Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Latest News: Microsoft Sees 24% Rise in Tech Support Scam Complaints

Featured Deal: Pay What You Want Complete Cyber Security Certification Bundle Deal

Forced to do the Facebook malware scan, which knocked out my real antivirus

Started by Jack Yan , Jan 03 2016 05:10 AM

This topic is locked

12 replies to this topic

#1 Jack Yan

Members
41 posts
OFFLINE

Local time:05:22 AM

Posted 03 January 2016 - 05:10 AM

Hi there: during the small hours of the 2nd, Facebook claimed that my computer was infected with malware and that I had to download their version of Kaspersky and let it run before I could access my account. This is the legitimate version, not the scam that has been going around. However, it might as well have been the scam, because not only does the scan not finish (although it sends Facebook a notification that it has), on a reboot it knocked out my McAfee antivirus, and it would not let me switch it back on. (If you would like any background, I blogged about the 16 hours here.)

Malware Bytes and McAfee’s Getsusp tool both consider my computer to be clean; the former picked up some PUPs, which I already knew about (they weren’t malicious). But to be on the safe side I removed them anyway. Malware Bytes was able to restore my access to McAfee, though even now, despite having regained access to my Facebook account, I still get regular notifications saying my antivirus is turned off. A system restore was impossible, as Windows 10 ironically claimed that I had an antivirus running—and having restored before without issue, I don’t think McAfee was the culprit. I believe Kaspersky was.

Kaspersky also never appeared in my list of installed programs, though I found it inside the C:\Users\USERNAME\AppData\Local\Temp\FBScanner_331840299 directory and removed it. I don’t know if that was the right thing to do, but it was after the deletion of that directory that I could get back into my account (albeit one that no longer allows me to post links).

I should also note that Facebook claims I have malware regardless of computer or browser (including Mac OS X and Lubuntu), except Windows 10 is the only platform where I have been forced to download their program and suffered as a result.

My belief is that this is a Facebook error, though having had their version of Kaspersky installed does not instil me with any confidence, as I think its remnants are messing with my set-up, including McAfee. I’m used to Facebook removing features for hours, days or even months before restoring them, and I see people go through these all the time. However, this is the first time a download has been forced upon me—the “if you don’t do it, we won’t let you come in” approach. With hindsight I should have just not tried to get back in!

As instructed, please find below my Farbar log, with the addition.txt attached. Hopefully it’s clean but an extra pair of far more expert eyes than mine would be welcome. Thank you in advance.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:31-12-2015
Ran by User (administrator) on GLADIATOR (03-01-2016 09:49:45)
Running from C:\My Download Files
Loaded Profiles: User & DefaultAppPool (Available Profiles: User & DefaultAppPool)
Platform: Windows 10 Home Version 1511 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: "C:\Program Files\Cyberfox\Cyberfox.exe" -osint -url "%1")
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe
(DeviceVM, Inc.) C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
() C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe
() C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
(Paramount Software UK Ltd) C:\Program Files\Macrium\Reflect\ReflectService.exe
(GlavSoft LLC.) C:\Program Files\TightVNC\tvnserver.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_2.12.15004.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(Microsoft Corporation) C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(GlavSoft LLC.) C:\Program Files\TightVNC\tvnserver.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Program Files (x86)\Microsoft Office\Office\FINDFAST.EXE
() C:\Program Files (x86)\Microtek\ScanWizard 5\ScannerFinder.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(DeviceVM, Inc.) C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe
() C:\Program Files (x86)\Microsoft Office\Office\OSA.EXE
(Dropbox, Inc.) C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
(Power Software Ltd) C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Agent.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(QUALCOMM Incorporated) C:\Program Files (x86)\Qualcomm\Eudora\Eudora.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\CSP\1.8.203.0\McCSPServiceHost.exe
(8pecxstudios) C:\Program Files\Cyberfox\Cyberfox.exe
(8pecxstudios) C:\Program Files\Cyberfox\plugin-container.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(VideoLAN) C:\Program Files (x86)\VideoLAN\VLC\vlc.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1208.10480.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Trend Micro Inc.) C:\My Download Files\HijackThis.exe
(Microsoft Corporation) C:\Windows\System32\inetsrv\w3wp.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11613288 2010-11-19] (Realtek Semiconductor)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [499608 2011-03-15] (Adobe Systems Incorporated)
HKLM\...\Run: [tvncontrol] => C:\Program Files\TightVNC\tvnserver.exe [2179056 2013-07-19] (GlavSoft LLC.)
HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2771576 2015-12-09] (NVIDIA Corporation)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [BCU] => C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe [411864 2010-03-04] (DeviceVM, Inc.)
HKLM-x32\...\Run: [UpdateLBPShortCut] => C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-12-15] (CyberLink)
HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [UCam_Menu] => C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [218408 2009-02-17] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePSTShortCut] => C:\Program Files (x86)\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [222504 2010-04-19] (CyberLink Corp.)
HKLM-x32\...\Run: [mcui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [723392 2015-12-03] (McAfee, Inc.)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [402432 2010-07-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-01-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [36760 2012-01-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [815512 2012-01-03] (Adobe Systems Inc.)
HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.)
HKLM-x32\...\Run: [PWRISOVM.EXE] => C:\Program Files (x86)\PowerISO\PWRISOVM.EXE [337432 2013-07-22] (Power Software Ltd)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-08-06] (Apple Inc.)
HKLM-x32\...\Run: [QuickFinder Scheduler] => c:\Program Files (x86)\Corel\WordPerfect Office X6\Programs\QFSCHD160.EXE [155592 2012-11-01] (Corel Corporation)
HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [896632 2015-07-22] (BlueStack Systems, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596528 2015-11-09] (Oracle Corporation)
HKU\S-1-5-21-2415837414-1117440713-3139033140-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8590760 2015-12-08] (Piriform Ltd)
HKU\S-1-5-21-2415837414-1117440713-3139033140-1000\...\Run: [Dropbox Update] => C:\Users\User\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-16] (Dropbox, Inc.)
HKU\S-1-5-21-2415837414-1117440713-3139033140-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\Ribbons.scr [149504 2015-10-30] (Microsoft Corporation)
AppInit_DLLs: MacType64.dll => C:\Program Files (x86)\MacType\MacType64.dll [816128 2012-10-22] (2ch & THEMEX)
AppInit_DLLs-x32: MacType.dll => C:\Program Files (x86)\MacType\MacType.dll [655360 2012-10-22] (2ch & THEMEX)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [MOBK] -> {3c3f3c1a-9153-7c05-f938-622e7003894d} => C:\Program Files (x86)\McAfee Online Backup\MOBKshell.dll [2010-04-13] (McAfee, Inc.)
ShellIconOverlayIdentifiers: [MOBK2] -> {e6ea1d7d-144e-b977-98c4-84c53c1a69d0} => C:\Program Files (x86)\McAfee Online Backup\MOBKshell.dll [2010-04-13] (McAfee, Inc.)
ShellIconOverlayIdentifiers: [MOBK3] -> {b4caf489-1eec-c617-49ad-8d7088598c06} => C:\Program Files (x86)\McAfee Online Backup\MOBKshell.dll [2010-04-13] (McAfee, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-12-08] (Dropbox, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Find Fast.lnk [2012-01-25]
ShortcutTarget: Microsoft Find Fast.lnk -> C:\Program Files (x86)\Microsoft Office\Office\FINDFAST.EXE ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microtek Scanner Finder.lnk [2012-01-24]
ShortcutTarget: Microtek Scanner Finder.lnk -> C:\Program Files (x86)\Microtek\ScanWizard 5\ScannerFinder.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Office Startup.lnk [2012-01-25]
ShortcutTarget: Office Startup.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA.EXE ()
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-12-12]
ShortcutTarget: Dropbox.lnk -> C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{270002da-121f-4efa-af81-6b6fdb9a1439}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2415837414-1117440713-3139033140-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://jyanet.com/
URLSearchHook: HKU\S-1-5-21-2415837414-1117440713-3139033140-1000 - SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch64.dll (DeviceVM, Inc.)
URLSearchHook: HKU\S-1-5-21-2415837414-1117440713-3139033140-1000 - SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll (DeviceVM, Inc.)
URLSearchHook: HKU\S-1-5-21-2415837414-1117440713-3139033140-1000 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
URLSearchHook: HKU\S-1-5-21-2415837414-1117440713-3139033140-1000 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
SearchScopes: HKU\S-1-5-21-2415837414-1117440713-3139033140-1000 -> DefaultScope {B2B80890-64DF-423E-B16A-9F878C3886F2} URL = hxxp://duckduckgo.com/?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2415837414-1117440713-3139033140-1000 -> {2CACE863-63C5-4efd-BFCD-6935E3557A63} URL = hxxp://au.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=EGMB
SearchScopes: HKU\S-1-5-21-2415837414-1117440713-3139033140-1000 -> {360CD6D1-16A3-4e21-AD93-F8CF845EE462} URL = hxxp://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=5369970905&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=en&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2415837414-1117440713-3139033140-1000 -> {B2B80890-64DF-423E-B16A-9F878C3886F2} URL = hxxp://duckduckgo.com/?q={searchTerms}
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_65\bin\ssv.dll [2015-10-28] (Oracle Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_65\bin\jp2ssv.dll [2015-10-28] (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-01-03] (Adobe Systems Incorporated)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\ssv.dll [2015-11-26] (Oracle Corporation)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2012-01-03] (Adobe Systems Incorporated)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-26] (Oracle Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2012-01-03] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2012-01-03] (Adobe Systems Incorporated)
Toolbar: HKU\.DEFAULT -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Toolbar: HKU\S-1-5-21-2415837414-1117440713-3139033140-1000 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
IE Session Restore: HKU\S-1-5-21-2415837414-1117440713-3139033140-1000 -> is enabled.
DPF: HKLM {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2015-11-06] (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2015-11-06] (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2015-11-06] (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2015-11-06] (McAfee, Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl64.dll [2015-12-03] (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\MSC\McSnIePl.dll [2015-12-03] (McAfee, Inc.)

FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\4y9o43hc.default
FF DefaultSearchEngine: DuckDuckGo
FF SelectedSearchEngine: DuckDuckGo
FF Homepage: hxxp://jyanet.com
FF Session Restore: -> is enabled.
FF NetworkProxy: "http", "192.184.3.251"
FF NetworkProxy: "http_port", 3128
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_20_0_0_235.dll [2015-12-22] ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [1999-12-31] (Tracker Software Products (Canada) Ltd.)
FF Plugin: @java.com/DTPlugin,version=11.65.2 -> C:\Program Files\Java\jre1.8.0_65\bin\dtplugin\npDeployJava1.dll [2015-10-28] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.65.2 -> C:\Program Files\Java\jre1.8.0_65\bin\plugin2\npjp2.dll [2015-10-28] (Oracle Corporation)
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2015-12-03] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-04] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_235.dll [2015-12-22] ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [1999-12-31] (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-11-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-11-26] (Oracle Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2015-12-03] ()
FF Plugin-x32: @mcafee.com/MVT -> C:\Program Files (x86)\McAfee\Supportability\MVT\NPMVTPlugin.dll [2014-03-04] (McAfee, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-04] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-12-16] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-12-16] (NVIDIA Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll [2012-01-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2415837414-1117440713-3139033140-1000: @citrixonline.com/appdetectorplugin -> C:\Users\User\AppData\Local\Citrix\Plugins\79\npappdetector.dll [2012-10-01] (Citrix Online)
FF Plugin HKU\S-1-5-21-2415837414-1117440713-3139033140-1000: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [1999-12-31] (Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\S-1-5-21-2415837414-1117440713-3139033140-1000: @hola.org/vlc,version=1.8.103 -> C:\Users\User\AppData\Local\Hola\firefox\app\vlc [2015-06-01] ()
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\4y9o43hc.default\searchplugins\11-suche.xml [2012-02-23]
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\4y9o43hc.default\searchplugins\creative-commons-search-beta.xml [2014-07-30]
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\4y9o43hc.default\searchplugins\duckduckgo.xml [2012-01-24]
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\4y9o43hc.default\searchplugins\englische-ergebnisse.xml [2012-02-23]
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\4y9o43hc.default\searchplugins\gmx-suche.xml [2012-02-23]
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\4y9o43hc.default\searchplugins\lastminute.xml [2012-02-23]
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\4y9o43hc.default\searchplugins\webde-suche.xml [2012-02-23]
FF Extension: Alexa Sparky - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\4y9o43hc.default\extensions\toolbar@alexa.com.xpi [2015-08-19]
FF Extension: ReloadEvery - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\4y9o43hc.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}.xpi [2015-08-19]
FF Extension: Modify Headers - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\4y9o43hc.default\extensions\{b749fc7c-e949-447f-926c-3f4eed6accfe}.xpi [2015-08-19]
FF Extension: Navigational Sounds - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\4y9o43hc.default\extensions\{d84a846d-f7cb-4187-a408-b171020e8940}.xpi [2015-08-19]
FF Extension: Super Start - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\4y9o43hc.default\extensions\superstart@enjoyfreeware.org [2015-08-19]
FF Extension: Flash and Video Download - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\4y9o43hc.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a} [2015-08-19]
FF Extension: McAfee WebAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi [2015-12-02]
FF Extension: Hola Better Internet - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\4y9o43hc.default\Extensions\jid1-4P0kohSJxU1qGg@jetpack [2015-08-19] [not signed]
FF Extension: No Name - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\4y9o43hc.default\Extensions\the-addon-bar@GeekInTraining-GiT.xpi [2015-08-19] [not signed]
FF Extension: Troubleshooter - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\4y9o43hc.default\Extensions\troubleshooter@mozilla.org.xpi [2015-08-19]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2015-08-19] [not signed]
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012-01-25] [not signed]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2015-11-27] [not signed]

