Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

I think im infected by a bootkit


  • This topic is locked This topic is locked
14 replies to this topic

#1 superyui

superyui

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:01:54 PM

Posted 09 December 2015 - 05:58 AM

Hello, i attached my frst logs, so here is the problem that i'm facing, my computer has been extremely slow and the memory and cpu usages are not normal, my ram is 12gb and for example i could have nothing opened but still be using 40% of it.

 

Also, i have tried malwarebytes, combofix, ccleaner, hitman pro, adwcleaner and i think that's it.

 

Malwarebytes finds the malware which is at c//pcre.exe and deletes it but it keeps coming back, and also, it wont let me boot up into safe mode or sm with networking.

 

I even tried putting in a usb hitman pro on a clean computer to use it to boot up on this laptop but still, didn't even opened, it loaded up windows as normal.

 

Also, a lot of my files say "This program has been manipulated and maybe it's infected by virus or its cracked".

 

Also, since this started happening, my second partition shows an error while im booting up pc, but i still can use it as normal

 

And i think that's pretty much all the details that i can give, i will be really thankful if anyone can help me.

Attached Files



BC AdBot (Login to Remove)

 


#2 Jo*

Jo*

  • Malware Response Team
  • 3,445 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:09:54 PM

Posted 09 December 2015 - 06:36 AM

:welcome:

Hello superyui,

my name is Jo and I will help you with your computer problems.


Please follow these guidelines:
  • Logs can take a while to research, so please be patient.
  • Read and follow the instructions in the sequence they are posted.
  • print or copy & save instructions.
  • back up all your private data / important files on another (external) drive before using our tools.
  • Do not install / uninstall any applications, unless otherwise instructed.
  • Use only that tools you have been instructed to use.
  • Copy and Paste the log files inside your post, unless otherwise instructed.
  • Ask for clarification, if you have any questions.
  • Stay with this topic til you get the all clean post.
  • My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

***


Download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
    Vista / Windows 7/8 users right-click and select Run As Administrator.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

***


Did you set those FF proxy values:

FireFox:
========
FF ProfilePath: C:\Users\Jorge\AppData\Roaming\Mozilla\Firefox\Profiles\qu3tz7k2.default-1441595658464
FF NetworkProxy: "backup.ftp", ""
FF NetworkProxy: "backup.ftp_port", 0
FF NetworkProxy: "backup.socks", "92.36.161.7"
FF NetworkProxy: "backup.socks_port", 19940
FF NetworkProxy: "backup.ssl", ""
FF NetworkProxy: "backup.ssl_port", 0
FF NetworkProxy: "ftp", "203.156.126.38"
FF NetworkProxy: "ftp_port", 8080
FF NetworkProxy: "http", "203.156.126.38"
FF NetworkProxy: "http_port", 8080
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "203.156.126.38"
FF NetworkProxy: "socks_port", 8080
FF NetworkProxy: "ssl", "203.156.126.38"
FF NetworkProxy: "ssl_port", 8080
FF NetworkProxy: "type", 0

Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.


#3 superyui

superyui
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:01:54 PM

Posted 09 December 2015 - 02:04 PM

Hey Jo!!! Thanks a lot for helping me it's really urgent, here are the logs.

 

