Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HitmanPro and MBAM say I'm okay; TDSSKiller reports 50+ ForgedFile.Multi.Gen


  • This topic is locked This topic is locked
7 replies to this topic

#1 bill02888

bill02888

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:00 AM

Posted 15 June 2016 - 06:08 AM

Hi.

 

I've got a laptop from work running Windows 7 32-bit and McAfee (Host Intrusion Prevention + VirusScan Enterprise + AntiSpyware Enterprise). I've regularly used MBAM, HitmanPro, and adwcleaner to scan for malware. Never seen an issue. Today I ran them again. All was okay. I decided to run TDSSKiller. I was shocked when it reported 50+ occurrences of ForgedFile.Multi.Generic. It would be pesky to have to replace all these files if there is in fact an issue.

 

I just ran MBAR (Yes, Anti-Rootkit, 1.09.3.1001) to get a second opinion. It took a while to scan (I guess it's very thorough!) It reported "Scan Finished: No malware found!" Huh? That's very dissatisfying.

 

Here are a few entries from the TDSSKiller log:

06:40:15.0435 0x1e24  TDSS rootkit removing tool 3.1.0.9 Dec 11 2015 22:49:12
06:40:23.0415 0x1e24  ============================================================
06:40:23.0415 0x1e24  Current date / time: 2016/06/15 06:40:23.0415
06:40:23.0425 0x1e24  SystemInfo:
06:40:23.0425 0x1e24
06:40:23.0425 0x1e24  OS Version: 6.1.7601 ServicePack: 1.0
06:40:23.0425 0x1e24  Product type: Workstation
...

06:45:29.0301 0x1670  Suspicious file ( Forged ): C:\Program Files\Malwarebytes Anti-Malware\BusinessMessaging.exe. Real md5: 07093093A650DA1149B3DC7950F5041C, sha256: D1021D59FD5CCDDFE3A68B1905A93BBA50109670B44367F51EE3D4AC37ABB144, fake md5: 85CC4B37FFD1CF8ABD9A97657CF65146, fake sha256: 307AD7D9BD12A13B1620CC6773AB28694E2CAF721AE3527D54426FA2EC2928A1
06:45:29.0301 0x1670  Malwarebytes Anti-Malware - detected ForgedFile.Multi.Generic ( 1 )
06:45:29.0763 0x1670  Malwarebytes Anti-Malware ( ForgedFile.Multi.Generic ) - warning
06:45:29.0763 0x1670  Force sending object to P2P due to detect: C:\Program Files\Malwarebytes Anti-Malware\BusinessMessaging.exe
06:45:30.0403 0x1670  Object send P2P result: true
...

06:45:35.0572 0x0dd4  Detected object count: 58
06:45:35.0572 0x0dd4  Actual detected object count: 58
...

06:45:54.0042 0x0dd4  McAfee Host Intrusion Prevention Tray ( ForgedFile.Multi.Generic ) - skipped by user
06:45:54.0044 0x0dd4  IgfxTray ( ForgedFile.Multi.Generic ) - skipped by user
06:45:54.0046 0x0dd4  HotKeysCmds ( ForgedFile.Multi.Generic ) - skipped by user
06:45:54.0048 0x0dd4  Persistence ( ForgedFile.Multi.Generic ) - skipped by user
06:45:54.0050 0x0dd4  CmgShieldUI ( ForgedFile.Multi.Generic ) - skipped by user
06:45:54.0050 0x0dd4  EmsService ( ForgedFile.Multi.Generic ) - skipped by user
06:45:54.0052 0x0dd4  EvtMgr6 ( ForgedFile.Multi.Generic ) - skipped by user
06:45:54.0053 0x0dd4  McAfeeUpdaterUI ( ForgedFile.Multi.Generic ) - skipped by user
06:45:54.0054 0x0dd4  SunJavaUpdateSched ( ForgedFile.Multi.Generic ) - skipped by user
06:45:54.0055 0x0dd4  Malwarebytes Anti-Malware ( ForgedFile.Multi.Generic ) - skipped by user
06:45:54.0058 0x0dd4  Sidebar ( ForgedFile.Multi.Generic ) - skipped by user
06:45:54.0059 0x0dd4  mctadmin ( ForgedFile.Multi.Generic ) - skipped by user
06:45:54.0061 0x0dd4  Sidebar ( ForgedFile.Multi.Generic ) - skipped by user
 

Thanks,

Bill



BC AdBot (Login to Remove)

 


#2 HelpBot

HelpBot

    Bleepin' Binary Bot


  • Bots
  • 12,733 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:00 AM

Posted 20 June 2016 - 06:10 AM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

step1.gif In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/617377 <<< CLICK THIS LINK



If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

step2.gifIf you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new FRST log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download FRST by Farbar from the following link if you no longer have it available and save it to your destop.

    FRST Download Link

  • When you go to the above page, there will be 32-bit and 64-bit downloads available. Please click on the appropriate one for your version of Windows. If you are unsure as to whether your Windows is 32-bit or 64-bit, please see this tutorial.
  • Double click on the FRST icon and allow it to run.
  • Agree to the usage agreement and FRST will open. Do not make any changes and click on the Scan button.
  • Notepad will open with the results.
  • Post the new logs as explained in the prep guide.
  • Close the program window, and delete the program from your desktop.


As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#3 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,486 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:04:00 AM

Posted 21 June 2016 - 01:17 PM

Greetings bill02888 and :welcome: to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

If you would allow me to call you by your first name I would prefer to do that.

===================================================

Ground Rules:
  • First, I would like to inform you that most of us here at Bleeping Computer offer our expert assistance out of the goodness of our hearts. Please try to match our commitment to you with your patience toward us. If this was easy we would never have met.
  • Please do not run any tools or take any steps other than those I will provide for you while we work on your computer together. I need to be certain about the state of your computer in order to provide appropriate and effective steps for you to take. Most often "well intentioned" (and usually panic driven!) independent efforts can make things much worse for both of us. If at any point you would prefer to take your own steps please let me know, I will not be offended. I would be happy to focus on the many others who are waiting in line for assistance.
  • Please perform all steps in the order they are listed in each set of instructions. Some steps may be a bit complicated. If things are not clear, be sure to stop and let me know. We need to work on this together with confidence.
  • Please copy and paste all logs into your post unless directed otherwise. Please do not re-run any programs I suggest. If you encounter problems simply stop and tell me.
  • When you post your reply, use the Replytopic.jpg button instead.
  • In the upper right hand corner of the topic you will see the Followtopic.jpg button. Click on this then choose Immediate E-Mail notification and then Proceed and you will be sent an email once I have posted a response.
  • If you do not reply to your topic after 5 days we assume it has been abandoned and I will close it.
  • When your computer is clean I will alert you of such. I will also provide for you detailed information about how you can combat future infections.
  • I would like to remind you to make no further changes to your computer unless I direct you to do so.
===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and post that information so that I know you are still with me. Unfortunately, there are many people waiting to be assisted and not enough of us at BleepingComputer to go around. I appreciate your understanding and diligence.

Thank you for your patience thus far.

Please post the entire TDSSKiller report.

Please do this.

===================================================

Farbar Recovery Scan Tool (FRST)

--------------------
  • Download Farbar Recover Scan Tool for either 32 bit or 64 bit systems and save it to your Desktop. <<< Important
  • Double click the icon
  • Click Yes to the disclaimer
  • Make sure the Addition.txt box is checked
  • Click Scan and allow the program to run
  • Click OK on the Scan complete screen, then OK on the Addition.txt pop up screen
  • 2 Notepad documents should now be open on your desktop.
  • Please copy and paste the contents of both in your reply
===================================================

System Summary Information

--------------------
  • Press the windows key Windows_Logo_key.gif + r on your keyboard at the same time
  • Type msinfo32 and press Enter
  • Left click on System Summary
  • Click File, Save, and name the file Summary
  • Zip and attach the file to your reply
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • TDSSKiller report
  • FRST results
  • Addition log
  • System Summary Information

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"May you be richly rewarded by the Lord, the God of Israel, under whose wings you have come to take refuge."

