View Full Version : Total ad performance
Does anyone know how to get rid of Total Ad Performance? When browsing on Chrome the malware randomly opens up the total ad performance website. I have tried running Spybot but it hasn't managed to get rid of the malware.
scan logs
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:18-07-2015 01
Ran by Hugh (administrator) on HUGH_LAPTOP on 20-07-2015 11:09:30
Running from D:\FARBAR
Loaded Profiles: Hugh (Available Profiles: Hugh)
Platform: Windows 8.1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\SCM\MSIService.exe
(MSI) C:\Program Files (x86)\MSI\SUPER CHARGER\ChargeService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Qualcomm Atheros) C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.1\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.1\GoogleCrashHandler64.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(MSI) C:\Program Files (x86)\SCM\SCM.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\MSI\Dragon Gaming Center\Dragon Gaming Center.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
() C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\MSI\KLM\KLM.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(MSI) C:\Program Files (x86)\MSI\SUPER CHARGER\SUPER CHARGER.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Telstra) C:\Program Files (x86)\Telstra\Mobile Broadband Manager\TelstraUCM.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\excel.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\outlook.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\ismagent.exe
() C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\updateui.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Reader_6.3.9654.17499_x64__8wekyb3d8bbwe\glcnd.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Oracle Corporation) C:\Program Files (x86)\Java\jre1.8.0_45\bin\javaw.exe
(Oracle Corporation) C:\Program Files (x86)\Java\jre1.8.0_45\bin\javaw.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\msosync.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8446832 2015-01-22] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2015-01-22] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [322712 2014-10-10] (Intel Corporation)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [3281160 2015-01-22] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [SCM] => C:\Program Files (x86)\SCM\SCM.exe [405504 2014-11-07] (MSI)
HKLM-x32\...\Run: [KLM] => C:\Program Files (x86)\MSI\KLM\KLM.exe [1569416 2014-11-12] (Micro-Star International Co., Ltd.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-09] (CyberLink Corp.)
HKLM-x32\...\Run: [SUPER CHARGER] => C:\Program Files (x86)\MSI\SUPER CHARGER\SUPER CHARGER.exe [1047536 2014-02-22] (MSI)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM-x32\...\Run: [BigPondWirelessBroadbandCM] => C:\Program Files (x86)\Telstra\Mobile Broadband Manager\TelstraUCM.exe [4352408 2010-05-14] (Telstra)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22012688 2015-06-20] (Google)
HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53288576 2015-06-29] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Killer Network Manager.lnk [2015-01-23]
ShortcutTarget: Killer Network Manager.lnk -> C:\Windows\Installer\{5B62C353-75A3-463F-A52E-CC005846F3CE}\NetworkManager.exe_130C27D738F34C89BDDF21BCFD74B56D.exe (Flexera Software LLC)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://msi13.msn.com
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001 -> DefaultScope {E24B6B7F-4EEA-40BE-8286-5FE2CA130926} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-05-19] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-06-07] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-07] (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-06-08] (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 10.5.133.45 10.5.136.242
Tcpip\..\Interfaces\{6CA879F1-BA5A-40DB-96D7-FBC3D00CB47F}: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{EB9EA036-9040-49E8-8D13-9D0854090602}: [DhcpNameServer] 10.5.133.45 10.5.136.242
FireFox:
========
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-17] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-17] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-07] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-07] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-06-07] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-04-01] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
Chrome:
=======
CHR Profile: C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-07-19]
CHR Extension: (Google Cast) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2015-06-07]
CHR Extension: (Adblock Super) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\knebimhcckndhiglamoabbnifdkijidd [2015-06-08]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-07]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2015-07-19]
CHR Extension: (Google Wallet) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-07]
CHR HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Hugh\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx [2015-06-07]
CHR HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2739888 2015-05-19] (Microsoft Corporation)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [101680 2015-01-22] (ELAN Microelectronics Corp.)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2015-01-22] (NVIDIA Corporation)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [18584 2014-10-10] (Intel Corporation)
R2 iBtSiva; C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe [122984 2015-01-22] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [345864 2015-03-19] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-28] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-28] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-17] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-17] (Intel Corporation)
R2 Micro Star SCM; C:\Program Files (x86)\SCM\MSIService.exe [160768 2014-11-07] (Micro-Star International Co., Ltd.) [File not signed]
R2 MSI_SuperCharger; C:\Program Files (x86)\MSI\SUPER CHARGER\ChargeService.exe [162800 2014-02-22] (MSI)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2014-05-30] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2015-01-22] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2015-01-22] (NVIDIA Corporation)
R2 Qualcomm Atheros Killer Service V2; C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe [360448 2014-08-19] (Qualcomm Atheros) [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1740760 2014-09-03] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3816176 2014-05-30] (Intel® Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R1 BfLwf; C:\Windows\system32\DRIVERS\bwcW8x64.sys [97968 2014-08-14] (Qualcomm Atheros, Inc.)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
S3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [141624 2014-05-14] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1424184 2014-06-18] (Motorola Solutions, Inc.)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [222664 2015-01-22] (Intel Corporation)