 Results of screen317's Security Check version 1.013 --- 11/28/15  
 Windows 7 Service Pack 1 x64 (UAC is disabled!)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:``````````````
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 Java 8 Update 60  
 Java version 32-bit out of Date!
 Adobe Flash Player 20.0.0.235  
 Adobe Reader XI  
 Google Chrome (46.0.2490.86)
 Google Chrome (47.0.2526.73)
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 Malwarebytes Anti-Malware mbamscheduler.exe   
 Symantec Norton Online Backup NOBuAgent.exe  
 Kaspersky Lab Kaspersky Security Scan kss.exe  
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 5%
````````````````````End of Log``````````````````````
 

 

And yes i set those in the past but not using them.



#4 Jo*

Jo*

  • Malware Response Team
  • 3,445 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:09:54 PM

Posted 09 December 2015 - 02:29 PM

Hello superyui,

IP address: 92.36.161.7
Server Location:
Sarajevo, Federation of Bosnia and Herzegovina in Bosnia and Herzegovina

IP address: 203.156.126.38
Server Location:
Bangkok, Krung Thep in Thailand

Are you sure this is what you want to have as Firefox proxy?


Please download Malwarebytes Anti-Rootkit and save it to your desktop.
  • Be sure to print out and follow the instructions provided on that same page.
  • Caution: This is a beta version so please be sure to read the disclaimer and back up all your data before using.
  • Scan your system for malware
With some infections, you may see two messages boxes.
  • 'Could not load protection driver'. Click 'OK'.
  • 'Could not load DDA driver'. Click 'Yes' to this message, to allow the driver to load after a restart. Allow the computer to restart. Continue with the rest of these instructions.
  • If malware is found - do not press the Clean up button, please go to the MBAR folder and then copy/paste the contents of the MBAR-log-***.txt file to your next reply.
  • If there is no malware found, please let me know as well.

***


Please download AdwCleaner by Xplode and save to your Desktop.
Double-click AdwCleaner.exe
Vista / Windows 7/8 users right-click and select Run As Administrator.
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
    When the scan has finished, the actual line should say "Pending. Please uncheck elements you do not want to remove" => scan is complete.
  • After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it.
    If you see an entry you want to keep, let me know about it.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

***


Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.


#5 superyui

superyui
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:01:54 PM

Posted 09 December 2015 - 03:17 PM

Here is the mbar log:

 

Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org

Database version:
  main:    v2015.12.09.05
  rootkit: v2015.12.07.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.18124
Jorge :: JORGE-MSI [administrator]

09/12/2015 01:39:30 p.m.
mbar-log-2015-12-09 (13-39-30).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 460598
Time elapsed: 31 minute(s), 16 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\pcre.exe (Trojan.MalPack.Gen) -> No action taken. [a5647f24a1ea0f27e2321e22da27728e]

Physical Sectors Detected: 0
(No malicious items detected)

(end)
 

and the adw cleaner log: # AdwCleaner v5.024 - Registro generado 09/12/2015 en 14:14:29
# Actualizado 07/12/2015 por Xplode
# Base de datos : 2015-12-07.3 [Servidor]
# Sistema operativo : Windows 7 Home Premium Service Pack 1 (x64)
# Nombre de usuario : Jorge - JORGE-MSI
# Ejecutado desde : C:\Users\Jorge\Desktop\adwcleaner_5.024.exe
# Opción : Escanear
# Apoyo : http://toolslib.net/forum

***** [ Servicios ] *****


***** [ Carpetas ] *****


***** [ Archivos ] *****


***** [ DLL ] *****


***** [ Accesos directos ] *****


***** [ Tareas programadas ] *****


***** [ Registro ] *****


***** [ Navegadores Web ] *****

[C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Encontrar : openvpn.softonic.com

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [761 bytes] ##########
 

 

The adw doesn't shows now anything else because i ran it some days ago.



#6 Jo*

Jo*

  • Malware Response Team
  • 3,445 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:09:54 PM

Posted 09 December 2015 - 03:26 PM

Hello superyui,

Run Malwarebytes Anti-Rootkit again: Right-click mbar.exe and select Run As Administrator
  • Scan your system for malware
  • If malware is found, click on the Cleanup button to remove any threats and reboot if prompted to do so.
  • Wait while the system shuts down and the cleanup process is performed.
  • then please go to the MBAR folder and then copy/paste the contents of the MBAR-log-***.txt file to your next reply.
  • If there is no malware found, please let me know as well.


    ***


    Please download Junkware Removal Tool from HERE and save it to your desktop.
    Shutdown your antivirus to avoid any potential conflicts.
    Double click JRT.exe to run the tool.
    Vista / Windows 7/8 users right-click and select
Run As Administrator.
  • JRT will begin to backup your registry and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, the log JRT.txt is saved on your desktop and will automatically open.
Enable your antivirus!
Post the contents of JRT.txt into your next reply.


***


Run the Farbar Recovery Scan Tool again.
  • Double-click to run FSRT / FSRT64. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.

***


How the computer is running now?


***


Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.


#7 superyui

superyui
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:01:54 PM

Posted 09 December 2015 - 04:23 PM

Alright i did all that i will leave the logs down below, my computer is infected still, malwarebytes removed the file pcre.exe but it came back when rebooted, and many programs seem infected since notifications like this: https://gyazo.com/f5e70f03535041d5e13845daa3c94203 keep coming up.

 

Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org

Database version:
  main:    v2015.12.09.05
  rootkit: v2015.12.07.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.18124
Jorge :: JORGE-MSI [administrator]

09/12/2015 02:28:21 p.m.
mbar-log-2015-12-09 (14-28-21).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 460629
Time elapsed: 32 minute(s), 16 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\pcre.exe (Trojan.MalPack.Gen) -> Delete on reboot. [03063f643e4dda5c7b998cb441c0de22]

Physical Sectors Detected: 0
(No malicious items detected)

(end)
 

 

 

.----------------------------------

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.1 (11.24.2015)
Operating System: Windows 7 Home Premium x64
Ran by Jorge (Administrator) on 09/12/2015 at 15:09:59.57
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 1

Successfully deleted: C:\Users\Jorge\AppData\Local\crashrpt (Folder)



Registry: 1

Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} (Registry Key)




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 09/12/2015 at 15:15:25.43
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

-------------------------------------------------

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-12-2015
Ran by Jorge (administrator) on JORGE-MSI (09-12-2015 15:17:35)
Running from C:\Users\Jorge\Desktop
Loaded Profiles: Jorge (Available Profiles: Jorge)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: Español (España, internacional)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
() C:\Program Files\Autodesk\3ds Max 2014\NVIDIA\Satellite\raysat_3dsmax2014_64server.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\S-Bar\MSIService.exe
(MSI) C:\Program Files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe
(MSI) C:\Program Files (x86)\MSI\Super-Charger\ChargeService.exe
(Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files\Qualcomm Atheros\Killer Network Manager\BFNService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Popcorn Time) C:\Program Files (x86)\Popcorn Time\Updater.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel® Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [THXCfg64] => C:\windows\system32\RunDLL32.exe C:\windows\system32\THXCfg64.dll,RunDLLEntry THXCfg64
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2655520 2015-11-05] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\windows\system32\rundll32.exe C:\windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [14021336 2015-06-18] (Realtek Semiconductor)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-04] (Intel Corporation)
HKLM-x32\...\Run: [THX Audio Control Panel] => C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe [1517056 2011-08-29] (Creative Technology Ltd)
HKLM-x32\...\Run: [UpdReg] => C:\windows\UpdReg.EXE
HKLM-x32\...\Run: [VGAOCAP] => C:\Program Files (x86)\MSI\MSI VGA Overclock Tool\VGAOCAP.exe [88576 2012-01-31] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [597552 2015-08-04] (Oracle Corporation)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [5565448 2015-11-12] (LogMeIn Inc.)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3234211791-2759061018-4055047508-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8322328 2015-11-15] (Piriform Ltd)
HKU\S-1-5-21-3234211791-2759061018-4055047508-1001\...\Run: [Dropbox Update] => C:\Users\Jorge\AppData\Local\Dropbox\Update\DropboxUpdate.exe [1252720 2015-06-28] (Dropbox, Inc.)
HKU\S-1-5-21-3234211791-2759061018-4055047508-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [50509440 2015-11-30] (Skype Technologies S.A.)
HKU\S-1-5-18\...\Run: [KSS] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe [919296 2015-06-03] (Kaspersky Lab ZAO)
AppInit_DLLs: C:\windows\system32\nvinitx.dll => C:\windows\system32\nvinitx.dll [177600 2015-11-05] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\windows\SysWOW64\nvinit.dll => C:\windows\SysWOW64\nvinit.dll [155792 2015-11-05] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Qualcomm Atheros Killer Network Manager.lnk [2012-04-25]
ShortcutTarget: Qualcomm Atheros Killer Network Manager.lnk -> C:\Program Files\Qualcomm Atheros\Killer Network Manager\KillerNetManager.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk [2014-09-09]
ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files (x86)\RALINK\Common\RaUI.exe (Ralink Technology, Corp.)
Startup: C:\Users\Jorge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-10-16]
ShortcutTarget: Dropbox.lnk -> C:\Users\Jorge\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Jorge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2015-08-18]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Startup: C:\Users\Jorge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk [2013-06-10]
ShortcutTarget: MagicDisc.lnk -> C:\Program Files (x86)\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
Startup: C:\Users\Jorge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Psi.lnk [2013-07-04]
ShortcutTarget: Psi.lnk -> C:\Program Files (x86)\Psi\Psi.exe ()
AlternateShell:
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{9B0B69A7-F7F0-4A5B-A2AC-D259FC9C6B09}: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{B603761B-71FB-42E4-81DF-D036DEBB8F21}: [DhcpNameServer] 192.168.1.254

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-3234211791-2759061018-4055047508-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3234211791-2759061018-4055047508-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {C7253179-90B7-45E8-8A16-58B517C9EB40} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSITDF&pc=MAM3&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {C7253179-90B7-45E8-8A16-58B517C9EB40} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSITDF&pc=MAM3&src=IE-SearchBox
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar_x64.dll [2015-10-12] (LastPass)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\ssv.dll [2015-09-03] (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-07-01] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar.dll [2015-10-12] (LastPass)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\jp2ssv.dll [2015-09-03] (Oracle Corporation)
Toolbar: HKLM - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll [2015-10-12] (LastPass)
Toolbar: HKLM-x32 - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll [2015-10-12] (LastPass)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\Jorge\AppData\Roaming\Mozilla\Firefox\Profiles\qu3tz7k2.default-1441595658464
FF NetworkProxy: "backup.ftp", ""
FF NetworkProxy: "backup.ftp_port", 0
FF NetworkProxy: "backup.socks", "92.36.161.7"
FF NetworkProxy: "backup.socks_port", 19940
FF NetworkProxy: "backup.ssl", ""
FF NetworkProxy: "backup.ssl_port", 0
FF NetworkProxy: "ftp", "203.156.126.38"
FF NetworkProxy: "ftp_port", 8080
FF NetworkProxy: "http", "203.156.126.38"
FF NetworkProxy: "http_port", 8080
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "203.156.126.38"
FF NetworkProxy: "socks_port", 8080
FF NetworkProxy: "ssl", "203.156.126.38"
FF NetworkProxy: "ssl_port", 8080
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_20_0_0_235.dll [2015-12-08] ()
FF Plugin: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass64.dll [2015-10-12] (LastPass)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-04] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_235.dll [2015-12-08] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll [2013-10-25] (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-20] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-20] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.60.2 -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\dtplugin\npDeployJava1.dll [2015-09-03] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.60.2 -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\plugin2\npjp2.dll [2015-09-03] (Oracle Corporation)
FF Plugin-x32: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass64.dll [2015-10-12] (LastPass)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-04] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-04] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-04] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-05-08] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3234211791-2759061018-4055047508-1001: @citrixonline.com/appdetectorplugin -> C:\Users\Jorge\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2015-05-27] (Citrix Online)
FF Plugin HKU\S-1-5-21-3234211791-2759061018-4055047508-1001: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Jorge\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited)
FF Plugin HKU\S-1-5-21-3234211791-2759061018-4055047508-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Jorge\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2013-03-24] (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-05-08] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2013-01-28] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2013-01-28] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2013-01-28] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2013-01-28] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2013-01-28] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll [2013-01-28] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll [2013-01-28] (Apple Inc.)
FF Extension: User Agent Switcher - C:\Users\Jorge\AppData\Roaming\Mozilla\Firefox\Profiles\qu3tz7k2.default-1441595658464\extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}.xpi [2015-09-30]
FF Extension: LastPass - C:\Users\Jorge\AppData\Roaming\Mozilla\Firefox\Profiles\qu3tz7k2.default-1441595658464\Extensions\support@lastpass.com [2015-12-03]
FF Extension: User Agent Overrider - C:\Users\Jorge\AppData\Roaming\Mozilla\Firefox\Profiles\qu3tz7k2.default-1441595658464\Extensions\useragentoverrider@qixinglu.com.xpi [2015-09-30]
FF HKLM-x32\...\Firefox\Extensions: [2bf2d136-ab28-4bdd-8c8b-e1838343e631@2e9291c5-67cd-4375-afc8-b2772f9fcf45.com] - C:\Program Files (x86)\\George\2bf2d136-ab28-4bdd-8c8b-e1838343e631@2e9291c5-67cd-4375-afc8-b2772f9fcf45.com.xpi
FF Extension: HilariousVideos - C:\Program Files (x86)\\George\2bf2d136-ab28-4bdd-8c8b-e1838343e631@2e9291c5-67cd-4375-afc8-b2772f9fcf45.com.xpi [2013-06-11] [not signed]
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\firefox.cfg [2013-06-10] <==== ATTENTION

Chrome:
=======
CHR DefaultSearchKeyword: Default -> lp
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.8.823\_platform_specific\win_x86\widevinecdmadapter.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.73\PepperFlash\pepflashplayer.dll ()
CHR Profile: C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Traductor de Google) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb [2015-11-17]
CHR Extension: (Google Docs) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-05]
CHR Extension: (Google Drive) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-23]
CHR Extension: (YouTube) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24]
CHR Extension: (Búsqueda de Google) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
CHR Extension: (FB Pixel Helper) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdgfkebogiimcoedlicjlajpkdmockpc [2015-12-03]
CHR Extension: (LastPass: Free Password Manager) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2015-10-26]
CHR Extension: (Local SWF) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdmbckedabpbgjagmkgcejooabcdnone [2015-11-25]
CHR Extension: (Awesome Screenshot - Screen captura y Anotar ) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlipoenfbbikpbjkfpfillcgkoblgpmj [2015-12-02]
CHR Extension: (Sistema de pagos de Chrome Web Store) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-27]
CHR Extension: (Instagram for Chrome) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\opnbmdkdflhjiclaoiiifmheknpccalb [2015-12-04]
CHR Extension: (Gmail) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-03]
CHR HKLM\...\Chrome\Extension: [hdokiejnpimakedhajhdlcegeplioahd] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [hdokiejnpimakedhajhdlcegeplioahd] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [nfnoclbgfccijbdmhjabakjbalaahejm] - C:\Program Files (x86)\\George\hilariousvideos.crx [2013-06-11]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [3465216 2015-12-06] () [File not signed]
S2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [3764224 2015-12-04] (BlueStack Systems, Inc.) [File not signed]
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [384728 2014-08-13] (BlueStack Systems, Inc.)
R2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [777944 2014-08-13] (BlueStack Systems, Inc.)
R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376 2009-08-27] (MAGIX AG) [File not signed]
S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2015-12-08] (MAGIX®) [File not signed]
S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [4014080 2015-12-08] (Acresso Software Inc.) [File not signed]
S3 FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [4825976 2015-12-08] (Flexera Software LLC) [File not signed]
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1156384 2015-11-05] (NVIDIA Corporation)
S2 gupdate; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2380616 2015-12-04] (Google Inc.) [File not signed]
S3 gupdatem; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2380616 2015-12-04] (Google Inc.) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2310144 2015-12-08] (Macrovision Corporation) [File not signed]
S3 iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2877768 2015-12-06] (Apple Inc.) [File not signed]
R2 kss; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe [919296 2015-06-03] (Kaspersky Lab ZAO)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [417552 2015-11-12] (LogMeIn, Inc.)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 mi-raysat_3dsmax2014_64; C:\Program Files\Autodesk\3ds Max 2014\NVIDIA\Satellite\raysat_3dsmax2014_64server.exe [86016 2011-09-14] () [File not signed]
R2 Micro Star SCM; C:\Program Files (x86)\S-Bar\MSIService.exe [160768 2011-11-02] (Micro-Star International Co., Ltd.) [File not signed]
S3 MozillaMaintenance; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [172032 2015-12-07] (Mozilla Foundation) [File not signed]
R2 MSI Foundation Service; C:\Program Files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe [12800 2010-07-16] (MSI) [File not signed]
R2 MSI_SuperCharger; C:\Program Files (x86)\MSI\Super-Charger\ChargeService.exe [138768 2012-01-03] (MSI)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2510848 2015-12-08] () [File not signed]
R2 NIHardwareService; C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [5352960 2011-03-09] (Native Instruments GmbH) [File not signed]
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2782552 2010-03-05] (Symantec Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1873696 2015-11-05] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [5568288 2015-11-05] (NVIDIA Corporation)
S3 OpenVPNService; C:\Program Files (x86)\HMA! Pro VPN\bin\openvpnserv.exe [4510008 2015-12-08] (The OpenVPN Project) [File not signed]
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [3178496 2015-12-07] (Electronic Arts) [File not signed]
S3 ose64; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2412544 2015-12-06] (Microsoft Corporation) [File not signed]
S3 osppsvc; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [6045696 2015-12-06] (Microsoft Corporation) [File not signed]
R2 PnkBstrA; C:\windows\SysWOW64\PnkBstrA.exe [76888 2013-03-26] ()
R2 PSI_SVC_2; C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe [267552 2010-03-11] (Protexis Inc.) [File not signed]
R2 Qualcomm Atheros Killer Service; C:\Program Files\Qualcomm Atheros\Killer Network Manager\BFNService.exe [492032 2012-03-07] () [File not signed]
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2015-10-06] (Riverbed Technology, Inc.) [File not signed]
S3 Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [1957888 2015-12-08] (Valve Corporation) [File not signed]
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2756608 2015-12-08] (Adobe Systems Incorporated) [File not signed]
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5702416 2015-09-11] (TeamViewer GmbH)
R2 Update service; C:\Program Files (x86)\Popcorn Time\Updater.exe [339968 2015-10-19] (Popcorn Time) [File not signed]
R2 VMAuthdService; C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe [79872 2011-08-22] (VMware, Inc.) [File not signed]
S3 VMwareHostd; C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe [11837440 2015-10-06] () [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
S4 wlcrasvc; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [3411968 2015-12-06] (Microsoft Corporation) [File not signed]
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [594704 2011-12-08] (Intel® Corporation)
S2 FastUserSwitchingCompatibility; C:\windows\installer\AMDEx3.msi [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R1 BfLwf; C:\Windows\System32\DRIVERS\bflwfx64.sys [75880 2012-03-07] (Bigfoot Networks, Inc.)
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [122072 2014-08-13] (BlueStack Systems)
S3 ck3iusb64; C:\Windows\System32\DRIVERS\ck3iusb64.sys [64000 2010-01-18] (Xecuter)
R0 E8655EDC; C:\Windows\System32\drivers\E8655EDC.sys [478392 2015-10-06] (Kaspersky Lab ZAO)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 ipadtst; C:\Program Files (x86)\MSI\Super-Charger\ipadtst_64.sys [17936 2011-12-12] (Windows ® Win 7 DDK provider)
R3 L1C; C:\Windows\System32\DRIVERS\e22w7x64.sys [161616 2012-03-07] (Qualcomm Atheros, Inc.)
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [16896 2007-03-20] (hxxp://libusb-win32.sourceforge.net)
S3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-02-28] (Riverbed Technology, Inc.)
R3 NTIOLib_1_0_3; C:\Program Files (x86)\MSI\Super-Charger\NTIOLib_X64.sys [14136 2010-01-18] (MSI)
S3 NUMARK_NS6_MIDI; C:\Windows\System32\drivers\ns6_midi.sys [31296 2011-08-10] (Numark)
S3 NUMARK_NS6_USB; C:\Windows\System32\Drivers\ns6_usb.sys [416320 2011-08-10] (Ploytec GmbH)
S3 NUMARK_NS6_WDM; C:\Windows\System32\drivers\ns6_wdm.sys [54336 2011-08-10] (Numark)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20768 2015-11-05] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [50472 2015-11-05] (NVIDIA Corporation)
S3 qcusbser-forge; C:\Windows\System32\DRIVERS\qcusbser.sys [247872 2015-06-17] (FORGE Incorporated)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [30848 2015-12-09] ()
R1 VBoxNetAdp; C:\Windows\System32\DRIVERS\VBoxNetAdp6.sys [117768 2015-09-08] (Oracle Corporation)
R1 VBoxNetLwf; C:\Windows\System32\DRIVERS\VBoxNetLwf.sys [146072 2015-09-08] (Oracle Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 MGHwCtrl; \??\C:\Program Files\MSI\MSI Software Install\MGHwCtrl.sys [X]
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-09 15:15 - 2015-12-09 15:15 - 00000757 _____ C:\Users\Jorge\Desktop\JRT.txt
2015-12-09 15:06 - 2015-12-09 15:06 - 00103140 _____ C:\pcre.exe
2015-12-09 14:27 - 2015-12-09 14:27 - 01599336 _____ (Malwarebytes) C:\Users\Jorge\Desktop\JRT.exe
2015-12-09 14:13 - 2015-12-09 14:13 - 01738240 _____ C:\Users\Jorge\Desktop\adwcleaner_5.024.exe
2015-12-09 13:39 - 2015-12-09 15:03 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-12-09 13:34 - 2015-12-09 15:00 - 00000000 ____D C:\Users\Jorge\Desktop\mbar
2015-12-09 13:34 - 2015-12-09 13:34 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Jorge\Downloads\mbar-1.09.3.1001.exe
2015-12-09 13:10 - 2015-12-09 13:10 - 00105218 ____H C:\Users\Jorge\Desktop\~WRL3329.tmp
2015-12-09 12:48 - 2015-12-09 12:48 - 00852771 _____ C:\Users\Jorge\Desktop\SecurityCheck.exe
2015-12-09 04:50 - 2015-12-09 04:52 - 00088176 _____ C:\Users\Jorge\Desktop\Addition.txt
2015-12-09 04:49 - 2015-12-09 15:17 - 00033945 _____ C:\Users\Jorge\Desktop\FRST.txt
2015-12-09 04:49 - 2015-12-09 15:17 - 00000000 ____D C:\FRST
2015-12-09 04:46 - 2015-12-09 04:46 - 02369024 _____ (Farbar) C:\Users\Jorge\Desktop\FRST64.exe
2015-12-09 04:30 - 2015-12-09 04:30 - 00003400 ____N C:\bootsqm.dat
2015-12-09 04:28 - 2015-12-09 04:28 - 00000000 __SHD C:\found.001
2015-12-09 02:30 - 2015-12-09 02:36 - 00000000 ____D C:\ProgramData\HitmanPro
2015-12-09 02:29 - 2015-12-09 03:09 - 00000282 __RSH C:\ProgramData\ntuser.pol
2015-12-09 02:11 - 2015-12-09 02:27 - 00000000 ____D C:\ProgramData\RogueKiller
2015-12-09 02:11 - 2015-12-09 02:11 - 00030848 _____ C:\windows\system32\Drivers\TrueSight.sys
2015-12-09 02:04 - 2015-12-09 02:04 - 00123027 _____ C:\ComboFix.txt
2015-12-09 01:33 - 2011-06-26 00:45 - 00256000 _____ C:\windows\PEV.exe
2015-12-09 01:33 - 2010-11-07 11:20 - 00208896 _____ C:\windows\MBR.exe
2015-12-09 01:33 - 2009-04-19 22:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2015-12-09 01:33 - 2000-08-30 18:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2015-12-09 01:33 - 2000-08-30 18:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2015-12-09 01:33 - 2000-08-30 18:00 - 00098816 _____ C:\windows\sed.exe
2015-12-09 01:33 - 2000-08-30 18:00 - 00080412 _____ C:\windows\grep.exe
2015-12-09 01:33 - 2000-08-30 18:00 - 00068096 _____ C:\windows\zip.exe
2015-12-09 01:32 - 2015-12-09 02:04 - 00000000 ____D C:\Qoobox
2015-12-09 01:32 - 2015-12-09 01:58 - 00000000 ____D C:\windows\erdnt
2015-12-09 01:26 - 2015-12-09 01:30 - 11337112 _____ (SurfRight B.V.) C:\Users\Jorge\Desktop\HitmanPro_x64.exe
2015-12-09 01:25 - 2015-12-09 01:25 - 20829256 _____ C:\Users\Jorge\Desktop\RogueKiller.exe
2015-12-09 01:24 - 2015-12-09 01:24 - 05640425 ____R (Swearware) C:\Users\Jorge\Desktop\ComboFix.exe
2015-12-08 15:36 - 2015-11-20 12:54 - 03170304 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2015-12-08 15:36 - 2015-11-20 12:54 - 02609152 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2015-12-08 15:36 - 2015-11-20 12:54 - 00709632 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2015-12-08 15:36 - 2015-11-20 12:54 - 00192512 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2015-12-08 15:36 - 2015-11-20 12:54 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2015-12-08 15:36 - 2015-11-20 12:54 - 00098816 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2015-12-08 15:36 - 2015-11-20 12:54 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll
2015-12-08 15:36 - 2015-11-20 12:54 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2015-12-08 15:36 - 2015-11-20 12:54 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2015-12-08 15:36 - 2015-11-20 12:54 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
2015-12-08 15:36 - 2015-11-20 12:54 - 00012288 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll
2015-12-08 15:36 - 2015-11-20 12:34 - 00573440 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2015-12-08 15:36 - 2015-11-20 12:34 - 00174080 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2015-12-08 15:36 - 2015-11-20 12:34 - 00093696 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2015-12-08 15:36 - 2015-11-20 12:34 - 00030208 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll
2015-12-08 15:36 - 2015-11-20 12:33 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
2015-12-08 15:36 - 2015-11-11 15:12 - 00387792 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-12-08 15:36 - 2015-11-11 14:52 - 00341192 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2015-12-08 15:36 - 2015-11-11 12:53 - 01735680 _____ (Microsoft Corporation) C:\windows\system32\comsvcs.dll
2015-12-08 15:36 - 2015-11-11 12:53 - 00525312 _____ (Microsoft Corporation) C:\windows\system32\catsrvut.dll
2015-12-08 15:36 - 2015-11-11 12:39 - 01242624 _____ (Microsoft Corporation) C:\windows\SysWOW64\comsvcs.dll
2015-12-08 15:36 - 2015-11-11 12:39 - 00487936 _____ (Microsoft Corporation) C:\windows\SysWOW64\catsrvut.dll
2015-12-08 15:36 - 2015-11-11 10:21 - 25837568 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-12-08 15:36 - 2015-11-11 10:00 - 12856832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-12-08 15:36 - 2015-11-11 09:44 - 00416256 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2015-12-08 15:36 - 2015-11-11 09:44 - 00279040 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2015-12-08 15:36 - 2015-11-11 09:41 - 20366848 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-12-08 15:36 - 2015-11-11 09:12 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-12-08 15:36 - 2015-11-11 08:57 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2015-12-08 15:36 - 2015-11-10 12:55 - 01648128 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll
2015-12-08 15:36 - 2015-11-10 12:55 - 01180160 _____ (Microsoft Corporation) C:\windows\system32\FntCache.dll
2015-12-08 15:36 - 2015-11-10 12:55 - 01008640 _____ (Microsoft Corporation) C:\windows\system32\user32.dll
2015-12-08 15:36 - 2015-11-10 12:39 - 01251328 _____ (Microsoft Corporation) C:\windows\SysWOW64\DWrite.dll
2015-12-08 15:36 - 2015-11-10 12:37 - 00833024 _____ (Microsoft Corporation) C:\windows\SysWOW64\user32.dll
2015-12-08 15:36 - 2015-11-10 11:47 - 03211264 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-12-08 15:36 - 2015-11-09 18:24 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2015-12-08 15:36 - 2015-11-09 18:13 - 00496640 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-12-08 15:36 - 2015-11-09 18:13 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2015-12-08 15:36 - 2015-11-09 18:12 - 00341504 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2015-12-08 15:36 - 2015-11-09 18:12 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2015-12-08 15:36 - 2015-11-09 18:11 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2015-12-08 15:36 - 2015-11-09 18:08 - 02280448 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-12-08 15:36 - 2015-11-09 18:06 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2015-12-08 15:36 - 2015-11-09 18:06 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2015-12-08 15:36 - 2015-11-09 18:04 - 00476160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2015-12-08 15:36 - 2015-11-09 18:03 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2015-12-08 15:36 - 2015-11-09 18:02 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2015-12-08 15:36 - 2015-11-09 18:02 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2015-12-08 15:36 - 2015-11-09 17:50 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-12-08 15:36 - 2015-11-09 17:47 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2015-12-08 15:36 - 2015-11-09 17:46 - 04514816 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-12-08 15:36 - 2015-11-09 17:44 - 00130048 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll
2015-12-08 15:36 - 2015-11-09 17:37 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
2015-12-08 15:36 - 2015-11-09 17:36 - 02050560 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2015-12-08 15:36 - 2015-11-09 17:36 - 00687104 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-12-08 15:36 - 2015-11-09 17:35 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2015-12-08 15:36 - 2015-11-09 17:17 - 02011136 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-12-08 15:36 - 2015-11-09 17:14 - 01311744 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-12-08 15:36 - 2015-11-09 17:12 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2015-12-08 15:36 - 2015-11-08 16:33 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2015-12-08 15:36 - 2015-11-08 16:32 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2015-12-08 15:36 - 2015-11-08 16:16 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2015-12-08 15:36 - 2015-11-08 16:15 - 02887168 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-12-08 15:36 - 2015-11-08 16:15 - 00571392 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-12-08 15:36 - 2015-11-08 16:15 - 00417792 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2015-12-08 15:36 - 2015-11-08 16:15 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2015-12-08 15:36 - 2015-11-08 16:14 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-12-08 15:36 - 2015-11-08 16:07 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2015-12-08 15:36 - 2015-11-08 16:06 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2015-12-08 15:36 - 2015-11-08 16:04 - 05923840 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-12-08 15:36 - 2015-11-08 16:02 - 00615936 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2015-12-08 15:36 - 2015-11-08 16:01 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2015-12-08 15:36 - 2015-11-08 16:01 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2015-12-08 15:36 - 2015-11-08 16:01 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2015-12-08 15:36 - 2015-11-08 16:01 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2015-12-08 15:36 - 2015-11-08 15:52 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2015-12-08 15:36 - 2015-11-08 15:48 - 00489984 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-12-08 15:36 - 2015-11-08 15:40 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2015-12-08 15:36 - 2015-11-08 15:35 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2015-12-08 15:36 - 2015-11-08 15:32 - 00315392 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-12-08 15:36 - 2015-11-08 15:29 - 00152064 _____ (Microsoft Corporation) C:\windows\system32\occache.dll
2015-12-08 15:36 - 2015-11-08 15:18 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2015-12-08 15:36 - 2015-11-08 15:15 - 00798208 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-12-08 15:36 - 2015-11-08 15:15 - 00718336 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-12-08 15:36 - 2015-11-08 15:14 - 14456832 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-12-08 15:36 - 2015-11-08 15:14 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2015-12-08 15:36 - 2015-11-08 15:13 - 02123264 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-12-08 15:36 - 2015-11-08 14:53 - 02487808 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-12-08 15:36 - 2015-11-08 14:41 - 01546752 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-12-08 15:36 - 2015-11-08 14:30 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-12-08 15:36 - 2015-11-05 13:05 - 00017408 _____ (Microsoft Corporation) C:\windows\system32\wshrm.dll
2015-12-08 15:36 - 2015-11-05 13:02 - 00014848 _____ (Microsoft Corporation) C:\windows\SysWOW64\wshrm.dll
2015-12-08 15:36 - 2015-11-05 13:02 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2015-12-08 15:36 - 2015-11-05 13:00 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2015-12-08 15:36 - 2015-11-05 03:53 - 00146944 _____ (Microsoft Corporation) C:\windows\system32\Drivers\rmcast.sys
2015-12-08 15:36 - 2015-11-03 13:04 - 00802304 _____ (Microsoft Corporation) C:\windows\system32\usp10.dll
2015-12-08 15:36 - 2015-11-03 13:04 - 00241664 _____ (Microsoft Corporation) C:\windows\system32\els.dll
2015-12-08 15:36 - 2015-11-03 12:56 - 00627712 _____ (Microsoft Corporation) C:\windows\SysWOW64\usp10.dll
2015-12-08 15:36 - 2015-11-03 12:55 - 00179712 _____ (Microsoft Corporation) C:\windows\SysWOW64\els.dll
2015-12-08 15:36 - 2015-10-08 17:22 - 00069120 _____ (Microsoft Corporation) C:\windows\system32\nlsbres.dll
2015-12-08 15:36 - 2015-10-08 17:18 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDAZE.DLL
2015-12-08 15:36 - 2015-10-08 17:18 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\kbdgeoqw.dll
2015-12-08 15:36 - 2015-10-08 17:18 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDAZEL.DLL
2015-12-08 15:36 - 2015-10-08 17:18 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDAZE.DLL
2015-12-08 15:36 - 2015-10-08 17:18 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\kbdgeoqw.dll
2015-12-08 15:36 - 2015-10-08 17:18 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDAZEL.DLL
2015-12-08 15:36 - 2015-10-08 17:17 - 00069120 _____ (Microsoft Corporation) C:\windows\SysWOW64\nlsbres.dll
2015-12-08 15:36 - 2015-10-08 13:13 - 00419928 _____ C:\windows\SysWOW64\locale.nls
2015-12-08 15:36 - 2015-10-08 12:52 - 00419928 _____ C:\windows\system32\locale.nls
2015-12-04 14:46 - 2015-12-05 01:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-12-04 00:36 - 2015-12-09 14:14 - 00000000 ____D C:\AdwCleaner
2015-12-03 03:09 - 2015-12-03 03:09 - 00000572 _____ C:\Users\Public\Desktop\Fraps.lnk
2015-12-03 03:09 - 2015-12-03 03:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fraps
2015-12-02 22:43 - 2015-12-02 22:43 - 04264374 _____ C:\Users\Jorge\Downloads\11) LMD-03 u.6 González, M.J. (2007).pdf
2015-12-02 22:43 - 2015-12-02 22:43 - 04024951 _____ C:\Users\Jorge\Downloads\13) LMD-03 u. 6 Núñez, M.G., Salón, G., Romero, G. y Rosales, V. (2009).pdf
2015-12-02 22:43 - 2015-12-02 22:43 - 04018663 _____ C:\Users\Jorge\Downloads\12) LMD-03 u.6 Martínez, R., Munduate, L. y Medina, F.J. (2008).pdf
2015-12-02 22:21 - 2015-12-02 22:21 - 04464456 _____ C:\Users\Jorge\Downloads\8) LMD-03 u.5 Oblitas, L.A. (2010).pdf
2015-12-02 22:21 - 2015-12-02 22:21 - 04372388 _____ C:\Users\Jorge\Downloads\9) LMD-03 u.5 Harvard Business Press (2009).pdf
2015-12-02 22:21 - 2015-12-02 22:21 - 04017605 _____ C:\Users\Jorge\Downloads\10) LMD-03 u.5 Gabel, R., Peralta, V., Paiva, R.A. y Aguirre, G. (2012).pdf
2015-12-02 22:03 - 2015-12-02 22:03 - 00001614 _____ C:\Users\Jorge\Desktop\s.txt
2015-12-02 16:33 - 2015-12-02 16:33 - 00000678 _____ C:\Users\Jorge\Desktop\Untitled-1.ai
2015-12-02 16:33 - 2015-12-02 16:33 - 00000132 _____ C:\Users\Jorge\AppData\Roaming\Adobe IllExport Filter CS6 Prefs
2015-12-02 01:31 - 2015-12-02 01:30 - 00001995 _____ C:\Users\Jorge\Desktop\UserOptions.ini
2015-11-30 23:48 - 2015-12-09 15:06 - 00192216 _____ (Malwarebytes) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-11-30 23:48 - 2015-11-30 23:48 - 00001116 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-11-30 23:48 - 2015-11-30 23:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-11-30 23:47 - 2015-12-09 14:28 - 00109272 _____ (Malwarebytes) C:\windows\system32\Drivers\mbamchameleon.sys
2015-11-30 23:47 - 2015-11-30 23:48 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-11-30 23:47 - 2015-10-05 09:50 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-11-30 23:47 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\windows\system32\Drivers\mbam.sys
2015-11-30 03:10 - 2015-11-30 03:12 - 00001544 _____ C:\Users\Jorge\Desktop\Skype.exe.lnk
2015-11-27 00:13 - 2015-11-27 00:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2015-11-27 00:13 - 2015-11-27 00:13 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi
2015-11-23 16:46 - 2015-11-23 16:46 - 04378639 _____ C:\Users\Jorge\Downloads\7) LMD-03 u.4 Uribe, S.F. Molina, J.M., Contreras, F., Barbosa, D. y Espinosa, J.C. (2013).pdf
2015-11-23 16:46 - 2015-11-23 16:46 - 04339481 _____ C:\Users\Jorge\Downloads\5) LMD-03 u.3 Gil, M.D. (2013).pdf
2015-11-23 16:46 - 2015-11-23 16:46 - 04291726 _____ C:\Users\Jorge\Downloads\4) LMD-03 u.3 Shelton, N. y Burton, S. (2009).pdf
2015-11-23 16:46 - 2015-11-23 16:46 - 04192316 _____ C:\Users\Jorge\Downloads\6) LMD-02 u.4 Palomo, M.T. (2010).pdf
2015-11-18 03:26 - 2015-11-18 03:26 - 04247811 _____ C:\Users\Jorge\Downloads\3) LMD-03 u.2 Publicaciones Vértice (2010).pdf
2015-11-15 04:20 - 2015-12-07 23:38 - 02520755 _____ C:\Users\Jorge\AppData\Roaming\jorge-ms_64
2015-11-15 04:20 - 2015-11-30 03:53 - 10379264 _____ (TMCheats.com) C:\Users\Jorge\Desktop\D6OVwyOG.exe
2015-11-15 04:19 - 2015-11-15 04:19 - 08831506 _____ C:\Users\Jorge\Desktop\tmstreamer_v2_x64_2468D2H8R7D2C6DA5V.zip
