340E4B-23C9-4BC5-9D6F-58C885435540} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig
Task: {D0C53FD4-BBEF-476E-BC7F-00574F1180A5} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d
Task: {DA11C842-0FC4-44B3-A259-03C2E72AB4AB} - \Microsoft\Windows\Setup\gwx\launchtrayprocess
ask: {EA5186A8-B769-4940-B4AC-D3DAF47A2F24} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd
*****************
 
HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Local Page => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Local Page => value restored successfully
HKU\S-1-5-21-3446089022-584940005-864541517-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0BE19D86-99C3-47DD-9CEA-1D060D10880C} => key not found. 
HKCR\CLSID\{0BE19D86-99C3-47DD-9CEA-1D060D10880C} => key not found. 
"HKU\S-1-5-21-3446089022-584940005-864541517-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{398AD872-7519-4BD2-A47C-04BE792C1CE1}" => key removed successfully
HKCR\CLSID\{398AD872-7519-4BD2-A47C-04BE792C1CE1} => key not found. 
wfpcapture => service removed successfully
C:\Users\User\AppData\LocalLow\EmieUserList => moved successfully
C:\Users\User\AppData\LocalLow\EmieSiteList => moved successfully
C:\Users\User\AppData\Local\EmieUserList => moved successfully
C:\Users\User\AppData\Local\EmieSiteList => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{05324606-B74B-4579-B73B-AE9FB7F180F6}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{05324606-B74B-4579-B73B-AE9FB7F180F6}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{0E6580F6-310A-48FE-8621-E8D6D2E899B2}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0E6580F6-310A-48FE-8621-E8D6D2E899B2}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{200D4DAB-AE54-44CC-8DC6-6F0AB4CB4D92}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{200D4DAB-AE54-44CC-8DC6-6F0AB4CB4D92}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8680B442-A76E-4798-9D23-FF9A89B418B3}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8680B442-A76E-4798-9D23-FF9A89B418B3}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A3115E8B-996E-41A7-9927-1B73A2BA7F9F}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A3115E8B-996E-41A7-9927-1B73A2BA7F9F}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A4102C43-5355-405F-A1C6-29AFBD51738C}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A4102C43-5355-405F-A1C6-29AFBD51738C}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BFC0540B-642E-46F9-A377-F2AAB936DF51}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BFC0540B-642E-46F9-A377-F2AAB936DF51}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C3340E4B-23C9-4BC5-9D6F-58C885435540}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C3340E4B-23C9-4BC5-9D6F-58C885435540}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D0C53FD4-BBEF-476E-BC7F-00574F1180A5}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D0C53FD4-BBEF-476E-BC7F-00574F1180A5}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{DA11C842-0FC4-44B3-A259-03C2E72AB4AB}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DA11C842-0FC4-44B3-A259-03C2E72AB4AB}" => key removed successfully
ask: {EA5186A8-B769-4940-B4AC-D3DAF47A2F24} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd => Error: No automatic fix found for this entry.
 
==== End of Fixlog 14:36:53 ====


#4 newlaptop

newlaptop
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:35 AM

Posted 27 November 2015 - 07:04 PM

Alright Gary, Here's the rest of the info. 
 
 
Zoek.exe v5.0.0.1 Updated 26-November-2015
Tool run by User on Fri 11/27/2015 at 14:54:57.40.
Microsoft Windows 10 Home 10.0.10240  x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\User\Downloads\zoek.exe [Scan all users] [Script inserted] 
 
==== System Restore Info ======================
 
11/27/2015 2:56:07 PM Zoek.exe System Restore Point Created Successfully.
 
==== Empty Folders Check ======================
 
C:\PROGRA~3\Comms deleted successfully
C:\PROGRA~3\Malwarebytes' Anti-Malware (portable) deleted successfully
C:\PROGRA~3\SoftwareDistribution deleted successfully
C:\Users\User\AppData\Local\Adobe deleted successfully
 
==== Deleting CLSID Registry Keys ======================
 
HKEY_USERS\S-1-5-21-3446089022-584940005-864541517-1001\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6} deleted successfully
 
==== Deleting CLSID Registry Values ======================
 
 
==== Deleting Services ======================
 
 
==== Deleting Files \ Folders ======================
 
C:\PROGRA~3\Malwarebytes' Anti-Malware (portable) not found
C:\PROGRA~3\Package Cache deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted
C:\WINDOWS\SysWow64\AI_RecycleBin deleted
 
==== Chromium Look ======================
 
Google Chrome Version: 46.0.2490.86
 
 
 
==== Set IE to Default ======================
 
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://google.com/"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{398AD872-7519-4BD2-A47C-04BE792C1CE1}"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{398AD872-7519-4BD2-A47C-04BE792C1CE1}] not found
 
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://google.com/"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"
 