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-11-11]
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-11-11]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [433784 2015-06-16] (BlueStack Systems, Inc.)
S3 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [413304 2015-06-16] (BlueStack Systems, Inc.)
S3 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [831096 2015-07-21] (BlueStack Systems, Inc.)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1156216 2015-12-09] (NVIDIA Corporation)
R2 HiSuiteOuc64.exe; C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe [138272 2014-09-05] ()
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [451960 2015-11-02] (McAfee, Inc.)
R2 HuaweiHiSuiteService64.exe; C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe [219680 2014-09-05] ()
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [157928 2015-11-06] (McAfee, Inc.)
S2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [863448 2015-12-03] (McAfee, Inc.)
R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.8.203.0\McCSPServiceHost.exe [1694152 2015-12-02] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [451960 2015-11-02] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [451960 2015-11-02] (McAfee, Inc.)
S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [679120 2015-10-20] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [451960 2015-11-02] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [451960 2015-11-02] (McAfee, Inc.)
R3 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [233680 2015-09-21] (McAfee, Inc.)
R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\\mfemms.exe [378848 2015-10-21] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [256840 2015-09-21] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [451960 2015-11-02] (McAfee, Inc.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1872504 2015-12-09] (NVIDIA Corporation)
R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [8185464 2015-12-09] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [6477432 2015-12-09] (NVIDIA Corporation)
R2 ReflectService.exe; C:\Program Files\Macrium\Reflect\ReflectService.exe [3272656 2014-07-21] (Paramount Software UK Ltd)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S2 SwOffScheduler; C:\Program Files\Airytec\Switch Off\swoff.exe [173056 2011-05-28] (Airytec) [File not signed]
S2 SwOffWeb; C:\Program Files\Airytec\Switch Off\swoff.exe [173056 2011-05-28] (Airytec) [File not signed]
R2 tvnserver; C:\Program Files\TightVNC\tvnserver.exe [2179056 2013-07-19] (GlavSoft LLC.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-10-30] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 amdkmdap; C:\Windows\System32\DRIVERS\atikmpag.sys [310784 2011-09-08] (Advanced Micro Devices, Inc.) [File not signed]
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [145528 2015-06-16] (BlueStack Systems)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [80760 2015-09-23] (McAfee, Inc.)
R3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [207208 2015-05-19] (McAfee, Inc.)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\drivers\TeeDriverW8x64.sys [184096 2015-06-29] (Intel Corporation)
R3 mfeaack; C:\Windows\System32\drivers\mfeaack.sys [415976 2015-09-23] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [351120 2015-09-23] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [82072 2015-09-23] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [497888 2015-09-23] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [841944 2015-09-23] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [537408 2015-08-12] (McAfee, Inc.)
S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [111256 2015-08-12] (McAfee, Inc.)
R3 mfesapsn; C:\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys [37960 2015-11-06] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [244544 2015-09-23] (McAfee, Inc.)
R1 MOBKFilter; C:\Windows\System32\DRIVERS\MOBK.sys [66040 2010-04-13] (Mozy, Inc.)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19576 2015-12-09] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [50472 2015-08-11] (NVIDIA Corporation)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [589824 2015-10-30] (Realtek )
S3 semav6msr64; C:\Windows\system32\drivers\semav6msr64.sys [21984 2015-06-04] ()
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
U3 idsvc; no ImagePath
U3 wpcsvc; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-01-03 09:49 - 2016-01-03 09:49 - 00000000 ____D C:\FRST
2016-01-03 08:13 - 2016-01-03 08:13 - 00000000 ___HD C:\OneDriveTemp
2016-01-02 03:04 - 2016-01-02 04:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-01-02 03:04 - 2016-01-02 04:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-01-02 03:04 - 2016-01-02 03:05 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-01-02 03:04 - 2016-01-02 03:04 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-01-02 03:04 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2016-01-02 03:04 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2016-01-02 03:04 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2015-12-26 13:31 - 2016-01-02 23:18 - 00003691 _____ C:\Users\User\Desktop\Amanda reply.txt
2015-12-24 11:31 - 2015-12-24 11:31 - 00000000 ____D C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Cyberfox
2015-12-22 02:15 - 2015-12-16 14:19 - 00103216 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvStreaming.exe
2015-12-22 02:14 - 2015-12-16 14:54 - 00523384 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshext.dll
2015-12-22 02:14 - 2015-12-16 14:54 - 00075056 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshextr.dll
2015-12-22 02:12 - 2015-12-16 16:59 - 42976888 _____ C:\WINDOWS\system32\nvcompiler.dll
2015-12-22 02:12 - 2015-12-16 16:59 - 37608568 _____ C:\WINDOWS\SysWOW64\nvcompiler.dll
2015-12-22 02:12 - 2015-12-16 16:59 - 31098488 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglv64.dll
2015-12-22 02:12 - 2015-12-16 16:59 - 24923768 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglv32.dll
2015-12-22 02:12 - 2015-12-16 16:59 - 21131424 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvopencl.dll
2015-12-22 02:12 - 2015-12-16 16:59 - 20672376 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuda.dll
2015-12-22 02:12 - 2015-12-16 16:59 - 17568432 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvopencl.dll
2015-12-22 02:12 - 2015-12-16 16:59 - 17164160 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuda.dll
2015-12-22 02:12 - 2015-12-16 16:59 - 17123736 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvwgf2um.dll
2015-12-22 02:12 - 2015-12-16 16:59 - 02560816 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuvid.dll
2015-12-22 02:12 - 2015-12-16 16:59 - 02214192 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuvid.dll
2015-12-22 02:12 - 2015-12-16 16:59 - 01915512 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispco6436143.dll
2015-12-22 02:12 - 2015-12-16 16:59 - 01564976 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispgenco6436143.dll
2015-12-22 02:12 - 2015-12-16 16:59 - 00938104 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvFBC64.dll
2015-12-22 02:12 - 2015-12-16 16:59 - 00872056 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFR64.dll
2015-12-22 02:12 - 2015-12-16 16:59 - 00735024 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvFBC.dll
2015-12-22 02:12 - 2015-12-16 16:59 - 00681592 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFR.dll
2015-12-22 02:12 - 2015-12-16 16:59 - 00541000 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvumdshimx.dll
2015-12-22 02:12 - 2015-12-16 16:59 - 00445728 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvumdshim.dll
2015-12-22 02:12 - 2015-12-16 16:59 - 00175368 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvinitx.dll
2015-12-22 02:12 - 2015-12-16 16:59 - 00153208 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvinit.dll
2015-12-22 02:12 - 2015-12-16 16:59 - 00151184 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglshim64.dll
2015-12-22 02:12 - 2015-12-16 16:59 - 00128696 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglshim32.dll
2015-12-21 14:47 - 2015-12-21 14:47 - 00000000 ____D C:\Users\User\AppData\Local\Huawei
2015-12-18 02:01 - 2015-12-07 04:57 - 00973664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2015-12-18 02:01 - 2015-12-07 04:55 - 01281376 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
2015-12-18 02:01 - 2015-12-07 04:49 - 00412512 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifitask.exe
2015-12-18 02:01 - 2015-12-07 04:48 - 02544256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2015-12-18 02:01 - 2015-12-07 04:48 - 02180136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2015-12-18 02:01 - 2015-12-07 04:48 - 01299504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetsrc.dll
2015-12-18 02:01 - 2015-12-07 04:48 - 01155944 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2015-12-18 02:01 - 2015-12-07 04:48 - 01118208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll
2015-12-18 02:01 - 2015-12-07 04:48 - 01092456 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
2015-12-18 02:01 - 2015-12-07 04:48 - 01065080 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2015-12-18 02:01 - 2015-12-07 04:48 - 01020096 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsrcsnk.dll
2015-12-18 02:01 - 2015-12-07 04:48 - 00983464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2015-12-18 02:01 - 2015-12-07 04:48 - 00884256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2015-12-18 02:01 - 2015-12-07 04:48 - 00823264 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2015-12-18 02:01 - 2015-12-07 04:48 - 00794888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfds.dll
2015-12-18 02:01 - 2015-12-07 04:48 - 00696160 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll
2015-12-18 02:01 - 2015-12-07 04:48 - 00670928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfds.dll
2015-12-18 02:01 - 2015-12-07 04:48 - 00526856 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfreadwrite.dll
2015-12-18 02:01 - 2015-12-07 04:48 - 00502112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll
2015-12-18 02:01 - 2015-12-07 04:48 - 00498448 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFCaptureEngine.dll
2015-12-18 02:01 - 2015-12-07 04:48 - 00462760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfreadwrite.dll
2015-12-18 02:01 - 2015-12-07 04:48 - 00450904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFCaptureEngine.dll
2015-12-18 02:01 - 2015-12-07 04:48 - 00337840 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFPlay.dll
2015-12-18 02:01 - 2015-12-07 04:48 - 00289248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFPlay.dll
2015-12-18 02:01 - 2015-12-07 04:48 - 00245848 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2015-12-18 02:01 - 2015-12-07 04:48 - 00115040 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll
2015-12-18 02:01 - 2015-12-07 04:48 - 00084832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupApi.dll
2015-12-18 02:01 - 2015-12-07 04:47 - 00925064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll
2015-12-18 02:01 - 2015-12-07 04:47 - 00898184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsrcsnk.dll
2015-12-18 02:01 - 2015-12-07 04:47 - 00716928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2015-12-18 02:01 - 2015-12-07 04:47 - 00116720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfps.dll
2015-12-18 02:01 - 2015-12-07 04:46 - 03671888 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-12-18 02:01 - 2015-12-07 04:46 - 02919320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-12-18 02:01 - 2015-12-07 04:45 - 00264544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContentDeliveryManager.Utilities.dll
2015-12-18 02:01 - 2015-12-07 04:15 - 01035776 _____ (Microsoft Corporation) C:\WINDOWS\system32\XboxNetApiSvc.dll
2015-12-18 02:01 - 2015-12-07 04:15 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.XboxLive.ProxyStub.dll
2015-12-18 02:01 - 2015-12-07 04:10 - 00824320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
2015-12-18 02:01 - 2015-12-07 04:09 - 00133120 _____ (Microsoft Corporation) C:\WINDOWS\system32\flvprophandler.dll
2015-12-18 02:01 - 2015-12-07 04:09 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanagerprecheck.dll
2015-12-18 02:01 - 2015-12-07 04:09 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorageUsage.dll
2015-12-18 02:01 - 2015-12-07 04:07 - 16984064 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2015-12-18 02:01 - 2015-12-07 04:07 - 00134656 _____ (Microsoft Corporation) C:\WINDOWS\system32\wificonnapi.dll
2015-12-18 02:01 - 2015-12-07 04:07 - 00077312 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvPluginEng.dll
2015-12-18 02:01 - 2015-12-07 04:06 - 00572928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
2015-12-18 02:01 - 2015-12-07 04:06 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll
2015-12-18 02:01 - 2015-12-07 04:06 - 00199168 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2015-12-18 02:01 - 2015-12-07 04:05 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll
2015-12-18 02:01 - 2015-12-07 04:05 - 00036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\BackgroundTransferHost.exe
2015-12-18 02:01 - 2015-12-07 04:04 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshost.dll
2015-12-18 02:01 - 2015-12-07 04:04 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\provtool.exe
2015-12-18 02:01 - 2015-12-07 04:03 - 13017600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2015-12-18 02:01 - 2015-12-07 04:02 - 00269824 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshostcore.dll
2015-12-18 02:01 - 2015-12-07 04:02 - 00161280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2015-12-18 02:01 - 2015-12-07 04:01 - 00543232 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2015-12-18 02:01 - 2015-12-07 04:01 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BackgroundTransferHost.exe
2015-12-18 02:01 - 2015-12-07 04:00 - 00618496 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
2015-12-18 02:01 - 2015-12-07 04:00 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSFlacDecoder.dll
2015-12-18 02:01 - 2015-12-07 04:00 - 00210432 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll
2015-12-18 02:01 - 2015-12-07 04:00 - 00203776 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll
2015-12-18 02:01 - 2015-12-07 03:59 - 00558080 _____ (Microsoft Corporation) C:\WINDOWS\system32\MBMediaManager.dll
2015-12-18 02:01 - 2015-12-07 03:59 - 00292352 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2015-12-18 02:01 - 2015-12-07 03:59 - 00286208 _____ (Microsoft Corporation) C:\WINDOWS\system32\provhandlers.dll
2015-12-18 02:01 - 2015-12-07 03:59 - 00165376 _____ (Microsoft Corporation) C:\WINDOWS\system32\provdatastore.dll
2015-12-18 02:01 - 2015-12-07 03:58 - 24601600 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-12-18 02:01 - 2015-12-07 03:58 - 00459776 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2015-12-18 02:01 - 2015-12-07 03:57 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2015-12-18 02:01 - 2015-12-07 03:57 - 00387072 _____ (Microsoft Corporation) C:\WINDOWS\system32\qdvd.dll
2015-12-18 02:01 - 2015-12-07 03:57 - 00270848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSFlacDecoder.dll
2015-12-18 02:01 - 2015-12-07 03:56 - 00607232 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2015-12-18 02:01 - 2015-12-07 03:56 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmkvsrcsnk.dll
2015-12-18 02:01 - 2015-12-07 03:55 - 07979008 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2015-12-18 02:01 - 2015-12-07 03:55 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
2015-12-18 02:01 - 2015-12-07 03:54 - 00850432 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2015-12-18 02:01 - 2015-12-07 03:54 - 00569856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qdvd.dll
2015-12-18 02:01 - 2015-12-07 03:53 - 19339264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-12-18 02:01 - 2015-12-07 03:53 - 00381952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmkvsrcsnk.dll
2015-12-18 02:01 - 2015-12-07 03:51 - 01318912 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2015-12-18 02:01 - 2015-12-07 03:51 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapibase.dll
2015-12-18 02:01 - 2015-12-07 03:50 - 01131520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Audio.dll
2015-12-18 02:01 - 2015-12-07 03:49 - 01105920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Audio.dll
2015-12-18 02:01 - 2015-12-07 03:48 - 06297088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2015-12-18 02:01 - 2015-12-07 03:47 - 03428864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2015-12-18 02:01 - 2015-12-07 03:45 - 02582016 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2015-12-18 02:01 - 2015-12-07 03:45 - 00900608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.dll
2015-12-18 02:01 - 2015-12-07 03:45 - 00683008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.dll
2015-12-18 02:01 - 2015-12-07 03:44 - 02796032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2015-12-18 02:01 - 2015-12-07 03:43 - 02598400 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll
2015-12-18 02:01 - 2015-12-07 03:43 - 00931328 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSMPEG2ENC.DLL
2015-12-18 02:01 - 2015-12-07 03:41 - 02061824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2015-12-18 02:01 - 2015-12-07 03:40 - 03593216 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2015-12-18 02:01 - 2015-12-07 03:40 - 01995776 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActiveSyncProvider.dll
2015-12-18 02:01 - 2015-12-07 03:40 - 01706496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActiveSyncProvider.dll
2015-12-18 02:01 - 2015-12-07 03:39 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2015-12-18 02:01 - 2015-12-07 03:38 - 00871936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSMPEG2ENC.DLL
2015-12-18 02:01 - 2015-12-07 03:33 - 00375296 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDEServer.exe
2015-12-18 02:01 - 2015-12-07 03:32 - 00126464 _____ (Microsoft Corporation) C:\WINDOWS\system32\dialserver.dll
2015-12-14 11:17 - 2015-12-14 11:17 - 00001723 _____ C:\Users\Public\Desktop\Logitech Webcam Software .lnk
2015-12-12 04:45 - 2015-12-12 04:45 - 00000000 ____D C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-12-11 14:10 - 2015-12-11 14:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-12-08 22:49 - 2015-12-01 07:12 - 02152800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2015-12-08 22:49 - 2015-11-24 12:07 - 01817160 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-12-08 22:49 - 2015-11-24 11:06 - 01540768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-12-08 22:49 - 2015-11-24 10:26 - 01399224 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2015-12-08 22:49 - 2015-11-24 10:01 - 02756096 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2015-12-08 22:49 - 2015-11-24 09:54 - 00007680 _____ (Microsoft Corporation) C:\WINDOWS\system32\readingviewresources.dll
2015-12-08 22:49 - 2015-11-24 09:53 - 00115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-12-08 22:49 - 2015-11-24 09:45 - 00018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\wshrm.dll
2015-12-08 22:49 - 2015-11-24 09:37 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rmcast.sys
2015-12-08 22:49 - 2015-11-24 09:26 - 01337240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2015-12-08 22:49 - 2015-11-24 09:19 - 00182784 _____ (Microsoft Corporation) C:\WINDOWS\system32\shutdownux.dll
2015-12-08 22:49 - 2015-11-24 09:12 - 00523776 _____ (Microsoft Corporation) C:\WINDOWS\system32\catsrvut.dll
2015-12-08 22:49 - 2015-11-24 08:58 - 00604672 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-12-08 22:49 - 2015-11-24 08:55 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2015-12-08 22:49 - 2015-11-24 08:54 - 02756096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2015-12-08 22:49 - 2015-11-24 08:52 - 01717248 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2015-12-08 22:49 - 2015-11-24 08:49 - 01648640 _____ (Microsoft Corporation) C:\WINDOWS\system32\comsvcs.dll
2015-12-08 22:49 - 2015-11-24 08:14 - 00415744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\catsrvut.dll
2015-12-08 22:49 - 2015-11-24 08:03 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-12-08 22:49 - 2015-11-24 07:59 - 01467392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2015-12-08 22:49 - 2015-11-24 07:57 - 01328128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comsvcs.dll
2015-12-08 22:49 - 2015-11-24 07:35 - 22393856 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2015-12-08 22:49 - 2015-11-24 07:29 - 02352128 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2015-12-08 22:49 - 2015-11-24 07:23 - 13381120 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-12-08 22:49 - 2015-11-24 07:11 - 18678272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2015-12-08 22:49 - 2015-11-24 07:08 - 12125184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-12-08 22:49 - 2015-11-24 07:04 - 02155008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2015-12-04 02:09 - 2015-11-22 10:47 - 07476576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-12-04 02:09 - 2015-11-22 10:47 - 02653816 _____ C:\WINDOWS\system32\CoreUIComponents.dll
2015-12-04 02:09 - 2015-11-22 10:41 - 01859448 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2015-12-04 02:09 - 2015-11-22 10:41 - 00026408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2015-12-04 02:09 - 2015-11-22 10:35 - 00538632 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWanAPI.dll
2015-12-04 02:09 - 2015-11-22 10:34 - 00080600 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwapi.dll
2015-12-04 02:09 - 2015-11-22 10:33 - 00095072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdstor.sys
2015-12-04 02:09 - 2015-11-22 10:33 - 00058408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsNativeApi.dll
2015-12-04 02:09 - 2015-11-22 10:33 - 00051680 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsUtilsV2.dll
2015-12-04 02:09 - 2015-11-22 10:30 - 00604928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2015-12-04 02:09 - 2015-11-22 10:30 - 00161632 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2015-12-04 02:09 - 2015-11-22 10:26 - 00431232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWanAPI.dll
2015-12-04 02:09 - 2015-11-22 10:25 - 00063528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wwapi.dll