#4 bill02888

bill02888
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:00 AM

Posted 21 June 2016 - 06:44 PM

1) I tried pasting the TDSSKiller output into this post. Your software kept telling me that the post was too long. I tried splitting it in half. Still too big. I tried pasting the first 2000 lines. That was too long. I drew tired of playing forum posting games and simply zipped and attached that file.

 

2) I watched as msinfo32's progress bar completed. The process continued to use 25% of my CPU for a very long time after that. If I clicked on the System Information window the title changed to "System Information (Not Responding)". I finally gave up. Here is the post without System Information.

 

Attached File  TDSSKiller.3.1.0.9_17.06.2016_06.27.45_log.zip   250.58KB   1 downloads

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-06-2016 01
Ran by WS0002 (administrator) on LTMIDWSHERMAN1 (21-06-2016 19:38:50)
Running from C:\Users\ws0002\Desktop
Loaded Profiles: WS0002 (Available Profiles: WS0002 & Desktopadm & Profile)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(CREDANT Technologies, Inc.) C:\Windows\System32\CmgShieldSvc.exe
(CREDANT Technologies, Inc.) C:\Windows\System32\EmsService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(BMC ® Software, Inc.) C:\Program Files\BMC Software\FootPrints Asset Core\Client\bin\mtxagent.exe
(Pulse Secure, LLC) C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
(McAfee, Inc.) C:\Program Files\McAfee\Host Intrusion Prevention\FireSvc.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(McAfee, Inc.) C:\Program Files\McAfee\Host Intrusion Prevention\HipMgmt.exe
(Intel Corporation) C:\Program Files\Intel\Bluetooth\ibtsiva.exe
(IBM Corp) C:\Notes\SUService.exe
(IBM) C:\Notes\nsd.exe
(McAfee, Inc.) C:\Program Files\McAfee\Agent\macmnsvc.exe
(McAfee, Inc.) C:\Program Files\McAfee\Agent\masvc.exe
(McAfee, Inc.) C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe
(McAfee, Inc.) C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(IBM Corp) C:\Notes\ntmulti.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(McAfee, Inc.) C:\Program Files\McAfee\Agent\macompatsvc.exe
(Motorola Solutions, Inc.) C:\Program Files\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files\Intel\Bluetooth\mediasrv.exe
(Motorola Solutions, Inc.) C:\Program Files\Intel\Bluetooth\obexsrv.exe
(Secunia) C:\Program Files\Secunia\PSI\sua.exe
(BMC ® Software, Inc.) C:\Program Files\BMC Software\FootPrints Asset Core\Client\bin\mtxproxy.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(CREDANT Technologies, Inc.) C:\Windows\System32\CmgShieldUI.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(CREDANT Technologies, Inc.) C:\Windows\System32\EmsServiceHelper.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(McAfee, Inc.) C:\Program Files\McAfee\Agent\UpdaterUI.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Malwarebytes) C:\Program Files\Malwarebytes Anti-Malware\BusinessMessaging.exe
(Microsoft Corp.) C:\Users\ws0002\AppData\Local\Microsoft\OffCAT\OffCAT_RTS.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.exe
(McAfee, Inc.) C:\Program Files\McAfee\Agent\mctray.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Helios Software Solutions) C:\Program Files\TextPad 7\TextPad.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ShStatEXE] => C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE [244560 2016-02-11] (McAfee, Inc.)
HKLM\...\Run: [McAfee Host Intrusion Prevention Tray] => C:\Program Files\McAfee\Host Intrusion Prevention\FireTray.exe [219216 2013-12-18] (McAfee, Inc.)
HKLM\...\Run: [CmgShieldUI] => C:\Windows\System32\CMGShieldUI.exe [296584 2012-08-28] (CREDANT Technologies, Inc.)
HKLM\...\Run: [EmsService] => C:\Windows\system32\EmsServiceHelper.exe [960136 2012-08-28] (CREDANT Technologies, Inc.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [2312824 2015-08-25] (Logitech, Inc.)
HKLM\...\Run: [McAfeeUpdaterUI] => C:\Program Files\McAfee\Agent\UpdaterUI.exe [516432 2016-01-12] (McAfee, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [597016 2016-03-31] (Oracle Corporation)
HKLM\...\Run: [Malwarebytes Anti-Malware] => C:\Program Files\Malwarebytes Anti-Malware\BusinessMessaging.exe [3219456 2016-03-21] (Malwarebytes)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [2015-07-02] (Logitech, Inc.)
HKLM\...\Policies\Explorer: [NoWelcomeScreen] 1
HKU\S-1-5-21-2177354686-1047741297-147769659-66578\...\Run: [OffCAT] => C:\Users\ws0002\AppData\Local\Microsoft\OffCAT\OffCAT_RTS.exe [364928 2016-05-27] (Microsoft Corp.)
HKU\S-1-5-21-2177354686-1047741297-147769659-66578\...\Policies\system: [NoDispScrSavPage] 1
HKU\S-1-5-21-2177354686-1047741297-147769659-66578\...\Policies\system: [Wallpaper] C:\Windows\BBBYlogo.bmp
HKU\S-1-5-21-2177354686-1047741297-147769659-66578\...\Policies\system: [WallpaperStyle] 0
HKU\S-1-5-21-2177354686-1047741297-147769659-66578\...\Policies\system: [NoDispSettingsPage] 1
HKU\S-1-5-21-2177354686-1047741297-147769659-66578\...\Policies\system: [NoDispAppearancePage] 1
HKU\S-1-5-21-2177354686-1047741297-147769659-66578\...\Policies\Explorer: [NoRecentDocsNetHood] 1
HKU\S-1-5-21-2177354686-1047741297-147769659-66578\...\Policies\Explorer: [NoMovingBands] 1
HKU\S-1-5-21-2177354686-1047741297-147769659-66578\...\Policies\Explorer: [NoDesktopCleanupWizard] 1
HKU\S-1-5-21-2177354686-1047741297-147769659-66578\...\Policies\Explorer: [NoSetTaskbar] 1
HKU\S-1-5-21-2177354686-1047741297-147769659-66578\...\Policies\Explorer: [NoSMConfigurePrograms] 1
HKU\S-1-5-21-2177354686-1047741297-147769659-66578\...\Policies\Explorer: [NoWindowsUpdate] 1
HKU\S-1-5-21-2177354686-1047741297-147769659-66578\...\Policies\Explorer: [NoAutoUpdate] 0
HKU\S-1-5-21-2177354686-1047741297-147769659-66578\...\Policies\Explorer: [HideSCAHealth] 1
HKU\S-1-5-21-2177354686-1047741297-147769659-66578\...\Policies\Explorer: [NoThemesTab] 1
HKU\S-1-5-21-2177354686-1047741297-147769659-66578\...\Policies\Explorer: [DisablePersonalDirChange] 1
HKU\S-1-5-21-2177354686-1047741297-147769659-66578\...\MountPoints2: {a0ae737b-78b1-11e5-9a04-4851b70b1bdd} - D:\IronKey.exe
HKU\S-1-5-21-2177354686-1047741297-147769659-66578\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [10240 2009-07-13] (Microsoft Corporation)
ShellExecuteHooks: Eudora's Shell Extension - {EDB0E980-90BD-11D4-8599-0008C7D3B6F8} - C:\Program Files\Qualcomm\Eudora\EuShlExt.dll [86016 2006-08-17] (Qualcomm Inc.)
GroupPolicyScripts: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{C05F379B-C572-46DF-AA34-8DC49A12B1C8}: [DhcpNameServer] 192.168.1.1
ManualProxies: 0hxxp://pac.bedbath.com:8081/accelerated_pac_base.pac

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2177354686-1047741297-147769659-66578\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2177354686-1047741297-147769659-66578\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.bedbath.com
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_92\bin\ssv.dll [2016-05-05] (Oracle Corporation)
BHO: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20160505104740.dll [2016-05-05] (McAfee, Inc.)
BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll [2015-08-25] (Logitech, Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_92\bin\jp2ssv.dll [2016-05-05] (Oracle Corporation)
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} hxxps://connect.bedbath.com/dana-cached/sc/JuniperSetupClient.cab