R3 Ke2200; C:\Windows\system32\DRIVERS\e22w8x64.sys [130224 2014-03-28] (Qualcomm Atheros, Inc.)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-17] (Intel Corporation)
R3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3446240 2014-06-19] (Intel Corporation)
R3 NTIOLib_1_0_3; C:\Program Files (x86)\MSI\SUPER CHARGER\NTIOLib_X64.sys [13368 2012-10-26] (MSI)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-01-22] (NVIDIA Corporation)
S3 NVSWCFilter; C:\Windows\System32\drivers\nvswcfilter.sys [19616 2015-01-22] (Windows (R) Win 7 DDK provider)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2015-01-22] (NVIDIA Corporation)
R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [466648 2015-01-22] (Realsil Semiconductor Corporation)
R1 SDHookDriver; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookDrv64.sys [64160 2014-04-25] ()
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
R3 WINIO; C:\Program Files (x86)\MSI\Dragon Gaming Center\winio64.sys [15160 2010-06-08] ()
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-20 11:07 - 2015-07-20 11:08 - 00045015 _____ C:\Users\Hugh\Downloads\Addition.txt
2015-07-20 11:06 - 2015-07-20 11:09 - 00000000 ____D C:\FRST
2015-07-20 11:06 - 2015-07-20 11:08 - 00045631 _____ C:\Users\Hugh\Downloads\FRST.txt
2015-07-20 11:06 - 2015-07-20 11:06 - 02134528 _____ (Farbar) C:\Users\Hugh\Downloads\FRST64.exe
2015-07-20 11:05 - 2015-07-20 11:05 - 00000017 _____ C:\Users\Hugh\AppData\Local\resmon.resmoncfg
2015-07-20 11:03 - 2015-07-20 11:03 - 00000207 _____ C:\Windows\tweaking.com-regbackup-HUGH_LAPTOP-Windows-8.1-(64-bit).dat
2015-07-20 11:02 - 2015-07-20 11:02 - 00000000 ____D C:\RegBackup
2015-07-20 11:01 - 2015-07-20 11:01 - 04720448 _____ C:\Users\Hugh\Downloads\tweaking.com_registry_backup_setup.exe
2015-07-20 11:01 - 2015-07-20 11:01 - 00002265 _____ C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2015-07-20 11:01 - 2015-07-20 11:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2015-07-20 11:01 - 2015-07-20 11:01 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2015-07-19 17:59 - 2015-07-19 17:59 - 00002186 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth.lnk
2015-07-19 17:58 - 2015-07-19 17:58 - 00931408 _____ (Google Inc.) C:\Users\Hugh\Downloads\GoogleEarthSetup.exe
2015-07-17 08:38 - 2015-07-17 08:38 - 00000000 ____D C:\Users\Hugh\Tracing
2015-07-16 22:32 - 2015-07-20 10:49 - 00000000 ____D C:\Users\Hugh\AppData\Roaming\Skype
2015-07-16 22:32 - 2015-07-20 08:26 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-07-16 22:32 - 2015-07-20 08:26 - 00000000 ____D C:\ProgramData\Skype
2015-07-16 22:32 - 2015-07-16 22:32 - 00002713 _____ C:\Users\Public\Desktop\Skype.lnk
2015-07-16 22:32 - 2015-07-16 22:32 - 00000000 ____D C:\Users\Hugh\AppData\Local\Skype
2015-07-16 22:32 - 2015-07-16 22:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-07-16 22:31 - 2015-05-12 10:24 - 00536920 _____ (Microsoft Corporation) C:\Windows\system32\mcupdate_GenuineIntel.dll
2015-07-16 22:31 - 2015-05-01 11:13 - 06521800 _____ (Microsoft Corporation) C:\Windows\system32\sppsvc.exe
2015-07-16 22:31 - 2015-05-01 11:13 - 01488000 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2015-07-16 22:31 - 2015-05-01 11:13 - 00261376 _____ (Microsoft Corporation) C:\Windows\system32\sppwinob.dll
2015-07-15 09:39 - 2015-07-10 05:51 - 00136904 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-07-15 09:39 - 2015-07-10 04:40 - 00359936 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-07-15 09:39 - 2015-07-10 02:03 - 03701760 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-07-15 09:39 - 2015-07-10 01:54 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-07-15 09:39 - 2015-07-10 01:53 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-07-15 09:39 - 2015-07-10 01:50 - 00409088 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2015-07-15 09:39 - 2015-07-10 01:50 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-07-15 09:39 - 2015-07-10 01:48 - 00891904 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-07-15 09:39 - 2015-07-10 01:46 - 02229248 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-07-15 09:39 - 2015-07-10 01:38 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-07-15 09:39 - 2015-07-10 01:37 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-07-15 09:39 - 2015-07-10 01:35 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-07-15 09:39 - 2015-07-10 01:34 - 00721920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-07-15 09:39 - 2015-06-27 13:08 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-07-15 09:39 - 2015-06-27 13:08 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-07-15 09:39 - 2015-06-27 12:14 - 00027136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-07-15 09:38 - 2015-07-03 23:52 - 00358912 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-07-15 09:38 - 2015-07-03 23:52 - 00044032 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-07-15 09:38 - 2015-07-03 23:50 - 00301056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-07-15 09:38 - 2015-07-03 23:50 - 00035840 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-07-15 09:38 - 2015-07-03 07:21 - 19877376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-07-15 09:38 - 2015-07-03 06:50 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-07-15 09:38 - 2015-07-03 06:49 - 25193984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-07-15 09:38 - 2015-07-03 06:23 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-07-15 09:38 - 2015-07-03 06:19 - 12855296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-07-15 09:38 - 2015-07-03 05:55 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-07-15 09:38 - 2015-07-03 05:20 - 14453248 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-07-15 09:38 - 2015-07-03 04:59 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-07-15 09:38 - 2015-07-02 08:08 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-07-15 09:38 - 2015-07-02 07:14 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-07-15 09:38 - 2015-06-30 08:43 - 00026288 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-07-15 09:38 - 2015-06-30 01:07 - 01145856 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 01084928 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 00764928 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 00433152 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-07-15 09:38 - 2015-06-28 15:07 - 00442712 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-07-15 09:38 - 2015-06-28 15:07 - 00178008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-07-15 09:38 - 2015-06-28 15:06 - 01311960 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-07-15 09:38 - 2015-06-28 15:06 - 00332120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-07-15 09:38 - 2015-06-28 02:42 - 00747520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-07-15 09:38 - 2015-06-27 13:13 - 00202240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-07-15 