2015-12-04 02:09 - 2015-11-22 10:24 - 02772584 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2015-12-04 02:09 - 2015-11-22 10:20 - 00795840 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-12-04 02:09 - 2015-11-22 10:19 - 00440160 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe
2015-12-04 02:09 - 2015-11-22 10:14 - 02185840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2015-12-04 02:09 - 2015-11-22 10:00 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsCSP.dll
2015-12-04 02:09 - 2015-11-22 10:00 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\system32\MosResource.dll
2015-12-04 02:09 - 2015-11-22 09:57 - 00110592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft-Windows-MapControls.dll
2015-12-04 02:09 - 2015-11-22 09:57 - 00036352 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCoreRes.dll
2015-12-04 02:09 - 2015-11-22 09:57 - 00010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft-Windows-MosTrace.dll
2015-12-04 02:09 - 2015-11-22 09:57 - 00009728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft-Windows-MosHost.dll
2015-12-04 02:09 - 2015-11-22 09:56 - 01268736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll
2015-12-04 02:09 - 2015-11-22 09:56 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\MosHostClient.dll
2015-12-04 02:09 - 2015-11-22 09:56 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\ihvrilproxy.dll
2015-12-04 02:09 - 2015-11-22 09:56 - 00055808 _____ (Microsoft Corporation) C:\WINDOWS\system32\rilproxy.dll
2015-12-04 02:09 - 2015-11-22 09:55 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthManagerProxy.dll
2015-12-04 02:09 - 2015-11-22 09:55 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsBtSvcProxy.dll
2015-12-04 02:09 - 2015-11-22 09:54 - 00138240 _____ (Microsoft Corporation) C:\WINDOWS\system32\ETWCoreUIComponentsResources.dll
2015-12-04 02:09 - 2015-11-22 09:54 - 00117248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\capimg.sys
2015-12-04 02:09 - 2015-11-22 09:54 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsNativeApi.V2.dll
2015-12-04 02:09 - 2015-11-22 09:54 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanprotdim.dll
2015-12-04 02:09 - 2015-11-22 09:54 - 00044032 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsplib.dll
2015-12-04 02:09 - 2015-11-22 09:54 - 00032256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2015-12-04 02:09 - 2015-11-22 09:54 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\WordBreakers.dll
2015-12-04 02:09 - 2015-11-22 09:54 - 00028160 _____ (Microsoft Corporation) C:\WINDOWS\system32\nativemap.dll
2015-12-04 02:09 - 2015-11-22 09:54 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlStringsRes.dll
2015-12-04 02:09 - 2015-11-22 09:52 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininetlui.dll
2015-12-04 02:09 - 2015-11-22 09:52 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthTokenBrokerExt.dll
2015-12-04 02:09 - 2015-11-22 09:52 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll
2015-12-04 02:09 - 2015-11-22 09:52 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\mapsupdatetask.dll
2015-12-04 02:09 - 2015-11-22 09:51 - 00157184 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcertinst.exe
2015-12-04 02:09 - 2015-11-22 09:51 - 00119808 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsBtSvc.dll
2015-12-04 02:09 - 2015-11-22 09:51 - 00072704 _____ (Microsoft Corporation) C:\WINDOWS\system32\MosStorage.dll
2015-12-04 02:09 - 2015-11-22 09:51 - 00042496 _____ (Microsoft Corporation) C:\WINDOWS\system32\mapstoasttask.dll
2015-12-04 02:09 - 2015-11-22 09:51 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll
2015-12-04 02:09 - 2015-11-22 09:50 - 00074240 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssign32.dll
2015-12-04 02:09 - 2015-11-22 09:49 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2015-12-04 02:09 - 2015-11-22 09:49 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll
2015-12-04 02:09 - 2015-11-22 09:49 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wwanpref.dll
2015-12-04 02:09 - 2015-11-22 09:48 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosResource.dll
2015-12-04 02:09 - 2015-11-22 09:46 - 00248832 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserMgrProxy.dll
2015-12-04 02:09 - 2015-11-22 09:45 - 06572032 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll
2015-12-04 02:09 - 2015-11-22 09:45 - 00638464 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2015-12-04 02:09 - 2015-11-22 09:45 - 00264192 _____ (Nokia) C:\WINDOWS\system32\NmaDirect.dll
2015-12-04 02:09 - 2015-11-22 09:45 - 00220672 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-12-04 02:09 - 2015-11-22 09:45 - 00110592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Microsoft-Windows-MapControls.dll
2015-12-04 02:09 - 2015-11-22 09:45 - 00073728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwancfg.dll
2015-12-04 02:09 - 2015-11-22 09:45 - 00036352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCoreRes.dll
2015-12-04 02:09 - 2015-11-22 09:45 - 00010240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Microsoft-Windows-MosTrace.dll
2015-12-04 02:09 - 2015-11-22 09:45 - 00009728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Microsoft-Windows-MosHost.dll
2015-12-04 02:09 - 2015-11-22 09:44 - 01268736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll
2015-12-04 02:09 - 2015-11-22 09:44 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosHostClient.dll
2015-12-04 02:09 - 2015-11-22 09:43 - 00704000 _____ (Microsoft Corporation) C:\WINDOWS\system32\CellularAPI.dll
2015-12-04 02:09 - 2015-11-22 09:43 - 00382464 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-12-04 02:09 - 2015-11-22 09:43 - 00342016 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorService.dll
2015-12-04 02:09 - 2015-11-22 09:43 - 00041984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XblAuthManagerProxy.dll
2015-12-04 02:09 - 2015-11-22 09:42 - 00589312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApi.dll
2015-12-04 02:09 - 2015-11-22 09:42 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmmigrator.dll
2015-12-04 02:09 - 2015-11-22 09:42 - 00138240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ETWCoreUIComponentsResources.dll
2015-12-04 02:09 - 2015-11-22 09:42 - 00024064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WordBreakers.dll
2015-12-04 02:09 - 2015-11-22 09:42 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlStringsRes.dll
2015-12-04 02:09 - 2015-11-22 09:41 - 01814528 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnidui.dll
2015-12-04 02:09 - 2015-11-22 09:41 - 00948224 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthManager.dll
2015-12-04 02:09 - 2015-11-22 09:40 - 01056256 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpMapControl.dll
2015-12-04 02:09 - 2015-11-22 09:40 - 00465920 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanconn.dll
2015-12-04 02:09 - 2015-11-22 09:40 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininetlui.dll
2015-12-04 02:09 - 2015-11-22 09:40 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XblAuthTokenBrokerExt.dll
2015-12-04 02:09 - 2015-11-22 09:39 - 02126848 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-12-04 02:09 - 2015-11-22 09:39 - 01713664 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRHInproc.dll
2015-12-04 02:09 - 2015-11-22 09:39 - 00988160 _____ (Microsoft Corporation) C:\WINDOWS\system32\NMAA.dll
2015-12-04 02:09 - 2015-11-22 09:39 - 00957440 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2015-12-04 02:09 - 2015-11-22 09:39 - 00938496 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
2015-12-04 02:09 - 2015-11-22 09:39 - 00870400 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2015-12-04 02:09 - 2015-11-22 09:39 - 00783360 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-12-04 02:09 - 2015-11-22 09:39 - 00114688 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinelsa.dll
2015-12-04 02:09 - 2015-11-22 09:39 - 00086528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapsBtSvc.dll
2015-12-04 02:09 - 2015-11-22 09:39 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosStorage.dll
2015-12-04 02:09 - 2015-11-22 09:39 - 00045568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll
2015-12-04 02:09 - 2015-11-22 09:38 - 01223168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll
2015-12-04 02:09 - 2015-11-22 09:38 - 01212928 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2015-12-04 02:09 - 2015-11-22 09:38 - 00912384 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll
2015-12-04 02:09 - 2015-11-22 09:38 - 00320000 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptngc.dll
2015-12-04 02:09 - 2015-11-22 09:38 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssign32.dll
2015-12-04 02:09 - 2015-11-22 09:37 - 02624512 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
2015-12-04 02:09 - 2015-11-22 09:37 - 01395200 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCore.dll
2015-12-04 02:09 - 2015-11-22 09:37 - 00515584 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2015-12-04 02:09 - 2015-11-22 09:36 - 01042432 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingOnlineServices.dll
2015-12-04 02:09 - 2015-11-22 09:34 - 02843136 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2015-12-04 02:09 - 2015-11-22 09:34 - 00345600 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2015-12-04 02:09 - 2015-11-22 09:34 - 00175616 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2015-12-04 02:09 - 2015-11-22 09:34 - 00166912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserMgrProxy.dll
2015-12-04 02:09 - 2015-11-22 09:34 - 00108544 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll
2015-12-04 02:09 - 2015-11-22 09:34 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditBufferTestHook.dll
2015-12-04 02:09 - 2015-11-22 09:33 - 00205824 _____ (Nokia) C:\WINDOWS\SysWOW64\NmaDirect.dll
2015-12-04 02:09 - 2015-11-22 09:32 - 00340480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToDevice.dll
2015-12-04 02:09 - 2015-11-22 09:32 - 00334848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-12-04 02:09 - 2015-11-22 09:31 - 07199232 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2015-12-04 02:09 - 2015-11-22 09:31 - 00470528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MbaeApi.dll
2015-12-04 02:09 - 2015-11-22 09:31 - 00416768 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll
2015-12-04 02:09 - 2015-11-22 09:29 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JpMapControl.dll
2015-12-04 02:09 - 2015-11-22 09:28 - 01734656 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-12-04 02:09 - 2015-11-22 09:28 - 01443328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRHInproc.dll
2015-12-04 02:09 - 2015-11-22 09:28 - 01387008 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-12-04 02:09 - 2015-11-22 09:28 - 00948224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll
2015-12-04 02:09 - 2015-11-22 09:28 - 00870400 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpncore.dll
2015-12-04 02:09 - 2015-11-22 09:28 - 00793600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRH.dll
2015-12-04 02:09 - 2015-11-22 09:28 - 00784896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NMAA.dll
2015-12-04 02:09 - 2015-11-22 09:28 - 00686592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-12-04 02:09 - 2015-11-22 09:28 - 00100864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offlinelsa.dll
2015-12-04 02:09 - 2015-11-22 09:27 - 03993600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2015-12-04 02:09 - 2015-11-22 09:27 - 02049024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-12-04 02:09 - 2015-11-22 09:27 - 01944576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
2015-12-04 02:09 - 2015-11-22 09:27 - 00711680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlCore.dll
2015-12-04 02:09 - 2015-11-22 09:27 - 00241664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptngc.dll
2015-12-04 02:09 - 2015-11-22 09:27 - 00160768 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
2015-12-04 02:09 - 2015-11-22 09:26 - 03355136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2015-12-04 02:09 - 2015-11-22 09:26 - 01139200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCore.dll
2015-12-04 02:09 - 2015-11-22 09:26 - 00709120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingOnlineServices.dll
2015-12-04 02:09 - 2015-11-22 09:26 - 00421888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll
2015-12-04 02:09 - 2015-11-22 09:25 - 02280448 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-12-04 02:09 - 2015-11-22 09:25 - 00133632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll
2015-12-04 02:09 - 2015-11-22 09:24 - 02647552 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-12-04 02:09 - 2015-11-22 09:24 - 00245760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TextInputFramework.dll
2015-12-04 02:09 - 2015-11-22 09:24 - 00083456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputLocaleManager.dll
2015-12-04 02:09 - 2015-11-22 09:24 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EditBufferTestHook.dll
2015-12-04 02:09 - 2015-11-22 09:23 - 05202944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2015-12-04 02:09 - 2015-11-22 09:20 - 01860096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2015-12-04 02:09 - 2015-11-22 09:18 - 01505280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-12-04 02:09 - 2015-11-22 09:18 - 00697856 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToManager.dll
2015-12-04 02:09 - 2015-11-22 09:18 - 00458752 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToDevice.dll
2015-12-04 02:09 - 2015-11-22 09:17 - 02680320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2015-12-04 02:09 - 2015-11-22 09:17 - 02121216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-12-04 02:09 - 2015-11-22 09:11 - 00517632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToManager.dll
2015-12-04 01:06 - 2015-12-16 16:59 - 17104016 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvd3dumx.dll
2015-12-04 01:06 - 2015-11-24 23:07 - 01905272 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispco6435906.dll
2015-12-04 01:06 - 2015-11-24 23:07 - 01564792 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispgenco6435906.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-01-03 09:49 - 2015-10-30 06:28 - 00000000 ____D C:\Windows
2016-01-03 09:49 - 2012-01-24 07:13 - 00000000 ___RD C:\My Download Files
2016-01-03 09:12 - 2015-06-16 22:01 - 00000914 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-2415837414-1117440713-3139033140-1000UA.job
2016-01-03 08:24 - 2015-10-30 07:21 - 00000000 ____D C:\WINDOWS\INF
2016-01-03 08:24 - 2015-04-06 09:24 - 00000000 ____D C:\Users\User\AppData\Local\CrashDumps
2016-01-03 08:24 - 2012-01-24 09:14 - 00000000 ____D C:\Users\User\AppData\Roaming\uTorrent
2016-01-03 08:22 - 2014-06-08 00:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2016-01-03 08:20 - 2015-11-16 22:36 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-01-03 08:14 - 2012-09-27 10:42 - 00000000 ___RD C:\Users\User\Dropbox
2016-01-03 08:14 - 2012-07-30 09:23 - 00000000 ____D C:\Users\User\AppData\Roaming\Dropbox
2016-01-03 08:13 - 2015-11-16 22:48 - 00000000 ___RD C:\Users\User\OneDrive
2016-01-03 08:11 - 2015-11-16 22:02 - 00000000 ____D C:\ProgramData\NVIDIA
2016-01-03 08:10 - 2015-10-30 06:28 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2016-01-03 08:08 - 2013-08-12 10:09 - 00000000 ____D C:\Users\User\AppData\Roaming\vlc
2016-01-03 08:08 - 2012-01-24 09:17 - 00000600 _____ C:\Users\User\AppData\Roaming\winscp.rnd
2016-01-03 08:07 - 2009-07-14 03:20 - 00000000 ____D C:\Users\Default.migrated
2016-01-03 08:04 - 2012-01-24 08:46 - 00000000 ____D C:\Users\User\AppData\Roaming\Skype
2016-01-03 05:12 - 2015-06-16 22:01 - 00000862 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-2415837414-1117440713-3139033140-1000Core.job
2016-01-03 05:10 - 2012-01-24 09:46 - 00000000 ___RD C:\Lucire
2016-01-02 23:25 - 2015-10-30 07:24 - 00000000 ____D C:\WINDOWS\system32\FxsTmp
2016-01-02 10:16 - 2012-01-25 00:16 - 00000000 ____D C:\Users\User\.VirtualBox
2016-01-02 10:10 - 2015-11-21 04:55 - 00533504 ___SH C:\Users\User\Desktop\Thumbs.db
2016-01-02 09:04 - 2012-01-24 14:03 - 00000000 ____D C:\Users\User\AppData\Roaming\XnView
2016-01-02 04:08 - 2015-10-30 06:28 - 00000000 ____D C:\WINDOWS\system32\Sysprep
2016-01-02 04:08 - 2015-10-15 12:36 - 00000000 ____D C:\ProgramData\Protexis
2016-01-02 04:08 - 2014-09-13 00:48 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-01-02 03:59 - 2015-10-30 07:24 - 00000000 ____D C:\WINDOWS\registration
2016-01-02 03:30 - 2015-11-17 01:17 - 00000000 ____D C:\WINDOWS\en-GB
2016-01-02 03:29 - 2012-02-26 10:31 - 00000000 ____D C:\Program Files (x86)\Alexa Toolbar
2016-01-02 00:45 - 2015-10-30 06:28 - 00032768 ___SH C:\WINDOWS\system32\config\ELAM
2016-01-01 23:09 - 2015-10-30 07:24 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-01-01 09:29 - 2012-01-24 09:55 - 00000000 ____D C:\Temp
2015-12-31 22:49 - 2015-10-30 07:24 - 00000000 ___HD C:\Program Files\WindowsApps
2015-12-31 15:21 - 2013-02-15 08:20 - 00000600 _____ C:\Users\User\AppData\Local\PUTTY.RND
2015-12-31 14:47 - 2012-01-24 08:46 - 00000000 ____D C:\ProgramData\Skype
2015-12-31 13:18 - 2012-01-24 08:41 - 00000000 ____D C:\JY&A
2015-12-30 09:28 - 2015-10-30 07:11 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-12-29 09:52 - 2015-11-16 22:06 - 01009692 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-12-29 04:41 - 2012-01-24 05:11 - 00000000 ____D C:\Program Files\Common Files\McAfee
2015-12-27 21:10 - 2015-10-30 07:26 - 00826872 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-12-27 21:10 - 2015-10-30 07:26 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-12-26 09:24 - 2012-01-25 04:06 - 00000132 _____ C:\Users\User\AppData\Roaming\Adobe PNG Format CS5 Prefs
2015-12-25 13:27 - 2012-01-24 09:41 - 00000000 ____D C:\jackyan.com
2015-12-24 11:31 - 2014-12-24 11:11 - 00000000 ____D C:\Program Files\Cyberfox
2015-12-24 05:36 - 2012-01-24 07:52 - 00000000 ____D C:\Users\User\AppData\Local\ElevatedDiagnostics
2015-12-22 12:01 - 2015-04-30 12:40 - 00000873 _____ C:\Users\Public\Desktop\CCleaner.lnk
2015-12-22 02:15 - 2015-11-16 22:02 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2015-12-22 02:15 - 2012-10-27 09:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-12-21 14:58 - 2012-11-01 07:39 - 00000000 ____D C:\Users\User\Documents\HiSuite
2015-12-18 08:48 - 2015-08-29 00:31 - 12426896 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvlddmkm.sys
2015-12-18 06:02 - 2015-10-30 07:24 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-12-18 06:02 - 2015-10-30 07:24 - 00000000 ____D C:\WINDOWS\Provisioning
2015-12-18 06:02 - 2015-10-30 07:24 - 00000000 ____D C:\WINDOWS\bcastdvr
2015-12-16 16:59 - 2015-08-29 00:31 - 19727624 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvwgf2umx.dll
2015-12-16 16:59 - 2015-08-29 00:31 - 14103608 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvd3dum.dll
2015-12-16 16:59 - 2015-08-29 00:31 - 03603368 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvapi64.dll
2015-12-16 16:59 - 2015-08-29 00:31 - 03184152 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvapi.dll
2015-12-16 16:59 - 2015-08-07 08:10 - 00035775 _____ C:\WINDOWS\system32\nvinfo.pb
2015-12-16 16:59 - 2011-12-06 23:45 - 00206968 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll
2015-12-16 16:59 - 2011-12-06 23:45 - 00194680 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.dll
2015-12-16 14:54 - 2015-11-16 22:02 - 06359672 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcpl.dll
2015-12-16 14:54 - 2015-11-16 22:02 - 02985264 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvc64.dll
2015-12-16 14:54 - 2015-11-16 22:02 - 02554488 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvcr.dll
2015-12-16 14:54 - 2015-11-16 22:02 - 01256240 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvvsvc.exe
2015-12-16 14:54 - 2015-11-16 22:02 - 00385328 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvmctray.dll
2015-12-16 14:54 - 2015-11-16 22:02 - 00062768 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvshext.dll
2015-12-16 14:49 - 2015-11-16 22:02 - 06090019 _____ C:\WINDOWS\system32\nvcoproc.bin
2015-12-14 11:19 - 2015-11-16 22:03 - 00000000 ____D C:\Program Files\Common Files\logishrd
2015-12-14 11:17 - 2012-08-05 04:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
2015-12-13 22:41 - 2015-11-16 22:48 - 00002415 _____ C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2015-12-11 14:10 - 2014-03-13 10:47 - 00000000 ____D C:\Users\User\AppData\Local\Skype
2015-12-11 12:46 - 2015-06-11 12:39 - 00003138 _____ C:\WINDOWS\System32\Tasks\McAfeeLogon
2015-12-11 02:46 - 2012-04-01 00:04 - 00002720 _____ C:\Users\User\Desktop\2015 Q4 incoming attachments.lnk
2015-12-10 22:51 - 2015-11-16 22:42 - 00000000 ____D C:\Users\User\AppData\Local\Packages
2015-12-10 22:35 - 2012-02-20 13:28 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-12-10 22:35 - 2012-02-20 13:28 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-12-10 15:45 - 2015-10-30 07:24 - 00000000 ____D C:\WINDOWS\system32\oobe
2015-12-10 11:12 - 2012-09-05 09:24 - 00000000 ____D C:\Users\User\AppData\Roaming\Audacity
2015-12-09 03:39 - 2010-11-21 03:27 - 00301728 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2015-12-09 01:51 - 2015-11-19 23:06 - 00111520 _____ C:\WINDOWS\system32\NvRtmpStreamer64.dll
2015-12-09 01:51 - 2014-06-04 13:31 - 01756424 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvspbridge64.dll
2015-12-09 01:51 - 2014-06-04 13:31 - 01316184 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvspbridge.dll
2015-12-09 01:51 - 2013-10-31 14:32 - 01846016 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvspcap64.dll
2015-12-09 01:51 - 2013-10-31 14:32 - 01530240 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvspcap.dll
2015-12-08 23:23 - 2012-02-20 13:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-12-08 23:21 - 2013-08-15 03:01 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-12-08 23:15 - 2012-01-24 10:58 - 140158008 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-12-07 10:20 - 2015-11-28 05:15 - 00001923 _____ C:\Users\User\Desktop\2016 entrants so far.txt
2015-12-06 14:04 - 2012-11-27 02:52 - 00000000 ____D C:\Users\User\Documents\DVDVideoSoft
2015-12-05 03:26 - 2015-10-30 07:24 - 00000000 ____D C:\WINDOWS\rescache
2015-12-04 10:06 - 2015-10-30 07:24 - 00000000 ____D C:\WINDOWS\SysWOW64\en-GB
2015-12-04 10:06 - 2015-10-30 07:24 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2015-12-04 10:06 - 2015-10-30 07:24 - 00000000 ____D C:\WINDOWS\system32\en-GB
2015-12-04 03:46 - 2013-04-07 08:41 - 00000000 ____D C:\ProgramData\BlueStacksSetup