FireFox:
========
FF ProfilePath: C:\Users\ws0002\AppData\Roaming\Mozilla\Firefox\Profiles\3kg89afj.default
FF DefaultSearchEngine.US: Google
FF Session Restore: -> is enabled.
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_22_0_0_192.dll [2016-06-17] ()
FF Plugin: @java.com/DTPlugin,version=11.92.2 -> C:\Program Files\Java\jre1.8.0_92\bin\dtplugin\npDeployJava1.dll [2016-05-05] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.92.2 -> C:\Program Files\Java\jre1.8.0_92\bin\plugin2\npjp2.dll [2016-05-05] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-05-27] (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2015-11-06] [not signed]
FF HKLM\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files\Common Files\McAfee\SystemCore
FF Extension: McAfee ScriptScan for Firefox - C:\Program Files\Common Files\McAfee\SystemCore [2016-06-21] [not signed]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Bluetooth Device Monitor; C:\Program Files\Intel\Bluetooth\devmonsrv.exe [1198456 2015-01-27] (Motorola Solutions, Inc.)
R2 Bluetooth Media Service; C:\Program Files\Intel\Bluetooth\mediasrv.exe [1714216 2015-05-06] (Motorola Solutions, Inc.)
R2 Bluetooth OBEX Service; C:\Program Files\Intel\Bluetooth\obexsrv.exe [1161592 2015-01-27] (Motorola Solutions, Inc.)
R2 BMC FootPrints Asset Core Agent; C:\Program Files\BMC Software\FootPrints Asset Core\Client\bin\mtxagent.exe [103616 2015-12-08] (BMC ® Software, Inc.)
R2 CMGShield; C:\Windows\system32\CmgShieldSvc.exe [2709128 2012-08-28] (CREDANT Technologies, Inc.)
S3 cphs; C:\Windows\system32\IntelCpHeciSvc.exe [279024 2014-02-14] (Intel Corporation)
S3 Cwbrxd; C:\Windows\cwbrxd.exe [106496 2012-05-06] (IBM Corporation) [File not signed]
R2 dsNcService; C:\Program Files\Juniper Networks\Common Files\dsNcService.exe [673744 2016-03-08] (Pulse Secure, LLC)
R2 EMS; C:\Windows\system32\EMSService.exe [1152648 2012-08-28] (CREDANT Technologies, Inc.)
R2 enterceptAgent; C:\Program Files\McAfee\Host Intrusion Prevention\FireSvc.exe [525144 2013-12-18] (McAfee, Inc.)
R2 HipMgmt; C:\Program Files\McAfee\Host Intrusion Prevention\HipMgmt.exe [153832 2013-12-18] (McAfee, Inc.)
R2 iBtSiva; C:\Program Files\Intel\Bluetooth\ibtsiva.exe [131824 2015-07-31] (Intel Corporation)
R2 LNSUSvc; C:\Notes\SUService.exe [192104 2013-11-22] (IBM Corp)
R2 Lotus Notes Diagnostics; C:\Notes\nsd.exe [4456040 2013-11-22] (IBM)
R2 macmnsvc; C:\Program Files\McAfee\Agent\macmnsvc.exe [117584 2016-01-12] (McAfee, Inc.)
R2 masvc; C:\Program Files\McAfee\Agent\masvc.exe [52048 2016-01-12] (McAfee, Inc.)
R3 McAfeeFramework; C:\Program Files\McAfee\Agent\macompatsvc.exe [213840 2016-01-12] (McAfee, Inc.)
R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [222880 2016-05-05] (McAfee, Inc.)
R2 McTaskManager; C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe [208936 2016-02-11] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [169800 2013-12-17] (McAfee, Inc.)
R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\\mfemms.exe [341800 2016-04-01] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [267640 2016-04-01] (McAfee, Inc.)
R2 Multi-user Cleanup Service; C:\Notes\ntmulti.exe [73320 2013-11-22] (IBM Corp)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [252320 2015-12-02] ()
S3 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1572056 2015-12-01] (Secunia)
R2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [839384 2015-12-01] (Secunia)
S4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3040160 2015-12-02] (Intel® Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 BmcMirror.2.0; C:\Windows\System32\DRIVERS\BmcMirror.2.0.mini.sys [10912 2015-02-04] (BMC ® Software, Inc.)
R3 BmcMirror.4.0.beforeWin8; C:\Windows\System32\DRIVERS\BmcMirror.4.0.beforeWin8.mini.sys [10912 2015-10-13] (BMC ® Software, Inc.)
R3 btmaux; C:\Windows\System32\DRIVERS\btmaux.sys [116200 2015-05-12] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\System32\DRIVERS\btmhsf.sys [1132344 2015-01-13] (Motorola Solutions, Inc.)
R0 CmgHiber; C:\Windows\System32\DRIVERS\CmgHiber.sys [133008 2012-08-28] (CREDANT Technologies, Inc.)
R0 CmgPassThrough; C:\Windows\System32\DRIVERS\CmgShPT.sys [15248 2012-08-28] (CREDANT Technologies, Inc.)
R0 CmgPCS; C:\Windows\System32\DRIVERS\CmgPCS.sys [119408 2012-08-28] (CREDANT Technologies, Inc.)
R0 CmgShieldCEF; C:\Windows\System32\DRIVERS\CMGShCEF.sys [315280 2012-08-28] (CREDANT Technologies, Inc.)
R0 CMGShieldReg; C:\Windows\System32\DRIVERS\CmgShREG.sys [22416 2012-08-28] (CREDANT Technologies, Inc.)
R3 dsNcAdpt; C:\Windows\System32\DRIVERS\dsNcAdpt.sys [27648 2014-06-07] (Juniper Networks)
S3 e1cexpress; C:\Windows\System32\DRIVERS\e1c6232.sys [280744 2012-08-13] (Intel Corporation)
R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d6232.sys [367880 2014-02-14] (Intel Corporation)
R3 FireNfcp; C:\Windows\System32\drivers\FireNfcp.sys [43352 2014-08-12] (McAfee, Inc.)
R2 giveio; C:\Windows\system32\giveio.sys [5248 1996-04-03] () [File not signed]
R3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [149864 2013-12-18] (McAfee, Inc.)
R3 ibtusb; C:\Windows\System32\DRIVERS\ibtusb.sys [244976 2015-07-31] (Intel Corporation)
S3 IntcAzAudAddService; C:\Windows\System32\drivers\RTDVHDA.sys [3129768 2012-08-13] (Realtek Semiconductor Corp.)
R3 iusb3hub; C:\Windows\System32\DRIVERS\iusb3hub.sys [361968 2014-02-14] (Intel Corporation)
R3 iusb3xhc; C:\Windows\System32\DRIVERS\iusb3xhc.sys [793072 2014-02-14] (Intel Corporation)
R3 LEqdUsb; C:\Windows\System32\Drivers\LEqdUsb.Sys [52368 2015-06-17] (Logitech, Inc.)
R3 LHidEqd; C:\Windows\System32\Drivers\LHidEqd.Sys [20240 2015-06-17] (Logitech, Inc.)
R3 MEI; C:\Windows\System32\DRIVERS\TeeDriver.sys [87000 2014-02-14] (Intel Corporation)
R3 mfeaack; C:\Windows\System32\drivers\mfeaack.sys [319784 2016-04-01] (McAfee, Inc.)
R3 mfeaacsk; C:\Windows\System32\drivers\mfeaacsk.sys [60712 2016-05-05] (McAfee, Inc.)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [134472 2015-04-29] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [271144 2016-04-01] (McAfee, Inc.)
S3 mfebopk; C:\Windows\System32\drivers\mfebopk.sys [76888 2016-05-05] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [379688 2016-05-05] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [646952 2016-04-01] (McAfee, Inc.)
R1 mfenlfk; C:\Windows\System32\DRIVERS\mfenlfk.sys [67400 2013-12-17] (McAfee, Inc.)
R3 mfeplk; C:\Windows\System32\drivers\mfeplk.sys [63272 2016-05-05] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [96440 2016-05-05] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [199464 2016-05-05] (McAfee, Inc.)
R3 NETwNs32; C:\Windows\System32\DRIVERS\NETwsn02.sys [2782472 2015-12-25] (Intel Corporation)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2015-12-01] (Secunia)
R2 speedfan; C:\Windows\system32\speedfan.sys [24184 2012-12-29] (Almico Software)
R0 stdcfltn; C:\Windows\System32\DRIVERS\stdcfltn.sys [17904 2011-07-15] (ST Microelectronics)
R3 ST_Accel; C:\Windows\System32\DRIVERS\ST_Accel.sys [72832 2014-02-14] (STMicroelectronics)
U3 mfeavfk01; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-06-21 19:38 - 2016-06-21 19:39 - 00018122 _____ C:\Users\ws0002\Desktop\FRST.txt
2016-06-21 19:38 - 2016-06-21 19:38 - 00000000 ____D C:\Users\ws0002\Desktop\FRST-OlderVersion
2016-06-20 08:24 - 2016-06-20 08:24 - 10498991 _____ C:\Users\ws0002\Desktop\lr051g01_mine.txt
2016-06-17 12:01 - 2016-06-14 12:39 - 10485792 _____ C:\Users\ws0002\Desktop\store 3020 register 52 June 1 and 2 (lr052g01_).txt
2016-06-17 06:48 - 2016-06-17 06:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Log Parser 2.2
2016-06-17 06:48 - 2016-06-17 06:48 - 00000000 ____D C:\Program Files\Log Parser 2.2
2016-06-17 06:34 - 2016-06-21 19:38 - 00000000 ____D C:\FRST
2016-06-17 06:33 - 2016-06-21 19:38 - 01738240 _____ (Farbar) C:\Users\ws0002\Desktop\FRST.exe
2016-06-17 06:27 - 2016-06-17 06:30 - 01290834 _____ C:\TDSSKiller.3.1.0.9_17.06.2016_06.27.45_log.txt
2016-06-15 06:40 - 2016-06-15 06:53 - 01293324 _____ C:\TDSSKiller.3.1.0.9_15.06.2016_06.40.15_log.txt
2016-06-15 06:28 - 2016-06-15 07:09 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2016-06-15 06:16 - 2016-06-15 06:27 - 01148090 _____ C:\TDSSKiller.3.1.0.9_15.06.2016_06.16.09_log.txt
2016-06-15 06:11 - 2016-06-15 06:11 - 00000000 ____D C:\TDSSKiller_Quarantine
2016-06-15 06:06 - 2016-06-15 06:11 - 00303448 _____ C:\TDSSKiller.3.1.0.9_15.06.2016_06.06.38_log.txt
2016-06-15 06:03 - 2016-06-15 06:03 - 00231760 _____ C:\Users\ws0002\Desktop\CrucialScan.exe
2016-06-15 05:58 - 2016-06-15 05:58 - 03703360 _____ C:\Users\ws0002\Desktop\adwcleaner_5.200.exe
2016-06-15 05:53 - 2016-03-09 20:12 - 04727984 _____ (Kaspersky Lab ZAO) C:\Users\ws0002\Desktop\TDSSKiller.exe
2016-06-13 16:20 - 2016-06-13 16:20 - 00000000 ____D C:\Users\ws0002\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Office Configuration Analyzer Tool