2015-11-13 00:12 - 2015-11-13 00:12 - 00141570 _____ C:\Users\Jorge\Desktop\Price-Sheet-081815.pdf
2015-11-10 17:29 - 2015-10-19 19:12 - 05570496 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-11-10 17:29 - 2015-10-19 19:12 - 00154560 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-11-10 17:29 - 2015-10-19 19:12 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2015-11-10 17:29 - 2015-10-19 19:09 - 01730496 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2015-11-10 17:29 - 2015-10-19 19:06 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll
2015-11-10 17:29 - 2015-10-19 19:06 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2015-11-10 17:29 - 2015-10-19 19:06 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll
2015-11-10 17:29 - 2015-10-19 19:06 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 01461760 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 01216512 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 01164800 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00729600 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00424960 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00344064 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00315392 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00312320 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-11-10 17:29 - 2015-10-19 19:05 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2015-11-10 17:29 - 2015-10-19 19:05 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00044032 _____ (Microsoft Corporation) C:\windows\system32\cryptbase.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
2015-11-10 17:29 - 2015-10-19 19:04 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
2015-11-10 17:29 - 2015-10-19 19:04 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2015-11-10 17:29 - 2015-10-19 19:04 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2015-11-10 17:29 - 2015-10-19 19:00 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2015-11-10 17:29 - 2015-10-19 18:59 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:52 - 03991488 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2015-11-10 17:29 - 2015-10-19 18:52 - 03935680 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2015-11-10 17:29 - 2015-10-19 18:48 - 01311768 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2015-11-10 17:29 - 2015-10-19 18:45 - 00552960 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2015-11-10 17:29 - 2015-10-19 18:45 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2015-11-10 17:29 - 2015-10-19 18:45 - 00251392 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2015-11-10 17:29 - 2015-10-19 18:45 - 00223232 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2015-11-10 17:29 - 2015-10-19 18:45 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2015-11-10 17:29 - 2015-10-19 18:45 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2015-11-10 17:29 - 2015-10-19 18:45 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2015-11-10 17:29 - 2015-10-19 18:45 - 00036864 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptbase.dll
2015-11-10 17:29 - 2015-10-19 18:45 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2015-11-10 17:29 - 2015-10-19 18:45 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2015-11-10 17:29 - 2015-10-19 18:45 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2015-11-10 17:29 - 2015-10-19 18:45 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2015-11-10 17:29 - 2015-10-19 18:44 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll
2015-11-10 17:29 - 2015-10-19 18:44 - 00665088 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
2015-11-10 17:29 - 2015-10-19 18:44 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
2015-11-10 17:29 - 2015-10-19 18:44 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2015-11-10 17:29 - 2015-10-19 18:44 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe
2015-11-10 17:29 - 2015-10-19 18:44 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2015-11-10 17:29 - 2015-10-19 18:39 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2015-11-10 17:29 - 2015-10-19 18:39 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00686080 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 17:41 - 00159232 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys
2015-11-10 17:29 - 2015-10-19 17:40 - 00290816 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys
2015-11-10 17:29 - 2015-10-19 17:40 - 00129024 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
2015-11-10 17:29 - 2015-10-19 17:29 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2015-11-10 17:29 - 2015-10-19 17:29 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2015-11-10 17:29 - 2015-10-19 17:27 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 17:27 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 17:27 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 17:27 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-11-10 17:29 - 2015-09-23 07:15 - 00460776 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2015-11-10 17:29 - 2015-09-23 07:15 - 00299632 _____ (Microsoft Corporation) C:\windows\system32\bcryptprimitives.dll
2015-11-10 17:29 - 2015-09-23 07:09 - 00251000 _____ (Microsoft Corporation) C:\windows\SysWOW64\bcryptprimitives.dll
2015-11-10 17:28 - 2015-10-29 11:50 - 00342016 _____ (Microsoft Corporation) C:\windows\system32\apphelp.dll
2015-11-10 17:28 - 2015-10-29 11:50 - 00072192 _____ (Microsoft Corporation) C:\windows\system32\aelupsvc.dll
2015-11-10 17:28 - 2015-10-29 11:50 - 00023552 _____ (Microsoft Corporation) C:\windows\system32\sdbinst.exe
2015-11-10 17:28 - 2015-10-29 11:50 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\shimeng.dll
2015-11-10 17:28 - 2015-10-29 11:50 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\shimeng.dll
2015-11-10 17:28 - 2015-10-29 11:49 - 00295936 _____ (Microsoft Corporation) C:\windows\SysWOW64\apphelp.dll
2015-11-10 17:28 - 2015-10-29 11:49 - 00020992 _____ (Microsoft Corporation) C:\windows\SysWOW64\sdbinst.exe
2015-11-10 17:28 - 2015-10-13 10:41 - 00497664 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys
2015-11-10 17:28 - 2015-10-13 10:40 - 00118272 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tdx.sys
2015-11-10 17:28 - 2015-10-12 22:57 - 00950720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ndis.sys
2015-11-10 17:28 - 2015-10-01 12:00 - 00275456 _____ (Microsoft Corporation) C:\windows\system32\InkEd.dll
2015-11-10 17:28 - 2015-10-01 12:00 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\jnwmon.dll
2015-11-10 17:28 - 2015-10-01 11:50 - 00216064 _____ (Microsoft Corporation) C:\windows\SysWOW64\InkEd.dll
2015-11-10 00:36 - 2015-11-10 00:36 - 00002984 _____ C:\windows\System32\Tasks\{9E85CAA0-CAE9-4D74-8EB4-85AA1E4A11BB}
2015-11-10 00:36 - 2015-11-10 00:36 - 00000000 ____D C:\Users\Jorge\AppData\Roaming\Daybreak Game Company
2015-11-10 00:09 - 2015-11-10 00:09 - 00000000 ____D C:\windows\SysWOW64\NV
2015-11-10 00:09 - 2015-11-10 00:09 - 00000000 ____D C:\windows\system32\NV
2015-11-10 00:08 - 2015-11-05 11:13 - 42914096 _____ C:\windows\system32\nvcompiler.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 37882488 _____ C:\windows\SysWOW64\nvcompiler.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 22308656 _____ (NVIDIA Corporation) C:\windows\system32\nvoglv64.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 18362160 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvoglv32.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 17515208 _____ (NVIDIA Corporation) C:\windows\system32\nvwgf2umx.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 16553568 _____ (NVIDIA Corporation) C:\windows\system32\nvopencl.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 15717864 _____ (NVIDIA Corporation) C:\windows\system32\nvd3dumx.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 15121784 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvwgf2um.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 14835872 _____ (NVIDIA Corporation) C:\windows\system32\nvcuda.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 13527248 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvopencl.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 12770752 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvd3dum.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 12034248 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuda.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 11130488 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvlddmkm.sys
2015-11-10 00:08 - 2015-11-05 11:13 - 02870392 _____ (NVIDIA Corporation) C:\windows\system32\nvcuvid.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 02490488 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuvid.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 01905272 _____ (NVIDIA Corporation) C:\windows\system32\nvdispco6435891.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 01564792 _____ (NVIDIA Corporation) C:\windows\system32\nvdispgenco6435891.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 00877360 _____ (NVIDIA Corporation) C:\windows\system32\NvFBC64.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 00861816 _____ (NVIDIA Corporation) C:\windows\system32\NvIFR64.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 00689272 _____ (NVIDIA Corporation) C:\windows\SysWOW64\NvFBC.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 00673912 _____ (NVIDIA Corporation) C:\windows\SysWOW64\NvIFR.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 00151368 _____ (NVIDIA Corporation) C:\windows\system32\nvoglshim64.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 00128696 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvoglshim32.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 00069416 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvaudcap32v.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 00050472 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvvad64v.sys
2015-11-10 00:08 - 2015-11-05 11:13 - 00031352 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvpciflt.sys
2015-11-09 21:25 - 2015-11-09 21:25 - 00000000 ____D C:\Users\Jorge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-09 15:17 - 2012-10-28 23:50 - 00000000 ____D C:\Users\Jorge\AppData\Roaming\Skype
2015-12-09 15:16 - 2015-01-18 18:00 - 00000838 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2015-12-09 15:12 - 2009-07-13 22:45 - 00031712 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-12-09 15:12 - 2009-07-13 22:45 - 00031712 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-12-09 15:06 - 2015-06-05 07:09 - 00000634 _____ C:\windows\Tasks\G2MUploadTask-S-1-5-21-3234211791-2759061018-4055047508-1001.job
2015-12-09 15:04 - 2014-07-13 17:07 - 00000000 ____D C:\Users\Jorge\AppData\Local\LogMeIn Hamachi
2015-12-09 15:04 - 2013-05-06 20:46 - 00000000 ___RD C:\Users\Jorge\Dropbox
2015-12-09 15:04 - 2013-05-06 20:45 - 00000000 ____D C:\Users\Jorge\AppData\Roaming\Dropbox
2015-12-09 15:04 - 2012-04-25 20:07 - 00000000 ____D C:\ProgramData\Bigfoot Networks
2015-12-09 15:03 - 2014-09-07 22:35 - 00000000 ____D C:\ProgramData\VMware
2015-12-09 15:03 - 2012-11-30 15:09 - 00001032 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-12-09 15:02 - 2009-07-13 23:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2015-12-09 15:01 - 2015-06-28 14:50 - 00000960 _____ C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3234211791-2759061018-4055047508-1001UA.job
2015-12-09 15:00 - 2012-10-25 22:59 - 00000000 ___HD C:\Users\Jorge\AppData\Roaming\.purple
2015-12-09 15:00 - 2009-07-13 22:45 - 00000000 ____D C:\windows\Setup
2015-12-09 14:43 - 2015-05-27 10:07 - 00000538 _____ C:\windows\Tasks\G2MUpdateTask-S-1-5-21-3234211791-2759061018-4055047508-1001.job
2015-12-09 14:34 - 2012-11-30 15:09 - 00001036 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-12-09 14:13 - 2013-04-18 21:11 - 00000000 ____D C:\Users\Jorge\AppData\Local\Apps\2.0
2015-12-09 13:49 - 2013-08-17 03:44 - 00000928 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3234211791-2759061018-4055047508-1001UA.job
2015-12-09 04:51 - 2009-07-13 21:20 - 00000000 ____D C:\Windows
2015-12-09 04:49 - 2013-08-17 03:44 - 00000906 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3234211791-2759061018-4055047508-1001Core.job
2015-12-09 04:43 - 2012-04-24 20:35 - 00762104 _____ C:\windows\system32\perfh00A.dat
2015-12-09 04:43 - 2012-04-24 20:35 - 00164410 _____ C:\windows\system32\perfc00A.dat
2015-12-09 04:43 - 2009-07-13 23:13 - 01717320 _____ C:\windows\system32\PerfStringBackup.INI
2015-12-09 04:43 - 2009-07-13 21:20 - 00000000 ____D C:\windows\inf
2015-12-09 02:00 - 2015-09-05 01:33 - 00000000 ____D C:\Users\Jorge\AppData\Local\Adobe
2015-12-09 01:50 - 2009-07-13 20:34 - 00000252 _____ C:\windows\system.ini
2015-12-09 01:19 - 2009-07-13 22:45 - 05028104 _____ C:\windows\system32\FNTCACHE.DAT
2015-12-09 01:16 - 2015-06-07 00:23 - 00295518 _____ C:\windows\ntbtlog.txt
2015-12-09 01:14 - 2013-03-17 03:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-12-09 01:14 - 2013-03-17 03:00 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-12-09 01:14 - 2013-03-17 03:00 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-12-09 01:13 - 2012-11-14 22:03 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-12-09 01:09 - 2015-08-25 07:40 - 00002016 ____H C:\Users\Jorge\Documents\Default.rdp
2015-12-09 01:09 - 2012-10-26 03:02 - 00000000 ____D C:\Program Files (x86)\Steam
2015-12-08 23:16 - 2015-01-18 18:00 - 00003776 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-12-08 23:16 - 2012-10-26 02:40 - 00796864 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-12-08 23:16 - 2012-04-25 22:14 - 00142528 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-12-08 21:40 - 2012-12-15 18:58 - 00000000 ____D C:\Users\Jorge\AppData\Roaming\Audacity
2015-12-08 17:10 - 2015-06-28 14:50 - 00000908 _____ C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3234211791-2759061018-4055047508-1001Core.job
2015-12-08 02:00 - 2013-06-12 00:21 - 00000000 ____D C:\Users\Jorge\AppData\Roaming\TS3Client
2015-12-07 22:24 - 2012-10-26 02:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-12-07 22:24 - 2009-07-13 23:32 - 00000000 ____D C:\windows\Performance
2015-12-07 22:24 - 2009-07-13 21:20 - 00000000 ____D C:\windows\tracing
2015-12-07 02:36 - 2013-01-16 22:36 - 00002329 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-12-04 19:29 - 2012-11-30 15:09 - 00004032 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-12-04 19:29 - 2012-11-30 15:09 - 00003780 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-12-04 02:06 - 2013-07-04 10:29 - 00000000 ____D C:\Users\Jorge\AppData\Local\Psi
2015-12-04 00:40 - 2013-01-16 22:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-12-04 00:40 - 2012-10-26 02:04 - 00000000 ____D C:\Users\Jorge
2015-12-04 00:28 - 2009-07-13 21:20 - 00000000 ____D C:\windows\PolicyDefinitions
2015-12-03 11:25 - 2012-10-28 23:50 - 00000000 ____D C:\ProgramData\Skype
2015-12-03 11:08 - 2012-10-26 02:31 - 00000000 ____D C:\Users\Jorge\Documents\Youcam
2015-12-03 03:27 - 2009-07-13 21:20 - 00000000 ____D C:\windows\Globalization
2015-12-02 03:11 - 2013-05-03 13:02 - 00000000 ____D C:\Users\Jorge\AppData\Roaming\gtk-2.0
2015-12-01 23:16 - 2009-07-13 21:20 - 00000000 ____D C:\windows\Branding
2015-12-01 11:45 - 2015-11-06 20:57 - 00000000 ____D C:\Users\Jorge\Downloads\PopcornTime
2015-12-01 00:16 - 2009-07-13 23:32 - 00000000 ____D C:\windows\addins
2015-11-30 23:47 - 2012-11-22 03:24 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-11-30 23:31 - 2011-02-14 15:43 - 00000000 ____D C:\windows\Panther
2015-11-30 23:07 - 2012-10-25 23:04 - 00000000 ____D C:\Users\Jorge\AppData\Roaming\ICQ
2015-11-30 10:18 - 2012-04-24 21:11 - 23864880 _____ (Macrovision Corporation) C:\Users\Public\Desktop\TurboBoostMonitor.exe
2015-11-30 10:13 - 2015-06-21 16:41 - 01419384 _____ C:\Users\Jorge\Downloads\80176-670969-jdownloader.exe
2015-11-30 10:13 - 2015-01-19 12:39 - 07499328 _____ (Tim Kosse) C:\Users\Jorge\Downloads\FileZilla_3.10.0.2_win32-setup.exe
2015-11-30 10:13 - 2014-10-09 11:01 - 07176070 _____ (Tim Kosse) C:\Users\Jorge\Downloads\FileZilla_3.9.0.5_win32-setup.exe
2015-11-30 10:13 - 2014-09-23 12:29 - 03667488 _____ (VIP Technologies ) C:\Users\Jorge\Downloads\vip72socks-set.exe
2015-11-30 10:13 - 2014-08-21 02:04 - 07170737 _____ (Tim Kosse) C:\Users\Jorge\Downloads\FileZilla_3.9.0.3_win32-setup.exe
2015-11-30 10:13 - 2014-08-10 17:54 - 06131712 _____ (OpenVPN Technologies) C:\Users\Jorge\Downloads\privatetunnel-win-2.3.exe
2015-11-27 03:26 - 2015-03-05 00:43 - 00000000 ____D C:\Users\Jorge\Desktop\Internet Marketing
2015-11-27 02:39 - 2015-06-11 15:06 - 00000000 ____D C:\Users\Jorge\AppData\LocalLow\LastPass
2015-11-26 23:50 - 2013-09-15 19:49 - 00007616 _____ C:\Users\Jorge\AppData\Local\Resmon.ResmonCfg
2015-11-23 22:20 - 2015-03-05 18:42 - 00000000 ____D C:\Users\Jorge\AppData\Local\Popcorn-Time
2015-11-13 00:34 - 2013-06-12 00:15 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2015-11-13 00:09 - 2013-10-25 13:51 - 00000000 ____D C:\Users\Jorge\Desktop\Random
2015-11-13 00:06 - 2013-01-21 23:57 - 00000000 ____D C:\Users\Jorge\Desktop\Production
2015-11-12 11:51 - 2014-07-13 17:07 - 00034720 ____H (LogMeIn, Inc.) C:\windows\system32\hamachi.sys
2015-11-11 16:23 - 2012-04-24 20:23 - 00000000 ____D C:\Program Files\Windows Journal
2015-11-11 12:00 - 2012-11-02 11:23 - 01691906 _____ C:\windows\SysWOW64\PerfStringBackup.INI
2015-11-10 00:36 - 2012-10-26 02:36 - 00000000 ____D C:\Users\Jorge\AppData\Local\ElevatedDiagnostics
2015-11-10 00:09 - 2013-02-14 22:55 - 00000000 ____D C:\Temp
2015-11-10 00:09 - 2012-04-25 20:03 - 00000000 ____D C:\ProgramData\NVIDIA

==================== Files in the root of some directories =======

2015-12-02 16:33 - 2015-12-02 16:33 - 0000132 _____ () C:\Users\Jorge\AppData\Roaming\Adobe IllExport Filter CS6 Prefs
2015-09-09 15:28 - 2015-09-13 23:29 - 0000132 _____ () C:\Users\Jorge\AppData\Roaming\Adobe PNG Format CS6 Prefs
2013-05-30 13:14 - 2013-05-30 13:14 - 0000000 ____H () C:\Users\Jorge\AppData\Roaming\begin.txt
2015-11-15 04:20 - 2015-12-07 23:38 - 2520755 _____ () C:\Users\Jorge\AppData\Roaming\jorge-ms_64
2013-06-20 22:42 - 2013-06-21 18:55 - 0002391 ____H () C:\Users\Jorge\AppData\Roaming\net.telestream.producer.xml
2015-10-05 14:44 - 2015-10-05 14:44 - 0000004 _____ () C:\Users\Jorge\AppData\Roaming\steam_md4.dat
2013-12-19 00:48 - 2013-12-19 00:48 - 0000030 ____H () C:\Users\Jorge\AppData\Roaming\WB.CFG
2015-09-09 16:54 - 2015-10-20 00:24 - 0001456 _____ () C:\Users\Jorge\AppData\Local\Adobe Save for Web 13.0 Prefs
2015-01-23 02:31 - 2015-01-23 02:31 - 0000600 _____ () C:\Users\Jorge\AppData\Local\PUTTY.RND
2015-09-11 00:38 - 2015-09-11 00:38 - 0000857 _____ () C:\Users\Jorge\AppData\Local\recently-used.xbel
2013-09-15 19:49 - 2015-11-26 23:50 - 0007616 _____ () C:\Users\Jorge\AppData\Local\Resmon.ResmonCfg
2015-05-03 04:08 - 2015-05-03 04:08 - 0000000 _____ () C:\Users\Jorge\AppData\Local\{7C533208-C60D-4CC0-B0D4-1EEF88698DB0}
2013-02-28 20:55 - 2013-02-28 20:55 - 0000095 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
2015-09-09 03:02 - 2015-09-09 03:02 - 0004973 _____ () C:\ProgramData\uowzbvmm.cjf

Files to move or delete:
====================
C:\Users\Jorge\SSLLib 1.1.dll


Some files in TEMP:
====================
C:\Users\Jorge\AppData\Local\Temp\dllnt_dump.dll
C:\Users\Jorge\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp_volwz.dll
C:\Users\Jorge\AppData\Local\Temp\hrloyc.exe
C:\Users\Jorge\AppData\Local\Temp\sprh.exe


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\SysWOW64\wininit.exe => File is digitally signed
C:\windows\explorer.exe => File is digitally signed
C:\windows\SysWOW64\explorer.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\SysWOW64\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\SysWOW64\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\SysWOW64\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\dnsapi.dll => File is digitally signed
C:\windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-10-14 06:56

==================== End of FRST.txt ============================



#8 Jo*

Jo*

  • Malware Response Team
  • 3,445 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:09:54 PM

Posted 09 December 2015 - 05:56 PM

Hello superyui,

as you ran Combofix before, can you post the log please?

Case C:\pcre.exe is still on your pc:
Please go to one of the below sites to scan the following file(s):
Virus Total (Recommended)
jotti.org
VirScan
click on Browse, and upload the following file(s) for analysis:

C:\pcre.exe

Then click Submit. Allow the file to be scanned, and then please copy and paste the results link (for Virus Total) here for me to see.
If it says already scanned -- click "reanalyze now"
Please post the results in your next reply.
 

***


Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
Save it in the same location as / FSRT / FSRT64 (usually your desktop) as fixlist.txt

 
start
CreateRestorePoint:
CloseProcesses:
EmptyTemp:
C:\pcre.exe
C:\Users\Jorge\SSLLib 1.1.dll
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 MGHwCtrl; \??\C:\Program Files\MSI\MSI Software Install\MGHwCtrl.sys [X]
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]
S2 FastUserSwitchingCompatibility; C:\windows\installer\AMDEx3.msi [X]
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\firefox.cfg [2013-06-10] <==== ATTENTION
AlternateShell:
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-3234211791-2759061018-4055047508-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {C7253179-90B7-45E8-8A16-58B517C9EB40} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSITDF&pc=MAM3&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {C7253179-90B7-45E8-8A16-58B517C9EB40} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSITDF&pc=MAM3&src=IE-SearchBox
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.8.823\_platform_specific\win_x86\widevinecdmadapter.dll => No File
Task: {01B26980-3030-4E6E-8B22-37A2A5F2AC0B} - \Updater12555.exe -> No File <==== ATTENTION
Task: {2E5C9AF2-CCF3-46D3-B4F5-6DA560620441} - \DealPlyUpdate -> No File <==== ATTENTION
Task: {BF5B3073-4D69-48D8-BB35-49C460EFDEBA} - \Express FilesUpdate -> No File <==== ATTENTION
end


NOTICE: This script was written specifically for this user, for use on that particular machine.
Running this on another machine may cause damage to your operating system


Run FRST / FSRT64 again like we did before but this time press the Fix button just once and wait.
The tool will make a log (Fixlog.txt) please post it to your reply.


***


FRST / FSRT64: run it again.
  • Right-click FRST / FSRT64 then click "Run as administrator" (XP users: click run after receipt of Windows Security Warning - Open File).
  • When the tool opens, click Yes to disclaimer.
  • Press the Scan button.
  • When finished, it will produce a log called FRST.txt in the same directory the tool was run from.
  • Please copy and paste the log in your next reply.

***


Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.


#9 superyui

superyui
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:01:54 PM

Posted 09 December 2015 - 06:54 PM

Thanks man, here we go

 

ComboFix 15-12-07.01 - Jorge 09/12/2015   1:34.1.8 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.52.3082.18.12185.8927 [GMT -6:00]
Running from: c:\users\Jorge\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\data
c:\data\Sylenth_setup.exe
c:\program files (x86)\Common Files\lpuninstall.exe
c:\programdata\ntuser.pol
c:\programdata\Roaming
c:\users\Jorge\AppData\Roaming\Local
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\af_ZA\af_ZA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\af_ZA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ar_EG\ar_EG.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ar_EG\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ar_SA\ar_SA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ar_SA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\az_AZ\az_AZ.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\az_AZ\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\be_BY\be_BY.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\be_BY\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\bg_BG\bg_BG.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\bg_BG\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\bn_BD\bn_BD.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\bn_BD\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\bs_BA\bs_BA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\bs_BA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ca_ES\ca_ES.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ca_ES\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\cs_CZ\cs_CZ.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\cs_CZ\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\da_DK\da_DK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\da_DK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\de_DE\de_DE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\de_DE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\de_DE\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\de_DE\wxstd.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\el_GR\el_GR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\el_GR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\en_AU\en_AU.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\en_AU\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\en_GB\en_GB.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\en_GB\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\en_US\en_US.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\en_US\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\eo_US\eo_US.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\eo_US\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\es_ES\es_ES.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\es_ES\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\es_MX\es_MX.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\es_MX\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\et_EE\et_EE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\et_EE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\fa_IR\fa_IR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\fa_IR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\fa_IR\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\fi_FI\fi_FI.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\fi_FI\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\fo_FO\fo_FO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\fo_FO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\fr_CA\fr_CA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\fr_CA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\fr_FR\fr_FR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\fr_FR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\fr_FR\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ga_IE\ga_IE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ga_IE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\gl_ES\gl_ES.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\gl_ES\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\gu_IN\gu_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\gu_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\he_IL\he_IL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\he_IL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\he_IL\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\hi_IN\hi_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\hi_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\hr_HR\hr_HR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\hr_HR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\hu_HU\hu_HU.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\hu_HU\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\id_ID\id_ID.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\id_ID\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\is_IS\is_IS.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\is_IS\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\it_IT\it_IT.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\it_IT\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ja_JP\ja_JP.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ja_JP\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ka_GE\ka_GE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ka_GE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\kn_IN\kn_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\kn_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ko_KR\ko_KR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ko_KR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\lt_LT\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\lt_LT\lt_LT.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\lv_LV\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\lv_LV\lv_LV.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\mg_MG\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\mg_MG\mg_MG.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\mk_MK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\mk_MK\mk_MK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ml_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ml_IN\ml_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\mr_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\mr_IN\mr_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ms_MY\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ms_MY\ms_MY.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\nb_NO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\nb_NO\nb_NO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ne_NP\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ne_NP\ne_NP.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\nl_NL\junk.html
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\nl_NL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\nl_NL\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\nl_NL\nl_NL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\nn_NO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\nn_NO\nn_NO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\pa_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\pa_IN\pa_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\pl_PL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\pl_PL\pl_PL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\pt_BR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\pt_BR\pt_BR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\pt_PT\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\pt_PT\pt_PT.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ro_RO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ro_RO\ro_RO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ru_RU\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ru_RU\ru_RU.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\si_LK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\si_LK\si_LK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\sk_SK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\sk_SK\sk_SK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\sl_SI\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\sl_SI\sl_SI.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\sq_AL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\sq_AL\sq_AL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\sr_RS\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\sr_RS\sr_RS.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\sv_SE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\sv_SE\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\sv_SE\sv_SE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ta_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ta_IN\ta_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\th_TH\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\th_TH\th_TH.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\tl_PH\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\tl_PH\tl_PH.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\tr_TR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\tr_TR\tr_TR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\uk_UA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\uk_UA\uk_UA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ur_PK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\ur_PK\ur_PK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\vi_VN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\vi_VN\vi_VN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\zh_CN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\zh_CN\zh_CN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\zh_TW\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\languages\zh_TW\zh_TW.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\lp_languages.zip
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\nplastpass.dll
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp\nplastpass64.dll
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\af_ZA\af_ZA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\af_ZA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ar_EG\ar_EG.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ar_EG\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ar_SA\ar_SA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ar_SA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\az_AZ\az_AZ.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\az_AZ\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\be_BY\be_BY.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\be_BY\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\bg_BG\bg_BG.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\bg_BG\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\bn_BD\bn_BD.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\bn_BD\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\bs_BA\bs_BA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\bs_BA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ca_ES\ca_ES.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ca_ES\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\cs_CZ\cs_CZ.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\cs_CZ\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\da_DK\da_DK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\da_DK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\de_DE\de_DE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\de_DE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\de_DE\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\de_DE\wxstd.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\el_GR\el_GR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\el_GR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\en_AU\en_AU.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\en_AU\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\en_GB\en_GB.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\en_GB\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\en_US\en_US.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\en_US\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\eo_US\eo_US.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\eo_US\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\es_ES\es_ES.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\es_ES\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\es_MX\es_MX.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\es_MX\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\et_EE\et_EE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\et_EE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\fa_IR\fa_IR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\fa_IR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\fa_IR\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\fi_FI\fi_FI.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\fi_FI\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\fo_FO\fo_FO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\fo_FO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\fr_CA\fr_CA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\fr_CA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\fr_FR\fr_FR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\fr_FR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\fr_FR\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ga_IE\ga_IE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ga_IE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\gl_ES\gl_ES.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\gl_ES\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\gu_IN\gu_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\gu_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\he_IL\he_IL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\he_IL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\he_IL\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\hi_IN\hi_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\hi_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\hr_HR\hr_HR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\hr_HR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\hu_HU\hu_HU.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\hu_HU\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\id_ID\id_ID.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\id_ID\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\is_IS\is_IS.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\is_IS\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\it_IT\it_IT.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\it_IT\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ja_JP\ja_JP.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ja_JP\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ka_GE\ka_GE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ka_GE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\kn_IN\kn_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\kn_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ko_KR\ko_KR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ko_KR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\lt_LT\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\lt_LT\lt_LT.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\lv_LV\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\lv_LV\lv_LV.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\mg_MG\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\mg_MG\mg_MG.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\mk_MK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\mk_MK\mk_MK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ml_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ml_IN\ml_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\mr_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\mr_IN\mr_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ms_MY\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ms_MY\ms_MY.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\nb_NO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\nb_NO\nb_NO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ne_NP\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ne_NP\ne_NP.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\nl_NL\junk.html
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\nl_NL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\nl_NL\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\nl_NL\nl_NL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\nn_NO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\nn_NO\nn_NO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\pa_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\pa_IN\pa_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\pl_PL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\pl_PL\pl_PL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\pt_BR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\pt_BR\pt_BR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\pt_PT\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\pt_PT\pt_PT.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ro_RO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ro_RO\ro_RO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ru_RU\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ru_RU\ru_RU.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\si_LK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\si_LK\si_LK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\sk_SK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\sk_SK\sk_SK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\sl_SI\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\sl_SI\sl_SI.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\sq_AL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\sq_AL\sq_AL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\sr_RS\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\sr_RS\sr_RS.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\sv_SE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\sv_SE\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\sv_SE\sv_SE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ta_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ta_IN\ta_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\th_TH\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\th_TH\th_TH.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\tl_PH\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\tl_PH\tl_PH.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\tr_TR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\tr_TR\tr_TR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\uk_UA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\uk_UA\uk_UA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ur_PK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\ur_PK\ur_PK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\vi_VN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\vi_VN\vi_VN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\zh_CN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\zh_CN\zh_CN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\zh_TW\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\languages\zh_TW\zh_TW.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1017547650\lp_languages.zip