==================== Files in the root of some directories =======

2013-02-15 08:18 - 2015-11-24 03:02 - 0483328 _____ (Simon Tatham) C:\Program Files (x86)\putty.exe
2012-05-20 07:01 - 2014-01-11 03:20 - 0000132 _____ () C:\Users\User\AppData\Roaming\Adobe BMP Format CS5 Prefs
2012-02-26 10:58 - 2015-08-08 04:13 - 0000132 _____ () C:\Users\User\AppData\Roaming\Adobe GIF Format CS5 Prefs
2012-05-24 02:23 - 2014-01-02 03:39 - 0000132 _____ () C:\Users\User\AppData\Roaming\Adobe IllExport Filter CS5 Prefs
2012-01-25 04:06 - 2015-12-26 09:24 - 0000132 _____ () C:\Users\User\AppData\Roaming\Adobe PNG Format CS5 Prefs
2012-01-24 09:17 - 2016-01-03 08:08 - 0000600 _____ () C:\Users\User\AppData\Roaming\winscp.rnd
2012-04-08 03:00 - 2013-03-29 11:31 - 0001456 _____ () C:\Users\User\AppData\Local\Adobe Save for Web 12.0 Prefs
2012-02-04 04:38 - 2014-07-06 13:24 - 0016896 _____ () C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-02-15 08:20 - 2015-12-31 15:21 - 0000600 _____ () C:\Users\User\AppData\Local\PUTTY.RND
2012-02-26 01:01 - 2012-02-26 01:01 - 0000017 _____ () C:\Users\User\AppData\Local\resmon.resmoncfg
2012-07-02 05:56 - 2012-07-02 05:56 - 0000008 __RSH () C:\ProgramData\F39EFF72BB.sys
2012-01-25 20:52 - 2015-10-15 12:25 - 0002098 ___SH () C:\ProgramData\KGyGaAvL.sys

Files to move or delete:
====================
C:\Users\Public\AlexaNSISPlugin.2824.dll

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-12-26 07:38

==================== End of FRST.txt ============================

Attached Files

Addition.txt 74.74KB 6 downloads

BC AdBot (Login to Remove)

BleepingComputer.com
Register to remove ads

#2 Jo*

Malware Response Team
3,294 posts
OFFLINE

Gender:Male
Location:Germany
Local time:07:22 AM

Posted 04 January 2016 - 11:58 AM

:welcome: to BleepingComputer.