2016-06-10 06:08 - 2016-06-10 06:08 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-06-07 10:34 - 2016-06-14 09:37 - 00000000 ____D C:\Users\ws0002\Desktop\store 1338 - unexpected training mode
2016-06-07 08:56 - 2016-06-07 08:56 - 00000000 ____D C:\Users\ws0002\Desktop\OS Logs S1975 L09 2016-06-06 09.57 - 2016-06-06 15.56
2016-06-02 22:23 - 2016-06-02 22:23 - 00000008 _____ C:\Windows\system32\PROTOCOL.INI
2016-06-02 22:23 - 2016-06-02 22:23 - 00000000 ____D C:\Users\ws0002\AppData\Roaming\SecureNetTerm
2016-06-02 22:23 - 2016-06-02 22:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InterSoft International, Inc
2016-06-02 22:23 - 2016-06-02 22:23 - 00000000 ____D C:\Program Files\InterSoft International, Inc
2016-06-02 22:20 - 2016-06-02 22:20 - 00000000 ____D C:\Windows\{1A9A4736-4E49-4181-984C-747F1AF7C109}
2016-06-02 22:13 - 2016-06-02 22:13 - 00000000 ____D C:\Windows\{348BEB8C-E238-4F9D-A581-82B66FF23588}
2016-06-02 22:11 - 2016-06-02 22:11 - 00001804 _____ C:\Users\ws0002\Documents\OSLogs.ffs_gui
2016-06-02 22:10 - 2016-06-20 08:14 - 00000000 ____D C:\Users\ws0002\Desktop\OSLogs
2016-05-28 03:56 - 2016-04-09 02:59 - 00730344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2016-05-28 03:56 - 2016-04-09 02:59 - 00218856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2016-05-28 03:56 - 2016-04-09 02:54 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2016-05-28 03:56 - 2016-04-09 01:40 - 02397696 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-05-28 03:54 - 2016-04-09 02:59 - 03998952 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2016-05-28 03:54 - 2016-04-09 02:59 - 03943144 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-05-28 03:54 - 2016-04-09 02:59 - 00137960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-05-28 03:54 - 2016-04-09 02:59 - 00067304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-05-28 03:54 - 2016-04-09 02:57 - 01310528 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-05-28 03:54 - 2016-04-09 02:54 - 01062400 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-05-28 03:54 - 2016-04-09 02:54 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-05-28 03:54 - 2016-04-09 02:54 - 00655360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-05-28 03:54 - 2016-04-09 02:54 - 00644096 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2016-05-28 03:54 - 2016-04-09 02:54 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-05-28 03:54 - 2016-04-09 02:54 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2016-05-28 03:54 - 2016-04-09 02:54 - 00260608 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-05-28 03:54 - 2016-04-09 02:54 - 00251392 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-05-28 03:54 - 2016-04-09 02:54 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-05-28 03:54 - 2016-04-09 02:54 - 00171520 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-05-28 03:54 - 2016-04-09 02:54 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-05-28 03:54 - 2016-04-09 02:54 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2016-05-28 03:54 - 2016-04-09 02:54 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-05-28 03:54 - 2016-04-09 02:54 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-05-28 03:54 - 2016-04-09 02:54 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2016-05-28 03:54 - 2016-04-09 02:54 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2016-05-28 03:54 - 2016-04-09 02:54 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2016-05-28 03:54 - 2016-04-09 02:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2016-05-28 03:54 - 2016-04-09 02:54 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2016-05-28 03:54 - 2016-04-09 02:54 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-05-28 03:54 - 2016-04-09 02:54 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-05-28 03:54 - 2016-04-09 02:54 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2016-05-28 03:54 - 2016-04-09 01:42 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2016-05-28 03:54 - 2016-04-09 01:42 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2016-05-28 03:54 - 2016-04-09 01:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2016-05-28 03:54 - 2016-04-09 01:42 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2016-05-28 03:54 - 2016-04-09 01:42 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2016-05-28 03:54 - 2016-04-09 01:40 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2016-05-28 03:54 - 2016-04-09 01:38 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-05-28 03:54 - 2016-04-09 01:38 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-05-28 03:54 - 2016-04-09 01:38 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-05-28 03:54 - 2016-04-09 01:37 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2016-05-28 03:54 - 2016-04-09 01:37 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2016-05-28 03:54 - 2016-04-09 01:37 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-05-28 03:54 - 2016-04-09 01:37 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-05-28 03:53 - 2016-04-09 00:20 - 01230848 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2016-05-28 03:52 - 2016-04-14 09:49 - 00603648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2016-05-28 03:52 - 2016-04-09 02:54 - 00306176 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-05-28 03:51 - 2016-04-06 06:36 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2016-05-28 03:47 - 2016-04-23 00:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-05-28 03:47 - 2016-04-23 00:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-05-28 03:47 - 2016-04-23 00:07 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2016-05-28 03:47 - 2016-04-22 23:59 - 00476160 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-05-28 03:47 - 2016-04-22 23:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2016-05-28 03:46 - 2016-04-23 12:24 - 00346312 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-05-28 03:46 - 2016-04-23 00:20 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2016-05-28 03:46 - 2016-04-23 00:11 - 20350464 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-05-28 03:46 - 2016-04-23 00:08 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-05-28 03:46 - 2016-04-23 00:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2016-05-28 03:46 - 2016-04-23 00:07 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-05-28 03:46 - 2016-04-23 00:04 - 02285568 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-05-28 03:46 - 2016-04-23 00:02 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-05-28 03:46 - 2016-04-23 00:01 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-05-28 03:46 - 2016-04-22 23:58 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-05-28 03:46 - 2016-04-22 23:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2016-05-28 03:46 - 2016-04-22 23:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-05-28 03:46 - 2016-04-22 23:58 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2016-05-28 03:46 - 2016-04-22 23:53 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2016-05-28 03:46 - 2016-04-22 23:50 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-05-28 03:46 - 2016-04-22 23:45 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-05-28 03:46 - 2016-04-22 23:44 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2016-05-28 03:46 - 2016-04-22 23:43 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2016-05-28 03:46 - 2016-04-22 23:41 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-05-28 03:46 - 2016-04-22 23:40 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-05-28 03:46 - 2016-04-22 23:36 - 04611072 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-05-28 03:46 - 2016-04-22 23:33 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-05-28 03:46 - 2016-04-22 23:31 - 00693248 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-05-28 03:46 - 2016-04-22 23:31 - 00689664 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-05-28 03:46 - 2016-04-22 23:30 - 02056192 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-05-28 03:46 - 2016-04-22 23:30 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2016-05-28 03:46 - 2016-04-22 23:26 - 13811200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-05-28 03:46 - 2016-04-22 23:12 - 02121216 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-05-28 03:46 - 2016-04-22 23:09 - 01312256 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-05-28 03:46 - 2016-04-22 23:07 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-05-24 20:49 - 2016-05-24 20:50 - 00000000 ____D C:\Windows\OS Logs S0606 L02 2016-05-10 16.00 - 2016-05-24 16.23
2016-05-24 20:47 - 2016-05-24 20:48 - 00000000 ____D C:\Windows\OS Logs S3030 L52 2016-05-22 11.51 - 2016-05-24 20.23
2016-05-24 20:46 - 2016-05-24 20:46 - 00000000 ____D C:\Program Files\OSLogs