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\af_ZA\af_ZA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\af_ZA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ar_EG\ar_EG.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ar_EG\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ar_SA\ar_SA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ar_SA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\az_AZ\az_AZ.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\az_AZ\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\be_BY\be_BY.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\be_BY\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\bg_BG\bg_BG.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\bg_BG\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\bn_BD\bn_BD.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\bn_BD\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\bs_BA\bs_BA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\bs_BA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ca_ES\ca_ES.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ca_ES\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\cs_CZ\cs_CZ.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\cs_CZ\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\da_DK\da_DK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\da_DK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\de_DE\de_DE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\de_DE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\de_DE\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\de_DE\wxstd.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\el_GR\el_GR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\el_GR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\en_AU\en_AU.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\en_AU\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\en_GB\en_GB.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\en_GB\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\en_US\en_US.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\en_US\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\eo_US\eo_US.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\eo_US\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\es_ES\es_ES.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\es_ES\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\es_MX\es_MX.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\es_MX\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\et_EE\et_EE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\et_EE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\fa_IR\fa_IR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\fa_IR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\fa_IR\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\fi_FI\fi_FI.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\fi_FI\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\fo_FO\fo_FO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\fo_FO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\fr_CA\fr_CA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\fr_CA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\fr_FR\fr_FR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\fr_FR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\fr_FR\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ga_IE\ga_IE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ga_IE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\gl_ES\gl_ES.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\gl_ES\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\gu_IN\gu_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\gu_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\he_IL\he_IL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\he_IL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\he_IL\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\hi_IN\hi_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\hi_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\hr_HR\hr_HR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\hr_HR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\hu_HU\hu_HU.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\hu_HU\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\id_ID\id_ID.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\id_ID\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\is_IS\is_IS.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\is_IS\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\it_IT\it_IT.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\it_IT\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ja_JP\ja_JP.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ja_JP\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ka_GE\ka_GE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ka_GE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\kn_IN\kn_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\kn_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ko_KR\ko_KR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ko_KR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\lt_LT\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\lt_LT\lt_LT.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\lv_LV\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\lv_LV\lv_LV.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\mg_MG\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\mg_MG\mg_MG.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\mk_MK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\mk_MK\mk_MK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ml_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ml_IN\ml_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\mr_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\mr_IN\mr_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ms_MY\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ms_MY\ms_MY.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\nb_NO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\nb_NO\nb_NO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ne_NP\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ne_NP\ne_NP.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\nl_NL\junk.html
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\nl_NL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\nl_NL\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\nl_NL\nl_NL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\nn_NO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\nn_NO\nn_NO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\pa_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\pa_IN\pa_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\pl_PL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\pl_PL\pl_PL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\pt_BR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\pt_BR\pt_BR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\pt_PT\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\pt_PT\pt_PT.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ro_RO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ro_RO\ro_RO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ru_RU\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ru_RU\ru_RU.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\si_LK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\si_LK\si_LK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\sk_SK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\sk_SK\sk_SK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\sl_SI\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\sl_SI\sl_SI.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\sq_AL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\sq_AL\sq_AL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\sr_RS\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\sr_RS\sr_RS.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\sv_SE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\sv_SE\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\sv_SE\sv_SE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ta_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ta_IN\ta_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\th_TH\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\th_TH\th_TH.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\tl_PH\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\tl_PH\tl_PH.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\tr_TR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\tr_TR\tr_TR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\uk_UA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\uk_UA\uk_UA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ur_PK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\ur_PK\ur_PK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\vi_VN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\vi_VN\vi_VN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\zh_CN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\zh_CN\zh_CN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\zh_TW\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\languages\zh_TW\zh_TW.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1290088826\lp_languages.zip
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\af_ZA\af_ZA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\af_ZA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ar_EG\ar_EG.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ar_EG\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ar_SA\ar_SA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ar_SA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\az_AZ\az_AZ.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\az_AZ\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\be_BY\be_BY.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\be_BY\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\bg_BG\bg_BG.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\bg_BG\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\bn_BD\bn_BD.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\bn_BD\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\bs_BA\bs_BA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\bs_BA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ca_ES\ca_ES.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ca_ES\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\cs_CZ\cs_CZ.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\cs_CZ\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\da_DK\da_DK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\da_DK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\de_DE\de_DE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\de_DE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\de_DE\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\de_DE\wxstd.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\el_GR\el_GR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\el_GR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\en_AU\en_AU.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\en_AU\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\en_GB\en_GB.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\en_GB\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\en_US\en_US.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\en_US\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\eo_US\eo_US.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\eo_US\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\es_ES\es_ES.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\es_ES\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\es_MX\es_MX.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\es_MX\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\et_EE\et_EE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\et_EE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\fa_IR\fa_IR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\fa_IR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\fa_IR\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\fi_FI\fi_FI.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\fi_FI\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\fo_FO\fo_FO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\fo_FO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\fr_CA\fr_CA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\fr_CA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\fr_FR\fr_FR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\fr_FR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\fr_FR\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ga_IE\ga_IE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ga_IE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\gl_ES\gl_ES.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\gl_ES\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\gu_IN\gu_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\gu_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\he_IL\he_IL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\he_IL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\he_IL\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\hi_IN\hi_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\hi_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\hr_HR\hr_HR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\hr_HR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\hu_HU\hu_HU.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\hu_HU\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\id_ID\id_ID.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\id_ID\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\is_IS\is_IS.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\is_IS\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\it_IT\it_IT.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\it_IT\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ja_JP\ja_JP.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ja_JP\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ka_GE\ka_GE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ka_GE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\kn_IN\kn_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\kn_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ko_KR\ko_KR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ko_KR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\lt_LT\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\lt_LT\lt_LT.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\lv_LV\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\lv_LV\lv_LV.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\mg_MG\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\mg_MG\mg_MG.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\mk_MK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\mk_MK\mk_MK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ml_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ml_IN\ml_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\mr_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\mr_IN\mr_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ms_MY\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ms_MY\ms_MY.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\nb_NO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\nb_NO\nb_NO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ne_NP\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ne_NP\ne_NP.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\nl_NL\junk.html
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\nl_NL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\nl_NL\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\nl_NL\nl_NL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\nn_NO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\nn_NO\nn_NO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\pa_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\pa_IN\pa_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\pl_PL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\pl_PL\pl_PL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\pt_BR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\pt_BR\pt_BR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\pt_PT\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\pt_PT\pt_PT.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ro_RO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ro_RO\ro_RO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ru_RU\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ru_RU\ru_RU.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\si_LK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\si_LK\si_LK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\sk_SK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\sk_SK\sk_SK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\sl_SI\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\sl_SI\sl_SI.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\sq_AL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\sq_AL\sq_AL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\sr_RS\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\sr_RS\sr_RS.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\sv_SE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\sv_SE\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\sv_SE\sv_SE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ta_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ta_IN\ta_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\th_TH\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\th_TH\th_TH.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\tl_PH\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\tl_PH\tl_PH.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\tr_TR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\tr_TR\tr_TR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\uk_UA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\uk_UA\uk_UA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ur_PK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\ur_PK\ur_PK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\vi_VN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\vi_VN\vi_VN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\zh_CN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\zh_CN\zh_CN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\zh_TW\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\languages\zh_TW\zh_TW.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp1334703012\lp_languages.zip
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\af_ZA\af_ZA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\af_ZA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ar_EG\ar_EG.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ar_EG\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ar_SA\ar_SA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ar_SA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\az_AZ\az_AZ.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\az_AZ\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\be_BY\be_BY.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\be_BY\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\bg_BG\bg_BG.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\bg_BG\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\bn_BD\bn_BD.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\bn_BD\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\bs_BA\bs_BA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\bs_BA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ca_ES\ca_ES.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ca_ES\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\cs_CZ\cs_CZ.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\cs_CZ\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\da_DK\da_DK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\da_DK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\de_DE\de_DE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\de_DE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\de_DE\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\de_DE\wxstd.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\el_GR\el_GR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\el_GR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\en_AU\en_AU.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\en_AU\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\en_GB\en_GB.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\en_GB\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\en_US\en_US.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\en_US\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\eo_US\eo_US.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\eo_US\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\es_ES\es_ES.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\es_ES\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\es_MX\es_MX.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\es_MX\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\et_EE\et_EE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\et_EE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\fa_IR\fa_IR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\fa_IR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\fa_IR\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\fi_FI\fi_FI.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\fi_FI\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\fo_FO\fo_FO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\fo_FO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\fr_CA\fr_CA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\fr_CA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\fr_FR\fr_FR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\fr_FR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\fr_FR\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ga_IE\ga_IE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ga_IE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\gl_ES\gl_ES.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\gl_ES\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\gu_IN\gu_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\gu_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\he_IL\he_IL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\he_IL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\he_IL\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\hi_IN\hi_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\hi_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\hr_HR\hr_HR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\hr_HR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\hu_HU\hu_HU.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\hu_HU\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\id_ID\id_ID.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\id_ID\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\is_IS\is_IS.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\is_IS\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\it_IT\it_IT.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\it_IT\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ja_JP\ja_JP.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ja_JP\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ka_GE\ka_GE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ka_GE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\kn_IN\kn_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\kn_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ko_KR\ko_KR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ko_KR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\lt_LT\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\lt_LT\lt_LT.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\lv_LV\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\lv_LV\lv_LV.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\mg_MG\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\mg_MG\mg_MG.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\mk_MK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\mk_MK\mk_MK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ml_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ml_IN\ml_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\mr_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\mr_IN\mr_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ms_MY\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ms_MY\ms_MY.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\nb_NO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\nb_NO\nb_NO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ne_NP\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ne_NP\ne_NP.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\nl_NL\junk.html
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\nl_NL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\nl_NL\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\nl_NL\nl_NL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\nn_NO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\nn_NO\nn_NO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\pa_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\pa_IN\pa_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\pl_PL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\pl_PL\pl_PL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\pt_BR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\pt_BR\pt_BR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\pt_PT\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\pt_PT\pt_PT.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ro_RO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ro_RO\ro_RO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ru_RU\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ru_RU\ru_RU.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\si_LK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\si_LK\si_LK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\sk_SK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\sk_SK\sk_SK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\sl_SI\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\sl_SI\sl_SI.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\sq_AL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\sq_AL\sq_AL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\sr_RS\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\sr_RS\sr_RS.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\sv_SE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\sv_SE\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\sv_SE\sv_SE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ta_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ta_IN\ta_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\th_TH\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\th_TH\th_TH.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\tl_PH\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\tl_PH\tl_PH.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\tr_TR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\tr_TR\tr_TR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\uk_UA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\uk_UA\uk_UA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ur_PK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\ur_PK\ur_PK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\vi_VN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\vi_VN\vi_VN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\zh_CN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\zh_CN\zh_CN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\zh_TW\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\languages\zh_TW\zh_TW.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp2102233140\lp_languages.zip
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\af_ZA\af_ZA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\af_ZA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ar_EG\ar_EG.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ar_EG\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ar_SA\ar_SA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ar_SA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\az_AZ\az_AZ.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\az_AZ\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\be_BY\be_BY.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\be_BY\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\bg_BG\bg_BG.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\bg_BG\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\bn_BD\bn_BD.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\bn_BD\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\bs_BA\bs_BA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\bs_BA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ca_ES\ca_ES.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ca_ES\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\cs_CZ\cs_CZ.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\cs_CZ\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\da_DK\da_DK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\da_DK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\de_DE\de_DE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\de_DE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\de_DE\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\de_DE\wxstd.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\el_GR\el_GR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\el_GR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\en_AU\en_AU.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\en_AU\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\en_GB\en_GB.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\en_GB\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\en_US\en_US.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\en_US\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\eo_US\eo_US.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\eo_US\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\es_ES\es_ES.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\es_ES\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\es_MX\es_MX.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\es_MX\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\et_EE\et_EE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\et_EE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\fa_IR\fa_IR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\fa_IR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\fa_IR\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\fi_FI\fi_FI.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\fi_FI\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\fo_FO\fo_FO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\fo_FO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\fr_CA\fr_CA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\fr_CA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\fr_FR\fr_FR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\fr_FR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\fr_FR\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ga_IE\ga_IE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ga_IE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\gl_ES\gl_ES.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\gl_ES\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\gu_IN\gu_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\gu_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\he_IL\he_IL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\he_IL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\he_IL\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\hi_IN\hi_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\hi_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\hr_HR\hr_HR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\hr_HR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\hu_HU\hu_HU.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\hu_HU\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\id_ID\id_ID.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\id_ID\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\is_IS\is_IS.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\is_IS\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\it_IT\it_IT.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\it_IT\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ja_JP\ja_JP.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ja_JP\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ka_GE\ka_GE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ka_GE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\kn_IN\kn_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\kn_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ko_KR\ko_KR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ko_KR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\lt_LT\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\lt_LT\lt_LT.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\lv_LV\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\lv_LV\lv_LV.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\mg_MG\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\mg_MG\mg_MG.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\mk_MK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\mk_MK\mk_MK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ml_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ml_IN\ml_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\mr_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\mr_IN\mr_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ms_MY\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ms_MY\ms_MY.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\nb_NO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\nb_NO\nb_NO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ne_NP\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ne_NP\ne_NP.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\nl_NL\junk.html
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\nl_NL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\nl_NL\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\nl_NL\nl_NL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\nn_NO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\nn_NO\nn_NO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\pa_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\pa_IN\pa_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\pl_PL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\pl_PL\pl_PL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\pt_BR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\pt_BR\pt_BR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\pt_PT\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\pt_PT\pt_PT.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ro_RO\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ro_RO\ro_RO.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ru_RU\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ru_RU\ru_RU.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\si_LK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\si_LK\si_LK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\sk_SK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\sk_SK\sk_SK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\sl_SI\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\sl_SI\sl_SI.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\sq_AL\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\sq_AL\sq_AL.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\sr_RS\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\sr_RS\sr_RS.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\sv_SE\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\sv_SE\messages.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\sv_SE\sv_SE.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ta_IN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ta_IN\ta_IN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\th_TH\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\th_TH\th_TH.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\tl_PH\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\tl_PH\tl_PH.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\tr_TR\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\tr_TR\tr_TR.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\uk_UA\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\uk_UA\uk_UA.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ur_PK\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\ur_PK\ur_PK.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\vi_VN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\vi_VN\vi_VN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\zh_CN\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\zh_CN\zh_CN.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\zh_TW\lastpass.mo
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\languages\zh_TW\zh_TW.xpm
c:\users\Jorge\AppData\Roaming\Local\Temp\lptmp639838938\lp_languages.zip
c:\windows\msdownld.tmp
D:\hyumr.pif
D:\install.exe
.
.
(((((((((((((((((((((((((   Files Created from 2015-11-09 to 2015-12-09  )))))))))))))))))))))))))))))))
.
.
2015-12-09 07:49 . 2015-12-09 07:49    --------    d-----w-    c:\users\Default\AppData\Local\temp
2015-12-09 07:42 . 2015-12-09 07:42    75888    ----a-w-    c:\programdata\Microsoft\Windows Defender\Definition Updates\{518BC937-C628-43A5-8739-797AB5A8450E}\offreg.7804.dll
2015-12-09 07:20 . 2015-12-09 07:20    103140    ----a-w-    C:\pcre.exe
2015-12-08 21:34 . 2015-10-29 09:28    11138400    ----a-w-    c:\programdata\Microsoft\Windows Defender\Definition Updates\{518BC937-C628-43A5-8739-797AB5A8450E}\mpengine.dll
2015-12-04 06:36 . 2015-12-04 06:40    --------    d-----w-    C:\AdwCleaner
2015-12-01 05:48 . 2015-12-09 07:21    192216    ----a-w-    c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-12-01 05:47 . 2015-12-01 05:48    --------    d-----w-    c:\program files (x86)\Malwarebytes Anti-Malware
2015-12-01 05:47 . 2015-10-05 15:50    63704    ----a-w-    c:\windows\system32\drivers\mwac.sys
2015-12-01 05:47 . 2015-10-05 15:50    109272    ----a-w-    c:\windows\system32\drivers\mbamchameleon.sys
2015-12-01 05:47 . 2015-10-05 15:50    25816    ----a-w-    c:\windows\system32\drivers\mbam.sys
2015-11-27 06:13 . 2015-11-27 06:13    --------    d-----w-    c:\program files (x86)\LogMeIn Hamachi
2015-11-11 23:02 . 2015-11-11 23:02    901856    ----a-w-    c:\program files\Common Files\Microsoft Shared\OFFICE14\ACEEXCL.DLL
2015-11-11 08:07 . 2015-11-11 08:07    1199296    ----a-w-    c:\program files\Common Files\Microsoft Shared\OFFICE14\MSPTLS.DLL
2015-11-10 23:28 . 2015-10-13 16:41    497664    ----a-w-    c:\windows\system32\drivers\afd.sys
2015-11-10 06:36 . 2015-11-10 06:36    --------    d-----w-    c:\users\Jorge\AppData\Roaming\Daybreak Game Company
2015-11-10 06:09 . 2015-11-10 06:09    --------    d-----w-    c:\windows\SysWow64\NV
2015-11-10 06:09 . 2015-11-10 06:09    --------    d-----w-    c:\windows\system32\NV
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-12-09 05:16 . 2012-10-26 08:40    796864    ----a-w-    c:\windows\SysWow64\FlashPlayerApp.exe
2015-12-09 05:16 . 2012-04-26 04:14    142528    ----a-w-    c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-11-26 06:52 . 2012-04-26 04:16    2748416    ----a-w-    c:\programdata\Microsoft\OEMOffice14\OStarter\zh-tw\SetupConsumerC2R.exe
2015-11-26 06:52 . 2012-04-26 04:16    1627488    ----a-w-    c:\programdata\Microsoft\OEMOffice14\OStarter\zh-tw\SetupConsumerC2ROLW.exe
2015-11-26 06:52 . 2012-04-26 04:16    5337088    ----a-w-    c:\programdata\Microsoft\OEMOffice14\OStarter\zh-tw\Office.exe
2015-11-26 06:52 . 2012-04-26 04:15    1630208    ----a-w-    c:\programdata\Microsoft\OEMOffice14\OStarter\es-es\SetupConsumerC2ROLW.exe
2015-11-26 06:51 . 2012-04-26 04:15    1630208    ----a-w-    c:\programdata\Microsoft\OEMOffice14\OStarter\en-us\SetupConsumerC2R.exe