Hi there,

my name is Jo and I will help you with your computer problems.

Please follow these guidelines:

Read and follow the instructions in the sequence they are posted.
print or copy & save instructions.
back up all your private data / music / important files on another (external) drive before using our tools.
Do not install / uninstall any applications, unless otherwise instructed.
Use only that tools you have been instructed to use.
Copy and Paste the log files inside your post, unless otherwise instructed.
Ask for clarification, if you have any questions.
Stay with this topic til you get the all clean post.
My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

***

Download Security Check by screen317 from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
Vista / Windows 7/8 users right-click and select Run As Administrator.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

***

Please download Malwarebytes Anti-Rootkit and save it to your desktop.

Be sure to print out and follow the instructions provided on that same page.
Caution: This is a beta version so please be sure to read the disclaimer and back up all your data before using.
Double click on downloaded file. OK self extracting prompt.
MBAR will start. Click in the introduction screen "next" to continue.
Click in the following screen "Update" to obtain the latest malware definitions.
Once the update is complete select "Next" and click "Scan".

With some infections, you may see two messages boxes.

'Could not load protection driver'. Click 'OK'.
'Could not load DDA driver'. Click 'Yes' to this message, to allow the driver to load after a restart. Allow the computer to restart. Continue with the rest of these instructions.

If malware is found - do not press the Clean up button, please go to the MBAR folder and then copy/paste the contents of the MBAR-log-***.txt file to your next reply.
If there is no malware found, please let me know as well.

***

Please download AdwCleaner by Xplode and save to your Desktop.
Double-click AdwCleaner.exe
Vista / Windows 7/8 users right-click and select Run As Administrator.

Click on the Scan button.
AdwCleaner will begin...be patient as the scan may take some time to complete.
The actual line should say "Pending. Please uncheck elements you do not want to remove" => scan is complete.
After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it.
If you see an entry you want to keep, let me know about it.
Copy and paste the contents of that logfile in your next reply.
A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

***

MiniToolbox by Farbar

Disable your antivirus if it does not allow you to download the tool!
Please download MiniToolBox, save it to your desktop and run it.
Place a checkmark in Select all, then click Go and post the result (MTB.txt). A copy of Result.txt will be saved in the same directory the tool is run.
Copy and paste the contents of that logfile in your next reply.

Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.

#3 Jack Yan

Topic Starter

Members
41 posts
OFFLINE

Local time:05:22 AM

Posted 04 January 2016 - 06:33 PM

Jo, thank you so much for your help. I have gone through the four steps and hopefully I have done everything correctly. I could not find a result.txt in the same directory as Mini Toolbox, however. It’s also not on my desktop.

(1)