09:38 - 2015-06-27 13:12 - 00401408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-07-15 09:38 - 2015-06-27 13:12 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-07-15 09:38 - 2015-06-27 12:40 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-07-15 09:38 - 2015-06-27 12:05 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-07-15 09:38 - 2015-06-27 12:00 - 00989184 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-15 09:38 - 2015-06-27 11:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-07-15 09:38 - 2015-06-27 11:26 - 00802816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-07-15 09:38 - 2015-06-27 09:21 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-07-15 09:38 - 2015-06-27 09:21 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-07-15 09:38 - 2015-06-25 12:31 - 04177920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-07-15 09:38 - 2015-06-16 08:41 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-15 09:38 - 2015-06-16 08:24 - 03320320 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-15 09:38 - 2015-06-16 07:16 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-07-15 09:38 - 2015-06-16 07:09 - 03607552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-07-15 09:38 - 2015-06-16 06:50 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-07-15 09:38 - 2015-06-16 05:57 - 02460160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-07-15 09:38 - 2015-05-31 07:18 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll
2015-07-15 09:38 - 2015-05-31 05:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2015-07-15 09:38 - 2015-05-31 05:35 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-07-15 09:38 - 2015-05-12 04:17 - 01201664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys
2015-07-15 09:38 - 2015-05-08 03:50 - 22292672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-07-15 09:38 - 2015-05-08 03:00 - 03109376 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2015-07-15 09:38 - 2015-05-08 02:53 - 19734960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-07-15 09:38 - 2015-05-08 02:12 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2015-07-15 09:38 - 2015-05-08 01:21 - 00522240 _____ (Microsoft Corporation) C:\Windows\system32\GeofenceMonitorService.dll
2015-07-15 09:38 - 2015-05-08 01:05 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GeofenceMonitorService.dll
2015-07-15 09:38 - 2015-05-04 01:09 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-07-15 09:38 - 2015-05-04 00:58 - 00210944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-07-15 09:38 - 2015-05-04 00:55 - 00971776 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2015-07-15 09:38 - 2015-05-04 00:49 - 00811008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2015-07-15 09:38 - 2015-05-03 10:39 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-07-15 09:38 - 2015-04-30 09:22 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\WiFiDisplay.dll
2015-07-15 09:38 - 2015-04-25 12:25 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2015-07-15 09:37 - 2015-06-16 15:36 - 01661576 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-15 09:37 - 2015-06-16 15:36 - 01212248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-07-15 09:37 - 2015-06-16 08:39 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-07-15 09:37 - 2015-06-16 08:38 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-07-15 09:37 - 2015-06-16 08:26 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-07-15 09:37 - 2015-06-16 08:24 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-07-15 09:37 - 2015-06-16 08:02 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2015-07-15 09:37 - 2015-06-16 07:58 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-07-15 09:37 - 2015-06-16 07:57 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-07-15 09:37 - 2015-06-16 07:56 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-07-15 09:37 - 2015-06-16 07:55 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-07-15 09:37 - 2015-06-16 07:49 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-07-15 09:37 - 2015-06-16 07:41 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-07-15 09:37 - 2015-06-16 07:38 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-07-15 09:37 - 2015-06-16 07:36 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-07-15 09:37 - 2015-06-16 07:17 - 02880000 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-07-15 09:37 - 2015-06-16 07:16 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-07-15 09:37 - 2015-06-16 07:15 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-07-15 09:37 - 2015-06-16 07:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-07-15 09:37 - 2015-06-16 07:04 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-07-15 09:37 - 2015-06-16 07:03 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-07-15 09:37 - 2015-06-16 06:52 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-07-15 09:37 - 2015-06-16 06:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2015-07-15 09:37 - 2015-06-16 06:44 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-07-15 09:37 - 2015-06-16 06:43 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-07-15 09:37 - 2015-06-16 06:42 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-07-15 09:37 - 2015-06-16 06:41 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-07-15 09:37 - 2015-06-16 06:37 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-07-15 09:37 - 2015-06-16 06:32 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-07-15 09:37 - 2015-06-16 06:31 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-07-15 09:37 - 2015-06-16 06:30 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-07-15 09:37 - 2015-06-16 06:30 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-07-15 09:37 - 2015-06-16 06:17 - 01048576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2015-07-15 09:37 - 2015-06-16 06:07 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-07-15 09:37 - 2015-06-16 06:02 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-07-15 09:37 - 2015-06-11 13:49 - 01380600 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-15 09:37 - 2015-06-11 02:13 - 01097216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-07-15 09:37 - 2015-05-12 23:19 - 00294912 _____ (Microsoft Corporation) C:\Windows\system32\SystemEventsBrokerServer.dll
2015-07-15 09:37 - 2015-05-12 02:34 - 00332800 _____ (Microsoft Corporation) C:\Windows\system32\fhcpl.dll
2015-07-15 09:37 - 2015-05-08 02:47 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-07-15 09:37 - 2015-05-04 01:07 - 07784448 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Data.Pdf.dll
2015-07-15 09:37 - 2015-05-04 00:57 - 05264384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Data.Pdf.dll
2015-07-15 09:37 - 2015-05-02 09:33 - 00410739 _____ C:\Windows\system32\ApnDatabase.xml
2015-07-15 09:37 - 2015-04-28 23:13 - 00513480 _____ C:\Windows\SysWOW64\locale.nls
2015-07-15 09:37 - 2015-04-28 23:13 - 00513480 _____ C:\Windows\system32\locale.nls