2015-11-26 06:51 . 2012-04-26 04:15    1628560    ----a-w-    c:\programdata\Microsoft\OEMOffice14\OStarter\en-us\SetupConsumerC2ROLW.exe
2015-11-26 06:51 . 2012-04-26 04:15    151552    ----a-w-    c:\programdata\Microsoft\OEMOffice14\Office14\SingleImage.WW\ose.exe
2015-11-26 03:37 . 2012-04-26 04:15    1629112    ----a-w-    c:\programdata\Microsoft\OEMOffice14\OStarter\fr-fr\SetupConsumerC2R.exe
2015-11-26 03:37 . 2012-04-26 04:15    5337088    ----a-w-    c:\programdata\Microsoft\OEMOffice14\OStarter\es-es\Office.exe
2015-11-26 03:37 . 2012-04-26 04:15    1630208    ----a-w-    c:\programdata\Microsoft\OEMOffice14\OStarter\es-es\SetupConsumerC2R.exe
2015-11-26 03:37 . 2012-04-26 04:15    5337088    ----a-w-    c:\programdata\Microsoft\OEMOffice14\OStarter\en-us\Office.exe
2015-11-26 03:34 . 2012-04-26 04:16    520192    ----a-w-    c:\programdata\Microsoft\OEMOffice14\Office14\Office.zh-tw\dwtrig20.exe
2015-11-26 03:34 . 2012-04-26 04:15    1637792    ----a-w-    c:\programdata\Microsoft\OEMOffice14\Office14\Office.fr-fr\dwtrig20.exe
2015-11-26 03:34 . 2012-04-26 04:15    839680    ----a-w-    c:\programdata\Microsoft\OEMOffice14\Office14\Office.es-es\DW20.EXE
2015-11-26 03:34 . 2012-04-26 04:15    1637792    ----a-w-    c:\programdata\Microsoft\OEMOffice14\Office14\Office.es-es\dwtrig20.exe
2015-11-26 03:34 . 2012-04-26 04:15    1637792    ----a-w-    c:\programdata\Microsoft\OEMOffice14\Office14\Office.en-us\dwtrig20.exe
2015-11-12 17:51 . 2014-07-13 23:07    34720    ---ha-w-    c:\windows\system32\hamachi.sys
2015-11-05 17:13 . 2015-06-11 04:01    1756424    ----a-w-    c:\windows\system32\nvspbridge64.dll
2015-11-05 17:13 . 2015-06-11 04:01    1710752    ----a-w-    c:\windows\system32\nvspcap64.dll
2015-11-05 17:13 . 2015-06-11 04:01    1423304    ----a-w-    c:\windows\SysWow64\nvspcap.dll
2015-11-05 17:13 . 2015-06-11 04:01    1316000    ----a-w-    c:\windows\SysWow64\nvspbridge.dll
2015-11-05 17:13 . 2015-06-11 03:59    72504    ----a-w-    c:\windows\system32\nvaudcap64v.dll
2015-11-05 17:13 . 2013-05-22 07:07    388208    ----a-w-    c:\windows\SysWow64\nvumdshim.dll
2015-11-05 17:13 . 2012-04-26 02:03    467912    ----a-w-    c:\windows\system32\nvumdshimx.dll
2015-11-05 17:13 . 2012-04-26 02:03    177600    ----a-w-    c:\windows\system32\nvinitx.dll
2015-11-05 17:13 . 2012-04-26 02:03    155792    ----a-w-    c:\windows\SysWow64\nvinit.dll
2015-11-05 17:13 . 2012-04-26 02:03    3579000    ----a-w-    c:\windows\system32\nvapi64.dll
2015-11-05 17:13 . 2012-04-26 02:03    3158736    ----a-w-    c:\windows\SysWow64\nvapi.dll
2015-11-05 15:13 . 2012-04-26 02:03    6358648    ----a-w-    c:\windows\system32\nvcpl.dll
2015-11-05 15:13 . 2012-04-26 02:03    2983032    ----a-w-    c:\windows\system32\nvsvc64.dll
2015-11-05 15:13 . 2012-04-26 02:03    938616    ----a-w-    c:\windows\system32\nvvsvc.exe
2015-11-05 15:13 . 2012-04-26 02:03    74872    ----a-w-    c:\windows\system32\nv3dappshextr.dll
2015-11-05 15:13 . 2012-04-26 02:03    62584    ----a-w-    c:\windows\system32\nvshext.dll
2015-11-05 15:13 . 2012-04-26 02:03    523568    ----a-w-    c:\windows\system32\nv3dappshext.dll
2015-11-05 15:13 . 2012-04-26 02:03    385328    ----a-w-    c:\windows\system32\nvmctray.dll
2015-11-05 15:13 . 2012-04-26 02:03    2554488    ----a-w-    c:\windows\system32\nvsvcr.dll
2015-11-03 00:48 . 2013-03-27 01:32    111928    ----a-w-    c:\windows\SysWow64\PnkBstrB.exe
2015-11-03 00:48 . 2013-03-27 01:32    111928    ----a-w-    c:\windows\SysWow64\PnkBstrB.ex0
2015-10-29 17:50 . 2015-11-10 23:28    350208    ----a-w-    c:\windows\apppatch\AppPatch64\AcLayers.dll
2015-10-29 17:50 . 2015-11-10 23:28    309248    ----a-w-    c:\windows\apppatch\AppPatch64\AcGenral.dll
2015-10-29 17:50 . 2015-11-10 23:28    135168    ----a-w-    c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2015-10-29 17:50 . 2015-11-10 23:28    103424    ----a-w-    c:\windows\apppatch\AppPatch64\acspecfc.dll
2015-10-29 17:49 . 2015-11-10 23:28    562176    ----a-w-    c:\windows\apppatch\AcLayers.dll
2015-10-29 17:49 . 2015-11-10 23:28    470528    ----a-w-    c:\windows\apppatch\AcSpecfc.dll
2015-10-29 17:49 . 2015-11-10 23:28    2178560    ----a-w-    c:\windows\apppatch\AcGenral.dll
2015-10-29 17:49 . 2015-11-10 23:28    211968    ----a-w-    c:\windows\apppatch\AcXtrnal.dll
2015-10-29 17:39 . 2015-11-10 23:28    2560    ----a-w-    c:\windows\apppatch\AcRes.dll
2015-10-28 07:42 . 2012-04-26 02:03    6027430    ----a-w-    c:\windows\system32\nvcoproc.bin
2015-10-20 00:45 . 2015-11-10 23:29    44032    ----a-w-    c:\windows\apppatch\acwow64.dll
2015-10-13 07:29 . 2015-10-13 07:29    875720    ----a-w-    c:\windows\SysWow64\msvcr120_clr0400.dll
2015-10-13 07:22 . 2015-10-13 07:22    869568    ----a-w-    c:\windows\system32\msvcr120_clr0400.dll
2015-10-07 03:07 . 2012-04-26 04:09    90112    ----a-w-    c:\windows\Updreg.EXE
2015-10-06 20:50 . 2015-10-06 20:50    478392    ----a-w-    c:\windows\system32\drivers\E8655EDC.sys
2015-10-01 18:06 . 2015-10-13 18:22    692672    ----a-w-    c:\windows\system32\winload.efi
2015-10-01 18:04 . 2015-10-13 18:22    616360    ----a-w-    c:\windows\system32\winresume.efi
2015-10-01 18:00 . 2015-10-13 18:22    63488    ----a-w-    c:\windows\system32\setbcdlocale.dll
2015-10-01 18:00 . 2015-10-13 18:22    59392    ----a-w-    c:\windows\system32\appidapi.dll
2015-10-01 18:00 . 2015-10-13 18:22    32768    ----a-w-    c:\windows\system32\appidsvc.dll
2015-10-01 18:00 . 2015-10-13 18:22    17920    ----a-w-    c:\windows\system32\appidcertstorecheck.exe
2015-10-01 18:00 . 2015-10-13 18:22    147456    ----a-w-    c:\windows\system32\appidpolicyconverter.exe
2015-10-01 17:50 . 2015-10-13 18:22    50688    ----a-w-    c:\windows\SysWow64\appidapi.dll
2015-10-01 17:00 . 2015-10-13 18:22    61440    ----a-w-    c:\windows\system32\drivers\appid.sys
2015-09-25 00:02 . 2015-09-25 00:02    682280    ----a-w-    c:\windows\SysWow64\pbsvc.exe
2015-09-18 19:22 . 2015-10-15 19:14    25432    ----a-w-    c:\windows\system32\CompatTelRunner.exe
2015-09-18 19:19 . 2015-10-15 19:14    700416    ----a-w-    c:\windows\system32\invagent.dll
2015-09-18 19:19 . 2015-10-15 19:14    766464    ----a-w-    c:\windows\system32\generaltel.dll
2015-09-18 19:19 . 2015-10-15 19:14    503808    ----a-w-    c:\windows\system32\devinv.dll
2015-09-18 19:19 . 2015-10-15 19:14    1291264    ----a-w-    c:\windows\system32\appraiser.dll
2015-09-18 19:19 . 2015-10-15 19:14    73216    ----a-w-    c:\windows\system32\acmigration.dll
2015-09-18 19:09 . 2015-10-15 19:14    1163776    ----a-w-    c:\windows\system32\aeinv.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2015-11-04 23:46    198464    ----a-w-    c:\users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2015-11-04 23:46    198464    ----a-w-    c:\users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt3]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2015-11-04 23:46    198464    ----a-w-    c:\users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt4]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2015-11-04 23:46    198464    ----a-w-    c:\users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt5]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2015-11-04 23:46    198464    ----a-w-    c:\users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt6]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2015-11-04 23:46    198464    ----a-w-    c:\users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt7]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2015-11-04 23:46    198464    ----a-w-    c:\users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt8]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2015-11-04 23:46    198464    ----a-w-    c:\users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2015-11-04 23:46    198464    ----a-w-    c:\users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2015-11-04 23:46    198464    ----a-w-    c:\users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt5]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2015-11-04 23:46    198464    ----a-w-    c:\users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2015-11-16 8322328]
"Dropbox Update"="c:\users\Jorge\AppData\Local\Dropbox\Update\DropboxUpdate.exe" [2015-06-28 1252720]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2015-11-30 50509440]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2011-11-30 284440]
"USB3MON"="c:\program files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-01-04 291608]
"Super-Charger"="c:\program files (x86)\MSI\Super-Charger\Super-Charger.exe" [2012-01-03 576016]
"THX Audio Control Panel"="c:\program files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe" [2011-08-29 1517056]
"UpdReg"="c:\windows\UpdReg.EXE" [2015-10-07 90112]
"VGAOCAP"="c:\program files (x86)\MSI\MSI VGA Overclock Tool\VGAOCAP.exe" [2012-01-31 88576]
"YouCam Mirage"="c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe" [2011-10-13 214312]
"YouCam Tray"="c:\program files (x86)\CyberLink\YouCam\YouCam.exe" [2011-10-13 300328]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2015-08-04 597552]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2015-12-09 3313664]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2015-12-09 2756608]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2015-11-12 5565448]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"KSS"="c:\program files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe" [2015-06-03 919296]
.
c:\users\Jorge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Jorge\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2015-5-4 36713096]
EvernoteClipper.lnk - c:\program files (x86)\Evernote\Evernote\EvernoteClipper.exe [2015-7-1 1210376]
MagicDisc.lnk - c:\program files (x86)\MagicDisc\MagicDisc.exe [2013-6-10 576000]
Psi.lnk - c:\program files (x86)\Psi\Psi.exe [2012-10-3 7036928]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Qualcomm Atheros Killer Network Manager.lnk - c:\program files\Qualcomm Atheros\Killer Network Manager\KillerNetManager.exe -minimized [2012-3-7 549888]
Ralink Wireless Utility.lnk - c:\program files (x86)\RALINK\Common\RaUI.exe -s [2014-9-9 692224]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\E8655EDC.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
.
R2 BstHdAndroidSvc;BlueStacks Android Service;c:\program files (x86)\BlueStacks\HD-Service.exe BstHdAndroidSvc Android;c:\program files (x86)\BlueStacks\HD-Service.exe BstHdAndroidSvc Android [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
R2 mi-raysat_3dsmax2014_64;mental ray Satellite for Autodesk 3ds Max 2014 64-bit;c:\program files\Autodesk\3ds Max 2014\NVIDIA\Satellite\raysat_3dsmax2014_64server.exe;c:\program files\Autodesk\3ds Max 2014\NVIDIA\Satellite\raysat_3dsmax2014_64server.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 AMPPALP;Protocolo Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed;c:\windows\system32\DRIVERS\amppal.sys;c:\windows\SYSNATIVE\DRIVERS\amppal.sys [x]
R3 BEService;BattlEye Service;c:\program files (x86)\Common Files\BattlEye\BEService.exe;c:\program files (x86)\Common Files\BattlEye\BEService.exe [x]
R3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys;c:\windows\SYSNATIVE\DRIVERS\btmaux.sys [x]
R3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys;c:\windows\SYSNATIVE\DRIVERS\btmhsf.sys [x]
R3 ck3iusb64;XECUTER CK3i USB Controller Driver;c:\windows\system32\DRIVERS\ck3iusb64.sys;c:\windows\SYSNATIVE\DRIVERS\ck3iusb64.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 DrvAgent64;DrvAgent64;c:\windows\SysWOW64\Drivers\DrvAgent64.SYS;c:\windows\SysWOW64\Drivers\DrvAgent64.SYS [x]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [x]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [x]
R3 FOLIKRSV;FOLIKRSV;c:\users\Jorge\AppData\Roaming\Follow Liker\mdb\bin\folikrSrv.exe;c:\users\Jorge\AppData\Roaming\Follow Liker\mdb\bin\folikrSrv.exe [x]
R3 ibtfltcoex;ibtfltcoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys;c:\windows\SYSNATIVE\DRIVERS\iBtFltCoex.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 ipadtst;ipadtst;c:\program files (x86)\MSI\Super-Charger\ipadtst_64.sys;c:\program files (x86)\MSI\Super-Charger\ipadtst_64.sys [x]
R3 libusb0;LibUsb-Win32 - Kernel Driver 03/20/2007, 0.1.12.1;c:\windows\system32\DRIVERS\libusb0.sys;c:\windows\SYSNATIVE\DRIVERS\libusb0.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 MGHwCtrl;MGHwCtrl;c:\program files\MSI\MSI Software Install\MGHwCtrl.sys;c:\program files\MSI\MSI Software Install\MGHwCtrl.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 netr7364;Controlador de tarjeta LAN inalámbrica USB RT73 para Vista;c:\windows\system32\DRIVERS\netr7364.sys;c:\windows\SYSNATIVE\DRIVERS\netr7364.sys [x]
R3 NUMARK_NS6_MIDI;Numark NS6 MIDI device;c:\windows\system32\drivers\ns6_midi.sys;c:\windows\SYSNATIVE\drivers\ns6_midi.sys [x]
R3 NUMARK_NS6_USB;Numark NS6 USB driver service;c:\windows\system32\Drivers\ns6_usb.sys;c:\windows\SYSNATIVE\Drivers\ns6_usb.sys [x]
R3 NUMARK_NS6_WDM;Numark NS6 WDM device;c:\windows\system32\drivers\ns6_wdm.sys;c:\windows\SYSNATIVE\drivers\ns6_wdm.sys [x]
R3 Origin Client Service;Origin Client Service;c:\program files (x86)\Origin\OriginClientService.exe;c:\program files (x86)\Origin\OriginClientService.exe [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 qcusbser-forge;Forge USB Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\qcusbser.sys;c:\windows\SYSNATIVE\DRIVERS\qcusbser.sys [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetFlt.sys [x]
R3 VMwareHostd;VMware Workstation Server;c:\program files (x86)\VMware\VMware Workstation\vmware-hostd.exe;c:\program files (x86)\VMware\VMware Workstation\vmware-hostd.exe [x]
R3 WatAdminSvc;Servicio de tecnologías de activación de Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 E8655EDC;E8655EDC;c:\windows\system32\drivers\E8655EDC.sys;c:\windows\SYSNATIVE\drivers\E8655EDC.sys [x]
S0 iusb3hcs;Controlador del conmutador de la controladora de host Intel® USB 3.0;c:\windows\system32\drivers\iusb3hcs.sys;c:\windows\SYSNATIVE\drivers\iusb3hcs.sys [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys;c:\windows\SYSNATIVE\DRIVERS\vmci.sys [x]
S1 BfLwf;Bigfoot Networks Bandwidth Control;c:\windows\system32\DRIVERS\bflwfx64.sys;c:\windows\SYSNATIVE\DRIVERS\bflwfx64.sys [x]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxDrv.sys [x]
S1 VBoxNetAdp;VirtualBox NDIS 6.0 Miniport Service;c:\windows\system32\DRIVERS\VBoxNetAdp6.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetAdp6.sys [x]
S1 VBoxNetLwf;VirtualBox NDIS6 Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetLwf.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetLwf.sys [x]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxUSBMon.sys [x]
S2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [x]
S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [x]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [x]
S2 BstHdDrv;BlueStacks Hypervisor;c:\program files (x86)\BlueStacks\HD-Hypervisor-amd64.sys;c:\program files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [x]
S2 BstHdLogRotatorSvc;BlueStacks Log Rotator Service;c:\program files (x86)\BlueStacks\HD-LogRotatorService.exe;c:\program files (x86)\BlueStacks\HD-LogRotatorService.exe [x]
S2 BstHdUpdaterSvc;BlueStacks Updater Service;c:\program files (x86)\BlueStacks\HD-UpdaterService.exe;c:\program files (x86)\BlueStacks\HD-UpdaterService.exe [x]
S2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [x]
S2 GfExperienceService;NVIDIA GeForce Experience Service;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [x]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [x]
S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S2 kss;Servicio Kaspersky Security Scan;c:\program files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe  -r;c:\program files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe  -r [x]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe;c:\program files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [x]
S2 Micro Star SCM;Micro Star SCM;c:\program files (x86)\S-Bar\MSIService.exe;c:\program files (x86)\S-Bar\MSIService.exe [x]
S2 MSI Foundation Service;MSI Foundation Service;c:\program files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe;c:\program files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe [x]
S2 MSI_SuperCharger;MSI_SuperCharger;c:\program files (x86)\MSI\Super-Charger\ChargeService.exe;c:\program files (x86)\MSI\Super-Charger\ChargeService.exe [x]
S2 NIHardwareService;NIHardwareService;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [x]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe service;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe service [x]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys;c:\windows\SYSNATIVE\drivers\npf.sys [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [x]
S2 Qualcomm Atheros Killer Service;Qualcomm Atheros Killer Service;c:\program files\Qualcomm Atheros\Killer Network Manager\BFNService.exe;c:\program files\Qualcomm Atheros\Killer Network Manager\BFNService.exe [x]
S2 regi;regi;c:\windows\system32\drivers\regi.sys;c:\windows\SYSNATIVE\drivers\regi.sys [x]
S2 Update service;Update service;c:\program files (x86)\Popcorn Time\Updater.exe;c:\program files (x86)\Popcorn Time\Updater.exe [x]
S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [x]
S2 vstor2-mntapi10-shared;Vstor2 MntApi 1.0 Driver (shared);SysWOW64\drivers\vstor2-mntapi10-shared.sys;SysWOW64\drivers\vstor2-mntapi10-shared.sys [x]
S2 ZeroConfigService;Intel® PROSet/Wireless Zero Configuration Service;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe [x]
S3 AMPPAL;Adaptador virtual Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed;c:\windows\system32\DRIVERS\AMPPAL.sys;c:\windows\SYSNATIVE\DRIVERS\AMPPAL.sys [x]
S3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 IntcDAud;Sonido Intel® para pantallas;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 iusb3hub;Controlador del concentrador Intel® USB 3.0;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Controlador de la controladora de host Intel® USB 3.0 eXtensible;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 L1C;NDIS Miniport Driver for the Killer e2200 PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\e22w7x64.sys;c:\windows\SYSNATIVE\DRIVERS\e22w7x64.sys [x]
S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys;c:\windows\SYSNATIVE\drivers\MBfilt64.sys [x]
S3 NTIOLib_1_0_3;NTIOLib_1_0_3;c:\program files (x86)\MSI\Super-Charger\NTIOLib_X64.sys;c:\program files (x86)\MSI\Super-Charger\NTIOLib_X64.sys [x]
S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - NVSTREAMKMS
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-12-09 05:38    2118472    ----a-w-    c:\program files (x86)\Google\Chrome\Application\47.0.2526.73\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2015-12-09 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-26 05:16]
.
2015-12-08 c:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3234211791-2759061018-4055047508-1001Core.job
- c:\users\Jorge\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-28 20:50]
.
2015-12-09 c:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3234211791-2759061018-4055047508-1001UA.job
- c:\users\Jorge\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-28 20:50]
.
2015-12-08 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3234211791-2759061018-4055047508-1001Core.job
- c:\users\Jorge\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-08-17 09:31]
.
2015-12-09 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3234211791-2759061018-4055047508-1001UA.job
- c:\users\Jorge\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-08-17 09:31]
.
2015-12-09 c:\windows\Tasks\G2MUpdateTask-S-1-5-21-3234211791-2759061018-4055047508-1001.job
- c:\program files (x86)\Citrix\GoToMeeting\3499\g2mupdate.exe [2015-10-12 03:29]
.
2015-12-09 c:\windows\Tasks\G2MUploadTask-S-1-5-21-3234211791-2759061018-4055047508-1001.job
- c:\program files (x86)\Citrix\GoToMeeting\3499\g2mupload.exe [2015-10-12 03:29]
.
2015-12-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-30 01:09]
.
2015-12-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-30 01:09]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2015-11-04 23:46    236352    ----a-w-    c:\users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2015-11-04 23:46    236352    ----a-w-    c:\users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt3]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2015-11-04 23:46    236352    ----a-w-    c:\users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt4]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2015-11-04 23:46    236352    ----a-w-    c:\users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt5]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2015-11-04 23:46    236352    ----a-w-    c:\users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt6]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2015-11-04 23:46    236352    ----a-w-    c:\users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt7]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2015-11-04 23:46    236352    ----a-w-    c:\users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt8]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2015-11-04 23:46    236352    ----a-w-    c:\users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2011-12-20 11406608]
"THXCfg64"="c:\windows\system32\THXCfg64.dll" [2010-09-14 25600]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-03-30 170264]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-03-30 398616]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-03-30 439064]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2015-11-05 2655520]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2015-11-05 1710752]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2015-12-09 6037504]
"XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-09-30 825184]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2015-06-18 14021336]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://login.latinaminternet.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: &Enviar a OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Captura URL - c:\program files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=0
IE: Capturar esta página - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=1
IE: Capturar imagen - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=4
IE: Capturar marcador - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=0
IE: Capturar selección - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=3
IE: Descargar con Mipony - file://c:\program files (x86)\MiPony\Browser\IEContext.htm
IE: E&xportar a Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: LastPass - file://c:\users\Jorge\AppData\LocalLow\LastPass\context.html?cmd=lastpass
IE: LastPass Fill Forms - file://c:\users\Jorge\AppData\LocalLow\LastPass\context.html?cmd=fillforms
IE: Llenado de formas LastPass - file://c:\users\Jorge\AppData\LocalLow\LastPass\context.html?cmd=fillforms
IE: Nota nueva - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\NewNote.html
IE: Nueva Nota - c:\program files (x86)\Evernote\Evernote\\EvernoteIERes\NewNote.html
IE: {{781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - c:\program files (x86)\ICQ7M\ICQ.exe
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\users\Jorge\AppData\Roaming\Mozilla\Firefox\Profiles\qu3tz7k2.default-1441595658464\
FF - prefs.js: network.proxy.ftp - 203.156.126.38
FF - prefs.js: network.proxy.ftp_port - 8080
FF - prefs.js: network.proxy.http - 203.156.126.38
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.socks - 203.156.126.38
FF - prefs.js: network.proxy.socks_port - 8080
FF - prefs.js: network.proxy.ssl - 203.156.126.38
FF - prefs.js: network.proxy.ssl_port - 8080
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass FF RunOnce.lnk - c:\program files (x86)\Common Files\lpuninstall.exe -q -name=LastPass -ffuuid support@lastpass.com
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass IE RunOnce.lnk - c:\program files (x86)\Common Files\lpuninstall.exe -p -name=LastPass -ffuuid support@lastpass.com
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
AddRemove-{F4B2C5C1-F084-4858-B9C3-E641F5C12BBA}_is1 - c:\users\Jorge\AppData\Roaming\Popcorn Time\unins000.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility]
"ServiceDll"="c:\windows\installer\AMDEx3.msi"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3234211791-2759061018-4055047508-1001\Software\SecuROM\License information*]
"datasecu"=hex:b2,67,e0,1c,b8,bf,61,5f,1f,3d,3b,04,66,27,e9,60,6c,c7,17,8c,b8,
   5d,ce,23,24,b6,cf,26,cf,3d,97,79,56,11,99,c2,95,dd,63,8a,7b,7e,58,80,a5,e2,\
"rkeysecu"=hex:6b,3a,db,3a,03,e7,b0,6b,a9,8e,33,b6,86,00,04,13
.
[HKEY_LOCAL_MACHINE\SOFTWARE\BlueStacks]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_20_0_0_228_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_20_0_0_228_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_20_0_0_228_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_20_0_0_228_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_20_0_0_228.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.20"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_20_0_0_228.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_20_0_0_228.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_20_0_0_228.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2015-12-09  02:03:57
ComboFix-quarantined-files.txt  2015-12-09 08:03
.
Pre-Run: 23,724,269,568 bytes libres
Post-Run: 25,206,321,152 bytes libres
.
- - End Of File - - EFB5B64CC63F23BFEA9F7AADB1562339
 

 

 

 

https://www.virustotal.com/en/file/2b67fe64841d510e66a474b5ef77ed7e18a22a75734c5e14e5f6fbd745bf2da3/analysis/1449704236/



#10 superyui

superyui
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:01:54 PM

Posted 09 December 2015 - 06:57 PM

The frst fixlog:

 

Fix result of Farbar Recovery Scan Tool (x64) Version:05-12-2015
Ran by Jorge (2015-12-09 17:47:31) Run:1
Running from C:\Users\Jorge\Desktop
Loaded Profiles: Jorge (Available Profiles: Jorge)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start
CreateRestorePoint:
CloseProcesses:
EmptyTemp:
C:\pcre.exe
C:\Users\Jorge\SSLLib 1.1.dll
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 MGHwCtrl; \??\C:\Program Files\MSI\MSI Software Install\MGHwCtrl.sys [X]
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]
S2 FastUserSwitchingCompatibility; C:\windows\installer\AMDEx3.msi [X]
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\firefox.cfg [2013-06-10] <==== ATTENTION
AlternateShell:
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-3234211791-2759061018-4055047508-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {C7253179-90B7-45E8-8A16-58B517C9EB40} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSITDF&pc=MAM3&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {C7253179-90B7-45E8-8A16-58B517C9EB40} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSITDF&pc=MAM3&src=IE-SearchBox
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.8.823\_platform_specific\win_x86\widevinecdmadapter.dll => No File
Task: {01B26980-3030-4E6E-8B22-37A2A5F2AC0B} - \Updater12555.exe -> No File <==== ATTENTION
Task: {2E5C9AF2-CCF3-46D3-B4F5-6DA560620441} - \DealPlyUpdate -> No File <==== ATTENTION
Task: {BF5B3073-4D69-48D8-BB35-49C460EFDEBA} - \Express FilesUpdate -> No File <==== ATTENTION
end
*****************

Restore point was successfully created.
Processes closed successfully.
C:\pcre.exe => moved successfully
C:\Users\Jorge\SSLLib 1.1.dll => moved successfully
catchme => service removed successfully
MGHwCtrl => service removed successfully
VBoxNetFlt => service removed successfully
FastUserSwitchingCompatibility => service removed successfully
C:\Program Files (x86)\mozilla firefox\firefox.cfg => moved successfully
hklm\System\CurrentControlSet\Control\SafeBoot\\AlternateShell => value restored successfully
"HKLM\SOFTWARE\Policies\Google" => key removed successfully
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
"HKU\S-1-5-21-3234211791-2759061018-4055047508-1001\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => key removed successfully
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C7253179-90B7-45E8-8A16-58B517C9EB40}" => key removed successfully
HKCR\CLSID\{C7253179-90B7-45E8-8A16-58B517C9EB40} => key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found.
HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{C7253179-90B7-45E8-8A16-58B517C9EB40}" => key removed successfully
HKCR\Wow6432Node\CLSID\{C7253179-90B7-45E8-8A16-58B517C9EB40} => key not found.
"HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => key removed successfully
"HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE" => key removed successfully
C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.8.823\_platform_specific\win_x86\widevinecdmadapter.dll => not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{01B26980-3030-4E6E-8B22-37A2A5F2AC0B}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{01B26980-3030-4E6E-8B22-37A2A5F2AC0B}" => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updater12555.exe => key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2E5C9AF2-CCF3-46D3-B4F5-6DA560620441}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2E5C9AF2-CCF3-46D3-B4F5-6DA560620441}" => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyUpdate => key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{BF5B3073-4D69-48D8-BB35-49C460EFDEBA}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BF5B3073-4D69-48D8-BB35-49C460EFDEBA}" => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Express FilesUpdate => key not found.
EmptyTemp: => 1.3 GB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 17:49:15 ====

 

 

 

and the other log here:

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-12-2015
Ran by Jorge (administrator) on JORGE-MSI (09-12-2015 17:55:25)
Running from C:\Users\Jorge\Desktop
Loaded Profiles: Jorge (Available Profiles: Jorge)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: Español (España, internacional)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Program Files\Qualcomm Atheros\Killer Network Manager\KillerNetManager.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\RALINK\Common\RaUI.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Dropbox, Inc.) C:\Users\Jorge\AppData\Roaming\Dropbox\bin\Dropbox.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(MagicISO, Inc.) C:\Program Files (x86)\MagicDisc\MagicDisc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe
() C:\Program Files (x86)\MSI\MSI VGA Overclock Tool\VGAOCAP.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(NVIDIA Corporation) C:\Users\Jorge\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
() C:\Program Files\Autodesk\3ds Max 2014\NVIDIA\Satellite\raysat_3dsmax2014_64server.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\S-Bar\MSIService.exe
(MSI) C:\Program Files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(MSI) C:\Program Files (x86)\MSI\Super-Charger\ChargeService.exe
(Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files\Qualcomm Atheros\Killer Network Manager\BFNService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Popcorn Time) C:\Program Files (x86)\Popcorn Time\Updater.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Don HO don.h@free.fr) C:\Program Files (x86)\Notepad++\notepad++.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel® Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [THXCfg64] => C:\windows\system32\RunDLL32.exe C:\windows\system32\THXCfg64.dll,RunDLLEntry THXCfg64
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2655520 2015-11-05] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\windows\system32\rundll32.exe C:\windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [14021336 2015-06-18] (Realtek Semiconductor)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-04] (Intel Corporation)
HKLM-x32\...\Run: [THX Audio Control Panel] => C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe [1517056 2011-08-29] (Creative Technology Ltd)
HKLM-x32\...\Run: [UpdReg] => C:\windows\UpdReg.EXE
HKLM-x32\...\Run: [VGAOCAP] => C:\Program Files (x86)\MSI\MSI VGA Overclock Tool\VGAOCAP.exe [88576 2012-01-31] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [597552 2015-08-04] (Oracle Corporation)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [5565448 2015-11-12] (LogMeIn Inc.)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3234211791-2759061018-4055047508-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8322328 2015-11-15] (Piriform Ltd)
HKU\S-1-5-21-3234211791-2759061018-4055047508-1001\...\Run: [Dropbox Update] => C:\Users\Jorge\AppData\Local\Dropbox\Update\DropboxUpdate.exe [1252720 2015-06-28] (Dropbox, Inc.)
HKU\S-1-5-21-3234211791-2759061018-4055047508-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [50509440 2015-11-30] (Skype Technologies S.A.)
HKU\S-1-5-18\...\Run: [KSS] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe [919296 2015-06-03] (Kaspersky Lab ZAO)
AppInit_DLLs: C:\windows\system32\nvinitx.dll => C:\windows\system32\nvinitx.dll [177600 2015-11-05] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\windows\SysWOW64\nvinit.dll => C:\windows\SysWOW64\nvinit.dll [155792 2015-11-05] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Qualcomm Atheros Killer Network Manager.lnk [2012-04-25]
ShortcutTarget: Qualcomm Atheros Killer Network Manager.lnk -> C:\Program Files\Qualcomm Atheros\Killer Network Manager\KillerNetManager.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk [2014-09-09]
ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files (x86)\RALINK\Common\RaUI.exe (Ralink Technology, Corp.)
Startup: C:\Users\Jorge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-10-16]
ShortcutTarget: Dropbox.lnk -> C:\Users\Jorge\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Jorge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2015-08-18]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Startup: C:\Users\Jorge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk [2013-06-10]
ShortcutTarget: MagicDisc.lnk -> C:\Program Files (x86)\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
Startup: C:\Users\Jorge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Psi.lnk [2013-07-04]
ShortcutTarget: Psi.lnk -> C:\Program Files (x86)\Psi\Psi.exe ()
AlternateShell:

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\..\Interfaces\{9B0B69A7-F7F0-4A5B-A2AC-D259FC9C6B09}: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{B603761B-71FB-42E4-81DF-D036DEBB8F21}: [DhcpNameServer] 192.168.1.254

Internet Explorer:
==================
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3234211791-2759061018-4055047508-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar_x64.dll [2015-10-12] (LastPass)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\ssv.dll [2015-09-03] (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-07-01] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar.dll [2015-10-12] (LastPass)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\jp2ssv.dll [2015-09-03] (Oracle Corporation)
Toolbar: HKLM - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll [2015-10-12] (LastPass)
Toolbar: HKLM-x32 - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll [2015-10-12] (LastPass)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\Jorge\AppData\Roaming\Mozilla\Firefox\Profiles\qu3tz7k2.default-1441595658464
FF NetworkProxy: "backup.ftp", ""
FF NetworkProxy: "backup.ftp_port", 0
FF NetworkProxy: "backup.socks", "92.36.161.7"
FF NetworkProxy: "backup.socks_port", 19940
FF NetworkProxy: "backup.ssl", ""
FF NetworkProxy: "backup.ssl_port", 0
FF NetworkProxy: "ftp", "203.156.126.38"
FF NetworkProxy: "ftp_port", 8080
FF NetworkProxy: "http", "203.156.126.38"
FF NetworkProxy: "http_port", 8080
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "203.156.126.38"
FF NetworkProxy: "socks_port", 8080
FF NetworkProxy: "ssl", "203.156.126.38"
FF NetworkProxy: "ssl_port", 8080
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_20_0_0_235.dll [2015-12-08] ()
FF Plugin: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass64.dll [2015-10-12] (LastPass)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-04] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_235.dll [2015-12-08] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll [2013-10-25] (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-20] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-20] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.60.2 -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\dtplugin\npDeployJava1.dll [2015-09-03] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.60.2 -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\plugin2\npjp2.dll [2015-09-03] (Oracle Corporation)
FF Plugin-x32: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass64.dll [2015-10-12] (LastPass)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-04] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-04] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-04] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-05-08] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3234211791-2759061018-4055047508-1001: @citrixonline.com/appdetectorplugin -> C:\Users\Jorge\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2015-05-27] (Citrix Online)
FF Plugin HKU\S-1-5-21-3234211791-2759061018-4055047508-1001: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Jorge\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited)
FF Plugin HKU\S-1-5-21-3234211791-2759061018-4055047508-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Jorge\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2013-03-24] (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-05-08] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2013-01-28] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2013-01-28] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2013-01-28] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2013-01-28] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2013-01-28] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll [2013-01-28] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll [2013-01-28] (Apple Inc.)
FF Extension: User Agent Switcher - C:\Users\Jorge\AppData\Roaming\Mozilla\Firefox\Profiles\qu3tz7k2.default-1441595658464\extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}.xpi [2015-09-30]
FF Extension: LastPass - C:\Users\Jorge\AppData\Roaming\Mozilla\Firefox\Profiles\qu3tz7k2.default-1441595658464\Extensions\support@lastpass.com [2015-12-03]
FF Extension: User Agent Overrider - C:\Users\Jorge\AppData\Roaming\Mozilla\Firefox\Profiles\qu3tz7k2.default-1441595658464\Extensions\useragentoverrider@qixinglu.com.xpi [2015-09-30]
FF HKLM-x32\...\Firefox\Extensions: [2bf2d136-ab28-4bdd-8c8b-e1838343e631@2e9291c5-67cd-4375-afc8-b2772f9fcf45.com] - C:\Program Files (x86)\\George\2bf2d136-ab28-4bdd-8c8b-e1838343e631@2e9291c5-67cd-4375-afc8-b2772f9fcf45.com.xpi
FF Extension: HilariousVideos - C:\Program Files (x86)\\George\2bf2d136-ab28-4bdd-8c8b-e1838343e631@2e9291c5-67cd-4375-afc8-b2772f9fcf45.com.xpi [2013-06-11] [not signed]

Chrome:
=======
CHR DefaultSearchKeyword: Default -> lp
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.8.823\_platform_specific\win_x86\widevinecdmadapter.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.73\PepperFlash\pepflashplayer.dll ()
CHR Profile: C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Traductor de Google) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb [2015-11-17]
CHR Extension: (Google Docs) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-05]
CHR Extension: (Google Drive) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-23]
CHR Extension: (YouTube) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24]
CHR Extension: (Búsqueda de Google) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
CHR Extension: (FB Pixel Helper) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdgfkebogiimcoedlicjlajpkdmockpc [2015-12-03]
CHR Extension: (LastPass: Free Password Manager) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2015-10-26]
CHR Extension: (Local SWF) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdmbckedabpbgjagmkgcejooabcdnone [2015-11-25]
CHR Extension: (Awesome Screenshot - Screen captura y Anotar ) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlipoenfbbikpbjkfpfillcgkoblgpmj [2015-12-02]
CHR Extension: (Sistema de pagos de Chrome Web Store) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-27]
CHR Extension: (Instagram for Chrome) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\opnbmdkdflhjiclaoiiifmheknpccalb [2015-12-04]
CHR Extension: (Gmail) - C:\Users\Jorge\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-03]
CHR HKLM\...\Chrome\Extension: [hdokiejnpimakedhajhdlcegeplioahd] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [hdokiejnpimakedhajhdlcegeplioahd] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [nfnoclbgfccijbdmhjabakjbalaahejm] - C:\Program Files (x86)\\George\hilariousvideos.crx [2013-06-11]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [3465216 2015-12-06] () [File not signed]
S2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [3764224 2015-12-04] (BlueStack Systems, Inc.) [File not signed]