Security Check checkup.txt

Results of screen317's Security Check version 1.009
   x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Windows Defender
McAfee Anti-Virus and Anti-Spyware
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Java 8 Update 66
Java version 32-bit out of Date!
Adobe Flash Player    20.0.0.235
Mozilla Firefox (43.0.1)
````````Process Check: objlist.exe by Laurent````````
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````

(2)
Malware Bytes Anti-rootkit
No malware found.

(3)

Adwcleaner

I would to keep the Alexa Toolbar.

# AdwCleaner v5.028 - Logfile created 04/01/2016 at 23:05:41
# Updated 04/01/2016 by Xplode
# Database : 2016-01-04.2 [Server]
# Operating system : Windows 10 Home (x64)
# Username : User - GLADIATOR
# Running from : C:\My Download Files\AdwCleaner.exe
# Option : Scan
# Support : http://toolslib.net/forum

***** [ Services ] *****

Service Found : BCUService

***** [ Folders ] *****

Folder Found : C:\Program Files (x86)\Alexa Toolbar
Folder Found : C:\Program Files (x86)\DeviceVM
Folder Found : C:\ProgramData\DeviceVM
Folder Found : C:\Users\User\AppData\Local\Hola
Folder Found : C:\Users\User\AppData\Roaming\DeviceVM
Folder Found : C:\Users\User\AppData\Roaming\8pecxstudios\Cyberfox\Profiles\uelh0zxb.default\Extensions\toolbar@alexa.com.xpi
Folder Found : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\4y9o43hc.default\Extensions\toolbar@alexa.com.xpi

***** [ Files ] *****

File Found : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\4y9o43hc.default\searchplugins\11-suche.xml
File Found : C:\WINDOWS\Installer\5d687.msi

***** [ DLL ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

Key Found : HKLM\SOFTWARE\Classes\AddressBarSearch.SearchHook
Key Found : HKLM\SOFTWARE\Classes\AddressBarSearch.SearchHook.1
Key Found : HKLM\SOFTWARE\Classes\AlxSSB.AlxTBSSB
Key Found : HKLM\SOFTWARE\Classes\AlxSSB.AlxTBSSB.1
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [BCU]
Key Found : HKLM\SOFTWARE\Classes\AppID\{1F02FB61-2BE5-4C16-8199-AEAA16EB0342}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{51F04BD6-3888-4849-864C-617FAE709CE0}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E57091A7-B5F0-4C42-9329-72ED3E59ED31}
Key Found : HKLM\SOFTWARE\Classes\Interface\{51F04BD6-3888-4849-864C-617FAE709CE0}
Key Found : HKLM\SOFTWARE\Classes\Interface\{8C953EC4-8CFA-44FB-B32E-1249E5505091}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E4E394E0-D331-431F-B76D-E3A19193D5F6}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{77AA6435-2488-4A94-9FE5-49519DD2ED9B}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{DA9FC525-41ED-4C00-B046-946DA7CDD305}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E57091A7-B5F0-4C42-9329-72ED3E59ED31}
Key Found : HKCU\Software\Alexa Internet
Key Found : HKCU\Software\Softonic
Key Found : HKCU\Software\Hola
Key Found : HKLM\SOFTWARE\Alexa Toolbar
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Alexa Toolbar

***** [ Web browsers ] *****

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [2554 bytes] ##########

(4)
Mini Toolbox by Farbar

MiniToolBox by Farbar Version: 02-11-2015
Ran by User (administrator) on 04-01-2016 at 23:18:40
Running from "C:\My Download Files"
Microsoft Windows 10 Home (X64)
Model: System Product Name Manufacturer: System manufacturer
Boot Mode: Normal
***************************************************************************

========================= Flush DNS: ===================================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.

========================= FF Proxy Settings: ==============================

"network.proxy.http", "192.184.3.251"
"network.proxy.http_port", 3128

"Reset FF Proxy Settings": Firefox Proxy settings were reset.

========================= Hosts content: =================================
127.0.0.1       google-analytics.com
127.0.0.1   kiwishoppingvoucher.com
127.0.0.1   stage.traffiliate.com
127.0.0.1   palm-fortune.co.nz
127.0.0.1   mobjmp.com
127.0.0.1       planet49.co.nz
127.0.0.1       free-test.co.nz
127.0.0.1       gnspf.com
127.0.0.1       bid.openx.net
127.0.0.1       lltrafficsource7.com
127.0.0.1       ch8health.com
127.0.0.1       weeklyhealthnz.net
127.0.0.1 dk.imrworldwide.com
127.0.0.1 fe-au.imrworldwide.com
127.0.0.1 fe1-au.imrworldwide.com
127.0.0.1 fe1-fi.imrworldwide.com
127.0.0.1 fe1-it.imrworldwide.com
127.0.0.1 fe2-au.imrworldwide.com
127.0.0.1 fe2-gc.imrworldwide.com
127.0.0.1 fe3-au.imrworldwide.com
127.0.0.1 fe3-gc.imrworldwide.com
127.0.0.1 fe3-uk.imrworldwide.com
127.0.0.1 fe4-uk.imrworldwide.com
127.0.0.1 imrworldwide.com
127.0.0.1 lycos-eu.imrworldwide.com
127.0.0.1 ninemsn.imrworldwide.com
127.0.0.1 rc-au.imrworldwide.com
127.0.0.1 redsheriff.com
127.0.0.1 secure-au.imrworldwide.com
127.0.0.1 secure-uk.imrworldwide.com

There are 68 entries.

========================= IP Configuration: ================================

Realtek PCIe GBE Family Controller = Local Area Connection (Connected)
VirtualBox Host-Only Ethernet Adapter = Ethernet (Connected)

# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4

reset
set global
set interface interface="Local Area Connection" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Local Area Connection* 1" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Ethernet" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled

popd
# End of IPv4 configuration

Windows IP Configuration

   Host Name . . . . . . . . . . . . : Gladiator
   Primary Dns Suffix . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix . :
   Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller
   Physical Address. . . . . . . . . : 14-DA-E9-72-D7-E1
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::e152:c92a:4c4d:be8%4(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.1.100(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Monday, January 4, 2016 9:15:14 PM
   Lease Expires . . . . . . . . . . : Friday, February 11, 2152 5:46:59 AM
   Default Gateway . . . . . . . . . : 192.168.1.1
   DHCP Server . . . . . . . . . . . : 192.168.1.1
   DHCPv6 IAID . . . . . . . . . . . : 236247785
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-16-65-FD-39-14-DA-E9-72-D7-E1
   DNS Servers . . . . . . . . . . . : 192.168.1.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix . :
   Description . . . . . . . . . . . : VirtualBox Host-Only Ethernet Adapter
   Physical Address. . . . . . . . . : 08-00-27-00-D0-C0
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::3c6f:5966:71a7:5bb9%5(Preferred)
   Autoconfiguration IPv4 Address. . : 169.254.91.185(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . :
   DHCPv6 IAID . . . . . . . . . . . : 252182567
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-16-65-FD-39-14-DA-E9-72-D7-E1
   DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.{28360EA2-7701-4CEE-99C2-AC31F0D53036}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{270002DA-121F-4EFA-AF81-6B6FDB9A1439}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
Server: UnKnown
Address: 192.168.1.1

Name:    google.com
Addresses: 2404:6800:4003:c01::66
      203.97.26.20
      203.97.26.24
      203.97.26.26
      203.97.26.27
      203.97.26.31
      203.97.26.35
      203.97.26.37
      203.97.26.38
      203.97.26.42
      203.97.26.46
      203.97.26.48
      203.97.26.49
      203.97.26.53
      203.97.26.57
      203.97.26.59
      203.97.26.16

Pinging google.com [203.97.26.24] with 32 bytes of data:
Reply from 203.97.26.24: bytes=32 time=381ms TTL=60
Reply from 203.97.26.24: bytes=32 time=9ms TTL=60

Ping statistics for 203.97.26.24:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 9ms, Maximum = 381ms, Average = 195ms
Server: UnKnown
Address: 192.168.1.1

Name:    yahoo.com
Addresses: 2001:4998:58:c02::a9
      2001:4998:c:a06::2:4008
      2001:4998:44:204::a7
      206.190.36.45
      98.138.253.109
      98.139.183.24

Pinging yahoo.com [206.190.36.45] with 32 bytes of data:
Reply from 206.190.36.45: bytes=32 time=409ms TTL=45
Reply from 206.190.36.45: bytes=32 time=176ms TTL=45

Ping statistics for 206.190.36.45:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 176ms, Maximum = 409ms, Average = 292ms

Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.1:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms
===========================================================================
Interface List
4...14 da e9 72 d7 e1 ......Realtek PCIe GBE Family Controller
5...08 00 27 00 d0 c0 ......VirtualBox Host-Only Ethernet Adapter
1...........................Software Loopback Interface 1
8...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
10...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface Metric
          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.100     20
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1 255.255.255.255         On-link         127.0.0.1    306
127.255.255.255 255.255.255.255         On-link         127.0.0.1    306
      169.254.0.0      255.255.0.0         On-link    169.254.91.185    276
   169.254.91.185 255.255.255.255         On-link    169.254.91.185    276
169.254.255.255 255.255.255.255         On-link    169.254.91.185    276
      192.168.1.0    255.255.255.0         On-link     192.168.1.100    276
    192.168.1.100 255.255.255.255         On-link     192.168.1.100    276
    192.168.1.255 255.255.255.255         On-link     192.168.1.100    276
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link    169.254.91.185    276
        224.0.0.0        240.0.0.0         On-link     192.168.1.100    276
255.255.255.255 255.255.255.255         On-link         127.0.0.1    306
255.255.255.255 255.255.255.255         On-link    169.254.91.185    276
255.255.255.255 255.255.255.255         On-link     192.168.1.100    276
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination      Gateway
1    306 ::1/128                  On-link
5    276 fe80::/64                On-link
4    276 fe80::/64                On-link
5    276 fe80::3c6f:5966:71a7:5bb9/128
                                    On-link
4    276 fe80::e152:c92a:4c4d:be8/128
                                    On-link
1    306 ff00::/8                 On-link
5    276 ff00::/8                 On-link
4    276 ff00::/8                 On-link
===========================================================================
Persistent Routes:
None
========================= Winsock entries =====================================

Catalog5 01 C:\WINDOWS\SysWOW64\NLAapi.dll [65024] (Microsoft Corporation)
Catalog5 02 C:\WINDOWS\SysWOW64\napinsp.dll [55808] (Microsoft Corporation)
Catalog5 03 C:\WINDOWS\SysWOW64\pnrpnsp.dll [70656] (Microsoft Corporation)
Catalog5 04 C:\WINDOWS\SysWOW64\pnrpnsp.dll [70656] (Microsoft Corporation)
Catalog5 05 C:\WINDOWS\SysWOW64\mswsock.dll [312160] (Microsoft Corporation)
Catalog5 06 C:\WINDOWS\SysWOW64\winrnr.dll [23552] (Microsoft Corporation)
Catalog9 01 C:\WINDOWS\SysWOW64\mswsock.dll [312160] (Microsoft Corporation)
Catalog9 02 C:\WINDOWS\SysWOW64\mswsock.dll [312160] (Microsoft Corporation)
Catalog9 03 C:\WINDOWS\SysWOW64\mswsock.dll [312160] (Microsoft Corporation)
Catalog9 04 C:\WINDOWS\SysWOW64\mswsock.dll [312160] (Microsoft Corporation)
Catalog9 05 C:\WINDOWS\SysWOW64\mswsock.dll [312160] (Microsoft Corporation)
Catalog9 06 C:\WINDOWS\SysWOW64\mswsock.dll [312160] (Microsoft Corporation)
Catalog9 07 C:\WINDOWS\SysWOW64\mswsock.dll [312160] (Microsoft Corporation)
Catalog9 08 C:\WINDOWS\SysWOW64\mswsock.dll [312160] (Microsoft Corporation)
Catalog9 09 C:\WINDOWS\SysWOW64\mswsock.dll [312160] (Microsoft Corporation)
Catalog9 10 C:\WINDOWS\SysWOW64\mswsock.dll [312160] (Microsoft Corporation)
Catalog9 11 C:\WINDOWS\SysWOW64\mswsock.dll [312160] (Microsoft Corporation)
x64-Catalog5 01 C:\Windows\System32\NLAapi.dll [80896] (Microsoft Corporation)
x64-Catalog5 02 C:\Windows\System32\napinsp.dll [68096] (Microsoft Corporation)
x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [87040] (Microsoft Corporation)
x64-Catalog5 04 C:\Windows\System32\pnrpnsp.dll [87040] (Microsoft Corporation)
x64-Catalog5 05 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog5 06 C:\Windows\System32\winrnr.dll [31744] (Microsoft Corporation)
x64-Catalog9 01 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog9 02 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog9 03 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog9 04 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog9 05 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog9 06 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog9 07 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog9 08 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog9 09 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog9 10 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog9 11 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)

========================= Event log errors: ===============================

Application errors:
==================
Error: (01/04/2016 09:53:56 PM) (Source: Application Error) (User: )
Description: Faulting application name: ShellExperienceHost.exe, version: 10.0.10586.35, time stamp: 0x566505bc
Faulting module name: Windows.UI.Xaml.dll, version: 10.0.10586.35, time stamp: 0x566505e8
Exception code: 0xc000027b
Fault offset: 0x00000000004a049c
Faulting process id: 0x1710
Faulting application start time: 0xShellExperienceHost.exe0
Faulting application path: ShellExperienceHost.exe1
Faulting module path: ShellExperienceHost.exe2
Report Id: ShellExperienceHost.exe3
Faulting package full name: ShellExperienceHost.exe4
Faulting package-relative application ID: ShellExperienceHost.exe5

Error: (01/04/2016 09:21:05 PM) (Source: Application Error) (User: )
Description: Faulting application name: Eudora.exe, version: 7.1.0.9, time stamp: 0x4522b689
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x00000000
Faulting process id: 0xd24
Faulting application start time: 0xEudora.exe0
Faulting application path: Eudora.exe1
Faulting module path: Eudora.exe2
Report Id: Eudora.exe3
Faulting package full name: Eudora.exe4
Faulting package-relative application ID: Eudora.exe5

Error: (01/04/2016 09:21:04 PM) (Source: Application Error) (User: )
Description: Faulting application name: Eudora.exe, version: 7.1.0.9, time stamp: 0x4522b689
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x00000000
Faulting process id: 0xd24
Faulting application start time: 0xEudora.exe0
Faulting application path: Eudora.exe1
Faulting module path: Eudora.exe2
Report Id: Eudora.exe3
Faulting package full name: Eudora.exe4
Faulting package-relative application ID: Eudora.exe5

Error: (01/04/2016 09:21:04 PM) (Source: Application Error) (User: )
Description: Faulting application name: Eudora.exe, version: 7.1.0.9, time stamp: 0x4522b689
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x00000000
Faulting process id: 0xd24
Faulting application start time: 0xEudora.exe0
Faulting application path: Eudora.exe1
Faulting module path: Eudora.exe2
Report Id: Eudora.exe3
Faulting package full name: Eudora.exe4
Faulting package-relative application ID: Eudora.exe5

Error: (01/04/2016 09:20:45 PM) (Source: Application Error) (User: )
Description: Faulting application name: svchost.exe_Schedule, version: 10.0.10586.0, time stamp: 0x5632d7ba
Faulting module name: ntdll.dll, version: 10.0.10586.20, time stamp: 0x56540c3b
Exception code: 0xc0000409
Fault offset: 0x0000000000025265
Faulting process id: 0x1f0
Faulting application start time: 0xsvchost.exe_Schedule0
Faulting application path: svchost.exe_Schedule1
Faulting module path: svchost.exe_Schedule2
Report Id: svchost.exe_Schedule3
Faulting package full name: svchost.exe_Schedule4
Faulting package-relative application ID: svchost.exe_Schedule5

Error: (01/04/2016 09:17:05 PM) (Source: Application Error) (User: )
Description: Faulting application name: Eudora.exe, version: 7.1.0.9, time stamp: 0x4522b689
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x00000000
Faulting process id: 0xd24
Faulting application start time: 0xEudora.exe0
Faulting application path: Eudora.exe1
Faulting module path: Eudora.exe2
Report Id: Eudora.exe3
Faulting package full name: Eudora.exe4
Faulting package-relative application ID: Eudora.exe5

Error: (01/04/2016 12:21:02 PM) (Source: Application Error) (User: )
Description: Faulting application name: Eudora.exe, version: 7.1.0.9, time stamp: 0x4522b689
Faulting module name: QuickTime.qts_unloaded, version: 7.78.80.95, time stamp: 0x55c3a9ef
Exception code: 0xc0000005
Fault offset: 0x0005cce9
Faulting process id: 0x1424
Faulting application start time: 0xEudora.exe0
Faulting application path: Eudora.exe1
Faulting module path: Eudora.exe2
Report Id: Eudora.exe3
Faulting package full name: Eudora.exe4
Faulting package-relative application ID: Eudora.exe5

Error: (01/04/2016 12:17:34 PM) (Source: Application Error) (User: )
Description: Faulting application name: Eudora.exe, version: 7.1.0.9, time stamp: 0x4522b689
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x00000000
Faulting process id: 0x1424
Faulting application start time: 0xEudora.exe0
Faulting application path: Eudora.exe1
Faulting module path: Eudora.exe2
Report Id: Eudora.exe3
Faulting package full name: Eudora.exe4
Faulting package-relative application ID: Eudora.exe5

Error: (01/04/2016 12:17:22 PM) (Source: Application Error) (User: )
Description: Faulting application name: Eudora.exe, version: 7.1.0.9, time stamp: 0x4522b689
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x00000000