2015-07-15 09:37 - 2015-04-24 01:47 - 03084288 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2015-07-15 09:37 - 2015-04-24 01:16 - 02471424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2015-07-14 20:59 - 2015-07-20 08:35 - 00000000 ____D C:\Users\Hugh\AppData\Local\CrashDumps
2015-07-14 08:58 - 2013-08-22 23:25 - 00000824 _____ C:\Windows\system32\Drivers\etc\hosts.20150714-085812.backup
2015-07-14 08:14 - 2015-07-14 08:14 - 00000000 ____D C:\Users\Default\AppData\Local\Google
2015-07-14 08:14 - 2015-07-14 08:14 - 00000000 ____D C:\Users\Default User\AppData\Local\Google
2015-07-13 21:40 - 2015-07-13 21:40 - 00558328 _____ (Safer-Networking Ltd. ) C:\Users\Hugh\Downloads\spybot2-license.exe
2015-07-13 20:39 - 2015-07-14 08:57 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2015-07-13 20:39 - 2015-07-14 08:11 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-07-13 20:39 - 2015-07-13 20:39 - 00001417 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-07-13 20:39 - 2015-07-13 20:39 - 00001405 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-07-13 20:39 - 2015-07-13 20:39 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2015-07-13 20:39 - 2015-07-13 20:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-07-13 20:39 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-07-13 20:27 - 2015-07-13 20:31 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Hugh\Downloads\spybot-2.4.exe
2015-07-13 15:02 - 2015-07-13 15:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-07-13 15:01 - 2015-07-13 15:01 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Hugh\Downloads\mbam-setup-2.1.8.1057.exe
2015-07-09 09:27 - 2015-07-09 09:27 - 00000000 ____D C:\Users\Public\Downloads\Norton
2015-07-07 20:14 - 2015-07-07 20:14 - 00000500 _____ C:\Users\Hugh\Desktop\asx options.csv
2015-07-07 15:01 - 2015-07-07 15:01 - 1092367527 _____ C:\Windows\MEMORY.DMP
2015-07-07 15:01 - 2015-07-07 15:01 - 01270288 _____ C:\Windows\Minidump\070715-12031-01.dmp
2015-07-07 15:01 - 2015-07-07 15:01 - 00000000 ____D C:\Windows\Minidump
2015-07-07 13:10 - 2015-07-07 13:10 - 03121152 _____ C:\Users\Hugh\Downloads\TWS API Install 972.03.msi
2015-07-06 08:24 - 2015-07-13 08:36 - 00009728 ___SH C:\Users\Hugh\Desktop\Thumbs.db
2015-06-28 13:34 - 2015-06-28 13:34 - 00000000 ____D C:\ProgramData\Samsung
2015-06-26 18:41 - 2015-06-26 18:41 - 00001086 _____ C:\Users\Hugh\Desktop\AmiBroker.lnk
2015-06-26 18:41 - 2015-06-26 18:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AmiBroker
2015-06-26 18:40 - 2015-07-17 17:40 - 00000000 ____D C:\Program Files (x86)\AmiBroker
2015-06-26 11:28 - 2015-06-26 11:28 - 00000000 ____D C:\Users\Hugh\AppData\Local\Microsoft Help
2015-06-26 11:23 - 2015-06-26 11:23 - 01104014 _____ () C:\Users\Hugh\Downloads\CodeCleaner.exe
2015-06-26 11:23 - 2015-06-26 11:23 - 00000000 ____D C:\Program Files (x86)\AppsPro
2015-06-26 11:23 - 2000-12-06 03:00 - 00209608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TABCTL32.OCX
2015-06-26 10:17 - 2015-06-26 10:56 - 00000931 _____ C:\Users\Hugh\Desktop\AmiBroker x64.lnk
2015-06-26 10:17 - 2015-06-26 10:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AmiBroker x64
2015-06-25 14:07 - 2015-06-25 14:07 - 00000000 ____D C:\Users\Hugh\AppData\Local\WinZip
2015-06-24 15:53 - 2015-06-24 15:53 - 01271296 _____ C:\Users\Hugh\Downloads\Span Margin Calculation.ppt
2015-06-23 16:57 - 2015-06-23 16:57 - 00140678 _____ C:\Users\Hugh\Downloads\Polaris_Trades (3).csv
2015-06-23 16:46 - 2015-06-23 16:46 - 00130743 _____ C:\Users\Hugh\Downloads\Polaris_Trades (2).csv
2015-06-23 16:28 - 2015-06-23 16:28 - 00129602 _____ C:\Users\Hugh\Downloads\Polaris_Trades (1).csv
2015-06-22 05:24 - 2015-06-22 05:24 - 00226424 _____ C:\Windows\system32\SBuySupplies.exe
2015-06-22 05:24 - 2015-06-22 05:24 - 00158016 _____ C:\Windows\system32\us005ci.exe
2015-06-22 05:24 - 2015-06-22 05:24 - 00089600 _____ (SS) C:\Windows\system32\us005ci.dll
2015-06-22 05:24 - 2015-06-22 05:24 - 00022528 _____ () C:\Windows\system32\us005lm.dll
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-20 11:09 - 2015-06-07 19:14 - 00004980 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for HUGH_LAPTOP-Hugh Hugh_Laptop
2015-07-20 11:07 - 2015-06-07 17:09 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2823309964-2513555705-3651140861-1001
2015-07-20 10:46 - 2015-06-07 17:45 - 00000930 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-07-20 10:09 - 2015-06-07 19:30 - 00000000 ____D C:\Jts
2015-07-20 09:35 - 2014-03-18 20:03 - 00865408 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-20 08:46 - 2015-06-07 17:45 - 00000926 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-07-20 08:36 - 2013-08-23 00:46 - 00055312 _____ C:\Windows\setupact.log
2015-07-20 08:27 - 2015-06-07 19:22 - 00000000 ___RD C:\Users\Hugh\Google Drive
2015-07-20 08:27 - 2015-06-07 17:44 - 00003934 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{3D2F1FB9-A0C3-47F9-8104-40390AB06AAF}
2015-07-20 08:25 - 2015-06-07 17:09 - 00000000 ___RD C:\Users\Hugh\OneDrive
2015-07-19 18:05 - 2015-06-07 15:51 - 01960760 _____ C:\Windows\WindowsUpdate.log
2015-07-19 17:58 - 2015-06-07 17:45 - 00000000 ____D C:\Program Files (x86)\Google
2015-07-19 17:45 - 2013-08-23 01:36 - 00000000 ____D C:\Windows\AppReadiness
2015-07-19 17:45 - 2013-08-23 00:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-17 08:38 - 2015-06-07 17:02 - 00000000 ____D C:\Users\Hugh
2015-07-17 08:13 - 2013-08-22 23:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2015-07-17 08:12 - 2014-03-18 19:54 - 00581980 _____ C:\Windows\PFRO.log
2015-07-16 22:31 - 2013-08-23 01:20 - 00000000 ____D C:\Windows\CbsTemp
2015-07-16 08:41 - 2015-06-07 17:45 - 00003902 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-07-16 08:41 - 2015-06-07 17:45 - 00003666 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-07-16 08:29 - 2013-08-23 00:44 - 00481880 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-16 08:28 - 2013-08-23 01:36 - 00000000 ___RD C:\Windows\ToastData
2015-07-16 08:28 - 2013-08-23 01:36 - 00000000 ____D C:\Windows\WinStore
2015-07-15 09:43 - 2015-06-12 15:39 - 00000000 ____D C:\Windows\system32\appraiser
2015-07-15 09:43 - 2015-06-08 17:08 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-07-15 09:42 - 2015-06-08 16:59 - 00000000 ____D C:\Windows\system32\MRT
2015-07-15 09:39 - 2015-06-07 17:46 - 00002213 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-07-15 08:31 - 2014-11-05 10:48 - 00000000 ____D C:\ProgramData\Norton
2015-07-14 09:12 - 2015-06-08 17:08 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-07-14 09:12 - 2015-06-08 17:08 - 00000000 ___SD C:\Windows\system32\GWX
2015-07-14 08:14 - 2015-06-07 19:20 - 00002068 _____ C:\Users\Public\Desktop\Google Slides.lnk
2015-07-14 08:14 - 2015-06-07 19:20 - 00002066 _____ C:\Users\Public\Desktop\Google Sheets.lnk
2015-07-14 08:14 - 2015-06-07 19:20 - 00002056 _____ C:\Users\Public\Desktop\Google Docs.lnk