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [384728 2014-08-13] (BlueStack Systems, Inc.)
R2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [777944 2014-08-13] (BlueStack Systems, Inc.)
R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376 2009-08-27] (MAGIX AG) [File not signed]
S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2015-12-08] (MAGIX®) [File not signed]
S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [4014080 2015-12-08] (Acresso Software Inc.) [File not signed]
S3 FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [4825976 2015-12-08] (Flexera Software LLC) [File not signed]
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1156384 2015-11-05] (NVIDIA Corporation)
S2 gupdate; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2380616 2015-12-04] (Google Inc.) [File not signed]
S3 gupdatem; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2380616 2015-12-04] (Google Inc.) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2310144 2015-12-08] (Macrovision Corporation) [File not signed]
S3 iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2877768 2015-12-06] (Apple Inc.) [File not signed]
R2 kss; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe [919296 2015-06-03] (Kaspersky Lab ZAO)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [417552 2015-11-12] (LogMeIn, Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 mi-raysat_3dsmax2014_64; C:\Program Files\Autodesk\3ds Max 2014\NVIDIA\Satellite\raysat_3dsmax2014_64server.exe [86016 2011-09-14] () [File not signed]
R2 Micro Star SCM; C:\Program Files (x86)\S-Bar\MSIService.exe [160768 2011-11-02] (Micro-Star International Co., Ltd.) [File not signed]
S3 MozillaMaintenance; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [172032 2015-12-07] (Mozilla Foundation) [File not signed]
R2 MSI Foundation Service; C:\Program Files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe [12800 2010-07-16] (MSI) [File not signed]
R2 MSI_SuperCharger; C:\Program Files (x86)\MSI\Super-Charger\ChargeService.exe [138768 2012-01-03] (MSI)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2510848 2015-12-08] () [File not signed]
R2 NIHardwareService; C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [5352960 2011-03-09] (Native Instruments GmbH) [File not signed]
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2782552 2010-03-05] (Symantec Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1873696 2015-11-05] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [5568288 2015-11-05] (NVIDIA Corporation)
S3 OpenVPNService; C:\Program Files (x86)\HMA! Pro VPN\bin\openvpnserv.exe [4510008 2015-12-08] (The OpenVPN Project) [File not signed]
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [3178496 2015-12-07] (Electronic Arts) [File not signed]
S3 ose64; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2412544 2015-12-06] (Microsoft Corporation) [File not signed]
S3 osppsvc; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [6045696 2015-12-06] (Microsoft Corporation) [File not signed]
R2 PnkBstrA; C:\windows\SysWOW64\PnkBstrA.exe [76888 2013-03-26] ()
R2 PSI_SVC_2; C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe [267552 2010-03-11] (Protexis Inc.) [File not signed]
R2 Qualcomm Atheros Killer Service; C:\Program Files\Qualcomm Atheros\Killer Network Manager\BFNService.exe [492032 2012-03-07] () [File not signed]
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2015-10-06] (Riverbed Technology, Inc.) [File not signed]
S3 Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [1957888 2015-12-08] (Valve Corporation) [File not signed]
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2756608 2015-12-08] (Adobe Systems Incorporated) [File not signed]
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5702416 2015-09-11] (TeamViewer GmbH)
R2 Update service; C:\Program Files (x86)\Popcorn Time\Updater.exe [339968 2015-10-19] (Popcorn Time) [File not signed]
R2 VMAuthdService; C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe [79872 2011-08-22] (VMware, Inc.) [File not signed]
S3 VMwareHostd; C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe [11837440 2015-10-06] () [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
S4 wlcrasvc; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [3411968 2015-12-06] (Microsoft Corporation) [File not signed]
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [594704 2011-12-08] (Intel® Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R1 BfLwf; C:\Windows\System32\DRIVERS\bflwfx64.sys [75880 2012-03-07] (Bigfoot Networks, Inc.)
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [122072 2014-08-13] (BlueStack Systems)
S3 ck3iusb64; C:\Windows\System32\DRIVERS\ck3iusb64.sys [64000 2010-01-18] (Xecuter)
R0 E8655EDC; C:\Windows\System32\drivers\E8655EDC.sys [478392 2015-10-06] (Kaspersky Lab ZAO)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 ipadtst; C:\Program Files (x86)\MSI\Super-Charger\ipadtst_64.sys [17936 2011-12-12] (Windows ® Win 7 DDK provider)
R3 L1C; C:\Windows\System32\DRIVERS\e22w7x64.sys [161616 2012-03-07] (Qualcomm Atheros, Inc.)
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [16896 2007-03-20] (hxxp://libusb-win32.sourceforge.net)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [192216 2015-12-09] (Malwarebytes)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-02-28] (Riverbed Technology, Inc.)
R3 NTIOLib_1_0_3; C:\Program Files (x86)\MSI\Super-Charger\NTIOLib_X64.sys [14136 2010-01-18] (MSI)
S3 NUMARK_NS6_MIDI; C:\Windows\System32\drivers\ns6_midi.sys [31296 2011-08-10] (Numark)
S3 NUMARK_NS6_USB; C:\Windows\System32\Drivers\ns6_usb.sys [416320 2011-08-10] (Ploytec GmbH)
S3 NUMARK_NS6_WDM; C:\Windows\System32\drivers\ns6_wdm.sys [54336 2011-08-10] (Numark)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20768 2015-11-05] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [50472 2015-11-05] (NVIDIA Corporation)
S3 qcusbser-forge; C:\Windows\System32\DRIVERS\qcusbser.sys [247872 2015-06-17] (FORGE Incorporated)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [30848 2015-12-09] ()
R1 VBoxNetAdp; C:\Windows\System32\DRIVERS\VBoxNetAdp6.sys [117768 2015-09-08] (Oracle Corporation)
R1 VBoxNetLwf; C:\Windows\System32\DRIVERS\VBoxNetLwf.sys [146072 2015-09-08] (Oracle Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-09 17:52 - 2015-12-09 17:52 - 00103140 __RSH C:\uvhg.exe
2015-12-09 17:47 - 2015-12-09 17:49 - 00005725 _____ C:\Users\Jorge\Desktop\Fixlog.txt
2015-12-09 15:15 - 2015-12-09 15:15 - 00000757 _____ C:\Users\Jorge\Desktop\JRT.txt
2015-12-09 14:27 - 2015-12-09 14:27 - 01599336 _____ (Malwarebytes) C:\Users\Jorge\Desktop\JRT.exe
2015-12-09 14:13 - 2015-12-09 14:13 - 01738240 _____ C:\Users\Jorge\Desktop\adwcleaner_5.024.exe
2015-12-09 13:39 - 2015-12-09 17:50 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-12-09 13:34 - 2015-12-09 15:00 - 00000000 ____D C:\Users\Jorge\Desktop\mbar
2015-12-09 13:34 - 2015-12-09 13:34 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Jorge\Downloads\mbar-1.09.3.1001.exe
2015-12-09 13:10 - 2015-12-09 13:10 - 00105218 ____H C:\Users\Jorge\Desktop\~WRL3329.tmp
2015-12-09 12:48 - 2015-12-09 12:48 - 00852771 _____ C:\Users\Jorge\Desktop\SecurityCheck.exe
2015-12-09 04:50 - 2015-12-09 04:52 - 00088176 _____ C:\Users\Jorge\Desktop\Addition.txt
2015-12-09 04:49 - 2015-12-09 17:55 - 00034655 _____ C:\Users\Jorge\Desktop\FRST.txt
2015-12-09 04:49 - 2015-12-09 17:55 - 00000000 ____D C:\FRST
2015-12-09 04:46 - 2015-12-09 04:46 - 02369024 _____ (Farbar) C:\Users\Jorge\Desktop\FRST64.exe
2015-12-09 04:30 - 2015-12-09 04:30 - 00003400 ____N C:\bootsqm.dat
2015-12-09 04:28 - 2015-12-09 04:28 - 00000000 __SHD C:\found.001
2015-12-09 02:30 - 2015-12-09 02:36 - 00000000 ____D C:\ProgramData\HitmanPro
2015-12-09 02:29 - 2015-12-09 03:09 - 00000282 __RSH C:\ProgramData\ntuser.pol
2015-12-09 02:11 - 2015-12-09 02:27 - 00000000 ____D C:\ProgramData\RogueKiller
2015-12-09 02:11 - 2015-12-09 02:11 - 00030848 _____ C:\windows\system32\Drivers\TrueSight.sys
2015-12-09 02:04 - 2015-12-09 02:04 - 00123027 _____ C:\ComboFix.txt
2015-12-09 01:33 - 2011-06-26 00:45 - 00256000 _____ C:\windows\PEV.exe
2015-12-09 01:33 - 2010-11-07 11:20 - 00208896 _____ C:\windows\MBR.exe
2015-12-09 01:33 - 2009-04-19 22:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2015-12-09 01:33 - 2000-08-30 18:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2015-12-09 01:33 - 2000-08-30 18:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2015-12-09 01:33 - 2000-08-30 18:00 - 00098816 _____ C:\windows\sed.exe
2015-12-09 01:33 - 2000-08-30 18:00 - 00080412 _____ C:\windows\grep.exe
2015-12-09 01:33 - 2000-08-30 18:00 - 00068096 _____ C:\windows\zip.exe
2015-12-09 01:32 - 2015-12-09 02:04 - 00000000 ____D C:\Qoobox
2015-12-09 01:32 - 2015-12-09 01:58 - 00000000 ____D C:\windows\erdnt
2015-12-09 01:26 - 2015-12-09 01:30 - 11337112 _____ (SurfRight B.V.) C:\Users\Jorge\Desktop\HitmanPro_x64.exe
2015-12-09 01:25 - 2015-12-09 01:25 - 20829256 _____ C:\Users\Jorge\Desktop\RogueKiller.exe
2015-12-09 01:24 - 2015-12-09 01:24 - 05640425 ____R (Swearware) C:\Users\Jorge\Desktop\ComboFix.exe
2015-12-08 15:36 - 2015-11-20 12:54 - 03170304 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2015-12-08 15:36 - 2015-11-20 12:54 - 02609152 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2015-12-08 15:36 - 2015-11-20 12:54 - 00709632 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2015-12-08 15:36 - 2015-11-20 12:54 - 00192512 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2015-12-08 15:36 - 2015-11-20 12:54 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2015-12-08 15:36 - 2015-11-20 12:54 - 00098816 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2015-12-08 15:36 - 2015-11-20 12:54 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll
2015-12-08 15:36 - 2015-11-20 12:54 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2015-12-08 15:36 - 2015-11-20 12:54 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2015-12-08 15:36 - 2015-11-20 12:54 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
2015-12-08 15:36 - 2015-11-20 12:54 - 00012288 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll
2015-12-08 15:36 - 2015-11-20 12:34 - 00573440 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2015-12-08 15:36 - 2015-11-20 12:34 - 00174080 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2015-12-08 15:36 - 2015-11-20 12:34 - 00093696 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2015-12-08 15:36 - 2015-11-20 12:34 - 00030208 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll
2015-12-08 15:36 - 2015-11-20 12:33 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
2015-12-08 15:36 - 2015-11-11 15:12 - 00387792 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-12-08 15:36 - 2015-11-11 14:52 - 00341192 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2015-12-08 15:36 - 2015-11-11 12:53 - 01735680 _____ (Microsoft Corporation) C:\windows\system32\comsvcs.dll
2015-12-08 15:36 - 2015-11-11 12:53 - 00525312 _____ (Microsoft Corporation) C:\windows\system32\catsrvut.dll
2015-12-08 15:36 - 2015-11-11 12:39 - 01242624 _____ (Microsoft Corporation) C:\windows\SysWOW64\comsvcs.dll
2015-12-08 15:36 - 2015-11-11 12:39 - 00487936 _____ (Microsoft Corporation) C:\windows\SysWOW64\catsrvut.dll
2015-12-08 15:36 - 2015-11-11 10:21 - 25837568 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-12-08 15:36 - 2015-11-11 10:00 - 12856832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-12-08 15:36 - 2015-11-11 09:44 - 00416256 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2015-12-08 15:36 - 2015-11-11 09:44 - 00279040 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2015-12-08 15:36 - 2015-11-11 09:41 - 20366848 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-12-08 15:36 - 2015-11-11 09:12 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-12-08 15:36 - 2015-11-11 08:57 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2015-12-08 15:36 - 2015-11-10 12:55 - 01648128 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll
2015-12-08 15:36 - 2015-11-10 12:55 - 01180160 _____ (Microsoft Corporation) C:\windows\system32\FntCache.dll
2015-12-08 15:36 - 2015-11-10 12:55 - 01008640 _____ (Microsoft Corporation) C:\windows\system32\user32.dll
2015-12-08 15:36 - 2015-11-10 12:39 - 01251328 _____ (Microsoft Corporation) C:\windows\SysWOW64\DWrite.dll
2015-12-08 15:36 - 2015-11-10 12:37 - 00833024 _____ (Microsoft Corporation) C:\windows\SysWOW64\user32.dll
2015-12-08 15:36 - 2015-11-10 11:47 - 03211264 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-12-08 15:36 - 2015-11-09 18:24 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2015-12-08 15:36 - 2015-11-09 18:13 - 00496640 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-12-08 15:36 - 2015-11-09 18:13 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2015-12-08 15:36 - 2015-11-09 18:12 - 00341504 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2015-12-08 15:36 - 2015-11-09 18:12 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2015-12-08 15:36 - 2015-11-09 18:11 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2015-12-08 15:36 - 2015-11-09 18:08 - 02280448 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-12-08 15:36 - 2015-11-09 18:06 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2015-12-08 15:36 - 2015-11-09 18:06 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2015-12-08 15:36 - 2015-11-09 18:04 - 00476160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2015-12-08 15:36 - 2015-11-09 18:03 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2015-12-08 15:36 - 2015-11-09 18:02 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2015-12-08 15:36 - 2015-11-09 18:02 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2015-12-08 15:36 - 2015-11-09 17:50 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-12-08 15:36 - 2015-11-09 17:47 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2015-12-08 15:36 - 2015-11-09 17:46 - 04514816 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-12-08 15:36 - 2015-11-09 17:44 - 00130048 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll
2015-12-08 15:36 - 2015-11-09 17:37 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
2015-12-08 15:36 - 2015-11-09 17:36 - 02050560 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2015-12-08 15:36 - 2015-11-09 17:36 - 00687104 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-12-08 15:36 - 2015-11-09 17:35 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2015-12-08 15:36 - 2015-11-09 17:17 - 02011136 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-12-08 15:36 - 2015-11-09 17:14 - 01311744 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-12-08 15:36 - 2015-11-09 17:12 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2015-12-08 15:36 - 2015-11-08 16:33 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2015-12-08 15:36 - 2015-11-08 16:32 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2015-12-08 15:36 - 2015-11-08 16:16 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2015-12-08 15:36 - 2015-11-08 16:15 - 02887168 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-12-08 15:36 - 2015-11-08 16:15 - 00571392 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-12-08 15:36 - 2015-11-08 16:15 - 00417792 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2015-12-08 15:36 - 2015-11-08 16:15 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2015-12-08 15:36 - 2015-11-08 16:14 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-12-08 15:36 - 2015-11-08 16:07 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2015-12-08 15:36 - 2015-11-08 16:06 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2015-12-08 15:36 - 2015-11-08 16:04 - 05923840 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-12-08 15:36 - 2015-11-08 16:02 - 00615936 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2015-12-08 15:36 - 2015-11-08 16:01 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2015-12-08 15:36 - 2015-11-08 16:01 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2015-12-08 15:36 - 2015-11-08 16:01 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2015-12-08 15:36 - 2015-11-08 16:01 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2015-12-08 15:36 - 2015-11-08 15:52 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2015-12-08 15:36 - 2015-11-08 15:48 - 00489984 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-12-08 15:36 - 2015-11-08 15:40 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2015-12-08 15:36 - 2015-11-08 15:35 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2015-12-08 15:36 - 2015-11-08 15:32 - 00315392 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-12-08 15:36 - 2015-11-08 15:29 - 00152064 _____ (Microsoft Corporation) C:\windows\system32\occache.dll
2015-12-08 15:36 - 2015-11-08 15:18 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2015-12-08 15:36 - 2015-11-08 15:15 - 00798208 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-12-08 15:36 - 2015-11-08 15:15 - 00718336 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-12-08 15:36 - 2015-11-08 15:14 - 14456832 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-12-08 15:36 - 2015-11-08 15:14 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2015-12-08 15:36 - 2015-11-08 15:13 - 02123264 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-12-08 15:36 - 2015-11-08 14:53 - 02487808 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-12-08 15:36 - 2015-11-08 14:41 - 01546752 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-12-08 15:36 - 2015-11-08 14:30 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-12-08 15:36 - 2015-11-05 13:05 - 00017408 _____ (Microsoft Corporation) C:\windows\system32\wshrm.dll
2015-12-08 15:36 - 2015-11-05 13:02 - 00014848 _____ (Microsoft Corporation) C:\windows\SysWOW64\wshrm.dll
2015-12-08 15:36 - 2015-11-05 13:02 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2015-12-08 15:36 - 2015-11-05 13:00 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2015-12-08 15:36 - 2015-11-05 03:53 - 00146944 _____ (Microsoft Corporation) C:\windows\system32\Drivers\rmcast.sys
2015-12-08 15:36 - 2015-11-03 13:04 - 00802304 _____ (Microsoft Corporation) C:\windows\system32\usp10.dll
2015-12-08 15:36 - 2015-11-03 13:04 - 00241664 _____ (Microsoft Corporation) C:\windows\system32\els.dll
2015-12-08 15:36 - 2015-11-03 12:56 - 00627712 _____ (Microsoft Corporation) C:\windows\SysWOW64\usp10.dll
2015-12-08 15:36 - 2015-11-03 12:55 - 00179712 _____ (Microsoft Corporation) C:\windows\SysWOW64\els.dll
2015-12-08 15:36 - 2015-10-08 17:22 - 00069120 _____ (Microsoft Corporation) C:\windows\system32\nlsbres.dll
2015-12-08 15:36 - 2015-10-08 17:18 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDAZE.DLL
2015-12-08 15:36 - 2015-10-08 17:18 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\kbdgeoqw.dll
2015-12-08 15:36 - 2015-10-08 17:18 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDAZEL.DLL
2015-12-08 15:36 - 2015-10-08 17:18 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDAZE.DLL
2015-12-08 15:36 - 2015-10-08 17:18 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\kbdgeoqw.dll
2015-12-08 15:36 - 2015-10-08 17:18 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDAZEL.DLL
2015-12-08 15:36 - 2015-10-08 17:17 - 00069120 _____ (Microsoft Corporation) C:\windows\SysWOW64\nlsbres.dll
2015-12-08 15:36 - 2015-10-08 13:13 - 00419928 _____ C:\windows\SysWOW64\locale.nls
2015-12-08 15:36 - 2015-10-08 12:52 - 00419928 _____ C:\windows\system32\locale.nls
2015-12-04 14:46 - 2015-12-09 17:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-12-04 00:36 - 2015-12-09 14:14 - 00000000 ____D C:\AdwCleaner
2015-12-03 03:09 - 2015-12-03 03:09 - 00000572 _____ C:\Users\Public\Desktop\Fraps.lnk
2015-12-03 03:09 - 2015-12-03 03:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fraps
2015-12-02 22:43 - 2015-12-02 22:43 - 04264374 _____ C:\Users\Jorge\Downloads\11) LMD-03 u.6 González, M.J. (2007).pdf
2015-12-02 22:43 - 2015-12-02 22:43 - 04024951 _____ C:\Users\Jorge\Downloads\13) LMD-03 u. 6 Núñez, M.G., Salón, G., Romero, G. y Rosales, V. (2009).pdf
2015-12-02 22:43 - 2015-12-02 22:43 - 04018663 _____ C:\Users\Jorge\Downloads\12) LMD-03 u.6 Martínez, R., Munduate, L. y Medina, F.J. (2008).pdf
2015-12-02 22:21 - 2015-12-02 22:21 - 04464456 _____ C:\Users\Jorge\Downloads\8) LMD-03 u.5 Oblitas, L.A. (2010).pdf
2015-12-02 22:21 - 2015-12-02 22:21 - 04372388 _____ C:\Users\Jorge\Downloads\9) LMD-03 u.5 Harvard Business Press (2009).pdf
2015-12-02 22:21 - 2015-12-02 22:21 - 04017605 _____ C:\Users\Jorge\Downloads\10) LMD-03 u.5 Gabel, R., Peralta, V., Paiva, R.A. y Aguirre, G. (2012).pdf
2015-12-02 22:03 - 2015-12-02 22:03 - 00001614 _____ C:\Users\Jorge\Desktop\s.txt
2015-12-02 16:33 - 2015-12-02 16:33 - 00000678 _____ C:\Users\Jorge\Desktop\Untitled-1.ai
2015-12-02 16:33 - 2015-12-02 16:33 - 00000132 _____ C:\Users\Jorge\AppData\Roaming\Adobe IllExport Filter CS6 Prefs
2015-12-02 01:31 - 2015-12-02 01:30 - 00001995 _____ C:\Users\Jorge\Desktop\UserOptions.ini
2015-11-30 23:48 - 2015-12-09 17:52 - 00192216 _____ (Malwarebytes) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-11-30 23:48 - 2015-11-30 23:48 - 00001116 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-11-30 23:48 - 2015-11-30 23:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-11-30 23:47 - 2015-12-09 14:28 - 00109272 _____ (Malwarebytes) C:\windows\system32\Drivers\mbamchameleon.sys
2015-11-30 23:47 - 2015-11-30 23:48 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-11-30 23:47 - 2015-10-05 09:50 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-11-30 23:47 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\windows\system32\Drivers\mbam.sys
2015-11-30 03:10 - 2015-11-30 03:12 - 00001544 _____ C:\Users\Jorge\Desktop\Skype.exe.lnk
2015-11-27 00:13 - 2015-11-27 00:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2015-11-27 00:13 - 2015-11-27 00:13 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi
2015-11-23 16:46 - 2015-11-23 16:46 - 04378639 _____ C:\Users\Jorge\Downloads\7) LMD-03 u.4 Uribe, S.F. Molina, J.M., Contreras, F., Barbosa, D. y Espinosa, J.C. (2013).pdf
2015-11-23 16:46 - 2015-11-23 16:46 - 04339481 _____ C:\Users\Jorge\Downloads\5) LMD-03 u.3 Gil, M.D. (2013).pdf
2015-11-23 16:46 - 2015-11-23 16:46 - 04291726 _____ C:\Users\Jorge\Downloads\4) LMD-03 u.3 Shelton, N. y Burton, S. (2009).pdf
2015-11-23 16:46 - 2015-11-23 16:46 - 04192316 _____ C:\Users\Jorge\Downloads\6) LMD-02 u.4 Palomo, M.T. (2010).pdf
2015-11-18 03:26 - 2015-11-18 03:26 - 04247811 _____ C:\Users\Jorge\Downloads\3) LMD-03 u.2 Publicaciones Vértice (2010).pdf
2015-11-15 04:20 - 2015-12-07 23:38 - 02520755 _____ C:\Users\Jorge\AppData\Roaming\jorge-ms_64
2015-11-15 04:20 - 2015-11-30 03:53 - 10379264 _____ (TMCheats.com) C:\Users\Jorge\Desktop\D6OVwyOG.exe
2015-11-15 04:19 - 2015-11-15 04:19 - 08831506 _____ C:\Users\Jorge\Desktop\tmstreamer_v2_x64_2468D2H8R7D2C6DA5V.zip
2015-11-13 00:12 - 2015-11-13 00:12 - 00141570 _____ C:\Users\Jorge\Desktop\Price-Sheet-081815.pdf
2015-11-10 17:29 - 2015-10-19 19:12 - 05570496 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-11-10 17:29 - 2015-10-19 19:12 - 00154560 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-11-10 17:29 - 2015-10-19 19:12 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2015-11-10 17:29 - 2015-10-19 19:09 - 01730496 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2015-11-10 17:29 - 2015-10-19 19:06 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll
2015-11-10 17:29 - 2015-10-19 19:06 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2015-11-10 17:29 - 2015-10-19 19:06 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll
2015-11-10 17:29 - 2015-10-19 19:06 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 01461760 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 01216512 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 01164800 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00729600 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00424960 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00344064 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00315392 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00312320 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-11-10 17:29 - 2015-10-19 19:05 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2015-11-10 17:29 - 2015-10-19 19:05 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00044032 _____ (Microsoft Corporation) C:\windows\system32\cryptbase.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2015-11-10 17:29 - 2015-10-19 19:05 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
2015-11-10 17:29 - 2015-10-19 19:04 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
2015-11-10 17:29 - 2015-10-19 19:04 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2015-11-10 17:29 - 2015-10-19 19:04 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2015-11-10 17:29 - 2015-10-19 19:00 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2015-11-10 17:29 - 2015-10-19 18:59 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:53 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:52 - 03991488 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2015-11-10 17:29 - 2015-10-19 18:52 - 03935680 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2015-11-10 17:29 - 2015-10-19 18:48 - 01311768 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2015-11-10 17:29 - 2015-10-19 18:45 - 00552960 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2015-11-10 17:29 - 2015-10-19 18:45 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2015-11-10 17:29 - 2015-10-19 18:45 - 00251392 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2015-11-10 17:29 - 2015-10-19 18:45 - 00223232 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2015-11-10 17:29 - 2015-10-19 18:45 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2015-11-10 17:29 - 2015-10-19 18:45 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2015-11-10 17:29 - 2015-10-19 18:45 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2015-11-10 17:29 - 2015-10-19 18:45 - 00036864 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptbase.dll
2015-11-10 17:29 - 2015-10-19 18:45 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2015-11-10 17:29 - 2015-10-19 18:45 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2015-11-10 17:29 - 2015-10-19 18:45 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2015-11-10 17:29 - 2015-10-19 18:45 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2015-11-10 17:29 - 2015-10-19 18:44 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll
2015-11-10 17:29 - 2015-10-19 18:44 - 00665088 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
2015-11-10 17:29 - 2015-10-19 18:44 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
2015-11-10 17:29 - 2015-10-19 18:44 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2015-11-10 17:29 - 2015-10-19 18:44 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe
2015-11-10 17:29 - 2015-10-19 18:44 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2015-11-10 17:29 - 2015-10-19 18:39 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2015-11-10 17:29 - 2015-10-19 18:39 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00686080 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 18:35 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 17:41 - 00159232 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys
2015-11-10 17:29 - 2015-10-19 17:40 - 00290816 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys
2015-11-10 17:29 - 2015-10-19 17:40 - 00129024 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
2015-11-10 17:29 - 2015-10-19 17:29 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2015-11-10 17:29 - 2015-10-19 17:29 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2015-11-10 17:29 - 2015-10-19 17:27 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 17:27 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 17:27 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-11-10 17:29 - 2015-10-19 17:27 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-11-10 17:29 - 2015-09-23 07:15 - 00460776 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2015-11-10 17:29 - 2015-09-23 07:15 - 00299632 _____ (Microsoft Corporation) C:\windows\system32\bcryptprimitives.dll
2015-11-10 17:29 - 2015-09-23 07:09 - 00251000 _____ (Microsoft Corporation) C:\windows\SysWOW64\bcryptprimitives.dll
2015-11-10 17:28 - 2015-10-29 11:50 - 00342016 _____ (Microsoft Corporation) C:\windows\system32\apphelp.dll
2015-11-10 17:28 - 2015-10-29 11:50 - 00072192 _____ (Microsoft Corporation) C:\windows\system32\aelupsvc.dll
2015-11-10 17:28 - 2015-10-29 11:50 - 00023552 _____ (Microsoft Corporation) C:\windows\system32\sdbinst.exe
2015-11-10 17:28 - 2015-10-29 11:50 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\shimeng.dll
2015-11-10 17:28 - 2015-10-29 11:50 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\shimeng.dll
2015-11-10 17:28 - 2015-10-29 11:49 - 00295936 _____ (Microsoft Corporation) C:\windows\SysWOW64\apphelp.dll
2015-11-10 17:28 - 2015-10-29 11:49 - 00020992 _____ (Microsoft Corporation) C:\windows\SysWOW64\sdbinst.exe
2015-11-10 17:28 - 2015-10-13 10:41 - 00497664 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys
2015-11-10 17:28 - 2015-10-13 10:40 - 00118272 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tdx.sys
2015-11-10 17:28 - 2015-10-12 22:57 - 00950720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ndis.sys
2015-11-10 17:28 - 2015-10-01 12:00 - 00275456 _____ (Microsoft Corporation) C:\windows\system32\InkEd.dll
2015-11-10 17:28 - 2015-10-01 12:00 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\jnwmon.dll
2015-11-10 17:28 - 2015-10-01 11:50 - 00216064 _____ (Microsoft Corporation) C:\windows\SysWOW64\InkEd.dll
2015-11-10 00:36 - 2015-11-10 00:36 - 00002984 _____ C:\windows\System32\Tasks\{9E85CAA0-CAE9-4D74-8EB4-85AA1E4A11BB}
2015-11-10 00:36 - 2015-11-10 00:36 - 00000000 ____D C:\Users\Jorge\AppData\Roaming\Daybreak Game Company
2015-11-10 00:09 - 2015-11-10 00:09 - 00000000 ____D C:\windows\SysWOW64\NV
2015-11-10 00:09 - 2015-11-10 00:09 - 00000000 ____D C:\windows\system32\NV
2015-11-10 00:08 - 2015-11-05 11:13 - 42914096 _____ C:\windows\system32\nvcompiler.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 37882488 _____ C:\windows\SysWOW64\nvcompiler.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 22308656 _____ (NVIDIA Corporation) C:\windows\system32\nvoglv64.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 18362160 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvoglv32.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 17515208 _____ (NVIDIA Corporation) C:\windows\system32\nvwgf2umx.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 16553568 _____ (NVIDIA Corporation) C:\windows\system32\nvopencl.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 15717864 _____ (NVIDIA Corporation) C:\windows\system32\nvd3dumx.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 15121784 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvwgf2um.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 14835872 _____ (NVIDIA Corporation) C:\windows\system32\nvcuda.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 13527248 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvopencl.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 12770752 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvd3dum.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 12034248 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuda.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 11130488 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvlddmkm.sys
2015-11-10 00:08 - 2015-11-05 11:13 - 02870392 _____ (NVIDIA Corporation) C:\windows\system32\nvcuvid.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 02490488 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuvid.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 01905272 _____ (NVIDIA Corporation) C:\windows\system32\nvdispco6435891.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 01564792 _____ (NVIDIA Corporation) C:\windows\system32\nvdispgenco6435891.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 00877360 _____ (NVIDIA Corporation) C:\windows\system32\NvFBC64.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 00861816 _____ (NVIDIA Corporation) C:\windows\system32\NvIFR64.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 00689272 _____ (NVIDIA Corporation) C:\windows\SysWOW64\NvFBC.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 00673912 _____ (NVIDIA Corporation) C:\windows\SysWOW64\NvIFR.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 00151368 _____ (NVIDIA Corporation) C:\windows\system32\nvoglshim64.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 00128696 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvoglshim32.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 00069416 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvaudcap32v.dll
2015-11-10 00:08 - 2015-11-05 11:13 - 00050472 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvvad64v.sys
2015-11-10 00:08 - 2015-11-05 11:13 - 00031352 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvpciflt.sys
2015-11-09 21:25 - 2015-11-09 21:25 - 00000000 ____D C:\Users\Jorge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-09 17:56 - 2012-10-28 23:50 - 00000000 ____D C:\Users\Jorge\AppData\Roaming\Skype
2015-12-09 17:52 - 2013-05-06 20:46 - 00000000 ___RD C:\Users\Jorge\Dropbox
2015-12-09 17:52 - 2013-05-06 20:45 - 00000000 ____D C:\Users\Jorge\AppData\Roaming\Dropbox
2015-12-09 17:51 - 2014-09-07 22:35 - 00000000 ____D C:\ProgramData\VMware
2015-12-09 17:51 - 2014-07-13 17:07 - 00000000 ____D C:\Users\Jorge\AppData\Local\LogMeIn Hamachi
2015-12-09 17:51 - 2012-04-25 20:07 - 00000000 ____D C:\ProgramData\Bigfoot Networks
2015-12-09 17:50 - 2012-11-30 15:09 - 00001032 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-12-09 17:50 - 2009-07-13 23:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2015-12-09 17:47 - 2012-10-26 02:04 - 00000000 ____D C:\Users\Jorge
2015-12-09 17:46 - 2012-10-25 22:59 - 00000000 ___HD C:\Users\Jorge\AppData\Roaming\.purple
2015-12-09 17:43 - 2015-05-27 10:07 - 00000538 _____ C:\windows\Tasks\G2MUpdateTask-S-1-5-21-3234211791-2759061018-4055047508-1001.job
2015-12-09 17:40 - 2015-08-25 07:40 - 00002016 ____H C:\Users\Jorge\Documents\Default.rdp
2015-12-09 17:34 - 2012-11-30 15:09 - 00001036 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-12-09 17:16 - 2015-01-18 18:00 - 00000838 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2015-12-09 17:06 - 2015-06-05 07:09 - 00000634 _____ C:\windows\Tasks\G2MUploadTask-S-1-5-21-3234211791-2759061018-4055047508-1001.job
2015-12-09 17:01 - 2015-06-28 14:50 - 00000960 _____ C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3234211791-2759061018-4055047508-1001UA.job
2015-12-09 17:01 - 2015-06-28 14:50 - 00000908 _____ C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3234211791-2759061018-4055047508-1001Core.job
2015-12-09 16:49 - 2013-08-17 03:44 - 00000928 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3234211791-2759061018-4055047508-1001UA.job
2015-12-09 15:18 - 2009-07-13 22:45 - 00031712 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-12-09 15:18 - 2009-07-13 22:45 - 00031712 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-12-09 15:02 - 2009-07-13 22:45 - 00000000 ____D C:\windows\Setup
2015-12-09 14:13 - 2013-04-18 21:11 - 00000000 ____D C:\Users\Jorge\AppData\Local\Apps\2.0
2015-12-09 04:51 - 2009-07-13 21:20 - 00000000 ____D C:\Windows
2015-12-09 04:49 - 2013-08-17 03:44 - 00000906 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3234211791-2759061018-4055047508-1001Core.job
2015-12-09 04:43 - 2012-04-24 20:35 - 00762104 _____ C:\windows\system32\perfh00A.dat
2015-12-09 04:43 - 2012-04-24 20:35 - 00164410 _____ C:\windows\system32\perfc00A.dat
2015-12-09 04:43 - 2009-07-13 23:13 - 01717320 _____ C:\windows\system32\PerfStringBackup.INI
2015-12-09 04:43 - 2009-07-13 21:20 - 00000000 ____D C:\windows\inf
2015-12-09 02:00 - 2015-09-05 01:33 - 00000000 ____D C:\Users\Jorge\AppData\Local\Adobe
2015-12-09 01:50 - 2009-07-13 20:34 - 00000252 _____ C:\windows\system.ini
2015-12-09 01:19 - 2009-07-13 22:45 - 05028104 _____ C:\windows\system32\FNTCACHE.DAT
2015-12-09 01:16 - 2015-06-07 00:23 - 00295518 _____ C:\windows\ntbtlog.txt
2015-12-09 01:14 - 2013-03-17 03:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-12-09 01:14 - 2013-03-17 03:00 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-12-09 01:14 - 2013-03-17 03:00 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-12-09 01:13 - 2012-11-14 22:03 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-12-09 01:09 - 2012-10-26 03:02 - 00000000 ____D C:\Program Files (x86)\Steam
2015-12-08 23:16 - 2015-01-18 18:00 - 00003776 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-12-08 23:16 - 2012-10-26 02:40 - 00796864 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-12-08 23:16 - 2012-04-25 22:14 - 00142528 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-12-08 21:40 - 2012-12-15 18:58 - 00000000 ____D C:\Users\Jorge\AppData\Roaming\Audacity
2015-12-08 02:00 - 2013-06-12 00:21 - 00000000 ____D C:\Users\Jorge\AppData\Roaming\TS3Client
2015-12-07 22:24 - 2012-10-26 02:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-12-07 22:24 - 2009-07-13 23:32 - 00000000 ____D C:\windows\Performance
2015-12-07 22:24 - 2009-07-13 21:20 - 00000000 ____D C:\windows\tracing
2015-12-07 02:36 - 2013-01-16 22:36 - 00002329 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-12-04 19:29 - 2012-11-30 15:09 - 00004032 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-12-04 19:29 - 2012-11-30 15:09 - 00003780 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-12-04 02:06 - 2013-07-04 10:29 - 00000000 ____D C:\Users\Jorge\AppData\Local\Psi
2015-12-04 00:40 - 2013-01-16 22:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-12-04 00:28 - 2009-07-13 21:20 - 00000000 ____D C:\windows\PolicyDefinitions
2015-12-03 11:25 - 2012-10-28 23:50 - 00000000 ____D C:\ProgramData\Skype
2015-12-03 11:08 - 2012-10-26 02:31 - 00000000 ____D C:\Users\Jorge\Documents\Youcam
2015-12-03 03:27 - 2009-07-13 21:20 - 00000000 ____D C:\windows\Globalization
2015-12-02 03:11 - 2013-05-03 13:02 - 00000000 ____D C:\Users\Jorge\AppData\Roaming\gtk-2.0
2015-12-01 23:16 - 2009-07-13 21:20 - 00000000 ____D C:\windows\Branding
2015-12-01 11:45 - 2015-11-06 20:57 - 00000000 ____D C:\Users\Jorge\Downloads\PopcornTime
2015-12-01 00:16 - 2009-07-13 23:32 - 00000000 ____D C:\windows\addins
2015-11-30 23:47 - 2012-11-22 03:24 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-11-30 23:31 - 2011-02-14 15:43 - 00000000 ____D C:\windows\Panther
2015-11-30 23:07 - 2012-10-25 23:04 - 00000000 ____D C:\Users\Jorge\AppData\Roaming\ICQ
2015-11-30 10:18 - 2012-04-24 21:11 - 23864880 _____ (Macrovision Corporation) C:\Users\Public\Desktop\TurboBoostMonitor.exe
2015-11-30 10:13 - 2015-06-21 16:41 - 01419384 _____ C:\Users\Jorge\Downloads\80176-670969-jdownloader.exe
2015-11-30 10:13 - 2015-01-19 12:39 - 07499328 _____ (Tim Kosse) C:\Users\Jorge\Downloads\FileZilla_3.10.0.2_win32-setup.exe
2015-11-30 10:13 - 2014-10-09 11:01 - 07176070 _____ (Tim Kosse) C:\Users\Jorge\Downloads\FileZilla_3.9.0.5_win32-setup.exe
2015-11-30 10:13 - 2014-09-23 12:29 - 03667488 _____ (VIP Technologies ) C:\Users\Jorge\Downloads\vip72socks-set.exe
2015-11-30 10:13 - 2014-08-21 02:04 - 07170737 _____ (Tim Kosse) C:\Users\Jorge\Downloads\FileZilla_3.9.0.3_win32-setup.exe
2015-11-30 10:13 - 2014-08-10 17:54 - 06131712 _____ (OpenVPN Technologies) C:\Users\Jorge\Downloads\privatetunnel-win-2.3.exe
2015-11-27 03:26 - 2015-03-05 00:43 - 00000000 ____D C:\Users\Jorge\Desktop\Internet Marketing
2015-11-27 02:39 - 2015-06-11 15:06 - 00000000 ____D C:\Users\Jorge\AppData\LocalLow\LastPass
2015-11-26 23:50 - 2013-09-15 19:49 - 00007616 _____ C:\Users\Jorge\AppData\Local\Resmon.ResmonCfg
2015-11-23 22:20 - 2015-03-05 18:42 - 00000000 ____D C:\Users\Jorge\AppData\Local\Popcorn-Time
2015-11-13 00:34 - 2013-06-12 00:15 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2015-11-13 00:09 - 2013-10-25 13:51 - 00000000 ____D C:\Users\Jorge\Desktop\Random
2015-11-13 00:06 - 2013-01-21 23:57 - 00000000 ____D C:\Users\Jorge\Desktop\Production
2015-11-12 11:51 - 2014-07-13 17:07 - 00034720 ____H (LogMeIn, Inc.) C:\windows\system32\hamachi.sys
2015-11-11 16:23 - 2012-04-24 20:23 - 00000000 ____D C:\Program Files\Windows Journal
2015-11-11 12:00 - 2012-11-02 11:23 - 01691906 _____ C:\windows\SysWOW64\PerfStringBackup.INI
2015-11-10 00:36 - 2012-10-26 02:36 - 00000000 ____D C:\Users\Jorge\AppData\Local\ElevatedDiagnostics
2015-11-10 00:09 - 2013-02-14 22:55 - 00000000 ____D C:\Temp
2015-11-10 00:09 - 2012-04-25 20:03 - 00000000 ____D C:\ProgramData\NVIDIA

==================== Files in the root of some directories =======

2015-12-02 16:33 - 2015-12-02 16:33 - 0000132 _____ () C:\Users\Jorge\AppData\Roaming\Adobe IllExport Filter CS6 Prefs
2015-09-09 15:28 - 2015-09-13 23:29 - 0000132 _____ () C:\Users\Jorge\AppData\Roaming\Adobe PNG Format CS6 Prefs
2013-05-30 13:14 - 2013-05-30 13:14 - 0000000 ____H () C:\Users\Jorge\AppData\Roaming\begin.txt
2015-11-15 04:20 - 2015-12-07 23:38 - 2520755 _____ () C:\Users\Jorge\AppData\Roaming\jorge-ms_64