Faulting process id: 0x1424
Faulting application start time: 0xEudora.exe0
Faulting application path: Eudora.exe1
Faulting module path: Eudora.exe2
Report Id: Eudora.exe3
Faulting package full name: Eudora.exe4
Faulting package-relative application ID: Eudora.exe5

Error: (01/04/2016 09:00:08 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: GLADIATOR)
Description: Package Microsoft.Windows.ShellExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy+App was terminated because it took too long to suspend.

System errors:
=============
Error: (01/04/2016 10:31:47 PM) (Source: DCOM) (User: GLADIATOR)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}GLADIATORUserS-1-5-21-2415837414-1117440713-3139033140-1000LocalHost (Using LRPC)Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewyS-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742

Error: (01/04/2016 10:31:44 PM) (Source: DCOM) (User: GLADIATOR)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}GLADIATORUserS-1-5-21-2415837414-1117440713-3139033140-1000LocalHost (Using LRPC)Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewyS-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742

Error: (01/04/2016 09:23:07 PM) (Source: Service Control Manager) (User: )
Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error:
%%1056

Error: (01/04/2016 09:23:07 PM) (Source: Service Control Manager) (User: )
Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Computer Browser service, but this action failed with the following error:
%%1056

Error: (01/04/2016 09:23:07 PM) (Source: Service Control Manager) (User: )
Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the IKE and AuthIP IPsec Keying Modules service, but this action failed with the following error:
%%1056

Error: (01/04/2016 09:23:07 PM) (Source: Service Control Manager) (User: )
Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the User Profile Service service, but this action failed with the following error:
%%1056

Error: (01/04/2016 09:22:07 PM) (Source: Service Control Manager) (User: )
Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Server service, but this action failed with the following error:
%%1056

Error: (01/04/2016 09:21:07 PM) (Source: Service Control Manager) (User: )
Description: The Windows Management Instrumentation service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

Error: (01/04/2016 09:21:07 PM) (Source: Service Control Manager) (User: )
Description: The User Manager service terminated unexpectedly. It has done this 1 time(s).

Error: (01/04/2016 09:21:07 PM) (Source: Service Control Manager) (User: )
Description: The Themes service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Microsoft Office Sessions:
=========================
Error: (01/04/2016 09:53:56 PM) (Source: Application Error)(User: )
Description: ShellExperienceHost.exe10.0.10586.35566505bcWindows.UI.Xaml.dll10.0.10586.35566505e8c000027b00000000004a049c171001d1473510d979a5C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeC:\Windows\System32\Windows.UI.Xaml.dll958251f8-fe88-4b64-8d54-b4e4b1247a89Microsoft.Windows.ShellExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewyApp

Error: (01/04/2016 09:21:05 PM) (Source: Application Error)(User: )
Description: Eudora.exe7.1.0.94522b689unknown0.0.0.000000000c000000500000000d2401d1473532bc1533C:\Program Files (x86)\Qualcomm\Eudora\Eudora.exeunknown68ce131f-5c8d-406b-9cbb-8346fc095991

Error: (01/04/2016 09:21:04 PM) (Source: Application Error)(User: )
Description: Eudora.exe7.1.0.94522b689unknown0.0.0.000000000c000000500000000d2401d1473532bc1533C:\Program Files (x86)\Qualcomm\Eudora\Eudora.exeunknown1405b6e8-1500-4a82-ba7d-84720c76472b

Error: (01/04/2016 09:21:04 PM) (Source: Application Error)(User: )
Description: Eudora.exe7.1.0.94522b689unknown0.0.0.000000000c000000500000000d2401d1473532bc1533C:\Program Files (x86)\Qualcomm\Eudora\Eudora.exeunknowne0790f6f-6387-452c-9004-463a4d70b21b

Error: (01/04/2016 09:20:45 PM) (Source: Application Error)(User: )
Description: svchost.exe_Schedule10.0.10586.05632d7bantdll.dll10.0.10586.2056540c3bc000040900000000000252651f001d1473500ffbc50C:\WINDOWS\system32\svchost.exeC:\WINDOWS\SYSTEM32\ntdll.dll8c177990-4b96-4078-bf80-5e3e054f279e

Error: (01/04/2016 09:17:05 PM) (Source: Application Error)(User: )
Description: Eudora.exe7.1.0.94522b689unknown0.0.0.000000000c000000500000000d2401d1473532bc1533C:\Program Files (x86)\Qualcomm\Eudora\Eudora.exeunknown76566f79-415b-4699-b1d8-ccf7ad159399

Error: (01/04/2016 12:21:02 PM) (Source: Application Error)(User: )
Description: Eudora.exe7.1.0.94522b689QuickTime.qts_unloaded7.78.80.9555c3a9efc00000050005cce9142401d14678d1a9d1f7C:\Program Files (x86)\Qualcomm\Eudora\Eudora.exeQuickTime.qts7ae9d03c-4a62-42fb-bb1c-688ca87605f2

Error: (01/04/2016 12:17:34 PM) (Source: Application Error)(User: )
Description: Eudora.exe7.1.0.94522b689unknown0.0.0.000000000c000000500000000142401d14678d1a9d1f7C:\Program Files (x86)\Qualcomm\Eudora\Eudora.exeunknowne57852a8-ccaa-4414-adcc-c4df77604ff5

Error: (01/04/2016 12:17:22 PM) (Source: Application Error)(User: )
Description: Eudora.exe7.1.0.94522b689unknown0.0.0.000000000c000000500000000142401d14678d1a9d1f7C:\Program Files (x86)\Qualcomm\Eudora\Eudora.exeunknowned3ef275-3f2a-42da-a001-3713e3eb331f

Error: (01/04/2016 09:00:08 AM) (Source: Microsoft-Windows-Immersive-Shell)(User: GLADIATOR)
Description: Microsoft.Windows.ShellExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy+App

CodeIntegrity Errors:
===================================
Date: 2015-12-31 03:26:31.984
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-12-18 09:02:45.275
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-12-11 03:41:07.487
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-12-10 22:38:21.569
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-12-09 04:47:51.416
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-12-04 10:12:15.335
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-11-26 02:02:28.011
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-11-24 22:21:48.483
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-11-19 14:21:30.902
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-11-19 11:46:25.741
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

=========================== Installed Programs ============================

[Redacted, can replace on request]

========================= Devices: ================================

========================= Memory info: ===================================

Percentage of memory in use: 46%
Total physical RAM: 8173.23 MB
Available physical RAM: 4350.61 MB
Total Virtual: 16365.23 MB
Available Virtual: 11851.34 MB

========================= Partitions: =====================================

1 Drive c: (Local Disk) (Fixed) (Total:930.97 GB) (Free:450.81 GB) NTFS
3 Drive e: (Moneypenny) (Fixed) (Total:465.76 GB) (Free:365.78 GB) NTFS
8 Drive j: (Seagate Expansion Drive) (Fixed) (Total:1863.01 GB) (Free:711.33 GB) NTFS
9 Drive l: (UK TV automotive) (CDROM) (Total:4.19 GB) (Free:0 GB) UDF

========================= Users: ========================================

User accounts for \\GLADIATOR

Administrator            DefaultAccount           Guest
User

========================= Minidump Files ==================================

No minidump file found

========================= Restore Points ==================================

01-01-2016 15:02:12 Windows Backup
02-01-2016 03:40:53 Restore Operation

**** End of log ****

Edited by Jack Yan, 05 January 2016 - 09:52 AM.

#4 Jo*

Malware Response Team
3,294 posts
OFFLINE

Gender:Male
Location:Germany
Local time:07:22 AM

Posted 05 January 2016 - 04:17 AM

Hello,

***

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
Save it in the same location as / FSRT / FSRT64 (usually your desktop) as fixlist.txt

start
CreateRestorePoint:
EmptyTemp:
C:\Users\Public\AlexaNSISPlugin.2824.dll
AlternateDataStreams: C:\Users\Public\.DS_Store:AFP_AfpInfo
AlternateDataStreams: C:\Users\Public\Downloads\.DS_Store:AFP_AfpInfo
HKLM-x32\...\Run: [] => [X]
SearchScopes: HKU\S-1-5-21-2415837414-1117440713-3139033140-1000 -> DefaultScope {B2B80890-64DF-423E-B16A-9F878C3886F2} URL = hxxp://duckduckgo.com/?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2415837414-1117440713-3139033140-1000 -> {2CACE863-63C5-4efd-BFCD-6935E3557A63} URL = hxxp://au.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=EGMB
SearchScopes: HKU\S-1-5-21-2415837414-1117440713-3139033140-1000 -> {360CD6D1-16A3-4e21-AD93-F8CF845EE462} URL = hxxp://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=5369970905&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=en&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2415837414-1117440713-3139033140-1000 -> {B2B80890-64DF-423E-B16A-9F878C3886F2} URL = hxxp://duckduckgo.com/?q={searchTerms}
U3 idsvc; no ImagePath
U3 wpcsvc; no ImagePath
Task: {15803DEE-6C63-427B-A8D3-A2CCCCE9CD9D} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {277C05FB-AB71-4193-B061-1DA62B55CEAF} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {2F1AB05D-3A13-44A4-838E-D3AA947C3E17} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {34EA32B6-6324-48C8-8705-C88BB1F0AD5D} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {3B4523B3-159E-4E0E-9B12-1B3C42E0105F} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {3F34DC64-7292-4FCA-8F52-524743DF5BB2} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {661C859C-5D12-4F43-AF14-431A7129A7FF} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {6E431ADD-8BF1-47B0-A631-220A787A50EF} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {7EF64B5B-2FE4-4DF6-B5F2-C19C647DF17B} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {A2D7D9B6-453A-4912-B091-51D3E909F9CA} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {C8312253-725F-418D-95C1-D81564ADAE75} - System32\Tasks\Event Viewer Tasks\8243ccdd-0dc8-4439-a6a2-65e6072896c4 => Wscript.exe "C:\Users\User\AppData\Local\Temp\tmpA9F5.vbs" <==== ATTENTION
Task: {DD241506-0484-4F8E-A63D-BC5851A69725} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
end

NOTICE: This script was written specifically for this user, for use on that particular machine.
Running this on another machine may cause damage to your operating system

Run FRST / FSRT64 again like we did before but this time press the Fix button just once and wait.
The tool will make a log (Fixlog.txt) please post it to your reply.

Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.

#5 Jack Yan

Topic Starter

Members
41 posts
OFFLINE

Local time:05:22 AM

Posted 05 January 2016 - 04:47 AM

Hi Jo:

Thank you! Vielen Dank! As instructed, here are the contents from fixlog.txt.

Fix result of Farbar Recovery Scan Tool (x64) Version:31-12-2015
Ran by User (2016-01-05 09:27:54) Run:1
Running from C:\My Download Files
Loaded Profiles: User (Available Profiles: User & DefaultAppPool)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start
CreateRestorePoint:
EmptyTemp:
C:\Users\Public\AlexaNSISPlugin.2824.dll
AlternateDataStreams: C:\Users\Public\.DS_Store:AFP_AfpInfo
AlternateDataStreams: C:\Users\Public\Downloads\.DS_Store:AFP_AfpInfo
HKLM-x32\...\Run: [] => [X]
SearchScopes: HKU\S-1-5-21-2415837414-1117440713-3139033140-1000 -> DefaultScope {B2B80890-64DF-423E-B16A-9F878C3886F2} URL = hxxp://duckduckgo.com/?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2415837414-1117440713-3139033140-1000 -> {2CACE863-63C5-4efd-BFCD-6935E3557A63} URL = hxxp://au.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=EGMB
SearchScopes: HKU\S-1-5-21-2415837414-1117440713-3139033140-1000 -> {360CD6D1-16A3-4e21-AD93-F8CF845EE462} URL = hxxp://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=5369970905&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=en&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2415837414-1117440713-3139033140-1000 -> {B2B80890-64DF-423E-B16A-9F878C3886F2} URL = hxxp://duckduckgo.com/?q={searchTerms}
U3 idsvc; no ImagePath
U3 wpcsvc; no ImagePath
Task: {15803DEE-6C63-427B-A8D3-A2CCCCE9CD9D} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {277C05FB-AB71-4193-B061-1DA62B55CEAF} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {2F1AB05D-3A13-44A4-838E-D3AA947C3E17} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {34EA32B6-6324-48C8-8705-C88BB1F0AD5D} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {3B4523B3-159E-4E0E-9B12-1B3C42E0105F} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {3F34DC64-7292-4FCA-8F52-524743DF5BB2} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {661C859C-5D12-4F43-AF14-431A7129A7FF} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {6E431ADD-8BF1-47B0-A631-220A787A50EF} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {7EF64B5B-2FE4-4DF6-B5F2-C19C647DF17B} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {A2D7D9B6-453A-4912-B091-51D3E909F9CA} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {C8312253-725F-418D-95C1-D81564ADAE75} - System32\Tasks\Event Viewer Tasks\8243ccdd-0dc8-4439-a6a2-65e6072896c4 => Wscript.exe "C:\Users\User\AppData\Local\Temp\tmpA9F5.vbs" <==== ATTENTION
Task: {DD241506-0484-4F8E-A63D-BC5851A69725} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
end
*****************

Restore point was successfully created.
C:\Users\Public\AlexaNSISPlugin.2824.dll => moved successfully
C:\Users\Public\.DS_Store => ":AFP_AfpInfo" ADS removed successfully.
C:\Users\Public\Downloads\.DS_Store => ":AFP_AfpInfo" ADS removed successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
HKU\S-1-5-21-2415837414-1117440713-3139033140-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
"HKU\S-1-5-21-2415837414-1117440713-3139033140-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2CACE863-63C5-4efd-BFCD-6935E3557A63}" => key removed successfully
HKCR\CLSID\{2CACE863-63C5-4efd-BFCD-6935E3557A63} => key not found.
"HKU\S-1-5-21-2415837414-1117440713-3139033140-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{360CD6D1-16A3-4e21-AD93-F8CF845EE462}" => key removed successfully
HKCR\CLSID\{360CD6D1-16A3-4e21-AD93-F8CF845EE462} => key not found.
"HKU\S-1-5-21-2415837414-1117440713-3139033140-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B2B80890-64DF-423E-B16A-9F878C3886F2}" => key removed successfully
HKCR\CLSID\{B2B80890-64DF-423E-B16A-9F878C3886F2} => key not found.
idsvc => service removed successfully
wpcsvc => service removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{15803DEE-6C63-427B-A8D3-A2CCCCE9CD9D}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{15803DEE-6C63-427B-A8D3-A2CCCCE9CD9D}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{277C05FB-AB71-4193-B061-1DA62B55CEAF}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{277C05FB-AB71-4193-B061-1DA62B55CEAF}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2F1AB05D-3A13-44A4-838E-D3AA947C3E17}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2F1AB05D-3A13-44A4-838E-D3AA947C3E17}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{34EA32B6-6324-48C8-8705-C88BB1F0AD5D}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{34EA32B6-6324-48C8-8705-C88BB1F0AD5D}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3B4523B3-159E-4E0E-9B12-1B3C42E0105F}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3B4523B3-159E-4E0E-9B12-1B3C42E0105F}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3F34DC64-7292-4FCA-8F52-524743DF5BB2}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3F34DC64-7292-4FCA-8F52-524743DF5BB2}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{661C859C-5D12-4F43-AF14-431A7129A7FF}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{661C859C-5D12-4F43-AF14-431A7129A7FF}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6E431ADD-8BF1-47B0-A631-220A787A50EF}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6E431ADD-8BF1-47B0-A631-220A787A50EF}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7EF64B5B-2FE4-4DF6-B5F2-C19C647DF17B}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7EF64B5B-2FE4-4DF6-B5F2-C19C647DF17B}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A2D7D9B6-453A-4912-B091-51D3E909F9CA}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A2D7D9B6-453A-4912-B091-51D3E909F9CA}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C8312253-725F-418D-95C1-D81564ADAE75}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C8312253-725F-418D-95C1-D81564ADAE75}" => key removed successfully
C:\WINDOWS\System32\Tasks\Event Viewer Tasks\8243ccdd-0dc8-4439-a6a2-65e6072896c4 => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Event Viewer Tasks\8243ccdd-0dc8-4439-a6a2-65e6072896c4" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{DD241506-0484-4F8E-A63D-BC5851A69725}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DD241506-0484-4F8E-A63D-BC5851A69725}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent" => key removed successfully
EmptyTemp: => 1.2 GB temporary data Removed.

The system needed a reboot.

==== End of Fixlog 09:33:23 ====

#6 Jo*

Malware Response Team
3,294 posts
OFFLINE

Gender:Male
Location:Germany
Local time:07:22 AM

Posted 05 January 2016 - 05:17 AM

Adwcleaner
I would to keep the Alexa Toolbar.

Folder Found : C:\Program Files (x86)\Alexa Toolbar

You can Keep it.

***

Double click on AdwCleaner.exe to run the tool again.
Vista / Windows 7/8 users right-click and select Run As Administrator.

Click on the Scan button.
AdwCleaner will begin to scan your computer like it did before.
When the scan has finished, the actual line should say "Pending. Please uncheck elements you do not want to remove". Look through the scan results and uncheck any entries that you do not wish to remove.