2015-07-14 08:14 - 2015-06-07 19:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-07-14 08:07 - 2014-11-05 10:49 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-07-14 08:05 - 2013-08-23 01:36 - 00000000 ___HD C:\Windows\ELAMBKUP
2015-07-14 08:05 - 2013-08-22 23:25 - 00262144 ___SH C:\Windows\system32\config\ELAM
2015-07-14 07:10 - 2015-06-08 17:17 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-14 07:10 - 2015-06-08 17:17 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-09 08:44 - 2013-08-23 01:36 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-07-07 13:16 - 2015-06-07 19:31 - 00000000 ____D C:\TWS API
2015-07-03 13:21 - 2015-06-07 17:03 - 00000000 ____D C:\Users\Hugh\AppData\Local\Packages
2015-07-03 08:43 - 2015-06-08 16:59 - 130333168 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-26 18:29 - 2015-06-07 19:09 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-06-25 14:07 - 2015-01-23 16:05 - 00000000 ____D C:\ProgramData\WinZip
2015-06-25 08:17 - 2013-08-23 01:36 - 00000000 ____D C:\Windows\LiveKernelReports
2015-06-24 13:20 - 2013-08-23 01:36 - 00000000 ____D C:\Windows\system32\sru
==================== Files in the root of some directories =======
2015-07-20 11:05 - 2015-07-20 11:05 - 0000017 _____ () C:\Users\Hugh\AppData\Local\resmon.resmoncfg
2015-01-23 15:12 - 2015-01-23 15:12 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-07-15 08:42
==================== End of log ============================
aswMBR version 1.0.1.2252 Copyright(c) 2014 AVAST Software
Run date: 2015-07-20 11:15:09
-----------------------------
11:15:09.385 OS Version: Windows x64 6.2.9200
11:15:09.385 Number of processors: 8 586 0x3C03
11:15:09.400 ComputerName: HUGH_LAPTOP UserName: Hugh
11:15:11.021 Initialize success
11:15:11.036 VM: initialized successfully
11:15:11.036 VM: Intel CPU supported
11:15:28.239 VM: disk I/O iaStorA.sys
11:28:58.312 AVAST engine defs: 15071902
11:31:08.712 Disk 0 \Device\Harddisk0\DR0 -> \Device\0000003b
11:31:08.712 Disk 0 Vendor: HGST_HTS721010A9E630 JB0OA3J0 Size: 953869MB BusType: 11
11:31:08.727 Disk 1 (boot) \Device\Harddisk1\DR1 -> \Device\0000003c
11:31:08.727 Disk 1 Vendor: ADATA_SP310 5.2 Size: 122104MB BusType: 11
11:31:08.743 Disk 1 MBR read successfully
11:31:08.743 Disk 1 MBR scan
11:31:08.759 Disk 1 unknown MBR code
11:31:08.759 Disk 1 Partition 1 00 EE GPT 2097151 MB offset 1
11:31:08.790 Disk 1 scanning C:\Windows\system32\drivers
11:31:13.893 Service scanning
11:31:28.405 Modules scanning
11:31:28.429 Disk 1 trace - called modules:
11:31:28.444 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll iaStorA.sys
11:31:28.452 1 nt!IofCallDriver -> \Device\Harddisk1\DR1[0xffffe0004d91f770]
11:31:28.456 3 CLASSPNP.SYS[fffff80169602170] -> nt!IofCallDriver -> [0xffffe0004b19ea50]
11:31:28.461 5 ACPI.sys[fffff8016917ac21] -> nt!IofCallDriver -> \Device\0000003c[0xffffe0004b19c060]
11:31:29.854 AVAST engine scan C:\Windows
11:31:31.595 AVAST engine scan C:\Windows\system32
11:33:17.684 AVAST engine scan C:\Windows\system32\drivers
11:33:26.863 AVAST engine scan C:\Users\Hugh
11:37:53.426 AVAST engine scan C:\ProgramData
11:38:03.615 Disk 1 statistics 3842835/0/0 @ 692.90 MB/s
11:38:03.620 Scan finished successfully
11:41:25.538 Disk 1 MBR has been saved successfully to "D:\FARBAR\MBR.dat"
11:41:25.554 The log file has been saved successfully to "D:\FARBAR\aswMBR.txt"
:snwelcome:
Just reply to this topic only by pressing Submit Reply and please dont start any new topics
Lets run these programs as you have some things to remove, I am posting the entire instructions for Malwarebytes, just bypass the download part and follow all the instructions to set it up and run the scan
-AdwCleaner-by Xplode
Click on this link to download : ADWCleaner (http://www.bleepingcomputer.com/download/adwcleaner/) TO YOUR DESKTOP
Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.
Use my link only, do not do a search for AdwCleaner as there is a bogus copy going around by scammers
Do not click on any links in the top Advertisment.
http://i24.photobucket.com/albums/c30/ken545/AdwCleaner4.201_zpsxrbk2llq.jpg (http://s24.photobucket.com/user/ken545/media/AdwCleaner4.201_zpsxrbk2llq.jpg.html)
Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Scan.
After the scan is complete click on "Clean"
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next reply.
You can find the logfile at C:\AdwCleaner[S1].txt as well.
===============================================================================
http://imageshack.us/a/img841/7292/thisisujrt.gif Please download Junkware Removal Tool (http://thisisudax.org/downloads/JRT.exe) TO YOUR DESKTOP
Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.
===============================================================================
Download Malwarebytes' Anti-Malware (http://www.malwarebytes.org/mbam-download.php) TO YOUR DESKTOP
Windows XP : Double click on the icon to run it.
Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
http://i24.photobucket.com/albums/c30/ken545/MBAM_zpsr1ew7hep.png (http://s24.photobucket.com/user/ken545/media/MBAM_zpsr1ew7hep.png.html)
On the Dashboard click on Update Now
Go to the Setting Tab
Under Setting go to Detection and Protection
Under PUP and PUM make sure both are set to show Treat Detections as Malware
Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
Then on the Dashboard click on Scan
Make sure to select THREAT SCAN
Then click on Scan
When the scan is finished and the log pops up...select Copy to Clipboard
Please paste the log back into this thread for review
Exit Malwarebytes
:snwelcome:
Just reply to this topic only by pressing Submit Reply and please dont start any new topics
Lets run these programs as you have some things to remove, I am posting the entire instructions for Malwarebytes, just bypass the download part and follow all the instructions to set it up and run the scan
-AdwCleaner-by Xplode
Click on this link to download : ADWCleaner (http://www.bleepingcomputer.com/download/adwcleaner/) TO YOUR DESKTOP
Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.
Use my link only, do not do a search for AdwCleaner as there is a bogus copy going around by scammers
Do not click on any links in the top Advertisment.
http://i24.photobucket.com/albums/c30/ken545/AdwCleaner4.201_zpsxrbk2llq.jpg (http://s24.photobucket.com/user/ken545/media/AdwCleaner4.201_zpsxrbk2llq.jpg.html)
Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Scan.
After the scan is complete click on "Clean"
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next reply.
You can find the logfile at C:\AdwCleaner[S1].txt as well.
===============================================================================
http://imageshack.us/a/img841/7292/thisisujrt.gif Please download Junkware Removal Tool (http://thisisudax.org/downloads/JRT.exe) TO YOUR DESKTOP
Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.
===============================================================================
Download Malwarebytes' Anti-Malware (http://www.malwarebytes.org/mbam-download.php) TO YOUR DESKTOP
Windows XP : Double click on the icon to run it.
Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
http://i24.photobucket.com/albums/c30/ken545/MBAM_zpsr1ew7hep.png (http://s24.photobucket.com/user/ken545/media/MBAM_zpsr1ew7hep.png.html)
On the Dashboard click on Update Now
Go to the Setting Tab
Under Setting go to Detection and Protection
Under PUP and PUM make sure both are set to show Treat Detections as Malware
Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
Then on the Dashboard click on Scan
Make sure to select THREAT SCAN
Then click on Scan
When the scan is finished and the log pops up...select Copy to Clipboard
Please paste the log back into this thread for review
Exit Malwarebytes
Thanks for the help. I have run the scans, the logs are attached. zeus.
Hey
No need to quote what I post, just taking up more space on the server, whatever I post is not deleted so you can always go back and look at it
Not much removed
Your running FRST64 from D:\FARBAR, our tools and scanners work more efficiently when run from the Desktop in lieu of being buried in some folder, so go to D:\FARBAR and look for FRST64, right click on it and select CUT, then come back to your Desktop and right click on a blank space and select PASTE, then we will have FRST64 exactly where we want it to be.
Then open up FRST, be sure to put a checkmark in Additions, run a new scan and post both logs please. In lieu of attaching them I prefer if you can just to copy and paste them in
Thanks for the feedback, I've run the app from the desktop and here are the logs:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:20-07-2015
Ran by Hugh (administrator) on HUGH_LAPTOP on 25-07-2015 08:57:27
Running from C:\Users\Hugh\Desktop
Loaded Profiles: Hugh (Available Profiles: Hugh)
Platform: Windows 8.1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\SCM\MSIService.exe
(MSI) C:\Program Files (x86)\MSI\SUPER CHARGER\ChargeService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Qualcomm Atheros) C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.1\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.1\GoogleCrashHandler64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\MSI\Dragon Gaming Center\Dragon Gaming Center.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(MSI) C:\Program Files (x86)\SCM\SCM.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\MSI\KLM\KLM.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(MSI) C:\Program Files (x86)\MSI\SUPER CHARGER\SUPER CHARGER.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Telstra) C:\Program Files (x86)\Telstra\Mobile Broadband Manager\TelstraUCM.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8446832 2015-01-22] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2015-01-22] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [322712 2014-10-10] (Intel Corporation)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [3281160 2015-01-22] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [SCM] => C:\Program Files (x86)\SCM\SCM.exe [405504 2014-11-07] (MSI)
HKLM-x32\...\Run: [KLM] => C:\Program Files (x86)\MSI\KLM\KLM.exe [1569416 2014-11-12] (Micro-Star International Co., Ltd.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-09] (CyberLink Corp.)
HKLM-x32\...\Run: [SUPER CHARGER] => C:\Program Files (x86)\MSI\SUPER CHARGER\SUPER CHARGER.exe [1047536 2014-02-22] (MSI)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM-x32\...\Run: [BigPondWirelessBroadbandCM] => C:\Program Files (x86)\Telstra\Mobile Broadband Manager\TelstraUCM.exe [4352408 2010-05-14] (Telstra)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22012688 2015-06-20] (Google)
HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53288576 2015-06-29] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Killer Network Manager.lnk [2015-01-23]
ShortcutTarget: Killer Network Manager.lnk -> C:\Windows\Installer\{5B62C353-75A3-463F-A52E-CC005846F3CE}\NetworkManager.exe_130C27D738F34C89BDDF21BCFD74B56D.exe (Flexera Software LLC)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://msi13.msn.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-06-09] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-06-17] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-06-07] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-07] (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-06-08] (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{6CA879F1-BA5A-40DB-96D7-FBC3D00CB47F}: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{EB9EA036-9040-49E8-8D13-9D0854090602}: [DhcpNameServer] 10.5.133.45 10.5.136.242
FireFox:
========
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-17] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-17] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-07] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-07] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-06-07] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-04-01] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
Chrome:
=======
CHR Profile: C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-07-19]
CHR Extension: (Google Cast) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2015-06-07]
CHR Extension: (Adblock Super) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\knebimhcckndhiglamoabbnifdkijidd [2015-06-08]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-07]
CHR Extension: (No Name) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2015-07-23]
CHR Extension: (Google Wallet) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-07]
CHR HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Hugh\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx [2015-06-07]
CHR HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2753720 2015-07-01] (Microsoft Corporation)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [101680 2015-01-22] (ELAN Microelectronics Corp.)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2015-01-22] (NVIDIA Corporation)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [18584 2014-10-10] (Intel Corporation)
R2 iBtSiva; C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe [122984 2015-01-22] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [345864 2015-03-19] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-28] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-28] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-17] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-17] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 Micro Star SCM; C:\Program Files (x86)\SCM\MSIService.exe [160768 2014-11-07] (Micro-Star International Co., Ltd.) [File not signed]
R2 MSI_SuperCharger; C:\Program Files (x86)\MSI\SUPER CHARGER\ChargeService.exe [162800 2014-02-22] (MSI)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2014-05-30] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2015-01-22] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2015-01-22] (NVIDIA Corporation)
R2 Qualcomm Atheros Killer Service V2; C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe [360448 2014-08-19] (Qualcomm Atheros) [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1740760 2014-09-03] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3816176 2014-05-30] (Intel® Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R1 BfLwf; C:\Windows\system32\DRIVERS\bwcW8x64.sys [97968 2014-08-14] (Qualcomm Atheros, Inc.)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
S3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [141624 2014-05-14] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1424184 2014-06-18] (Motorola Solutions, Inc.)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [222664 2015-01-22] (Intel Corporation)
R3 Ke2200; C:\Windows\system32\DRIVERS\e22w8x64.sys [130224 2014-03-28] (Qualcomm Atheros, Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-07-25] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-17] (Intel Corporation)
R3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3446240 2014-06-19] (Intel Corporation)