2013-06-20 22:42 - 2013-06-21 18:55 - 0002391 ____H () C:\Users\Jorge\AppData\Roaming\net.telestream.producer.xml
2015-10-05 14:44 - 2015-10-05 14:44 - 0000004 _____ () C:\Users\Jorge\AppData\Roaming\steam_md4.dat
2013-12-19 00:48 - 2013-12-19 00:48 - 0000030 ____H () C:\Users\Jorge\AppData\Roaming\WB.CFG
2015-09-09 16:54 - 2015-10-20 00:24 - 0001456 _____ () C:\Users\Jorge\AppData\Local\Adobe Save for Web 13.0 Prefs
2015-01-23 02:31 - 2015-01-23 02:31 - 0000600 _____ () C:\Users\Jorge\AppData\Local\PUTTY.RND
2015-09-11 00:38 - 2015-09-11 00:38 - 0000857 _____ () C:\Users\Jorge\AppData\Local\recently-used.xbel
2013-09-15 19:49 - 2015-11-26 23:50 - 0007616 _____ () C:\Users\Jorge\AppData\Local\Resmon.ResmonCfg
2015-05-03 04:08 - 2015-05-03 04:08 - 0000000 _____ () C:\Users\Jorge\AppData\Local\{7C533208-C60D-4CC0-B0D4-1EEF88698DB0}
2013-02-28 20:55 - 2013-02-28 20:55 - 0000095 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
2015-09-09 03:02 - 2015-09-09 03:02 - 0004973 _____ () C:\ProgramData\uowzbvmm.cjf

Some files in TEMP:
====================
C:\Users\Jorge\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpqo3qgk.dll
C:\Users\Jorge\AppData\Local\Temp\winioaw.exe
C:\Users\Jorge\AppData\Local\Temp\winlfqkp.exe


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\SysWOW64\wininit.exe => File is digitally signed
C:\windows\explorer.exe => File is digitally signed
C:\windows\SysWOW64\explorer.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\SysWOW64\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\SysWOW64\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\SysWOW64\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\dnsapi.dll => File is digitally signed
C:\windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-10-14 06:56

==================== End of FRST.txt ============================

 

 

The pcre.exe seems to have dissapeared finally from C, but im still getting the notifications from malwarebytes that i showed you.

 

Even from notepad++ now :( https://gyazo.com/eb76c59fa2590489bb69a927ea4a8908


Edited by superyui, 09 December 2015 - 07:00 PM.


#11 Jo*

Jo*

  • Malware Response Team
  • 3,445 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:09:54 PM

Posted 09 December 2015 - 07:07 PM

ESET Online Scanner

Note:
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.



If this program is already installed: Skip the installation and run only the scan!
  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the esetOnline.png button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on esetSmartInstall.png to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the esetSmartInstallDesktopIcon.png icon on your desktop.
  • Check esetAcceptTerms.png
  • Click the esetStart.png button.
  • Accept any security warnings from your browser.
  • Check esetScanArchives.png
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push esetListThreats.png
  • Push esetExport.png, and save the file to your desktop using a unique name, such as MyEsetScan. Alternatively, look for report in C:\Program Files\ESET\ESET Online Scanner\log.txt. Include the contents of this report in your next reply.
  • Push the Back button.
  • Select Uninstall application on close check box and push esetFinish.png

---


How the computer is running now?



---


Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.


#12 superyui

superyui
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:01:54 PM

Posted 10 December 2015 - 01:20 AM

Well, it's running the same since you told me to not remove the threats that it find, but it actually found like 780 lol

 

C:\autorun.inf    INF/Autorun.gen worm
C:\uvhg.exe    Win32/Sality virus
C:\$Windows.~BT\Drivers\DU\51e324b8-0a1d-40c3-a941-a452fa68acf6\3DVision.exe    Win32/Sality.NBA virus
C:\$Windows.~BT\Drivers\DU\51e324b8-0a1d-40c3-a941-a452fa68acf6\NvCplSetupEng.exe    Win32/Sality.NBA virus
C:\AdminPanel\AdminPanel.exe    a variant of Win32/Packed.Themida suspicious application
C:\AdminPanel\unins000.exe    Win32/Sality.NBA virus
C:\AdminPanel\tools\ExtractRDSFavorites\ExtractRdsFavorits.exe    Win32/Sality.NBA virus
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\Software Update Utility\dnu.exe.vir    Win32/Sality.NBA virus
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\Software Update Utility\uninstall.exe.vir    Win32/Sality.NBA virus
C:\AdwCleaner\Quarantine\C\Program Files (x86)\File Type Helper\FileTypeHelper.exe.vir    MSIL/FileTypeHelper.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\File Type Helper\FileTypeHelper_assoc.exe.vir    MSIL/FileTypeHelper.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\File Type Helper\uninstall.exe.vir    Win32/Sality.NBA virus
C:\AdwCleaner\Quarantine\C\Program Files (x86)\mipony\uninst.exe.vir    Win32/Sality.NBA virus
C:\AdwCleaner\Quarantine\C\Program Files (x86)\mipony\tes\tesseract.exe.vir    Win32/Sality.NBA virus
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mobogenie\New_UpdateMoboGenie.exe.vir    a variant of Win32/Adware.Mobogenie.A application
C:\AdwCleaner\Quarantine\C\ProgramData\Ask\APN-Stub\PF\APNIC.dll.vir    a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application
C:\AdwCleaner\Quarantine\C\Users\Jorge\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie2.1.26.zip.vir    multiple threats
C:\AdwCleaner\Quarantine\C\Users\Jorge\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\aapt.exe.vir    a variant of Win32/Adware.Mobogenie.A application
C:\AdwCleaner\Quarantine\C\Users\Jorge\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\CrashReport.exe.vir    a variant of Win32/Adware.Mobogenie.A application
C:\AdwCleaner\Quarantine\C\Users\Jorge\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\CrashRpt.dll.vir    a variant of Win32/Adware.Mobogenie.A application
C:\AdwCleaner\Quarantine\C\Users\Jorge\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\DaemonProcess.exe.vir    a variant of Win32/Adware.Mobogenie.A application
C:\AdwCleaner\Quarantine\C\Users\Jorge\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\devcon_x64.exe.vir    a variant of Win32/Adware.Mobogenie.A application
C:\AdwCleaner\Quarantine\C\Users\Jorge\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\devcon_x86.exe.vir    a variant of Win32/Adware.Mobogenie.A application
C:\AdwCleaner\Quarantine\C\Users\Jorge\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\DriverInstall_x64.exe.vir    a variant of Win32/Adware.Mobogenie.A application
C:\AdwCleaner\Quarantine\C\Users\Jorge\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\DriverInstall_x86.exe.vir    a variant of Win32/Adware.Mobogenie.A application
C:\AdwCleaner\Quarantine\C\Users\Jorge\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\lsusb.exe.vir    a variant of Win32/Adware.Mobogenie.A application
C:\AdwCleaner\Quarantine\C\Users\Jorge\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\mgadb.exe.vir    a variant of Win32/Adware.Mobogenie.A application
C:\AdwCleaner\Quarantine\C\Users\Jorge\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\mgusb.exe.vir    a variant of Win32/Adware.Mobogenie.A application
C:\AdwCleaner\Quarantine\C\Users\Jorge\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\Mobogenie.exe.vir    a variant of Win32/Mobogenie.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Jorge\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\MUServer.apk.vir    a variant of Android/Mobserv.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Jorge\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\New_UpdateMoboGenie.exe.vir    a variant of Win32/Adware.Mobogenie.A application
C:\AdwCleaner\Quarantine\C\Users\Jorge\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\OutlookOperatorC.exe.vir    a variant of Win32/Adware.Mobogenie.A application
C:\AdwCleaner\Quarantine\C\Users\Jorge\AppData\Local\VNT\vntldr.exe.vir    a variant of Win32/Bundled.Toolbar.Ask.M potentially unsafe application
C:\AdwCleaner\Quarantine\C\windows\SysNative\dmwu.exe.vir    a variant of Win64/Toolbar.Perion.D potentially unwanted application
C:\Fraps\fraps.exe    Win32/Sality.NBA virus
C:\Fraps\uninstall.exe    Win32/Sality.NBA virus
C:\FRST\Quarantine\C\pcre.exe.xBAD    Win32/Sality virus
C:\Games\Surgeon Simulator 2013\uninstall.exe    Win32/Sality.NBA virus
C:\NVIDIA\DisplayDriver\344.75\Win8_WinVista_Win7_64\International\GFExperience\7z.exe    Win32/Sality.NBA virus
C:\NVIDIA\DisplayDriver\344.75\Win8_WinVista_Win7_64\International\NV3DVision\3DVision.exe    Win32/Sality.NBA virus
C:\NVIDIA\DisplayDriver\358.91\Win8_WinVista_Win7_64\International\GFExperience\7z.exe    Win32/Sality.NBA virus
C:\NVIDIA\DisplayDriver\358.91\Win8_WinVista_Win7_64\International\NV3DVision\3DVision.exe    Win32/Sality.NBA virus
C:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\arh.exe    Win32/Sality.NBA virus
C:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\Adobe3DAndVideoServer\Adobe3DAndVideoServer.exe    Win32/Sality.NBA virus
C:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\photodownloader\Photodownloader.exe    Win32/Sality.NBA virus
C:\Program Files\Adobe\Adobe Illustrator CS6 (64 Bit)\Support Files\Contents\Windows\arh.exe    Win32/Sality.NBA virus
C:\Program Files\Adobe\Adobe Photoshop CS4 (64 Bit)\Adobe3DAndVideoServer\Adobe3DAndVideoServer.exe    Win32/Sality.NBA virus
C:\Program Files\Adobe\Adobe Photoshop CS4 (64 Bit)\Required\Droplet Template.exe    Win32/Sality.NBA virus
C:\Program Files\Autodesk\3ds Max 2014\SketchUpReader.exe    Win32/Sality.NBA virus
C:\Program Files\Autodesk\3ds Max 2014\stdplugs\Cube2QTVR.exe    Win32/Sality.NBA virus
C:\Program Files\Autodesk\3ds Max 2014\stdplugs\quicktimeShim.exe    Win32/Sality.NBA virus
C:\Program Files\Autodesk\3ds Max 2014\stdplugs\ShineExp\ra_tiff.exe    Win32/Sality.NBA virus
C:\Program Files\Autodesk\Composite2014\program\quicktimeShim.exe    Win32/Sality.NBA virus
C:\Program Files\Autodesk\Composite2014\python\lib\distutils\command\wininst-6.0.exe    Win32/Sality.NBA virus
C:\Program Files\Autodesk\Composite2014\python\lib\distutils\command\wininst-7.1.exe    Win32/Sality.NBA virus
C:\Program Files\Autodesk\Composite2014\python\lib\distutils\command\wininst-8.0.exe    Win32/Sality.NBA virus
C:\Program Files\Autodesk\Composite2014\python\lib\distutils\command\wininst-8_d.exe    Win32/Sality.NBA virus
C:\Program Files\Autodesk\Composite2014\python\lib\distutils\command\wininst-9.0.exe    Win32/Sality.NBA virus
C:\Program Files\Cakewalk\z3ta+\unins000.exe    Win32/Sality.NBA virus
C:\Program Files\Common Files\Autodesk Shared\DirectConnect2014 (64-bit)\bin\wrapper.exe    Win32/Sality.NBA virus
C:\Program Files\Common Files\Autodesk Shared\DirectConnect2014 (64-bit)\java\jre1.6.0_03\bin\java-rmi.exe    Win32/Sality.NBA virus
C:\Program Files\Common Files\Autodesk Shared\DirectConnect2014 (64-bit)\java\jre1.6.0_03\bin\java.exe    Win32/Sality.NBA virus
C:\Program Files\Common Files\Autodesk Shared\DirectConnect2014 (64-bit)\java\jre1.6.0_03\bin\javacpl.exe    Win32/Sality.NBA virus
C:\Program Files\Common Files\Autodesk Shared\DirectConnect2014 (64-bit)\java\jre1.6.0_03\bin\javaw.exe    Win32/Sality.NBA virus
C:\Program Files\Common Files\Autodesk Shared\DirectConnect2014 (64-bit)\java\jre1.6.0_03\bin\javaws.exe    Win32/Sality.NBA virus
C:\Program Files\Common Files\Autodesk Shared\DirectConnect2014 (64-bit)\java\jre1.6.0_03\bin\jucheck.exe    Win32/Sality.NBA virus
C:\Program Files\Common Files\Autodesk Shared\DirectConnect2014 (64-bit)\java\jre1.6.0_03\bin\jureg.exe    Win32/Sality.NBA virus
C:\Program Files\Common Files\Autodesk Shared\DirectConnect2014 (64-bit)\java\jre1.6.0_03\bin\jusched.exe    Win32/Sality.NBA virus
C:\Program Files\Common Files\Autodesk Shared\DirectConnect2014 (64-bit)\java\jre1.6.0_03\bin\keytool.exe    Win32/Sality.NBA virus
C:\Program Files\Common Files\Autodesk Shared\DirectConnect2014 (64-bit)\java\jre1.6.0_03\bin\kinit.exe    Win32/Sality.NBA virus
C:\Program Files\Common Files\Autodesk Shared\DirectConnect2014 (64-bit)\java\jre1.6.0_03\bin\klist.exe    Win32/Sality.NBA virus
C:\Program Files\Common Files\Autodesk Shared\DirectConnect2014 (64-bit)\java\jre1.6.0_03\bin\ktab.exe    Win32/Sality.NBA virus
C:\Program Files\Common Files\Autodesk Shared\DirectConnect2014 (64-bit)\java\jre1.6.0_03\bin\orbd.exe    Win32/Sality.NBA virus
C:\Program Files\Common Files\Autodesk Shared\DirectConnect2014 (64-bit)\java\jre1.6.0_03\bin\pack200.exe    Win32/Sality.NBA virus
C:\Program Files\Common Files\Autodesk Shared\DirectConnect2014 (64-bit)\java\jre1.6.0_03\bin\policytool.exe    Win32/Sality.NBA virus
C:\Program Files\Common Files\Autodesk Shared\DirectConnect2014 (64-bit)\java\jre1.6.0_03\bin\rmid.exe    Win32/Sality.NBA virus
C:\Program Files\Common Files\Autodesk Shared\DirectConnect2014 (64-bit)\java\jre1.6.0_03\bin\rmiregistry.exe    Win32/Sality.NBA virus
C:\Program Files\Common Files\Autodesk Shared\DirectConnect2014 (64-bit)\java\jre1.6.0_03\bin\servertool.exe    Win32/Sality.NBA virus
C:\Program Files\Common Files\Autodesk Shared\DirectConnect2014 (64-bit)\java\jre1.6.0_03\bin\tnameserv.exe    Win32/Sality.NBA virus
C:\Program Files\Common Files\Autodesk Shared\DirectConnect2014 (64-bit)\java\jre1.6.0_03\bin\unpack200.exe    Win32/Sality.NBA virus
C:\Program Files\Java\jdk1.7.0_67\bin\jvisualvm.exe    Win32/Sality.NBA virus
C:\Program Files\Java\jdk1.7.0_67\lib\visualvm\platform\lib\nbexec.exe    Win32/Sality.NBA virus
C:\Program Files\MotioninJoy\unins000.exe    Win32/Sality.NBA virus
C:\Program Files\MSI\MSI Software Install\InstallAP.exe    Win32/Sality.NBA virus
C:\Program Files\Native Instruments\Service Center\Reloader.exe    Win32/Sality.NBA virus
C:\Program Files\Native Instruments\Service Center\ServiceCenter.exe    Win32/Sality.NBA virus
C:\Program Files\Native Instruments\Traktor Audio 10 Driver\Helper\devcon.exe    Win32/Sality.NBA virus
C:\Program Files\Native Instruments\Traktor Audio 6 Driver\Helper\devcon.exe    Win32/Sality.NBA virus
C:\Program Files\Sony\Vegas Pro 10.0\vidcap60.exe    Win32/Sality.NBA virus
C:\Program Files\Sony\Vegas Pro 10.0\FileIO Plug-Ins\ac3plug\ac3market\ApplicationRegistration.exe    Win32/Sality.NBA virus
C:\Program Files\Sony\Vegas Pro 10.0\x86\CreateMinidumpx86.exe    Win32/Sality.NBA virus
C:\Program Files\Sony\Vegas Pro 10.0\x86\FileIOSurrogate.exe    Win32/Sality.NBA virus
C:\Program Files\Sony\Vegas Pro 10.0\x86\sfvstserver.exe    Win32/Sality.NBA virus
C:\Program Files\Sony\Vegas Pro 12.0\vidcap60.exe    Win32/Sality.NBA virus
C:\Program Files\Sublime Text 2\unins000.exe    Win32/Sality.NBA virus
C:\Program Files\TeamSpeak 3 Client\createfileassoc.exe    Win32/Sality.NBA virus
C:\Program Files\TeamSpeak 3 Client\Uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\7-Zip\7z.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\7-Zip\7zG.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\7-Zip\Uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\abgx360\abgx360gui.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\abgx360\uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe After Effects CS4\Mocha\bin\Mocha For After Effects.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Bridge CS4\Adobe3DAndVideoServer.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Bridge CS4\Bridge.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Bridge CS4\bridgeproxy.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Bridge CS4\Photodownloader.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Device Central CS4\LogTransport2.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Device Central CS4\Required\Opera\program\plugins\NPSWF32_FlashUtil.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Dreamweaver CS4\LogTransport2.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Dreamweaver CS4\JVM\bin\java.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Dreamweaver CS4\JVM\bin\javac.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Dreamweaver CS4\JVM\bin\javaw.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Dreamweaver CS4\JVM\bin\keytool.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Dreamweaver CS4\JVM\bin\policytool.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Dreamweaver CS4\JVM\bin\rmid.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Dreamweaver CS4\JVM\bin\rmiregistry.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Dreamweaver CS4\JVM\bin\tnameserv.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Extension Manager CS4\Adobe Extension Manager CS4.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Extension Manager CS4\Replace.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\arh.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\Replace.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\XManCommand.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Illustrator CS4\Support Files\Contents\Windows\AIRegTool.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Illustrator CS4\Support Files\Contents\Windows\CrashReporterApp.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Illustrator CS4\Support Files\Contents\Windows\LogTransport.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Illustrator CS4\Support Files\Contents\Windows\LogTransport2.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Photoshop CS4\Required\Droplet Template.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Photoshop CS6\Adobe Photoshop CS6\App\PhotoshopCS6\sniffer_gpu.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Photoshop CS6\Microsoft\vcredist_x64.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Photoshop CS6\Microsoft\vcredist_x86.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Adobe Premiere Pro CS4\MPEGHDVExport.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Flash Media Live Encoder 3.2\FlashMediaLiveEncoder.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Flash Media Live Encoder 3.2\FMLECmd.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Flash Media Live Encoder 3.2\FMLELauncher.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Adobe\Flash Media Live Encoder 3.2\LogTransport2.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Age of Empires II HD\empires 2.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Age of Empires II HD\steam_api.dll    a variant of Win32/HackTool.Crack.BQ potentially unsafe application
C:\Program Files (x86)\Age of Empires II HD\_CommonRedist\vcredist\2010\vcredist_x64.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Age of Empires II HD\_CommonRedist\vcredist\2010\vcredist_x86.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\ASIO4ALL v2\uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Audacity\unins000.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Bandicam\uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\BandiMPEG1\uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\BBE Sound\D82 Sonic Maximizer\Interlok Extensions\DriverSetup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Bitvise Tunnelier\bvtermc.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Bitvise Tunnelier\glclstgs.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Bitvise Tunnelier\log.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Bitvise Tunnelier\sexec.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Bitvise Tunnelier\sftpc.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Bitvise Tunnelier\sshdstgs.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Bitvise Tunnelier\stermc.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Bitvise Tunnelier\totermc.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Bitvise Tunnelier\uninst.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Bitvise Tunnelier\WRC-5.06\WRC.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Bitvise Tunnelier\WRC-5.11\WRC.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Bitvise Tunnelier\WRC-5.18\WRC.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\BlueStacks\HD-Adb.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\BlueStacks\HD-BlockDevice.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\BlueStacks\HD-GLCheck.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\BlueStacks\HD-Network.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\BlueStacks\HD-OptiPng.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\BlueStacks\HD-SharedFolder.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\BlueStacks\HD-unzip.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\BlueStacks\HD-zip.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Bohemia Interactive\ArmA\Expansion\BattlEye\UnInstallBE.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Browse For Hunger\Browse For Hunger-bg.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Browse For Hunger\Browse For Hunger-buttonutil.dll    a variant of Win32/Toolbar.CrossRider.H potentially unwanted application
C:\Program Files (x86)\Browse For Hunger\Browse For Hunger-buttonutil.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Browse For Hunger\Browse For Hunger-buttonutil64.dll    a variant of Win64/Toolbar.Crossrider.A potentially unwanted application
C:\Program Files (x86)\Browse For Hunger\Browse For Hunger-buttonutil64.exe    a variant of Win64/Toolbar.Crossrider.A potentially unwanted application
C:\Program Files (x86)\Browse For Hunger\Browse For Hunger-codedownloader.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Browse For Hunger\Browse For Hunger-helper.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Browse For Hunger\Uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Cheat Engine 6.3\cheatengine-i386.exe    a variant of Win32/HackTool.CheatEngine.AB potentially unsafe application
C:\Program Files (x86)\Cheat Engine 6.3\standalonephase1.dat    a variant of Win32/HackTool.CheatEngine.AF potentially unsafe application
C:\Program Files (x86)\Cheat Engine 6.3\unins000.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Citrix\GoToMeeting\3356\g2mcomm.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Citrix\GoToMeeting\3356\G2MInstaller.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Citrix\GoToMeeting\3356\G2MInstHigh.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Citrix\GoToMeeting\3356\g2mlauncher.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Citrix\GoToMeeting\3356\g2mstart.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Citrix\GoToMeeting\3356\g2mtranscoder.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Citrix\GoToMeeting\3356\g2mui.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Citrix\GoToMeeting\3356\G2MUninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Citrix\GoToMeeting\3356\g2mupdate.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Citrix\GoToMeeting\3356\g2mupload.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Citrix\GoToMeeting\3356\g2mvideoconference.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Citrix\GoToMeeting\3499\g2mcomm.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Citrix\GoToMeeting\3499\G2MInstaller.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Citrix\GoToMeeting\3499\G2MInstHigh.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Citrix\GoToMeeting\3499\g2mlauncher.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Citrix\GoToMeeting\3499\g2mstart.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Citrix\GoToMeeting\3499\g2mtranscoder.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Citrix\GoToMeeting\3499\g2mui.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Citrix\GoToMeeting\3499\G2MUninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Citrix\GoToMeeting\3499\g2mupdate.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Citrix\GoToMeeting\3499\g2mupload.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Citrix\GoToMeeting\3499\g2mvideoconference.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Common Files\Adobe\dynamiclink\CS6\dynamiclinkmanager.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Common Files\Adobe\dynamiclinkmediaserver\1.0\Adobe QT32 Server.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Common Files\Adobe\dynamiclinkmediaserver\1.0\amecommand.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Common Files\Adobe\dynamiclinkmediaserver\1.0\dynamiclinkmediaserver.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Common Files\Adobe\dynamiclinkmediaserver\1.0\ImporterREDServer.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\LogTransport2.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\IDriver.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\IDriver2.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriver.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriver2.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\gstat.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Common Files\MAGIX Services\Database\Compat1.5\bin\FABS.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Corel\CorelWinDVD2010\DIM.EXE    Win32/Sality.NBA virus
C:\Program Files (x86)\Corel\CorelWinDVD2010\WinDVD.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Corel\CorelWinDVD2010\WinDVD10Splash.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Corel\CorelWinDVD2010\WinDVDFs.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Creative\THX TruStudio Pro\APOIM\APOIM64.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\CTSUAppu.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\CyberLink\Shared files\EffectExtractor.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\CyberLink\YouCam\YouCam.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\CyberLink\YouCam\OLRSubmission\OLRStateCheck.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\CyberLink\YouCam\OLRSubmission\OLRSubmission.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\CyberLink\YouCam\subsys\BigBang\Runtime\CLUpdater.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Delphi7SE\Extras\DelphiTweaks.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Delphi7SE\Extras\MMXtrialCleaner.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\DsNET Corp\aTube Catcher 2.0\asfbin.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\DsNET Corp\aTube Catcher 2.0\eWorker.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\DsNET Corp\aTube Catcher 2.0\rtmpdump.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\DsNET Corp\aTube Catcher 2.0\tsmuxer.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\DsNET Corp\aTube Catcher 2.0\unins000.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\DsNET Corp\aTube Catcher 2.0\uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\DsNET Corp\aTube Catcher 2.0\videoplay.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Dxtory Software\Dxtory2.0\unins000.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Electronic Arts\SPORE\Sporebin\SporeApp.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Electronic Arts\SPORE\Support\SPORE™_code.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Electronic Arts\SPORE\Support\SPORE™_uninst.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Electronic Arts\The Sims 3\Game\Bin\TS3.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Electronic Arts\The Sims 3\Support\EADM\eadm-installer.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Euro Truck Simulator 2\unins000.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\FaceDominator\FaceDominator2.0\FD_LicensingManager.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Far Cry 4\GDFInstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Far Cry 4\unins000.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Far Cry 4\Redist\dxwebsetup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\FileZilla FTP Client\filezilla.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\FileZilla FTP Client\fzputtygen.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\FileZilla FTP Client\fzsftp.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\FileZilla FTP Client\uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\George\2bf2d136-ab28-4bdd-8c8b-e1838343e631@2e9291c5-67cd-4375-afc8-b2772f9fcf45.com.xpi    JS/Toolbar.Crossrider.G potentially unwanted application
C:\Program Files (x86)\George\hilariousvideos.crx    JS/Toolbar.Crossrider.E potentially unwanted application
C:\Program Files (x86)\GMT-MAX.ORG\The Sims 4 Deluxe Edition\Game\Bin\3dmgame.dll    a variant of Win32/Packed.VMProtect.AAA trojan
C:\Program Files (x86)\GMT-MAX.ORG\The Sims 4 Deluxe Edition\Uninstall\unins000.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\GMT-MAX.ORG\The Sims 4 Deluxe Edition\__Installer\vp6\vp6install.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Google\Google Web Designer\1.2.4.0\uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\47.0.2526.73\47.0.2526.73_46.0.2490.86_chrome_updater.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Google\Update\Download\{811767F4-C586-4673-A41F-E9D767497222}\1.2.4.0\googlewebdesigner_win_1.2.4.0.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\GtkSharp\2.12\bin\gdk-pixbuf-query-loaders.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\GtkSharp\2.12\bin\gspawn-win32-helper-console.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\GtkSharp\2.12\bin\gspawn-win32-helper.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\GtkSharp\2.12\bin\pango-querymodules.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Gyazo\unins000.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\HilariousVideos\HilariousVideos-bg.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\HilariousVideos\HilariousVideos-buttonutil.dll    a variant of Win32/Toolbar.CrossRider.H potentially unwanted application
C:\Program Files (x86)\HilariousVideos\HilariousVideos-buttonutil.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\HilariousVideos\HilariousVideos-buttonutil64.dll    a variant of Win64/Toolbar.Crossrider.A potentially unwanted application
C:\Program Files (x86)\HilariousVideos\HilariousVideos-buttonutil64.exe    a variant of Win64/Toolbar.Crossrider.A potentially unwanted application
C:\Program Files (x86)\HilariousVideos\HilariousVideos-codedownloader.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\HilariousVideos\HilariousVideos-helper.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\HilariousVids\HilariousVids-bg.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\HilariousVids\HilariousVids-buttonutil.dll    a variant of Win32/Toolbar.CrossRider.H potentially unwanted application
C:\Program Files (x86)\HilariousVids\HilariousVids-buttonutil.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\HilariousVids\HilariousVids-buttonutil64.dll    a variant of Win64/Toolbar.Crossrider.A potentially unwanted application
C:\Program Files (x86)\HilariousVids\HilariousVids-buttonutil64.exe    a variant of Win64/Toolbar.Crossrider.A potentially unwanted application
C:\Program Files (x86)\HilariousVids\HilariousVids-codedownloader.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\HilariousVids\HilariousVids-helper.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\HMA! Pro VPN\Uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\HMA! Pro VPN\bin\subinacl.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\HmelyoffLabs\unins000.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\HmelyoffLabs\VHScrCap\VHScrCapDlg.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\HmelyoffLabs\VHToolkit\VHCapture.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\HmelyoffLabs\VHToolkit\VHMultiCam.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\HmelyoffLabs\VHToolkit\VHPlayer.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\ICQ7M\ICQ.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\ICQ7M\IcqUpdater.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\IM Powerhouse\SocialRankJetSuite\SocialRankJetSuite.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Image-Line\Downloader\ILDownloadManager.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Image-Line\Downloader\Uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Image-Line\Downloader\Update\Updater.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Image-Line\FL Studio 10\Uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Image-Line\FL Studio 10\Plugins\VST\AiR LOGS\Waves SSL Collection v1.2\UNWISE.EXE    Win32/Sality.NBA virus
C:\Program Files (x86)\Image-Line\FL Studio 10\Plugins\VST\DX Utilities\WaveShell-DirectX_Registration-Utility5.7.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Image-Line\IL Gross Beat\Uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Image-Line\Shared\Uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\InstallShield Installation Information\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\InstallShield Installation Information\{2892E1B7-E24D-4CCB-B8A7-B63D4B66F89F}\setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\InstallShield Installation Information\{332EBFE0-C39E-42D1-99B5-ABBBECAD71B6}\setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\InstallShield Installation Information\{40FEF622-6E0F-46B6-824B-A40C178FD4CD}\setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\InstallShield Installation Information\{4DEA5B85-6C56-45F3-AE00-FED756B0D3B4}\setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\InstallShield Installation Information\{4FA6CB9A-2972-4AAF-A36E-3C40FCC22395}\setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\InstallShield Installation Information\{619FA785-489B-4D22-911F-82D6EDF5BDB0}\setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\InstallShield Installation Information\{671EC9B2-A0F0-4035-AA48-729EDC3C59EF}\setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\InstallShield Installation Information\{758C8301-2696-4855-AF45-534B1200980A}\setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\InstallShield Installation Information\{781B39EC-2E18-41FC-9B00-B84E4FFCA85F}\ICQ7.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\InstallShield Installation Information\{9DF0196F-B6B8-4C3A-8790-DE42AA530101}\SPORE™_uninst.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\InstallShield Installation Information\{9DF0196F-B6B8-4C3A-8790-DE42AA530101}\SPORESetup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\InstallShield Installation Information\{A4824921-63A6-4616-9335-557B860307F7}\setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\InstallShield Installation Information\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}\Sims3Setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\InstallShield Installation Information\{C1594429-8296-4652-BF54-9DBE4932A44C}\setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\InstallShield Installation Information\{DDCCBB78-8FFB-4FDE-912F-930E4D9FBC67}\setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\InstallShield Installation Information\{DF446558-ADF7-4884-9B2D-281979CCE71F}\setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\InstallShield Installation Information\{F50302D2-9E07-4A43-B9EA-7AC712F34711}\setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\InstallShield Installation Information\{F50302D2-9E07-4A43-B9EA-7AC712F34711}\THXSpkEQMSI\Setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\InstallShield Installation Information\{F50302D2-9E07-4A43-B9EA-7AC712F34711}\THXSpkEQMSI\support\i386\MBSEQstp.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\InstallShield Installation Information\{FAB1F336-1B7C-4057-A7BC-2922CD82A781}\setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Intel\Intel Control Center\Uninstaller\SetupICC.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Intel\Intel® Management Engine Components\uninstall\Setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Intel\Intel® Processor Graphics\uninstall\Setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\uninstall\Setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\uninstall\Setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Intel\OpenCL SDK\2.0\uninstall\Setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\JDownloader\JDownloader.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\JDownloader\JDownloaderBETA.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\JDownloader\JDownloaderD3D.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\JDownloader\plugins\jdshutdown\windows\shutdown.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\JDownloader\tools\Windows\kikin\kikin_installer.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\JDownloader\tools\Windows\unrarw32\unrar.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Lame For Audacity\unins000.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MagicDisc\muninst.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MagicDisc\UNWISE.EXE    Win32/Sality.NBA virus
C:\Program Files (x86)\MagicISO\MagicISO.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MagicISO\miso.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MagicISO\UNWISE.EXE    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\Foto_Manager_9\explore.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\Foto_Manager_9\InstallLauncher.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\Foto_Manager_9\instslct.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\Foto_Manager_9\MagixRestart.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\Foto_Manager_9\MGXCmdDel.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\Foto_Manager_9\uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\Foto_Manager_9\unwise.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\Foto_Manager_9\Validation.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\Foto_Manager_9\MAGIX Print Service\cewestart.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\MusicMaker16_Version_para_descargar\explore.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\MusicMaker16_Version_para_descargar\InstallLauncher.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\MusicMaker16_Version_para_descargar\instslct.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\MusicMaker16_Version_para_descargar\MagixRestart.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\MusicMaker16_Version_para_descargar\MGXCmdDel.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\MusicMaker16_Version_para_descargar\MusicMaker.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\MusicMaker16_Version_para_descargar\uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\MusicMaker16_Version_para_descargar\unwise.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\MusicMaker16_Version_para_descargar\mxcdr\setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\MusicMaker16_Version_para_descargar\PCVisit\setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\PCVisit\explore.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\PCVisit\instslct.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\PCVisit\Screenshare.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\PCVisit\uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\PCVisit\unwise.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\Speed2_burnR_mxcdr\explore.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\Speed2_burnR_mxcdr\instslct.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\Speed2_burnR_mxcdr\Restore.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\Speed2_burnR_mxcdr\Speed.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\Speed2_burnR_mxcdr\startup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\Speed2_burnR_mxcdr\uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\Speed2_burnR_mxcdr\unwise.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\Speed2_burnR_mxcdr\CDR_MediaManager\MediaManager.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\Video_easy_SE\InstallLauncher.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\Video_easy_SE\MagixRestart.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\Video_easy_SE\VideoEasy.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MAGIX\Video_easy_SE\Video_easy_SE_es-ES_setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Malwarebytes Anti-Malware\unins000.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Mono\bin\gdk-pixbuf-query-loaders.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Mono\bin\gspawn-win32-helper-console.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Mono\bin\gspawn-win32-helper.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Mono\bin\mono-boehm.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Mono\bin\mono-sgen.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Mono\bin\mono.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Mono\bin\pango-querymodules.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Mono\bin\pkg-config.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MonsterSocial\unins000.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Mozilla Firefox\maintenanceservice_installer.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Mozilla Firefox\webapp-uninstaller.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MSI\Super-Charger\ipadchg.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MSI\Super-Charger\MSIWallpaper.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MSI\Super-Charger\Super-Charger.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MSI\Super-Charger\unins000.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MSI Afterburner\MSIAfterburnerWrapper.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MSI Afterburner\Uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MSI Afterburner\Bundle\OSDServer\RTSS.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MSI Afterburner\Bundle\OSDServer\RTSSWrapper.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MSI Afterburner\Redist\dxwebsetup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MSI Afterburner\Redist\vcredist_x86.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MSI Afterburner\SDK\Samples\SharedMemory\MACMSharedMemorySample\Release\MACMSharedMemorySample.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MSI Afterburner\SDK\Samples\SharedMemory\MAHMSharedMemorySample\Release\MAHMSharedMemorySample.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\MSI Afterburner\SDK\Samples\SharedMemory\RTSSSharedMemorySample\Release\RTSSSharedMemorySample.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\NCH Software\ExpressBurn\expressburn.exe    a variant of Win32/Bundled.Toolbar.Google.C potentially unsafe application