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-06-21 19:29 - 2009-07-14 00:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-06-20 08:29 - 2015-10-13 14:21 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-06-20 08:14 - 2016-02-24 22:28 - 00000000 ____D C:\Users\ws0002\Desktop\Bill Sherman bookcase
2016-06-20 08:14 - 2016-02-24 22:24 - 00000000 ____D C:\Users\ws0002\Desktop\Bill Sherman BBBY development
2016-06-19 01:00 - 2009-07-13 22:37 - 00000000 ____D C:\Windows\inf
2016-06-18 08:46 - 2009-07-14 00:34 - 00023872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-06-18 08:46 - 2009-07-14 00:34 - 00023872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-06-17 20:52 - 2015-10-13 14:14 - 00000456 _____ C:\Windows\system32\config\netlogon.ftl
2016-06-17 13:56 - 2015-10-22 10:12 - 00002171 _____ C:\Users\ws0002\Desktop\Specialty on LAN.lnk
2016-06-17 12:23 - 2016-04-07 13:02 - 00000000 ____D C:\Users\ws0002\Desktop\EMV pilot logs
2016-06-17 12:21 - 2010-11-20 17:01 - 00781782 _____ C:\Windows\system32\PerfStringBackup.INI
2016-06-17 12:20 - 2015-10-14 14:10 - 00000000 ____D C:\ProgramData\CREDANT
2016-06-17 12:02 - 2015-11-06 07:49 - 00002250 ____H C:\Users\ws0002\Documents\Default.rdp
2016-06-17 08:29 - 2014-03-24 13:24 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2016-06-17 08:29 - 2014-03-24 13:24 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2016-06-15 06:28 - 2015-10-22 08:19 - 00170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-06-15 06:27 - 2015-10-22 07:53 - 00094936 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-06-15 06:13 - 2016-01-19 10:17 - 00000000 ____D C:\Program Files\7-Zip
2016-06-15 05:59 - 2015-12-19 21:05 - 00000000 ____D C:\AdwCleaner
2016-06-15 05:57 - 2015-10-22 08:00 - 00000000 ____D C:\Program Files\SpeedFan
2016-06-15 05:48 - 2015-11-24 11:18 - 00000000 ____D C:\Program Files\Beyond Compare 4
2016-06-15 05:47 - 2015-10-22 07:59 - 00001105 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FreeFileSync.lnk
2016-06-15 05:47 - 2015-10-22 07:59 - 00001081 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RealTimeSync.lnk
2016-06-15 05:47 - 2015-10-22 07:59 - 00000000 ____D C:\Program Files\FreeFileSync
2016-06-15 05:46 - 2015-10-22 07:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2016-06-15 05:46 - 2015-10-22 07:58 - 00000000 ____D C:\Program Files\FileZilla FTP Client
2016-06-13 17:00 - 2009-07-13 22:37 - 00000000 ____D C:\Windows\rescache
2016-06-11 08:18 - 2015-10-22 07:58 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2016-06-07 09:39 - 2015-10-22 08:18 - 00000000 ____D C:\Users\ws0002\.oracle_jre_usage
2016-06-07 08:55 - 2016-03-21 16:25 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-06-07 08:53 - 2015-11-06 08:03 - 00000000 _____ C:\work
2016-06-07 08:42 - 2014-02-18 09:44 - 00089848 _____ C:\Users\desktopadm\AppData\Local\GDIPFONTCACHEV1.DAT
2016-06-07 08:40 - 2009-07-14 00:33 - 00341144 _____ C:\Windows\system32\FNTCACHE.DAT
2016-06-02 22:23 - 2015-11-06 07:45 - 00000008 _____ C:\Windows\system32\WIN.INI
2016-06-02 22:23 - 2015-11-06 07:45 - 00000008 _____ C:\Windows\system32\SYSTEM.INI
2016-06-02 22:23 - 2015-10-29 10:03 - 00001874 _____ C:\Users\ws0002\Documents\Bill Sherman.ffs_gui
2016-06-02 22:23 - 2015-10-29 10:03 - 00001858 _____ C:\Users\ws0002\Documents\Bill Sherman local.ffs_gui
2016-06-02 07:24 - 2011-04-11 22:21 - 00000000 ____D C:\Program Files\Windows Journal
2016-05-26 21:55 - 2016-02-08 12:32 - 00000000 ____D C:\Eudora
2016-05-24 22:15 - 2015-10-13 14:17 - 00030113 __RSH C:\ProgramData\ntuser.pol