==== All HKLM and HKCU SearchScopes ======================
 
HKLM\SearchScopes "DefaultScope"="{0BE19D86-99C3-47DD-9CEA-1D060D10880C}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKLM\SearchScopes\{0BE19D86-99C3-47DD-9CEA-1D060D10880C} - http://www.bing.com/search?q={searchTerms}&form=IE11TR&src=IE11TR&pc=TNJB
HKLM\Wow6432Node\SearchScopes "DefaultScope"="{0BE19D86-99C3-47DD-9CEA-1D060D10880C}"
HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKLM\Wow6432Node\SearchScopes\{0BE19D86-99C3-47DD-9CEA-1D060D10880C} - http://www.bing.com/search?q={searchTerms}&form=IE11TR&src=IE11TR&pc=TNJB
HKCU\SearchScopes "DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
 
==== Empty IE Cache ======================
 
C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\User\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\User\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
 
==== Empty FireFox Cache ======================
 
No FireFox Profiles found
 
==== Empty Chrome Cache ======================
 
C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Cache will be emptied at reboot
 
==== Empty All Flash Cache ======================
 
No Flash Cache Found
 
==== Empty All Java Cache ======================
 
No Java Cache Found
 
==== C:\zoek_backup content ======================
 
C:\zoek_backup (files=13 folders=21 14104653 bytes)
 
==== Empty Temp Folders ======================
 
C:\WINDOWS\Temp will be emptied at reboot
 
==== After Reboot ======================
 
==== Empty Temp Folders ======================
 
C:\WINDOWS\Temp successfully emptied
C:\Users\User\AppData\Local\Temp successfully emptied
 
==== Empty Recycle Bin ======================
 
C:\$RECYCLE.BIN successfully emptied
 
==== Deleting Files / Folders ======================
 
"C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0" deleted
"C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1" deleted
"C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2" deleted
"C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3" deleted
"C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Cache\index" deleted
 
==== EOF on Fri 11/27/2015 at 15:28:23.60 ======================
 
RogueKiller V10.11.7.0 [Nov 23 2015] (Free) by Adlice Software
 
Operating System : Windows 10 (10.0.10240) 64 bits version
Started in : Normal mode
User : User [Administrator]
Started from : C:\Users\User\Downloads\RogueKiller.exe
Mode : Scan -- Date : 11/27/2015 15:46:46
 
¤¤¤ Processes : 0 ¤¤¤
 
¤¤¤ Registry : 2 ¤¤¤
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-3446089022-584940005-864541517-1001\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://toshiba13.msn.com/?pc=TNJB  -> Found
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-3446089022-584940005-864541517-1001\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://toshiba13.msn.com/?pc=TNJB  -> Found
 
¤¤¤ Tasks : 0 ¤¤¤
 
¤¤¤ Files : 0 ¤¤¤
 
¤¤¤ Hosts File : 0 ¤¤¤
 
¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000036b]) ¤¤¤
 
¤¤¤ Web browsers : 0 ¤¤¤
 
¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0:  +++++
--- User ---
[MBR] a84dd93b5b19931ceaddbccc47850486
[BSP] df4f83c1f72e36823a12b0dfc7617313 : Empty MBR Code
Partition table:
0 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 2048 | Size: 1024 MB
1 - [MAN-MOUNT] Basic data partition | Offset (sectors): 2099200 | Size: 100 MB
2 - [MAN-MOUNT] Basic data partition | Offset (sectors): 2304000 | Size: 128 MB
3 - Basic data partition | Offset (sectors): 2566144 | Size: 941504 MB
4 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 1930768384 | Size: 480 MB
5 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 1931751424 | Size: 10631 MB
User = LL1 ... OK
User = LL2 ... OK
 
 

Attached Files



#5 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 38,149 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:08:35 AM

Posted 27 November 2015 - 07:26 PM

How is your computer running now?


Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#6 newlaptop

newlaptop
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:35 AM

Posted 27 November 2015 - 09:05 PM

It appears to be working normally. what do you think it was? could it have spread to my usb flash / sd cards? and can you recommend free/inexpensive antivirus?


Edited by newlaptop, 27 November 2015 - 09:08 PM.


#7 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 38,149 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:08:35 AM

Posted 27 November 2015 - 09:21 PM

There were numerous things deleted and the malware could have been hiding in one of several places. I don't think it spread but we can check your other storage devices in a bit. We are not quite done with your main computer. Please do these things.