C:\Program Files (x86)\NCH Software\ExpressBurn\expressburnsetup_v4.82.exe    a variant of Win32/Bundled.Toolbar.Google.C potentially unsafe application
C:\Program Files (x86)\Notepad++\notepad++.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Notepad++\updater\GUP.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\7z.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\OpenVPN\Uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\OpenVPN\bin\openssl.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\OpenVPN\bin\openvpn-gui-1.0.3.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\OpenVPN\bin\openvpn.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Outsim\SynthMaker\uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Palringo\Uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\PAYDAY 2\unins000.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\PAYDAY 2\_CommonRedist\vcredist\2008\vcredist_x64.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\PAYDAY 2\_CommonRedist\vcredist\2008\vcredist_x86.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Pidgin\pidgin-uninst.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Pidgin\pidgin.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Pidgin\Gtk\bin\gdk-pixbuf-query-loaders.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Pidgin\Gtk\bin\gspawn-win32-helper-console.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Pidgin\Gtk\bin\gspawn-win32-helper.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Pidgin\Gtk\bin\pango-querymodules.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\pidgin-otr\pidgin-otr-uninst.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Pioneer\rekordbox 2.2.0\edb_streamd.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Pioneer\rekordbox 2.2.0\PSvLinkSysMgr.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Pioneer\rekordbox 2.2.0\PSvNFSd.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Pioneer\rekordbox 2.2.0\Uninstall rekordbox 2.2.0.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Pioneer\rekordbox 2.2.0\Upmgr rekordbox.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Pioneer\rekordbox 2.2.4\edb_streamd.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Pioneer\rekordbox 2.2.4\PSvLinkSysMgr.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Pioneer\rekordbox 2.2.4\PSvNFSd.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Pioneer\rekordbox 2.2.4\Uninstall rekordbox 2.2.4.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Pioneer\rekordbox 2.2.4\Upmgr rekordbox.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Pioneer\rekordbox 3.2.0\edb_streamd.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Pioneer\rekordbox 3.2.0\PSvLinkSysMgr.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Pioneer\rekordbox 3.2.0\PSvNFSd.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Pioneer\rekordbox 3.2.0\Upmgr rekordbox.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Playlist Creator 3.6.2\pc3.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Playlist Creator 3.6.2\uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Popcorn Time\PopcornTimeDesktop.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Popcorn Time\unins000.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Psi\uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Psicraft\Akai Professional\Vyzex MPK25\Win32\unins000.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Psicraft\Akai Professional\Vyzex MPK25\Win32\Vyzex MPK25.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\RALINK\RT6x Wireless LAN Card\Installer\VISTAX64\RaUI.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\RALINK\RT6x Wireless LAN Card\Installer\VISTAX86\RaUI.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Realtek\Audio\Drivers\HDADrv\Setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Samsung\Kies\DriverChecker.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Samsung\Kies\lame.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Samsung\Kies\oggenc.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Samsung\Kies\External\DeviceModules\ConnectionManager.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Samsung\Kies\External\DeviceModules\DeviceDataService.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Samsung\Kies\External\DeviceModules\DeviceManager.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Samsung\Kies\External\DeviceModules\ErrorReport.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Samsung\Kies\External\DeviceModules\FsUsbExAdmin.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Samsung\Kies\External\DeviceModules\FsUsbExService.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Samsung\Kies\External\TransModules\SelfMV.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Samsung\Kies\External\TransModules\SelfMV2.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Samsung\Kies\USB Driver\SAMSUNG_USB_Driver_for_Mobile_Phones.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Serato\ITCH\Driver Installers\NS6\32bit\CPLNumark_NS6.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Serato\ITCH\Driver Installers\NS6\32bit\Setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Serato\ITCH\Driver Installers\NS7\32bit\CPLNumark_NS7.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Serato\ITCH\Driver Installers\NS7\32bit\Setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Serato\ITCH\Driver Installers\V7\32bit\CPLNumark_V7.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Serato\ITCH\Driver Installers\V7\32bit\Setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Serato\ITCH\Driver Installers\XONE_DX\32bit\Setup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\SplitMediaLabs\XSplit\VHScrCapDlg32.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\SplitMediaLabs\XSplit\xsplit_updater.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\steam\backup\english\steambackup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\steam\backup\french\steambackup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\steam\backup\german\steambackup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\steam\backup\italian\steambackup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\steam\backup\spanish\steambackup.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\Alan Wake\thirdparty\Studio_Redistributable\vcredist_x86.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\APB Reloaded\Binaries\APB_Gecko.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\APB Reloaded\Binaries\pbsvc_apb.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\APB Reloaded\TPI\DotNet\dotnetfx.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\APB Reloaded\TPI\PhysX\PhysX_9.10.0129_SystemSoftware.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\APB Reloaded\TPI\PunkBuster\PunkBuster_APBInstaller.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\APB Reloaded\TPI\VC2005_Redist\vcredist_x86.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\APB Reloaded\TPI\VC2008_Redist\vcredist_x86.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\APB Reloaded\TPI\VC2010_Redist\vcredist_x86.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\APB Reloaded\TPI\WindowsInstaller\WindowsInstaller-KB893803-v2-x86.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\Arma 2\BattlEye\UnInstallBE.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\Arma 2\BEsetup\setup_BattlEyeARMA2.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\Arma 2 Operation Arrowhead\ArmA2OA.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\Arma 2 Operation Arrowhead\ArmA2OA_BE.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\Arma 2 Operation Arrowhead\Expansion\BattlEye\BEService.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\Arma 2 Operation Arrowhead\Expansion\BattlEye\UnInstallBE.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\Arma 2 Operation Arrowhead\TM cheats\objects.dll    a variant of Win32/Packed.Themida suspicious application
C:\Program Files (x86)\Steam\SteamApps\common\Call of Duty World at War\CoDWaW.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\Call of Duty World at War\CoDWaWmp.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\Call of Duty World at War\installers\pbsvc.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\chivalrymedievalwarfare\Binaries\UE3ShaderCompileWorker.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\chivalrymedievalwarfare\Binaries\Win32\UE3ShaderCompileWorker.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\chivalrymedievalwarfare\Binaries\Win32\WorkshopProc.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\chivalrymedievalwarfare\_CommonRedist\vcredist\2010\vcredist_x64.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\chivalrymedievalwarfare\_CommonRedist\vcredist\2010\vcredist_x86.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\DayZ\DayZ.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\DayZ\DayZ_BE.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\DayZ\Battleye\BEService.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\DayZ\_CommonRedist\vcredist\2010\vcredist_x64.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\DayZ\_CommonRedist\vcredist\2010\vcredist_x86.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\PAYDAY 2\_CommonRedist\vcredist\2008\vcredist_x64.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\PAYDAY 2\_CommonRedist\vcredist\2008\vcredist_x86.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\raceroom racing experience\game\protect.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Steam\SteamApps\common\raceroom racing experience\game\redist\vcredist_x86.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\tstefd\tstefd-bg.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\tstefd\tstefd-buttonutil.dll    a variant of Win32/Toolbar.CrossRider.H potentially unwanted application
C:\Program Files (x86)\tstefd\tstefd-buttonutil.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\tstefd\tstefd-buttonutil64.dll    a variant of Win64/Toolbar.Crossrider.A potentially unwanted application
C:\Program Files (x86)\tstefd\tstefd-buttonutil64.exe    a variant of Win64/Toolbar.Crossrider.A potentially unwanted application
C:\Program Files (x86)\tstefd\tstefd-codedownloader.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\tstefd\tstefd-helper.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Ustream\Ustream Producer\Ustream Producer.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Ustream\Ustream Producer\rsrc\Desktop Presenter.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\uTorrent\uTorrent.exe    a variant of Win32/Bunndle potentially unsafe application
C:\Program Files (x86)\VirtualDJ\crashguard3.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\VirtualDJ\ripdvd.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\VirtualDJ\ripvinyl.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\VMware\VMware Workstation\mkisofs.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\VMware\VMware Workstation\openssl.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\VMware\VMware Workstation\vixDiskMountServer.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\VMware\VMware Workstation\vmUpdateLauncher.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\VMware\VMware Workstation\zip.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\VMware\VMware Workstation\tools-upgraders\VMwareToolsUpgrader9x.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\VMware\VMware Workstation\tools-upgraders\VMwareToolsUpgraderNT.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\VstPlugins\Dada Life\Sausage Fattener\uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\VstPlugins\iZotope\Ozone 5 Advanced\uninstall.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\VstPlugins\LennarDigital\unsylnt1.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\Waves\AiR LOGS\Waves SSL Collection v1.2\UNWISE.EXE    Win32/Sality.NBA virus
C:\Program Files (x86)\Waves\DX Utilities\WaveShell-DirectX_Registration-Utility5.7.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\WhiteHatBox\unins000.exe    Win32/Sality.NBA virus
C:\Program Files (x86)\WhiteHatBox\BackupFile\174\TweetAttacksProIII.exe    a variant of Win32/Packed.Themida suspicious application
C:\Program Files (x86)\WinPcap\Uninstall.exe    Win32/Sality.NBA virus
C:\ProgramData\MAGIX\MusicMaker16_Version_para_descargar\Default\Validation.exe    Win32/Sality.NBA virus
C:\ProgramData\MAGIX\Video_easy_SE\Default\fcdummy.exe    Win32/Sality.NBA virus
C:\ProgramData\NVIDIA Corporation\GeForce Experience\Update\GFExperience\7z.exe    Win32/Sality.NBA virus
C:\ProgramData\NVIDIA Corporation\NetService\3b63ffc7-2321-4e5d-80ae-a3e9a28cff52\GeForce_Experience_Update_v2.7.4.10.exe    Win32/Sality.NBA virus
C:\ProgramData\VMware\VMware Workstation\Uninstaller\deleter.exe    Win32/Sality.NBA virus
C:\ProgramData\VMware\VMware Workstation\Uninstaller\uninstall.exe    Win32/Sality.NBA virus
C:\ProgramData\~0\Massive Setup PC.exe    Win32/Sality.NBA virus
C:\Qoobox\Quarantine\C\Data\Sylenth_setup.exe.vir    Win32/Sality.NBA virus
C:\Qoobox\Quarantine\D\hyumr.pif.vir    Win32/Sality virus
C:\Users\All Users\MAGIX\MusicMaker16_Version_para_descargar\Default\Validation.exe    Win32/Sality.NBA virus
C:\Users\All Users\MAGIX\Video_easy_SE\Default\fcdummy.exe    Win32/Sality.NBA virus
C:\Users\All Users\NVIDIA Corporation\GeForce Experience\Update\GFExperience\7z.exe    Win32/Sality.NBA virus
C:\Users\All Users\NVIDIA Corporation\NetService\3b63ffc7-2321-4e5d-80ae-a3e9a28cff52\GeForce_Experience_Update_v2.7.4.10.exe    Win32/Sality.NBA virus
C:\Users\All Users\VMware\VMware Workstation\Uninstaller\deleter.exe    Win32/Sality.NBA virus
C:\Users\All Users\VMware\VMware Workstation\Uninstaller\uninstall.exe    Win32/Sality.NBA virus
C:\Users\All Users\~0\Massive Setup PC.exe    Win32/Sality.NBA virus
C:\Users\Jorge\AppData\Local\PunkBuster\WAW\pb\PnkBstrB.exe    Win32/Sality.NBA virus
C:\Users\Jorge\AppData\Local\Todoist\WindowsDesktopApp\unins000.exe    Win32/Sality.NBA virus
C:\Users\Jorge\AppData\Local\Unity\WebPlayer\Uninstall.exe    Win32/Sality.NBA virus
C:\Users\Jorge\AppData\LocalLow\Sun\Java\JRERunOnce.exe    Win32/Sality.NBA virus
C:\Users\Jorge\AppData\Roaming\CoffeeCup Software\CoffeeCup Free HTML Editor\UNWISE.EXE    Win32/Sality.NBA virus
C:\Users\Jorge\AppData\Roaming\CoffeeCup Software\CoffeeCup Free HTML Editor\vcredist_x86.exe    Win32/Sality.NBA virus
C:\Users\Jorge\AppData\Roaming\Dropbox\bin\DropboxUninstaller.exe    Win32/Sality.NBA virus
C:\Users\Jorge\AppData\Roaming\Follow Liker\unins000.exe    Win32/Sality.NBA virus
C:\Users\Jorge\AppData\Roaming\Microsoft\Installer\{B18C2CFF-4D2D-490E-A8CD-9AA2C4AB9CDE}\ItchShortcut_3AACE619E70942C5B73003B60EB9E2F1.exe    Win32/Sality.NBA virus
C:\Users\Jorge\AppData\Roaming\Microsoft\Installer\{CBA98C68-775F-4683-A1C3-691CF95AE8EB}\DriverSetup.exe_0A1550D2469842C38FAC66FC1146E45A.exe    Win32/Sality.NBA virus
C:\Users\Jorge\AppData\Roaming\SplitMediaLabs\XSplit\install\6990E7D\VHScrCapDlg32.exe    Win32/Sality.NBA virus
C:\Users\Jorge\AppData\Roaming\SplitMediaLabs\XSplit\install\6990E7D\xsplit_updater.exe    Win32/Sality.NBA virus
C:\Users\Jorge\AppData\Roaming\VIP72 Socks Client\vip72socksRUS.exe    Win32/Sality.NBA virus
C:\Users\Jorge\AppData\Roaming\VIP72 Socks Client\ProxifierPE\Proxifier.exe    Win32/Sality.NBA virus
C:\Users\Jorge\AppData\Roaming\VIP72 Socks Client\ProxifierPE\ProxyChecker.exe    Win32/Sality.NBA virus
C:\Users\Jorge\BDKUC\settings.ini    Win32/Injector.Autoit.NS trojan
C:\Users\Jorge\BZLUT\run.vbs    VBS/Starter.NAQ trojan
C:\Users\Jorge\BZLUT\settings.ini    Win32/Injector.Autoit.NS trojan
C:\Users\Jorge\Desktop\HQ Music and more\Autorun.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Internet Marketing\CPA\cpaelitesapps.zip    a variant of MSIL/Hoax.FakeHack.GS application
C:\Users\Jorge\Desktop\Internet Marketing\CPA\CPAElites Sales Thread\Facebook Game Visual Basic App.zip    a variant of MSIL/Hoax.FakeHack.GS application
C:\Users\Jorge\Desktop\Internet Marketing\CPA\CPAElites Sales Thread\Visual Basic Fb Whitehat app\fb-app\fb-app\bin\Debug\fb-app.exe    a variant of MSIL/Hoax.FakeHack.GS application
C:\Users\Jorge\Desktop\Internet Marketing\CPA\CPAElites Sales Thread\Visual Basic Fb Whitehat app\fb-app\fb-app\obj\x86\Debug\fb-app.exe    a variant of MSIL/Hoax.FakeHack.GS application
C:\Users\Jorge\Desktop\Internet Marketing\CPA\GameHacks\hot_gamingzone.zip    PHP/Alter.A trojan
C:\Users\Jorge\Desktop\Internet Marketing\CPA\GameHacks\Hot-GamingZone\Hot-GamingZone\hot_gaming_zone25.zip    PHP/Alter.A trojan
C:\Users\Jorge\Desktop\Internet Marketing\CPA\GameHacks\Hot-GamingZone\Hot-GamingZone\hot_gaming_zone\images\social.png    PHP/Alter.A trojan
C:\Users\Jorge\Desktop\Internet Marketing\CPA\Ultimate PPD-CPA Viral Scripts Methods & Niche - Riddik\Ultimate PPD-CPA Viral Scripts\MSPointsOrange\img\claim\load.php    PHP/WebShell.NCG trojan
C:\Users\Jorge\Desktop\Internet Marketing\CPA\Ultimate PPD-CPA Viral Scripts Methods & Niche - Riddik\Ultimate PPD-CPA Viral Scripts\MSPointsOrange\scripts\load.php    PHP/WebShell.NCG trojan
C:\Users\Jorge\Desktop\Internet Marketing\CPA\Ultimate PPD-CPA Viral Scripts Methods & Niche - Riddik\Ultimate PPD-CPA Viral Scripts\XboxLiveGreen\img\claim\load.php    PHP/WebShell.NCG trojan
C:\Users\Jorge\Desktop\Internet Marketing\CPA\Ultimate PPD-CPA Viral Scripts Methods & Niche - Riddik\Ultimate PPD-CPA Viral Scripts\XboxLiveGreen\scripts\load.php    PHP/WebShell.NCG trojan
C:\Users\Jorge\Desktop\Internet Marketing\CPA\World of tanks\BlueStacks-SplitInstaller_native.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Internet Marketing\Mobile\Landers\Fancy App installer with scripts\landing2.zip    PHP/Obfuscated.A potentially unwanted application
C:\Users\Jorge\Desktop\Internet Marketing\Mobile\Landers\Fancy App installer with scripts\landing2\detect.php    PHP/Obfuscated.A potentially unwanted application
C:\Users\Jorge\Desktop\Internet Marketing\Mobile\Landers\Fancy App installer with scripts\landing2\ZIPclass.php    PHP/Obfuscated.A potentially unwanted application
C:\Users\Jorge\Desktop\Internet Marketing\Mobile\Landers\Fancy App installer with scripts\ld\MOBeH9ac3oT8sNT.html    PHP/Obfuscated.A potentially unwanted application
C:\Users\Jorge\Desktop\Internet Marketing\Mobile\Landers\Fancy App installer with scripts\ld\ZIPaxYk2BPs7k.html    PHP/Obfuscated.A potentially unwanted application
C:\Users\Jorge\Desktop\Internet Marketing\Mobile\Landers\Fancy App installer with scripts\ld\allphp\MOBeH9ac3oT8sNT.php    PHP/Obfuscated.A potentially unwanted application
C:\Users\Jorge\Desktop\Internet Marketing\Mobile\Landers\Fancy App installer with scripts\ld\allphp\ZIPaxYk2BPs7k.php    PHP/Obfuscated.A potentially unwanted application
C:\Users\Jorge\Desktop\Internet Marketing\PPV\techsupport\tech support\index.html    HTML/FakeAlert.AK trojan
C:\Users\Jorge\Desktop\Juegos\BurnRecovery Help.lnk.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Juegos\MotioninJoy_060005_amd64_signed.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Juegos\Age Of Empires II\clokspl.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Juegos\Age Of Empires II\DPLAY61A.EXE    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Juegos\Age Of Empires II\empires2.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Juegos\Age Of Empires II\UNINSTAL.EXE    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Juegos\Face.Dominator.2.0.2.0.Cracked-0MMO\Crack\FD_LicensingManager.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Juegos\GMT.KZ_The_Sims_4_Deluxe_Edition_RePack_MAXAGENT\setup.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Juegos\GMT.KZ_The_Sims_4_Deluxe_Edition_RePack_MAXAGENT\Redist\dxwebsetup.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Juegos\Ninja.Gram.2.5.0.Cracked-0MMO\NinjaGram.exe    a variant of Win32/Packed.EnigmaProtector.J suspicious application
C:\Users\Jorge\Desktop\Juegos\Social.Interest.Freak.1.6.0.Cracked-0MMO\SIF\SIF.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Juegos\SocialRankJetSuite.Pro.Edition.1.0.10.Cracked-0MMO\crack\SocialRankJetSuite.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Juegos\Tweet.Attacks.Pro.III.6.1.5.7.Cracked-0MMO\crack\TweetAttacksProIII.exe    a variant of Win32/Packed.Themida suspicious application
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\3d.rar    a variant of Win32/Keygen.HA potentially unsafe application
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\3rdParty\MSI\WindowsInstaller-KB893803-v2-x86.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\3rdParty\x64\VCRedist\2005SP1ATL\vcredist_x64.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\3rdParty\x64\VCRedist\2008SP1\vcredist_x64.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\3rdParty\x64\VCRedist\2010SP1\vcredist_x64.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\3rdParty\x86\VCRedist\2005SP1ATL\vcredist_x86.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\3rdParty\x86\VCRedist\2008SP1\vcredist_x86.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\3rdParty\x86\VCRedist\2010SP1\vcredist_x86.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\NLSDL\nlsdl.amd64.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\DirectConnect\Autodesk Shared\DC\bin\wrapper.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\DirectConnect\Autodesk Shared\DC\java\jre1.6.0_03\bin\java-rmi.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\DirectConnect\Autodesk Shared\DC\java\jre1.6.0_03\bin\java.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\DirectConnect\Autodesk Shared\DC\java\jre1.6.0_03\bin\javacpl.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\DirectConnect\Autodesk Shared\DC\java\jre1.6.0_03\bin\javaw.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\DirectConnect\Autodesk Shared\DC\java\jre1.6.0_03\bin\javaws.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\DirectConnect\Autodesk Shared\DC\java\jre1.6.0_03\bin\jucheck.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\DirectConnect\Autodesk Shared\DC\java\jre1.6.0_03\bin\jureg.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\DirectConnect\Autodesk Shared\DC\java\jre1.6.0_03\bin\jusched.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\DirectConnect\Autodesk Shared\DC\java\jre1.6.0_03\bin\keytool.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\DirectConnect\Autodesk Shared\DC\java\jre1.6.0_03\bin\kinit.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\DirectConnect\Autodesk Shared\DC\java\jre1.6.0_03\bin\klist.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\DirectConnect\Autodesk Shared\DC\java\jre1.6.0_03\bin\ktab.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\DirectConnect\Autodesk Shared\DC\java\jre1.6.0_03\bin\orbd.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\DirectConnect\Autodesk Shared\DC\java\jre1.6.0_03\bin\pack200.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\DirectConnect\Autodesk Shared\DC\java\jre1.6.0_03\bin\policytool.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\DirectConnect\Autodesk Shared\DC\java\jre1.6.0_03\bin\rmid.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\DirectConnect\Autodesk Shared\DC\java\jre1.6.0_03\bin\rmiregistry.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\DirectConnect\Autodesk Shared\DC\java\jre1.6.0_03\bin\servertool.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\DirectConnect\Autodesk Shared\DC\java\jre1.6.0_03\bin\tnameserv.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\DirectConnect\Autodesk Shared\DC\java\jre1.6.0_03\bin\unpack200.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\max\Autodesk\3ds Max 2014\SketchUpReader.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\max\Autodesk\3ds Max 2014\NVIDIA\Satellite\raysat_3dsmax2014_64server.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\max\Autodesk\3ds Max 2014\stdplugs\Cube2QTVR.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\max\Autodesk\3ds Max 2014\stdplugs\quicktimeShim.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\3d\x64\max\Autodesk\3ds Max 2014\stdplugs\ShineExp\ra_tiff.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\Adobe Flash CS5 portable\Virtual\MODIFIED\@PROGRAMFILES@\Adobe\Adobe Flash CS5\arh.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\Adobe Flash CS5 portable\Virtual\MODIFIED\@PROGRAMFILES@\Adobe\Adobe Flash CS5\Flash.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Flash CS5 portableZarzoxWEB\Adobe Flash CS5 portable\Virtual\MODIFIED\@PROGRAMFILESCOMMON@\Adobe\CS5ServiceManager\CS5ServiceManager.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Illustrator CS6\Illustrator\Adobe Illustrator CS6\payloads\AdobeHelp\arh.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Illustrator CS6\Illustrator\Adobe Illustrator CS6\payloads\Microsoft VC 2005 Redist (x86)\vcredist_x86.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Illustrator CS6\Illustrator\Adobe Illustrator CS6\payloads\Microsoft VC 2008 Redist (x64)\vcredist_x64.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Illustrator CS6\Illustrator\Adobe Illustrator CS6\payloads\Microsoft VC 2008 Redist (x86)\vcredist_x86.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Illustrator CS6\Illustrator\Adobe Illustrator CS6\payloads\Microsoft VC 2010 Redist (x64)\vcredist_x64.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Illustrator CS6\Illustrator\Adobe Illustrator CS6\payloads\Microsoft VC 2010 Redist (x86)\vcredist_x86.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Illustrator CS6 (x64) PL\IllustratorPortable\IllustratorCS6Portable.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Illustrator CS6 (x64) PL\IllustratorPortable\App\IllustratorCS6_x64\Support Files\Contents\Windows\arh.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\Adobe Illustrator CS6 16.0.0 (32-64 bit) [ChingLiu]\Crack 32 bit\Illustrator.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\IllustratorPortable\App\Illustrator\Support Files\Contents\Windows\arh.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe\IllustratorPortable\App\Illustrator\Support Files\Contents\Windows\Illustrator.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe Photoshop CS6 Extended\SOFTWARE\payloads\Microsoft VC 2005 Redist (x64)\vcredist_x64.EXE    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe Photoshop CS6 Extended\SOFTWARE\payloads\Microsoft VC 2005 Redist (x86)\vcredist_x86.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe Photoshop CS6 Extended\SOFTWARE\payloads\Microsoft VC 2008 Redist (x64)\vcredist_x64.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe Photoshop CS6 Extended\SOFTWARE\payloads\Microsoft VC 2008 Redist (x86)\vcredist_x86.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe Photoshop CS6 Extended\SOFTWARE\payloads\Microsoft VC 2010 Redist (x64)\vcredist_x64.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Adobe Photoshop CS6 Extended\SOFTWARE\payloads\Microsoft VC 2010 Redist (x86)\vcredist_x86.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Age.of.Empires.II.HD-RELOADED\rld-aoe2hd.iso    a variant of Win32/HackTool.Crack.BQ potentially unsafe application
C:\Users\Jorge\Desktop\Random\dayz\rename_me.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Designs\saul\boemia.zip    PHP/Alter.A trojan
C:\Users\Jorge\Desktop\Random\Designs\saul\tyrion125.zip    PHP/Alter.A trojan
C:\Users\Jorge\Desktop\Random\Designs\saul\boemia\images\social.png    PHP/Alter.A trojan
C:\Users\Jorge\Desktop\Random\Designs\saul\tyrion125\tyrion.rar    PHP/Alter.A trojan
C:\Users\Jorge\Desktop\Random\Designs\saul\tyrion125\tyrion\images\social.png    PHP/Alter.A trojan
C:\Users\Jorge\Desktop\Random\Ebook\AddMeFast Bot Suite by OMGWTFISTHIS\App\Bin\sqlite3.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Ebook\AddMeFast Bot Suite by OMGWTFISTHIS\App\Firefox\maintenanceservice_installer.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Ebook\AddMeFast Bot Suite by OMGWTFISTHIS\App\Firefox\webapp-uninstaller.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Ebook\AddMeFast Bot Suite by OMGWTFISTHIS\App\Firefox\uninstall\helper.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Multithings\anton\binary\test2.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Multithings\Monster Social\setup.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Net\LaserLocker.exe    a variant of MSIL/LockScreen.LT trojan
C:\Users\Jorge\Desktop\Random\Net\LaserLocker.zip    a variant of MSIL/Packed.NetSeal.A suspicious application
C:\Users\Jorge\Desktop\Random\Net\antonstrato\binary\bin.exe    a variant of Win32/Neurevt.E trojan
C:\Users\Jorge\Desktop\Random\Net\Crypters\cc.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Net\Crypters\Crypted.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Net\Crypters\fffff.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Net\Crypters\Razorcrypt.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Net\Crypters\Stub.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Net\Crypters\BC V7\ResHacker.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Net\CryptME\CryptME.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Net\CryptME\includes\run.vbs    VBS/Starter.NAQ trojan
C:\Users\Jorge\Desktop\Random\Net\CryptME\includes\upx.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Net\neutrino\bin.exe    a variant of Win32/Agent.NQS worm
C:\Users\Jorge\Desktop\Random\Net\NewVersion\mozilla.zip    JS/Toolbar.Crossrider.G potentially unwanted application
C:\Users\Jorge\Desktop\Random\Net\NewVersion\e8e0d625-2546-4612-a2ff-557380147cd8@f0d937ce-1b3b-4653-9929-9c2a6b035e3f.com\chrome\content\core\xhr.js    JS/Toolbar.Crossrider.G potentially unwanted application
C:\Users\Jorge\Desktop\Random\Net\NewVersion\working\mozilla.zip    JS/Toolbar.Crossrider.G potentially unwanted application
C:\Users\Jorge\Desktop\Random\Net\NewVersion\working\41a22c78-434f-4d66-a9e8-deb1501c8322@c7c90cf9-ea36-4134-8746-a527d9e8ec40.com\chrome\content\core\xhr.js    JS/Toolbar.Crossrider.G potentially unwanted application
C:\Users\Jorge\Desktop\Random\Net\VNC\AdminPanelSetup.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Net\VNC\beta.zip    Win32/Neurevt.I trojan
C:\Users\Jorge\Desktop\Random\Net\VNC\load.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Net\VNC\loads.exe    Win32/Neurevt.I trojan
C:\Users\Jorge\Desktop\Random\Net\VNC\load\load.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Programming\android-studio\uninstall.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Programming\android-studio\sdk\build-tools\android-4.4W\arm-linux-androideabi-ld.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Programming\android-studio\sdk\build-tools\android-4.4W\i686-linux-android-ld.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Programming\android-studio\sdk\build-tools\android-4.4W\mipsel-linux-android-ld.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Programming\android-studio\sdk\tools\emulator.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Programming\android-studio\sdk\tools\lib\monitor-x86\eclipsec.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Programming\android-studio\sdk\tools\lib\monitor-x86\monitor.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Roger\Viral_Media_Portal_1_4_2.zip    PHP/Obfuscated.E potentially unwanted application
C:\Users\Jorge\Desktop\Random\Roger\Viral_Media_Portal_1_4_2\upload.zip    PHP/Obfuscated.E potentially unwanted application
C:\Users\Jorge\Desktop\Random\Roger\Viral_Media_Portal_1_4_2\upload\admin\logout.php    PHP/Obfuscated.E potentially unwanted application
C:\Users\Jorge\Desktop\Random\Sony Vegas Pro 12 Build 770 (64 bit) (patch-keygen DI) [ChingLiu]\patch - keygen DI\Keygen.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Xbox 360\X360USBPRO_UPDATE_TOOL_v0.12.zip    a variant of Win32/TrojanDropper.Agent.QDF trojan
C:\Users\Jorge\Desktop\Random\Xbox 360\Xbox Backup Creator.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\Random\Xbox 360\Everything to Flash Updated 9-16-12\CK3 Pro Drivers\setup.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Desktop\VNC soft\vnc_2.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Documents\ArmA 2\expansion\beta\arma2rft.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Downloads\80176-670969-jdownloader.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Downloads\privatetunnel-win-2.3.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Downloads\sinvirus.apk    a variant of Android/SMSreg.IJ potentially unsafe application
C:\Users\Jorge\Downloads\vip72socks-set.exe    Win32/Sality.NBA virus
C:\Users\Jorge\Dropbox\Public\test2.exe    Win32/Sality.NBA virus
C:\Users\Jorge\FWXND\settings.ini    Win32/Injector.Autoit.NS trojan
C:\Users\Jorge\GCSKB\run.vbs    VBS/Starter.NAQ trojan
C:\Users\Jorge\GCSKB\settings.ini    Win32/Injector.Autoit.NS trojan
C:\Users\Jorge\JLETR\run.vbs    VBS/Starter.NAQ trojan
C:\Users\Jorge\JLETR\settings.ini    Win32/Injector.Autoit.NS trojan
C:\Users\Jorge\KVRSN\settings.ini    Win32/Injector.Autoit.NS trojan
C:\Users\Jorge\OOCZN\run.vbs    VBS/Starter.NAQ trojan
C:\Users\Jorge\OOCZN\settings.ini    Win32/Injector.Autoit.NS trojan
C:\Users\Jorge\QEWLA\run.vbs    VBS/Starter.NAQ trojan
C:\Users\Jorge\QEWLA\settings.ini    Win32/Injector.Autoit.NS trojan
C:\Users\Jorge\TUIWJ\settings.ini    Win32/Injector.Autoit.NS trojan
C:\Users\Jorge\UHRDQ\settings.ini    Win32/Injector.Autoit.NS trojan
C:\Users\Jorge\UQCKQ\run.vbs    VBS/Starter.NAQ trojan
C:\Users\Jorge\UQCKQ\settings.ini    Win32/Injector.Autoit.NS trojan
C:\Users\Jorge\VNKJB\run.vbs    VBS/Starter.NAQ trojan
C:\Users\Jorge\VNKJB\settings.ini    Win32/Injector.Autoit.NS trojan
C:\Users\Jorge\YPDCY\run.vbs    VBS/Starter.NAQ trojan
C:\Users\Jorge\YPDCY\settings.ini    Win32/Injector.Autoit.NS trojan
C:\Utility\GT6\Audio\ChCfg.exe    Win32/Sality.NBA virus
C:\Utility\GT6\Audio\Setup.exe    Win32/Sality.NBA virus
C:\Utility\GT6\Audio\MSHDQFE\Win2K3\us\kb888111srvrtm.exe    Win32/Sality.NBA virus
C:\Utility\GT6\Audio\MSHDQFE\Win2K_XP\us\kb888111w2ksp4.exe    Win32/Sality.NBA virus
C:\Utility\GT6\Audio\MSHDQFE\Win2K_XP\us\kb888111xpsp1.exe    Win32/Sality.NBA virus
C:\Utility\GT6\Audio\MSHDQFE\Win2K_XP\us\kb888111xpsp2.exe    Win32/Sality.NBA virus
C:\Utility\GT6\Audio\Vista\AERTSrv.exe    Win32/Sality.NBA virus
C:\Utility\GT6\Audio\Vista\MaxxAudioMeters.exe    Win32/Sality.NBA virus
C:\Utility\GT6\Audio\Vista\RtHDVBg.exe    Win32/Sality.NBA virus
C:\Utility\GT6\Audio\Vista\RtHDVCpl.exe    Win32/Sality.NBA virus
C:\Utility\GT6\Audio\Vista\RtkAudioService.exe    Win32/Sality.NBA virus
C:\Utility\GT6\Audio\Vista\RtkNGUI.exe    Win32/Sality.NBA virus
C:\Utility\GT6\Audio\Vista\RtlUpd.exe    Win32/Sality.NBA virus
C:\Utility\GT6\Audio\Vista\SkyTel.exe    Win32/Sality.NBA virus
C:\Utility\GT6\Audio\Vista\vncutil.exe    Win32/Sality.NBA virus
C:\Utility\GT6\Audio\Vista64\SkyTel.exe    Win32/Sality.NBA virus
C:\Utility\GT6\Audio\WDM\Alcmtr.exe    Win32/Sality.NBA virus
C:\Utility\GT6\Audio\WDM\RtkAudioService.exe    Win32/Sality.NBA virus
C:\Utility\GT6\Audio\WDM\RtlUpd.exe    Win32/Sality.NBA virus
C:\Utility\GT6\Audio\WDM\SkyTel.exe    Win32/Sality.NBA virus
C:\Utility\GT6\Audio\WDM\SoundMan.exe    Win32/Sality.NBA virus
C:\Utility\GT6\Audio\WDM\vncutil.exe    Win32/Sality.NBA virus
C:\Utility\GT7\Audio\ChCfg.exe    Win32/Sality.NBA virus
C:\Utility\GT7\Audio\Setup.exe    Win32/Sality.NBA virus
C:\Utility\GT7\Audio\MSHDQFE\Win2K3\us\kb888111srvrtm.exe    Win32/Sality.NBA virus
C:\Utility\GT7\Audio\MSHDQFE\Win2K_XP\us\kb888111w2ksp4.exe    Win32/Sality.NBA virus
C:\Utility\GT7\Audio\MSHDQFE\Win2K_XP\us\kb888111xpsp1.exe    Win32/Sality.NBA virus
C:\Utility\GT7\Audio\MSHDQFE\Win2K_XP\us\kb888111xpsp2.exe    Win32/Sality.NBA virus
C:\Utility\GT7\Audio\Vista\AERTSrv.exe    Win32/Sality.NBA virus
C:\Utility\GT7\Audio\Vista\MaxxAudioMeters.exe    Win32/Sality.NBA virus
C:\Utility\GT7\Audio\Vista\RtHDVBg.exe    Win32/Sality.NBA virus
C:\Utility\GT7\Audio\Vista\RtHDVCpl.exe    Win32/Sality.NBA virus
C:\Utility\GT7\Audio\Vista\RtkAudioService.exe    Win32/Sality.NBA virus
C:\Utility\GT7\Audio\Vista\RtkNGUI.exe    Win32/Sality.NBA virus
C:\Utility\GT7\Audio\Vista\RtlUpd.exe    Win32/Sality.NBA virus
C:\Utility\GT7\Audio\Vista\SkyTel.exe    Win32/Sality.NBA virus
C:\Utility\GT7\Audio\Vista\vncutil.exe    Win32/Sality.NBA virus
C:\Utility\GT7\Audio\Vista64\SkyTel.exe    Win32/Sality.NBA virus
C:\Utility\GT7\Audio\WDM\Alcmtr.exe    Win32/Sality.NBA virus
C:\Utility\GT7\Audio\WDM\RtkAudioService.exe    Win32/Sality.NBA virus
C:\Utility\GT7\Audio\WDM\RtlUpd.exe    Win32/Sality.NBA virus
C:\Utility\GT7\Audio\WDM\SkyTel.exe    Win32/Sality.NBA virus
C:\Utility\GT7\Audio\WDM\SoundMan.exe    Win32/Sality.NBA virus
C:\Utility\GT7\Audio\WDM\vncutil.exe    Win32/Sality.NBA virus
C:\Utility\IRST\setup.exe    Win32/Sality.NBA virus
C:\Utility\Nvidia\NV3DVision\3DVision_296.31.exe    Win32/Sality.NBA virus
C:\Utility\WinDVD\10.0.6.389(0x620d6958)\setup.exe    Win32/Sality.NBA virus
C:\Windows\Installer\1aa85771.msi    a variant of Win32/Bundled.Toolbar.Ask.D potentially unsafe application
D:\autorun.inf    INF/Autorun.gen worm
D:\hyumr.pif    Win32/Sality virus
D:\Juegos\SteamLibrary\steamapps\common\GarrysMod\bin\demoinfo.exe    Win32/Sality.NBA virus
D:\Juegos\SteamLibrary\steamapps\common\H1Z1\_CommonRedist\vcredist\2010\vcredist_x64.exe    Win32/Sality.NBA virus
D:\Juegos\SteamLibrary\steamapps\common\H1Z1\_CommonRedist\vcredist\2010\vcredist_x86.exe    Win32/Sality.NBA virus
D:\Juegos\SteamLibrary\steamapps\common\H1Z1 Test\wws_crashreport_uploader.exe    Win32/Sality.NBA virus
D:\Juegos\SteamLibrary\steamapps\common\H1Z1 Test\_CommonRedist\vcredist\2010\vcredist_x64.exe    Win32/Sality.NBA virus
D:\Juegos\SteamLibrary\steamapps\common\H1Z1 Test\_CommonRedist\vcredist\2010\vcredist_x86.exe    Win32/Sality.NBA virus
D:\Qoobox\Quarantine\D\hyumr.pif.vir    Win32/Sality virus
Operating memory    Win32/Sality.NBA virus
 



#13 Jo*

Jo*

  • Malware Response Team
  • 3,445 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:09:54 PM

Posted 10 December 2015 - 02:58 AM

Sorry, that's very bad news
Sality is a polymorphic file infector.

There are tools that claim that they can clean sality, but I personally don't believe you can ever trust a machine again that's been infected with it.

Here is my usual recommendation to users infected with this, sorry it couldn't be better news


You are infected with a polymorphic file infector called Sality. This infection can and will infect all the machine's executable files .exe, .scr plus .html and .htm.
Because there are a number of bugs in its code, it may create executable files that are corrupted beyond repair resulting in an inoperative machine.
Malware experts say that a Complete Reformat and Reinstall is the only way to clean the infection.

This includes All Drives that contain .exe, .scr, .hlm, & .html files.
Backup all your documents and important items only.
DO NOT backup any executable files (,exe .scr .html or .htm)
Do Not back up compressed files (zip/cab/rar) files that may contain .exe or .scr files
Reformat and Reinstall as outlined here.

Be further advised Sality infections have been identified as having backdoor capabilities.
I suggest you do the following immediately:
Call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.
From a clean computer, change *all* your online passwords -- for email, for banks, financial accounts, PayPal, eBay, online companies, any online forums or groups you belong to.

DO NOT change passwords or do any transactions while using the infected computer because the attacker will get the new passwords and transaction information

Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.


#14 superyui

superyui
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:01:54 PM

Posted 11 December 2015 - 02:31 AM

Hey Jo, i have ran salitykiller from kaspesrsky and said it cured many files, and also tds killer from kaspersky too, now the processor usage seems back to normal being at 1-10%, but the memory usage still seems high at about 50% having 12gb of ram.



#15 Jo*

Jo*

  • Malware Response Team
  • 3,445 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:09:54 PM

Posted 11 December 2015 - 03:58 AM

What you did is on your own risk.

Remember please: Malware experts say that a Complete Reformat and Reinstall is the only way to clean the infection.

This topic will be closed soon, because you do your own scans and do no follow our instructions.

Edited by Jo*, 11 December 2015 - 04:05 AM.

Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users