==================== Files in the root of some directories =======

2015-12-18 14:28 - 2015-12-18 14:28 - 0000037 ___SH () C:\Users\ws0002\AppData\Local\70149b02515b3bb20dd492.47983420
2015-11-06 10:17 - 2015-11-24 15:42 - 0000600 _____ () C:\Users\ws0002\AppData\Local\PUTTY.RND
2016-01-16 20:04 - 2016-01-16 20:04 - 0010218 _____ () C:\ProgramData\regid.2015-05.exe.textpad_83F5EF12-C2F9-4C11-A5C5-57A7B2D7AD25.swidtag

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-06-17 00:20

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 20-06-2016 01
Ran by WS0002 (2016-06-21 19:39:42)
Running from C:\Users\ws0002\Desktop
Microsoft Windows 7 Professional Service Pack 1 (X86) (2015-10-13 17:50:03)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3452704838-1871494145-2107766380-500 - Administrator - Disabled)
Desktopadm (S-1-5-21-3452704838-1871494145-2107766380-1000 - Administrator - Enabled) => C:\Users\desktopadm
Profile (S-1-5-21-3452704838-1871494145-2107766380-1001 - Administrator - Enabled) => C:\Users\Profile
tss_guest (S-1-5-21-3452704838-1871494145-2107766380-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: McAfee VirusScan Enterprise (Disabled - Up to date) {DA9F8ED0-D0DE-39CC-F55A-51AB4CC1B556}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: McAfee VirusScan Enterprise Antispyware Module (Disabled - Up to date) {61FE6F34-F6E4-3642-CFEA-6AD93746FFEB}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 16.02 (HKLM\...\7-Zip) (Version: 16.02 - Igor Pavlov)
Adobe Acrobat Reader DC (HKLM\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.016.20045 - Adobe Systems Incorporated)
Adobe Flash Player 22 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 22.0.0.192 - Adobe Systems Incorporated)
Adobe Flash Player 22 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 22.0.0.192 - Adobe Systems Incorporated)
Auslogics DiskDefrag (HKLM\...\{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1) (Version: 6.1.0.0 - Auslogics Labs Pty Ltd)
Beyond Compare 4.1.6 (HKLM\...\BeyondCompare4_is1) (Version: 4.1.6.21095 - Scooter Software)
CCleaner (HKLM\...\CCleaner) (Version: 5.18 - Piriform)
CMG Windows Shield (Version: 7.3.0.4650 - CREDANT Technologies, Inc.) Hidden
Eudora (HKLM\...\{FB80F9A2-34CB-4EE7-AEAD-A40ECF887355}) (Version: 7.0 - )
FileHippo App Manager (HKLM\...\FileHippo.com) (Version: - FileHippo.com)
FileZilla Client 3.18.0 (HKLM\...\FileZilla Client) (Version: 3.18.0 - Tim Kosse)
FreeFileSync 8.2 (HKLM\...\FreeFileSync_is1) (Version: 8.2 - www.FreeFileSync.org)
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.14.265 - SurfRight B.V.)
IBM i Access for Windows 7.1 (HKLM\...\{31E11496-1F84-4DCC-B07A-369B40B8B4A7}) (Version: 07.01.0600 - IBM)
IBM i Access for Windows MRI (Version: 07.01.0000 - IBM) Hidden
inSSIDer 3 (HKLM\...\{A80CEA4E-74C1-4F9F-806B-E1D9AFC01768}) (Version: 3.0.7.48 - MetaGeek, LLC)
Intel® Network Connections Drivers (HKLM\...\PROSet) (Version: 18.7 - Intel)
Intel® Processor Graphics (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.18.10.3220 - Intel Corporation)
Intel® Wireless Bluetooth®(patch version 17.1.1531.1764) (HKLM\...\{302600C1-6BDF-4FD1-1507-148929CC1385}) (Version: 17.1.1507.0532 - Intel Corporation)
Intel® Driver Update Utility (HKLM\...\{561b5fb5-1d4d-40e8-b3e4-ad52858b217c}) (Version: 2.4.0.7 - Intel)
Intel® PROSet/Wireless Software (HKLM\...\{bc1057f6-8279-45e7-9c35-c3ff7bf0c04d}) (Version: 18.32.0 - Intel Corporation)
Java 2 SDK, SE v1.4.2_19 (HKLM\...\{35A3A4F4-B792-11D6-A78A-00B0D0142190}) (Version: 1.4.2_19 - Sun Microsystems, Inc.)
Java 8 Update 92 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218092F0}) (Version: 8.0.920.14 - Oracle Corporation)
Java SE Development Kit 8 Update 92 (HKLM\...\{32A3A4F4-B792-11D6-A78A-00B0D0180920}) (Version: 8.0.920.14 - Oracle Corporation)
Juniper Networks Network Connect 7.4.0 (HKLM\...\Juniper Network Connect 7.4.0) (Version: 7.4.0.31481 - Juniper Networks)
Lawson Add-ins for Microsoft Office 10.0.109 (HKLM\...\{32EC0B07-7454-4569-8A23-CB5BB79876DB}) (Version: 10.0.109 - Lawson Software)
Log Parser 2.2 (HKLM\...\{4AC23178-EEBC-4BAF-8CC0-AB15C8897AC9}) (Version: 2.2.10 - Microsoft Corporation)
Logitech SetPoint 6.67 (HKLM\...\sp6) (Version: 6.67.83 - Logitech)
Lotus Notes 8.5.3 (HKLM\...\{E36FB5F6-94FE-47BF-9FBE-6D8CBCFB0269}) (Version: 8.53.11258 - IBM)
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
McAfee Agent (HKLM\...\{dea2d287-b3f7-4828-8332-3cf31ed15ed7}) (Version: 5.0.2.333 - McAfee, Inc.)
McAfee Host Intrusion Prevention (HKLM\...\{6B005DF6-6B6E-4551-B632-B0001DF50499}_Uninst) (Version: 8.00.0402 - McAfee, Inc.)
McAfee Host Intrusion Prevention (Version: 8.00.0402 - McAfee, Inc.) Hidden
McAfee VirusScan Enterprise (HKLM\...\{CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF}) (Version: 8.8.07000 - McAfee, Inc.)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Configuration Analyzer Tool 2.2 (HKLM\...\{EA5C0F11-00CA-020F-051B-14100202177C}) (Version: 2.2.6012.527 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft Visio Professional 2010 (HKLM\...\Office14.VISIO) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 47.0 (x86 en-US) (HKLM\...\Mozilla Firefox 47.0 (x86 en-US)) (Version: 47.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 47.0.0.5999 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Notepad++ (HKLM\...\Notepad++) (Version: 6.9.2 - Notepad++ Team)
Pulse Secure Host Checker (HKU\S-1-5-21-2177354686-1047741297-147769659-66578\...\PulseSecure_Host_Checker) (Version: 8.1.8.43849 - Pulse Secure, LLC)
Pulse Secure Network Connect 8.1 (HKLM\...\Pulse Secure Network Connect 8.1) (Version: 8.1.8.43849 - Pulse Secure, LLC)
Pulse Secure Setup Client (HKU\S-1-5-21-2177354686-1047741297-147769659-66578\...\Juniper_Setup_Client) (Version: 8.1.100.61517 - Pulse Secure, LLC)
RSA SecurID Software Token (HKLM\...\{1E7941DC-32F1-467D-8351-8955A038A76E}) (Version: 4.1.1 - RSA, The Security Division of EMC)
Secunia PSI (3.0.0.11003) (HKLM\...\Secunia PSI) (Version: 3.0.0.11003 - Secunia)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Visio 2010 (KB2687468) 32-Bit Edition (HKLM\...\{90140000-0057-0000-0000-0000000FF1CE}_Office14.VISIO_{359ADBEC-068A-4CC9-9174-77AB8EDB867A}) (Version: - Microsoft)
SNetTerm (HKLM\...\{B5ED1586-DF14-4A2E-A5D8-6E50708CC7AA}) (Version: 5.6.0.2016 - InterSoft International, Inc)
Sonos Controller (HKLM\...\{7BBA9BF8-05DF-47D8-8880-82A9B99505B9}) (Version: 31.3.22220 - Sonos, Inc.)
SpeedFan (remove only) (HKLM\...\SpeedFan) (Version: - )
TextPad 7 (HKLM\...\{BD290B7C-E023-4364-87D4-2B00DE2ED5A7}) (Version: 7.6.1 - Helios)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.4 - VideoLAN)
WinZip 19.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240E4}) (Version: 19.0.11293 - WinZip Computing, S.L. )

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2177354686-1047741297-147769659-66578_Classes\CLSID\{8A791F0C-C63C-4EC5-B97F-FBCE74EDBC54}\InprocServer32 -> C:\Program Files\TextPad 7\System\ShellExt32.dll ()