This time, click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder.

***

Please download Junkware Removal Tool from HERE and save it to your desktop.
Shutdown your antivirus to avoid any potential conflicts.
Double click JRT.exe to run the tool.
Vista / Windows 7/8 users right-click and select Run As Administrator.

JRT will begin to backup your registry and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, the log JRT.txt is saved on your desktop and will automatically open.

Enable your antivirus!
Post the contents of JRT.txt into your next reply.

***

How the computer is running now?

***

Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.

#7 Jack Yan

Topic Starter

Members
41 posts
OFFLINE

Local time:05:22 AM

Posted 05 January 2016 - 05:52 AM

Hi Jo:

Here you go!

(2)
AdwCleaner
The file that opened was called AdwCleaner[C1].txt, and its contents are below.

# AdwCleaner v5.028 - Logfile created 05/01/2016 at 10:27:53
# Updated 04/01/2016 by Xplode
# Database : 2016-01-04.2 [Server]
# Operating system : Windows 10 Home (x64)
# Username : User - GLADIATOR
# Running from : C:\My Download Files\AdwCleaner.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****

[-] Service Deleted : BCUService

***** [ Folders ] *****

[x] Folder Not Deleted : C:\Program Files (x86)\Alexa Toolbar
[-] Folder Deleted : C:\Program Files (x86)\DeviceVM
[-] Folder Deleted : C:\ProgramData\DeviceVM
[-] Folder Deleted : C:\Users\User\AppData\Local\Hola
[-] Folder Deleted : C:\Users\User\AppData\Roaming\DeviceVM
[x] Folder Not Deleted : C:\Users\User\AppData\Roaming\8pecxstudios\Cyberfox\Profiles\uelh0zxb.default\Extensions\toolbar@alexa.com.xpi
[x] Folder Not Deleted : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\4y9o43hc.default\Extensions\toolbar@alexa.com.xpi

***** [ Files ] *****

[-] File Deleted : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\4y9o43hc.default\searchplugins\11-suche.xml
[-] File Deleted : C:\WINDOWS\Installer\5d687.msi

***** [ DLLs ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

[-] Key Deleted : HKLM\SOFTWARE\Classes\AddressBarSearch.SearchHook
[-] Key Deleted : HKLM\SOFTWARE\Classes\AddressBarSearch.SearchHook.1
[x] Key Not Deleted : HKLM\SOFTWARE\Classes\AlxSSB.AlxTBSSB
[x] Key Not Deleted : HKLM\SOFTWARE\Classes\AlxSSB.AlxTBSSB.1
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [BCU]
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1F02FB61-2BE5-4C16-8199-AEAA16EB0342}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{51F04BD6-3888-4849-864C-617FAE709CE0}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E57091A7-B5F0-4C42-9329-72ED3E59ED31}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{51F04BD6-3888-4849-864C-617FAE709CE0}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8C953EC4-8CFA-44FB-B32E-1249E5505091}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E4E394E0-D331-431F-B76D-E3A19193D5F6}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{77AA6435-2488-4A94-9FE5-49519DD2ED9B}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{DA9FC525-41ED-4C00-B046-946DA7CDD305}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E57091A7-B5F0-4C42-9329-72ED3E59ED31}
[x] Key Not Deleted : HKCU\Software\Alexa Internet
[-] Key Deleted : HKCU\Software\Softonic
[-] Key Deleted : HKCU\Software\Hola
[x] Key Not Deleted : HKLM\SOFTWARE\Alexa Toolbar
[x] Key Not Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Alexa Toolbar

***** [ Web browsers ] *****

*************************

:: "Tracing" keys removed
:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [2852 bytes] ##########

I have also pasted the contents of the file called AdwCleaner[S2].txt as it was generated just before the above:

# AdwCleaner v5.028 - Logfile created 05/01/2016 at 10:22:18
# Updated 04/01/2016 by Xplode
# Database : 2016-01-04.2 [Server]
# Operating system : Windows 10 Home (x64)
# Username : User - GLADIATOR
# Running from : C:\My Download Files\AdwCleaner.exe
# Option : Scan
# Support : http://toolslib.net/forum

***** [ Services ] *****

Service Found : BCUService

***** [ Folders ] *****

Folder Found : C:\Program Files (x86)\Alexa Toolbar
Folder Found : C:\Program Files (x86)\DeviceVM
Folder Found : C:\ProgramData\DeviceVM
Folder Found : C:\Users\User\AppData\Local\Hola
Folder Found : C:\Users\User\AppData\Roaming\DeviceVM
Folder Found : C:\Users\User\AppData\Roaming\8pecxstudios\Cyberfox\Profiles\uelh0zxb.default\Extensions\toolbar@alexa.com.xpi
Folder Found : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\4y9o43hc.default\Extensions\toolbar@alexa.com.xpi

***** [ Files ] *****

File Found : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\4y9o43hc.default\searchplugins\11-suche.xml
File Found : C:\WINDOWS\Installer\5d687.msi

***** [ DLL ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

Key Found : HKLM\SOFTWARE\Classes\AddressBarSearch.SearchHook
Key Found : HKLM\SOFTWARE\Classes\AddressBarSearch.SearchHook.1
Key Found : HKLM\SOFTWARE\Classes\AlxSSB.AlxTBSSB
Key Found : HKLM\SOFTWARE\Classes\AlxSSB.AlxTBSSB.1
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [BCU]
Key Found : HKLM\SOFTWARE\Classes\AppID\{1F02FB61-2BE5-4C16-8199-AEAA16EB0342}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{51F04BD6-3888-4849-864C-617FAE709CE0}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E57091A7-B5F0-4C42-9329-72ED3E59ED31}
Key Found : HKLM\SOFTWARE\Classes\Interface\{51F04BD6-3888-4849-864C-617FAE709CE0}
Key Found : HKLM\SOFTWARE\Classes\Interface\{8C953EC4-8CFA-44FB-B32E-1249E5505091}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E4E394E0-D331-431F-B76D-E3A19193D5F6}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{77AA6435-2488-4A94-9FE5-49519DD2ED9B}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{DA9FC525-41ED-4C00-B046-946DA7CDD305}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E57091A7-B5F0-4C42-9329-72ED3E59ED31}
Key Found : HKCU\Software\Alexa Internet
Key Found : HKCU\Software\Softonic
Key Found : HKCU\Software\Hola
Key Found : HKLM\SOFTWARE\Alexa Toolbar
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Alexa Toolbar

***** [ Web browsers ] *****

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [2554 bytes] ##########

(3)
Junkware Removal Tool

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.1 (11.24.2015)
Operating System: Windows 10 Home x64
Ran by User (Administrator) on Tue 01/05/2016 at 10:37:22.47
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

File System: 13

Successfully deleted: C:\Users\User\AppData\Local\{060911B5-6C62-44C7-BCCF-CF6172CA9C3F} (Empty Folder)
Successfully deleted: C:\Users\User\AppData\Local\{0B1086BB-0FBF-4B19-A9F3-53E00643E8D5} (Empty Folder)
Successfully deleted: C:\Users\User\AppData\Local\{52E1334B-1AE7-4C5B-9552-68011C08C676} (Empty Folder)
Successfully deleted: C:\Users\User\AppData\Local\{8426A55C-A11A-4F31-B7AD-56F152E3116A} (Empty Folder)
Successfully deleted: C:\Users\User\AppData\Local\{9579C8C1-34E0-447E-A8D1-B35D641BF2F2} (Empty Folder)
Successfully deleted: C:\Users\User\AppData\Local\{A45BBA3E-21ED-43AA-B257-034FCC830EC9} (Empty Folder)
Successfully deleted: C:\Users\User\AppData\Local\{B7A161AB-7A73-4DDC-801D-2874E913EA3F} (Empty Folder)
Successfully deleted: C:\Users\User\AppData\Local\{BBE3F1CD-7E51-4AA6-B623-221EC40BB4E5} (Empty Folder)
Successfully deleted: C:\Users\User\AppData\Local\{CE2F84C1-5541-4704-B4FE-126A0C2EF366} (Empty Folder)
Successfully deleted: C:\Users\User\AppData\Local\{F6F3AC75-A842-472A-A3FE-33788213D062} (Empty Folder)
Successfully deleted: C:\Program Files (x86)\alexa toolbar (Folder)
Successfully deleted: C:\WINDOWS\SysWOW64\FAPAAC4.tmp (File)
Successfully deleted: C:\WINDOWS\SysWOW64\FAPE1CD.tmp (File)

Registry: 0

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 01/05/2016 at 10:42:29.01
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

(4)

I think you’ve solved the problem, Jo. One thing that was not working properly before was McAfee—Windows would shut it down each time an update occurred. I forced a manual update just now, and it appears to have worked normally. Thank you! If there are any other issues, I’ll come back to you.

#8 Jack Yan

Topic Starter

Members
41 posts
OFFLINE

Local time:05:22 AM

Posted 05 January 2016 - 05:53 AM

Jo, one more question for you: is it all right if I removed or edited one of my earlier replies to you? I don’t want my IP address out there for the public to see. I’ll leave it up for as long as you need it, of course.

#9 Jo*

Malware Response Team
3,294 posts
OFFLINE

Gender:Male
Location:Germany
Local time:07:22 AM

Posted 05 January 2016 - 06:24 AM

Hello again,

I do not need your IP address.

:step1:

We need to download Temp File Cleaner (TFC) by OldTimer:

Please download TFC.exe by Oldtimer at one of the two links: Link 1 Link 2
Save and close all running applications
Double-click on TFC.exe to run the program
Click on Start to begin the cleaning process note: this program may close running applications, make your screen disappear temporarily, or require a reboot of your PC - this is normal and part of the cleanup
When the scan is complete, if you were not asked to reboot the computer, please do so now

More Information can be found about the tool here:
http://www.geekstogo.com/forum/files/file/187-tfc-temp-file-cleaner-by-oldtimer/

***

Important Note: Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.
- Kaspersky Lab report: Evaluating the threat level of software vulnerabilities
- Microsoft: Unprecedented Wave of Java Exploitation
- Ghosts of Java Haunt Users

Please follow these steps to remove older version Java components and update:

Download the latest version of Java Runtime Environment (JRE) Version 8 and save it to your desktop.
Under "Java Platform, Standard Edition"...click the "Download JRE" button to the right.
Read the License Agreement, and then check the box that says: "Accept License Agreement".
From the list, select (click on) the download link for your operating system (Windows x86 Offline: jre-8u66-windows-i586.exe or Windows x64: jre-8u66-windows-x64.exe) and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to > Control Panel, double-click on Add/Remove Programs or Programs and Features in Vista/Windows 7/8 and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
Repeat as many times as necessary to remove each Java version.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-8u66-windows-i586.exe (or jre-8u66-windows-x64.exe for 64-bit) to install the newest version.
If using Windows 7/8 or Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
When the Java Setup - Welcome window opens, click the Install > button.
If offered any unwanted software or toolbars during installation, just uncheck the box before continuing unless you want it. The McAfee Security Scan Plus may be installed unless you uncheck the McAfee installation box when updating Java.

-- Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version. However, be aware that the Java updater prompts you to make Yahoo Search your browser's default search engine and home page...the option is pre-checked.

***

ESET Online Scanner

Click here to download the installer for ESET Online Scanner and save it to your Desktop.
Disable all your antivirus and antimalware software - see how to do that here.
Right click on esetsmartinstaller_enu.exe and select Run as Administrator.
Place a checkmark in YES, I accept the Terms of Use, then click Start. Wait for ESET Online Scanner to load its components.
Select Enable detection of potentially unwanted applications.
Click Advanced Settings, then place a checkmark in the following:
- Remove found threats
- Scan archives
- Scan for potentially unsafe applications
- Enable Anti-Stealth technology
Click Start to begin scanning.
ESET Online Scanner will start downloading signatures and scan. Please be patient, as this scan can take quite some time.
When the scan is done, click List threats (only available if ESET Online Scanner found something).
Click Export, then save the file to your desktop.
Click Back, then Finish to exit ESET Online Scanner.

Open the scan log and copy and paste the content to your next reply.

***

How the computer is running now?

***

Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.

#10 Jack Yan

Topic Starter

Members
41 posts
OFFLINE

Local time:05:22 AM

Posted 05 January 2016 - 07:16 PM

Hi Jo:

I followed your instructions, and (3) only finished running this morning. Some threats were found, some in email attachments (that I knew about but hadn’t got to deleting, which were subsequently backed up) and some that were a big surprise.

Everything seems to be working fine now, thank you!

The ESET log follows.

C:\FOG41\patch.exe   Win32/HackTool.Patcher.A potentially unsafe application   cleaned by deleting
C:\JYANet\openx-2.8.10\openx-2.8.10\etc\plugins\openXVideoAds.zip   PHP/Small.NAU trojan   deleted
C:\Users\User\AppData\Roaming\PowerISO\Upgrade\PowerISO6.exe   a variant of Win32/FusionCore.D potentially unwanted application   deleted
C:\Users\User\AppData\Roaming\Qualcomm\Eudora\Attach\INVOICE_90613661.doc   VBA/TrojanDownloader.Agent.AKQ trojan   contained infected files
C:\Users\User\AppData\Roaming\Qualcomm\Eudora\Attach\invoice_scan_48250456.doc   VBA/TrojanDownloader.Agent.AMH trojan   cleaned by deleting
C:\Users\User\AppData\Roaming\Qualcomm\Eudora\Attachments for archiving\2015 Q4 Attachments\In\DHL_RECEIPT.html   HTML/Refresh.DF trojan   cleaned by deleting
E:\Documents and Settings\Jack Yan\Application Data\Sun\Java\Deployment\cache\6.0\41\47f8b769-75a34494   a variant of Java/Agent.AC trojan   cleaned by deleting
E:\FOG41\patch.exe   Win32/HackTool.Patcher.A potentially unsafe application   cleaned by deleting
E:\Program Files\Qualcomm\Eudora Mail\Attachments for archiving\2011 Q4 Attachments\In\update_form1.pdf   PDF/WorldBusinessGuide potentially unwanted application   cleaned by deleting
J:\GLADIATOR\Backup Set 2015-09-04 150001\Backup Files 2015-10-23 150002\Backup files 1.zip   HTML/Refresh.DF trojan   deleted
J:\GLADIATOR\Backup Set 2015-10-30 213855\Backup Files 2015-10-30 213855\Backup files 15.zip   HTML/Refresh.DF trojan   deleted
J:\GLADIATOR\Backup Set 2015-10-30 213855\Backup Files 2015-11-06 150001\Backup files 1.zip   HTML/Refresh.DF trojan   deleted
J:\GLADIATOR\Backup Set 2015-10-30 213855\Backup Files 2015-12-04 211852\Backup files 1.zip   multiple threats   deleted
J:\GLADIATOR\Backup Set 2015-10-30 213855\Backup Files 2015-12-18 203257\Backup files 1.zip   VBA/TrojanDownloader.Agent.AMH trojan   deleted
J:\Software 16-01-01\ccsetup513.exe   Win32/Bundled.Toolbar.Google.D potentially unsafe application   deleted

#11 Jo*

Malware Response Team
3,294 posts
OFFLINE

Gender:Male
Location:Germany
Local time:07:22 AM

Posted 06 January 2016 - 02:19 AM

It Appears That Your Pc Is Now Clean!

***

Clean up:

***

Right-click AdwCleaner.exe and select Run As Administrator.

Click on the Uninstall button.
A window will open, press the Confirm button.
AdwCleaner will uninstall now.

***

Clean up with delfix:

please download delfix to your desktop.
Close all other programms and start delfix.
Please check all the boxes and run the tool.
delfix will now delete all found traces of our removal process

***

Delete the log files our tools created; they are located at your desktop or at the
"c:\users\{.......}\Downloads" folder.
Highlight them, and press the del or delete key on the keyboard.
You can browse to the location of the file or folder using either My Computer or Windows Explorer.

***

Here are some Preventive tips to reduce the potential for spyware infection in the future

Browse more secure

WOT - Know which websites to trust
Web of Trust - this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam.

Make sure you keep your Windows OS current.

Windows XP users can visit Windows update regularly to download and install any critical updates and service packs.
Windows Vista / 7 users can update via
Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane).

Avoid P2P

If you think you're using a "safe" P2P program, only the program is safe, not the data.
You will share files from unsafe sources, and these may be infected.
Some bad guys use P2P filesharing as an important chanel to spread their wares.

Use only one anti-virus software and keep it up-to-date.

Firewall
Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

Backup regularly
You never know when your PC will become unstable or become so infected that you can't recover it.

Use Strong passwords!

Email attachments
Do not open any unknown email attachments, which you received without asking for it!

Extra note:
Keep your Browser, Java, pdf Reader and Adobe Flash Up to Date.
And you could install Malwarebytes Anti-Exploit to run alongside your traditional anti-virus or anti-malware products.

Make sure your programs are up to date - because older versions may contain Security Leaks.

Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.

#12 Jack Yan

Topic Starter

Members
41 posts
OFFLINE

Local time:05:22 AM

Posted 06 January 2016 - 04:58 AM

That’s great, Jo, thank you! I’m very impressed, especially at the “after-clean-up” post. Stimmt!

#13 Jo*

Malware Response Team
3,294 posts
OFFLINE

Gender:Male
Location:Germany
Local time:07:22 AM

Posted 06 January 2016 - 06:23 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.

Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.