R3 NTIOLib_1_0_3; C:\Program Files (x86)\MSI\SUPER CHARGER\NTIOLib_X64.sys [13368 2012-10-26] (MSI)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-01-22] (NVIDIA Corporation)
S3 NVSWCFilter; C:\Windows\System32\drivers\nvswcfilter.sys [19616 2015-01-22] (Windows (R) Win 7 DDK provider)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2015-01-22] (NVIDIA Corporation)
R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [466648 2015-01-22] (Realsil Semiconductor Corporation)
R1 SDHookDriver; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookDrv64.sys [64160 2014-04-25] ()
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
R3 WINIO; C:\Program Files (x86)\MSI\Dragon Gaming Center\winio64.sys [15160 2010-06-08] ()
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-25 08:57 - 2015-07-25 08:57 - 00018868 _____ C:\Users\Hugh\Desktop\FRST.txt
2015-07-25 08:57 - 2015-07-25 08:57 - 00000000 ____D C:\Users\Hugh\Desktop\FRST-OlderVersion
2015-07-24 20:34 - 2015-07-24 20:34 - 00033263 _____ C:\Users\Hugh\Downloads\table (1).csv
2015-07-24 18:10 - 2015-07-24 18:11 - 00029538 _____ C:\Users\Hugh\Downloads\table.csv
2015-07-23 20:33 - 2015-07-23 20:33 - 00001055 _____ C:\Users\Hugh\Desktop\JRT.txt
2015-07-22 17:30 - 2015-07-25 08:47 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-22 17:30 - 2015-07-22 17:30 - 00001128 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-07-22 17:30 - 2015-07-22 17:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-07-22 17:30 - 2015-07-22 17:30 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-07-22 17:30 - 2015-06-18 08:42 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-07-22 17:30 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-07-22 17:30 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-07-22 17:18 - 2015-07-23 18:17 - 00000000 ____D C:\AdwCleaner
2015-07-22 17:17 - 2015-07-22 17:17 - 02248704 _____ C:\Users\Hugh\Downloads\AdwCleaner.exe
2015-07-22 17:16 - 2015-07-22 17:16 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Hugh\Downloads\mbam-setup-2.1.8.1057 (2).exe
2015-07-22 17:15 - 2015-07-22 17:16 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Hugh\Downloads\mbam-setup-2.1.8.1057 (1).exe
2015-07-22 17:14 - 2015-07-22 17:15 - 01798288 _____ (Malwarebytes Corporation) C:\Users\Hugh\Downloads\JRT.exe
2015-07-21 10:47 - 2015-07-15 00:14 - 00358912 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-07-21 10:47 - 2015-07-15 00:14 - 00301056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-07-21 10:47 - 2015-07-15 00:14 - 00035840 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-07-21 10:47 - 2015-07-15 00:13 - 00044032 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-07-20 11:13 - 2015-07-20 11:14 - 05198336 _____ (AVAST Software) C:\Users\Hugh\Desktop\aswMBR.exe
2015-07-20 11:09 - 2015-07-25 08:57 - 02135552 _____ (Farbar) C:\Users\Hugh\Desktop\FRST64.exe
2015-07-20 11:07 - 2015-07-20 11:08 - 00045015 _____ C:\Users\Hugh\Downloads\Addition.txt
2015-07-20 11:06 - 2015-07-25 08:57 - 00000000 ____D C:\FRST
2015-07-20 11:06 - 2015-07-20 11:08 - 00045631 _____ C:\Users\Hugh\Downloads\FRST.txt
2015-07-20 11:06 - 2015-07-20 11:06 - 02134528 _____ (Farbar) C:\Users\Hugh\Downloads\FRST64.exe
2015-07-20 11:05 - 2015-07-20 11:05 - 00000017 _____ C:\Users\Hugh\AppData\Local\resmon.resmoncfg
2015-07-20 11:03 - 2015-07-20 11:03 - 00000207 _____ C:\Windows\tweaking.com-regbackup-HUGH_LAPTOP-Windows-8.1-(64-bit).dat
2015-07-20 11:02 - 2015-07-20 11:02 - 00000000 ____D C:\RegBackup
2015-07-20 11:01 - 2015-07-20 11:01 - 04720448 _____ C:\Users\Hugh\Downloads\tweaking.com_registry_backup_setup.exe
2015-07-20 11:01 - 2015-07-20 11:01 - 00002265 _____ C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2015-07-20 11:01 - 2015-07-20 11:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2015-07-20 11:01 - 2015-07-20 11:01 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2015-07-19 17:59 - 2015-07-19 17:59 - 00002186 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth.lnk
2015-07-19 17:58 - 2015-07-19 17:58 - 00931408 _____ (Google Inc.) C:\Users\Hugh\Downloads\GoogleEarthSetup.exe
2015-07-17 08:38 - 2015-07-17 08:38 - 00000000 ____D C:\Users\Hugh\Tracing
2015-07-16 22:32 - 2015-07-25 08:49 - 00000000 ____D C:\Users\Hugh\AppData\Roaming\Skype
2015-07-16 22:32 - 2015-07-20 08:26 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-07-16 22:32 - 2015-07-20 08:26 - 00000000 ____D C:\ProgramData\Skype
2015-07-16 22:32 - 2015-07-16 22:32 - 00002713 _____ C:\Users\Public\Desktop\Skype.lnk
2015-07-16 22:32 - 2015-07-16 22:32 - 00000000 ____D C:\Users\Hugh\AppData\Local\Skype
2015-07-16 22:32 - 2015-07-16 22:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-07-16 22:31 - 2015-05-12 10:24 - 00536920 _____ (Microsoft Corporation) C:\Windows\system32\mcupdate_GenuineIntel.dll
2015-07-16 22:31 - 2015-05-01 11:13 - 06521800 _____ (Microsoft Corporation) C:\Windows\system32\sppsvc.exe
2015-07-16 22:31 - 2015-05-01 11:13 - 01488000 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2015-07-16 22:31 - 2015-05-01 11:13 - 00261376 _____ (Microsoft Corporation) C:\Windows\system32\sppwinob.dll
2015-07-15 09:39 - 2015-07-10 05:51 - 00136904 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-07-15 09:39 - 2015-07-10 04:40 - 00359936 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-07-15 09:39 - 2015-07-10 02:03 - 03701760 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-07-15 09:39 - 2015-07-10 01:54 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-07-15 09:39 - 2015-07-10 01:53 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-07-15 09:39 - 2015-07-10 01:50 - 00409088 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2015-07-15 09:39 - 2015-07-10 01:50 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-07-15 09:39 - 2015-07-10 01:48 - 00891904 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-07-15 09:39 - 2015-07-10 01:46 - 02229248 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-07-15 09:39 - 2015-07-10 01:38 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-07-15 09:39 - 2015-07-10 01:37 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-07-15 09:39 - 2015-07-10 01:35 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-07-15 09:39 - 2015-07-10 01:34 - 00721920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-07-15 09:39 - 2015-06-27 13:08 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-07-15 09:39 - 2015-06-27 13:08 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-07-15 09:39 - 2015-06-27 12:14 - 00027136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-07-15 09:38 - 2015-07-03 07:21 - 19877376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-07-15 09:38 - 2015-07-03 06:50 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-07-15 09:38 - 2015-07-03 06:49 - 25193984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-07-15 09:38 - 2015-07-03 06:23 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-07-15 09:38 - 2015-07-03 06:19 - 12855296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-07-15 09:38 - 2015-07-03 05:55 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-07-15 09:38 - 2015-07-03 05:20 - 14453248 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-07-15 09:38 - 2015-07-03 04:59 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-07-15 09:38 - 2015-07-02 08:08 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-07-15 09:38 - 2015-07-02 07:14 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-07-15 09:38 - 2015-06-30 08:43 - 00026288 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-07-15 09:38 - 2015-06-30 01:07 - 01145856 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 01084928 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 00764928 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 00433152 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-07-15 09:38 - 2015-06-28 15:07 - 00442712 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-07-15 09:38 - 2015-06-28 15:07 - 