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {1E6C9F26-CEC9-40A6-8F6C-540D5F9A2AAD} - System32\Tasks\HF_BOOT_TASK_JOB (INSTALL_STATE_UPDATE) => C:\Program Files\BMC Software\FootPrints Asset Core\Client\data\PatchManagementPremium\Patches\Groups\1102\SafeReboot.exe
Task: {370C09D9-E829-442F-9B33-8E40E6C4C219} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-04-22] (Adobe Systems Incorporated)
Task: {42C78D98-18EF-401A-BA71-FEEF7AA443FF} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-05-13] (Piriform Ltd)
Task: {F15F5874-30B0-44E8-B919-30E3D84CBFAF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2016-06-17] (Adobe Systems Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2015-04-29 16:19 - 2015-09-17 08:05 - 00171200 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\ApplicationMonitor.dll
2015-04-29 16:19 - 2015-12-08 06:26 - 00155328 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\MtxCoreUtils.dll
2015-04-29 16:19 - 2015-09-17 08:05 - 00065216 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\CustomInventory.dll
2015-04-29 16:19 - 2015-09-17 08:05 - 00075456 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\DeviceManagement.dll
2015-04-29 16:19 - 2015-09-17 08:05 - 00150208 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\EventLogManager.dll
2015-04-29 16:19 - 2015-09-17 08:05 - 00456896 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\FileStore.dll
2015-04-29 16:19 - 2015-09-17 08:05 - 00129216 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\HardwareInventory.dll
2015-04-29 16:19 - 2015-09-17 08:06 - 00203968 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\HttpProtocolHandler.dll
2015-04-29 16:19 - 2015-09-17 08:05 - 00048320 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\HostAccess.dll
2015-04-29 16:19 - 2015-09-17 08:06 - 00107712 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\Identity.dll
2015-04-29 16:19 - 2015-09-17 08:06 - 00073408 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\NtEvent.dll
2015-04-29 16:19 - 2015-09-17 08:06 - 00361664 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\OperationalRules.dll
2015-04-29 16:19 - 2015-09-17 08:06 - 00534720 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\PatchManagementPremium.dll
2015-04-29 16:19 - 2015-09-17 08:06 - 00115392 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\PowerManagement.dll
2015-04-29 16:19 - 2015-09-17 08:06 - 00097472 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\Privacy.dll
2015-04-29 16:19 - 2015-09-17 08:06 - 00242880 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\Relay.dll
2015-04-29 16:19 - 2015-09-17 08:06 - 00026816 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\Registry.dll
2015-04-29 16:19 - 2015-09-17 08:07 - 00100032 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\RemoteControl.dll
2015-04-29 16:19 - 2015-09-17 08:07 - 00122560 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\ScapInventory.dll
2015-04-29 16:19 - 2014-03-20 06:20 - 00026112 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\bin\XalanMessages_1_10.dll
2015-04-29 16:19 - 2015-09-17 08:07 - 00091328 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\SecurityInventory.dll
2015-04-29 16:19 - 2015-09-17 08:07 - 00120512 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\SecurityProductsManagement.dll
2015-04-29 16:19 - 2015-09-17 08:07 - 00088768 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\SelfHealing.dll
2015-04-29 16:19 - 2015-09-17 08:07 - 00032960 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\SendMail.dll
2015-04-29 16:19 - 2015-09-17 08:07 - 00213184 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\SoftwareInventory.dll
2015-04-29 16:19 - 2015-09-17 08:07 - 00093376 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\Timer.dll
2015-04-29 16:19 - 2015-09-17 08:07 - 00069824 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\TransferWindow.dll
2015-04-29 16:19 - 2015-09-17 08:07 - 00212672 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\UpdateManager.dll
2015-04-29 16:19 - 2015-09-17 08:07 - 00056000 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\UserAccess.dll
2015-04-29 16:19 - 2015-12-08 06:27 - 00064704 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\WakeOnLan.dll
2015-04-29 16:19 - 2015-09-17 08:07 - 00019136 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\WindowsServices.dll
2015-04-29 16:19 - 2015-12-08 06:25 - 00189120 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\AsynchronousActions.dll
2015-04-29 16:19 - 2015-09-17 08:07 - 00170688 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\modules\agent\VirtualInfrastructureManager.dll
2015-04-29 16:19 - 2015-09-17 08:02 - 00157888 ____N () C:\Program Files\BMC Software\FootPrints Asset Core\Client\bin\libMtxWS.dll
2016-01-12 20:44 - 2016-01-12 20:44 - 00423248 _____ () C:\Program Files\McAfee\Agent\sqlite.dll
2016-01-12 20:45 - 2016-01-12 20:45 - 00019792 _____ () C:\Program Files\McAfee\Agent\trex.dll
2016-01-12 20:34 - 2016-01-12 20:34 - 00132944 _____ () C:\Program Files\McAfee\Agent\libuv.dll
2016-01-12 20:44 - 2016-01-12 20:44 - 00041296 _____ () C:\Program Files\McAfee\Agent\MXML.dll
2016-01-12 20:45 - 2016-01-12 20:45 - 00096592 _____ () C:\Program Files\McAfee\Agent\zlib.dll
2016-01-12 20:34 - 2016-01-12 20:34 - 00021840 _____ () C:\Program Files\McAfee\Agent\libini.dll
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 15:45 - 2010-10-20 15:45 - 08801120 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\ws0002\Desktop\TDSSKiller.exe:com.dropbox.attributes [168]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\80828079.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\80828079.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfemms => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 22:04 - 2016-06-17 20:56 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2177354686-1047741297-147769659-66578\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is disabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BCSSync => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
MSCONFIG\startupreg: Client Access Service => C:\Program Files\IBM\Client Access\cwbsvstr.exe
MSCONFIG\startupreg: RtHDVCpl => C:\Program Files\Realtek\Audio\HDA\RtDCpl.exe
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{4F99D152-C8C3-47D7-9E95-544A4BD3520B}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{68CEF908-8E43-4465-97D4-22E35B56D86C}] => (Allow) LPort=1610
FirewallRules: [{7F4F284A-BA1B-4E1D-9F98-43082E3DF48D}] => (Allow) LPort=1611
FirewallRules: [{651F9E7C-91D4-4C34-89E3-6D6E10C7A228}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{C48C5815-F1BB-4D9D-AF2B-691DFE15769F}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{4C2486C2-342F-4CA8-9C71-438D1E88D578}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{7142CBBD-41DA-4D69-ABE2-12461835B132}] => (Allow) C:\Program Files\McAfee\Agent\macmnsvc.exe
FirewallRules: [{F0F48686-C324-4E97-90E0-833D20C8EE5D}] => (Allow) C:\Program Files\McAfee\Agent\macmnsvc.exe
FirewallRules: [{590C712E-EC57-4611-B938-5BE4B3C3C1C4}] => (Allow) C:\Program Files\McAfee\Agent\macmnsvc.exe
FirewallRules: [{8E1CDF52-0E79-4CA6-8544-3517A7017786}] => (Allow) C:\Program Files\McAfee\Agent\macmnsvc.exe
FirewallRules: [{F4AB1CD5-50BC-4696-B777-1B9363ACB0C4}] => (Allow) C:\Program Files\McAfee\Agent\macmnsvc.exe
FirewallRules: [{9B150FD7-7C2D-4301-8B8E-F03F3CD167E7}] => (Allow) C:\Program Files\McAfee\Agent\macmnsvc.exe

==================== Restore Points =========================

28-05-2016 03:51:48 Windows Update
28-05-2016 03:52:30 Windows Update
28-05-2016 03:53:09 Windows Update
28-05-2016 03:53:51 Windows Update
28-05-2016 03:55:59 Windows Update
28-05-2016 03:56:39 Windows Update
02-06-2016 22:21:34 Removed SNetTerm
02-06-2016 22:23:33 Installed SNetTerm
13-06-2016 16:15:15 Installed Microsoft Office Configuration Analyzer Tool 2.2
17-06-2016 06:47:58 Installed Log Parser 2.2

==================== Faulty Device Manager Devices =============

Name: Bluetooth Device (Personal Area Network)
Description: Bluetooth Device (Personal Area Network)
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: BthPan
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Microsoft Virtual WiFi Miniport Adapter
Description: Microsoft Virtual WiFi Miniport Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Microsoft Virtual WiFi Miniport Adapter #2
Description: Microsoft Virtual WiFi Miniport Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/21/2016 07:29:19 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/20/2016 08:37:44 AM) (Source: Credant EMS) (EventID: 4097) (User: )
Description: Failure: ERROR 0xe9 in MessageClientThread thread: ERROR reading from named pipe

Error: (06/17/2016 12:29:23 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/17/2016 12:28:02 PM) (Source: Credant EMS) (EventID: 4097) (User: )
Description: Failure: ERROR 0xe9 in MessageClientThread thread: ERROR reading from named pipe

Error: (06/17/2016 12:27:13 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program firefox.exe version 47.0.0.5999 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 958