===================================================

ESET Online Scanner

--------------------

I'd like us to scan your machine with ESET OnlineScan This process may may take several hours, that is normal.
  • Hold down Control and click on this link to open ESET OnlineScan in a new window.
  • Click Run ESET Online Scanner.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the icon on your desktop.
  • Check YES, I accept the Terms of Use.
  • Click the Start button.
  • Click Enable detection of potentially unwanted applications
  • Accept any security warnings from your browser.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, click List Threats
  • Copy and paste the information in your next reply. Note: If no malware was found you will not get a log.
  • Click the Back button.
  • Check Uninstall application on close and Delete quarantined files
  • Click the Finish button.
  • Close the ESET window and reboot your computer
===================================================

screen317's Security Check

--------------------
  • Please download screen317's Security Check to your desktop
  • Double-click icon to launch the program
  • Click OK
  • Select Run Note: If you receive an error message saying UNSUPPORTED OPERATING SYSTEM! ABORTED! reboot your computer and attempt to run it again
  • Allow the program to run
  • A Notepad document will open on your desktop. Please copy and paste the contents in your reply
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • ESET log
  • Security Check log

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#8 newlaptop

newlaptop
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:35 AM

Posted 28 November 2015 - 01:45 AM

No log from eset no malware found

 

 Results of screen317's Security Check version 1.009  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
 Windows Firewall Enabled!  
Windows Defender   
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 Adobe Flash Player 19.0.0.245  
 Adobe Reader XI  
 Google Chrome (46.0.2490.86) 
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 Malwarebytes Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log`````````````````````` 


#9 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 38,149 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:08:35 AM

Posted 28 November 2015 - 11:01 AM

That looks great. If you want to check your other storage devices you can do this. Ignore the downloading instructions of the below that don't apply and just go after the scanning part.

===================================================

Malwarebytes Anti-Malware Free and Malwarebytes Chameleon Including External Drive

----------
  • Download Malwarebytes Anti-Malware Free and save it to your desktop
  • Double click the desktop icon, click Run, then OK
  • Click Next
  • Select I accept the agreement then continue to click Next then finally click Install
  • Uncheck Enable free trial of Malwarebytes Anti-Malware Premium if you do not want the free trial of the paid version, then click Finish
  • If you are notified the Database is out of date click Update Now
  • Attach any external drives you want to scan if not already attached
  • Click the Scan button near the top
  • Select Custom Scan then click Scan Now >>
  • Place a check mark in any additonal drives you would like to scan
  • Click Start Scan
----------
Note:
  • If Malwarebytes will not launch please do the following to launch Malwarebytes Chameleon:
  • Using Windows Explorer navigate to C:\Program Files (x86)\Malwarebytes Anti-Malware\Chameleon\Windows
  • Double click one of the four following files (if one does not work try the next one, and so on) - Follow those instructions until the Malwarebytes program starts the scan

mbam-chameleon.scr
mbam-chameleon
mbam-chameleon.exe
mbam-chameleon.com

----------
  • When completed click the down arrow on Export Log and select Text file (*.txt)
  • Save the file to your desktop as MBAM
  • Click Apply Actions then restart your computer if requested
  • Copy and past the contents of MBAM.txt in your reply
===================================================

ESET Online Scanner Including External Device

--------------------

I'd like us to scan your machine with ESET OnlineScan Including External Device This process may may take several hours, that is normal
  • Attach your external device
  • Hold down Control and click on this link to open ESET OnlineScan in a new window.
  • Click Run ESET Online Scanner.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the icon on your desktop.
  • Check YES, I accept the Terms of Use.
  • Click the Start button.
  • Click Enable detection of potentially unwanted applications
  • Accept any security warnings from your browser.
  • Under scan settings, check "Scan Archives" and "Remove found threats"
  • Click Advanced settings and select the following:
    • Remove found threats
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth technology
    • In the Current scan targets line click Change...
    • Place an additional check mark next to any attached external drives
    • Click OK, then Start
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, click List Threats
  • Copy and paste the information in your next reply. Note: If no malware was found you will not get a log.
  • Click the Back button.
  • Click the Finish button.
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste the information rather than send an attachment. :thumbsup2:
  • MBAM results
  • ESET results

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#10 newlaptop

newlaptop
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:35 AM

Posted 28 November 2015 - 11:55 AM

Everything scanned clean. Thank you for all your help



#11 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 38,149 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:08:35 AM

Posted 28 November 2015 - 12:11 PM

You are quite welcome. Glad to hear everything is clean.

Now that your computer is running well it is my great pleasure to proclaim to you the Good News!

===================================================

All Clean!

--------------

Your machine appears to be clean and you may delete any programs or logs on your computer as a result of our efforts. If we used Emsisoft Emergency Kit just delete the icon on your desktop and the C:\EEK folder. For everything else you simply delete the log files or desktop icons.

Please take the time to read below on how to secure the machine and take the necessary steps to keep it clean :thumbsup:

Lawrence Abrams, the founder of BleepingComputer.com, has developed an excellent tutorial which will provide you with the information you need to know to keep your computer secure and clean. Please take the time to read:In addition, here are some more links you might find of interest:I will leave this topic open for just a brief period of time in case you have any further issues then it will be closed shortly thereafter.

Thank you for placing your trust in BleepingComputer. It was a pleasure serving you. OhMy_done.gif
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#12 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 38,149 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:08:35 AM

Posted 30 November 2015 - 05:04 PM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users