Start Time: 01d1c8834c4bcf93

Termination Time: 31

Application Path: C:\Program Files\Mozilla Firefox\firefox.exe

Report Id: 51d2c7b4-34a8-11e6-9981-4851b70b1bd9

Error: (06/17/2016 06:23:52 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mtxproxy.exe, version: 12.1.0.0, time stamp: 0x55fa9e61
Faulting module name: libMtx.dll, version: 12.1.0.0, time stamp: 0x5666bd64
Exception code: 0xc0000005
Fault offset: 0x0016a497
Faulting process id: 0x8138
Faulting application start time: 0xmtxproxy.exe0
Faulting application path: mtxproxy.exe1
Faulting module path: mtxproxy.exe2
Report Id: mtxproxy.exe3

Error: (06/17/2016 06:23:21 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mtxproxy.exe, version: 12.1.0.0, time stamp: 0x55fa9e61
Faulting module name: libMtx.dll, version: 12.1.0.0, time stamp: 0x5666bd64
Exception code: 0xc0000005
Fault offset: 0x0016a497
Faulting process id: 0x8518
Faulting application start time: 0xmtxproxy.exe0
Faulting application path: mtxproxy.exe1
Faulting module path: mtxproxy.exe2
Report Id: mtxproxy.exe3

Error: (06/17/2016 06:22:50 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mtxproxy.exe, version: 12.1.0.0, time stamp: 0x55fa9e61
Faulting module name: libMtx.dll, version: 12.1.0.0, time stamp: 0x5666bd64
Exception code: 0xc0000005
Fault offset: 0x0016a497
Faulting process id: 0x8548
Faulting application start time: 0xmtxproxy.exe0
Faulting application path: mtxproxy.exe1
Faulting module path: mtxproxy.exe2
Report Id: mtxproxy.exe3

Error: (06/17/2016 06:22:19 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mtxproxy.exe, version: 12.1.0.0, time stamp: 0x55fa9e61
Faulting module name: libMtx.dll, version: 12.1.0.0, time stamp: 0x5666bd64
Exception code: 0xc0000005
Fault offset: 0x0016a497
Faulting process id: 0x7f24
Faulting application start time: 0xmtxproxy.exe0
Faulting application path: mtxproxy.exe1
Faulting module path: mtxproxy.exe2
Report Id: mtxproxy.exe3

Error: (06/17/2016 06:21:48 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mtxproxy.exe, version: 12.1.0.0, time stamp: 0x55fa9e61
Faulting module name: libMtx.dll, version: 12.1.0.0, time stamp: 0x5666bd64
Exception code: 0xc0000005
Fault offset: 0x0016a497
Faulting process id: 0x8534
Faulting application start time: 0xmtxproxy.exe0
Faulting application path: mtxproxy.exe1
Faulting module path: mtxproxy.exe2
Report Id: mtxproxy.exe3


System errors:
=============
Error: (06/21/2016 07:34:35 PM) (Source: Microsoft-Windows-GroupPolicy) (EventID: 1129) (User: BBBY)
Description: The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has succesfully processed. If you do not see a success message for several hours, then contact your administrator.

Error: (06/21/2016 07:31:47 PM) (Source: TermService) (EventID: 1067) (User: )
Description: The terminal server cannot register 'TERMSRV' Service Principal Name to be used for server authentication. The following error occured: The specified domain either does not exist or could not be contacted.
.

Error: (06/21/2016 07:29:25 PM) (Source: Microsoft-Windows-GroupPolicy) (EventID: 1129) (User: NT AUTHORITY)
Description: The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has succesfully processed. If you do not see a success message for several hours, then contact your administrator.

Error: (06/21/2016 07:29:16 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
cdrom

Error: (06/21/2016 07:29:15 PM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: The BMC FootPrints Asset Core Agent service has reported an invalid current state 0.

Error: (06/21/2016 07:29:10 PM) (Source: NETLOGON) (EventID: 5719) (User: )
Description: This computer was not able to set up a secure session with a domain
controller in domain BBBY due to the following:
%%1311 = There are currently no logon servers available to service the logon request.


This may lead to authentication problems. Make sure that this
computer is connected to the network. If the problem persists,
please contact your domain administrator.



ADDITIONAL INFO

If this computer is a domain controller for the specified domain, it
sets up the secure session to the primary domain controller emulator in the specified
domain. Otherwise, this computer sets up the secure session to any domain controller
in the specified domain.

Error: (06/20/2016 08:37:38 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the CMGShield service.

Error: (06/20/2016 08:01:17 AM) (Source: NETLOGON) (EventID: 5719) (User: )
Description: This computer was not able to set up a secure session with a domain
controller in domain BBBY due to the following:
%%1311 = There are currently no logon servers available to service the logon request.


This may lead to authentication problems. Make sure that this
computer is connected to the network. If the problem persists,
please contact your domain administrator.



ADDITIONAL INFO

If this computer is a domain controller for the specified domain, it
sets up the secure session to the primary domain controller emulator in the specified
domain. Otherwise, this computer sets up the secure session to any domain controller
in the specified domain.

Error: (06/20/2016 03:47:39 AM) (Source: NETLOGON) (EventID: 5719) (User: )
Description: This computer was not able to set up a secure session with a domain
controller in domain BBBY due to the following:
%%1311 = There are currently no logon servers available to service the logon request.


This may lead to authentication problems. Make sure that this
computer is connected to the network. If the problem persists,
please contact your domain administrator.



ADDITIONAL INFO

If this computer is a domain controller for the specified domain, it
sets up the secure session to the primary domain controller emulator in the specified
domain. Otherwise, this computer sets up the secure session to any domain controller
in the specified domain.

Error: (06/19/2016 11:26:50 PM) (Source: Microsoft-Windows-GroupPolicy) (EventID: 1129) (User: NT AUTHORITY)
Description: The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has succesfully processed. If you do not see a success message for several hours, then contact your administrator.


CodeIntegrity:
===================================
Date: 2016-06-21 19:39:09.541
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mferkdet.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-06-21 19:39:09.541
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mferkdet.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-06-21 19:39:07.107
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mfebopk.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-06-21 19:39:07.092
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mfebopk.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-06-19 12:04:18.307
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mferkdet.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-06-19 12:04:18.305
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mferkdet.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-06-19 12:04:18.300
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mferkdet.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-06-19 12:04:18.299
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mferkdet.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-06-19 12:04:18.294
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mferkdet.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-06-19 12:04:18.293
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mferkdet.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Processor: Intel® Core™ i5-4310U CPU @ 2.00GHz
Percentage of memory in use: 42%
Total physical RAM: 3507.5 MB
Available physical RAM: 2015.19 MB
Total Virtual: 7013.32 MB
Available Virtual: 5529.99 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.41 GB) (Free:408.1 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 458C7D79)
Partition 1: (Active) - (Size=356 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.4 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================
 


Edited by bill02888, 21 June 2016 - 07:16 PM.


#5 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,486 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:04:00 AM

Posted 21 June 2016 - 07:14 PM

Greetings Bill,

I think those are all false positives. Not uncommon for TDSSKiller but I have to admit you have a larger number than what I normally see. If you want, you can run a few of the files through Virustotal.

Your computer is otherwise clean as a whistle.
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"May you be richly rewarded by the Lord, the God of Israel, under whose wings you have come to take refuge."

#6 bill02888

bill02888
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:00 AM

Posted 21 June 2016 - 07:22 PM

Hi Gary.

 

I chose 2 files and had Virustotal scan them. It shows them as clean (0/57, etc.). Like you said, a LOT of false positives. Oh well. Thank you very much for your assistance!

 

- Bill



#7 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,486 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:04:00 AM

Posted 21 June 2016 - 07:42 PM

No problem Bill. I commend you for the state of your computer. Things look great.

If you have don't have any other questions or issues I will close the topic.
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"May you be richly rewarded by the Lord, the God of Israel, under whose wings you have come to take refuge."

#8 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,486 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:04:00 AM

Posted 21 June 2016 - 08:41 PM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"May you be richly rewarded by the Lord, the God of Israel, under whose wings you have come to take refuge."




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users