00178008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-07-15 09:38 - 2015-06-28 15:06 - 01311960 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-07-15 09:38 - 2015-06-28 15:06 - 00332120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-07-15 09:38 - 2015-06-28 02:42 - 00747520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-07-15 09:38 - 2015-06-27 13:13 - 00202240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-07-15 09:38 - 2015-06-27 13:12 - 00401408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-07-15 09:38 - 2015-06-27 13:12 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-07-15 09:38 - 2015-06-27 12:40 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-07-15 09:38 - 2015-06-27 12:05 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-07-15 09:38 - 2015-06-27 12:00 - 00989184 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-15 09:38 - 2015-06-27 11:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-07-15 09:38 - 2015-06-27 11:26 - 00802816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-07-15 09:38 - 2015-06-27 09:21 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-07-15 09:38 - 2015-06-27 09:21 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-07-15 09:38 - 2015-06-25 12:31 - 04177920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-07-15 09:38 - 2015-06-16 08:41 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-15 09:38 - 2015-06-16 08:24 - 03320320 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-15 09:38 - 2015-06-16 07:16 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-07-15 09:38 - 2015-06-16 07:09 - 03607552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-07-15 09:38 - 2015-06-16 06:50 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-07-15 09:38 - 2015-06-16 05:57 - 02460160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-07-15 09:38 - 2015-05-31 07:18 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll
2015-07-15 09:38 - 2015-05-31 05:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2015-07-15 09:38 - 2015-05-31 05:35 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-07-15 09:38 - 2015-05-12 04:17 - 01201664 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys
2015-07-15 09:38 - 2015-05-08 03:50 - 22292672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-07-15 09:38 - 2015-05-08 03:00 - 03109376 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2015-07-15 09:38 - 2015-05-08 02:53 - 19734960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-07-15 09:38 - 2015-05-08 02:12 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2015-07-15 09:38 - 2015-05-08 01:21 - 00522240 _____ (Microsoft Corporation) C:\Windows\system32\GeofenceMonitorService.dll
2015-07-15 09:38 - 2015-05-08 01:05 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GeofenceMonitorService.dll
2015-07-15 09:38 - 2015-05-04 01:09 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-07-15 09:38 - 2015-05-04 00:58 - 00210944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-07-15 09:38 - 2015-05-04 00:55 - 00971776 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2015-07-15 09:38 - 2015-05-04 00:49 - 00811008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2015-07-15 09:38 - 2015-05-03 10:39 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-07-15 09:38 - 2015-04-30 09:22 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\WiFiDisplay.dll
2015-07-15 09:38 - 2015-04-25 12:25 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2015-07-15 09:37 - 2015-06-16 15:36 - 01661576 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-15 09:37 - 2015-06-16 15:36 - 01212248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-07-15 09:37 - 2015-06-16 08:39 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-07-15 09:37 - 2015-06-16 08:38 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-07-15 09:37 - 2015-06-16 08:26 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-07-15 09:37 - 2015-06-16 08:24 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-07-15 09:37 - 2015-06-16 08:02 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2015-07-15 09:37 - 2015-06-16 07:58 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-07-15 09:37 - 2015-06-16 07:57 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-07-15 09:37 - 2015-06-16 07:56 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-07-15 09:37 - 2015-06-16 07:55 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-07-15 09:37 - 2015-06-16 07:49 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-07-15 09:37 - 2015-06-16 07:41 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-07-15 09:37 - 2015-06-16 07:38 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-07-15 09:37 - 2015-06-16 07:36 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-07-15 09:37 - 2015-06-16 07:17 - 02880000 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-07-15 09:37 - 2015-06-16 07:16 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-07-15 09:37 - 2015-06-16 07:15 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-07-15 09:37 - 2015-06-16 07:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-07-15 09:37 - 2015-06-16 07:04 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-07-15 09:37 - 2015-06-16 07:03 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-07-15 09:37 - 2015-06-16 06:52 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-07-15 09:37 - 2015-06-16 06:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2015-07-15 09:37 - 2015-06-16 06:44 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-07-15 09:37 - 2015-06-16 06:43 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-07-15 09:37 - 2015-06-16 06:42 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-07-15 09:37 - 2015-06-16 06:41 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-07-15 09:37 - 2015-06-16 06:37 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-07-15 09:37 - 2015-06-16 06:32 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-07-15 09:37 - 2015-06-16 06:31 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-07-15 09:37 - 2015-06-16 06:30 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-07-15 09:37 - 2015-06-16 06:30 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-07-15 09:37 - 2015-06-16 06:17 - 01048576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2015-07-15 09:37 - 2015-06-16 06:07 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-07-15 09:37 - 2015-06-16 06:02 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-07-15 09:37 - 2015-06-11 13:49 - 01380600 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-15 09:37 - 2015-06-11 02:13 - 01097216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-07-15 09:37 - 2015-05-12 23:19 - 00294912 _____ (Microsoft Corporation) C:\Windows\system32\SystemEventsBrokerServer.dll
2015-07-15 09:37 - 2015-05-12 02:34 - 00332800 _____ (Microsoft Corporation) C:\Windows\system32\fhcpl.dll
2015-07-15 09:37 - 2015-05-08 02:47 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-07-15 09:37 - 2015-05-04 01:07 - 07784448 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Data.Pdf.dll
2015-07-15 09:37 - 2015-05-04 00:57 - 05264384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Data.Pdf.dll
2015-07-15 09:37 - 2015-05-02 09:33 - 00410739 _____ C:\Windows\system32\ApnDatabase.xml
2015-07-15 09:37 - 2015-04-28 23:13 - 00513480 _____ C:\Windows\SysWOW64\locale.nls
2015-07-15 09:37 - 2015-04-28 23:13 - 00513480 _____ C:\Windows\system32\locale.nls
2015-07-15 09:37 - 2015-04-24 01:47 - 03084288 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2015-07-15 09:37 - 2015-04-24 01:16 - 02471424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2015-07-14 20:59 - 2015-07-23 20:55 - 00000000 ____D C:\Users\Hugh\AppData\Local\CrashDumps
2015-07-14 08:58 - 2013-08-22 23:25 - 00000824 _____ C:\Windows\system32\Drivers\etc\hosts.20150714-085812.backup
2015-07-14 08:14 - 2015-07-14 08:14 - 00000000 ____D C:\Users\Default\AppData\Local\Google
2015-07-14 08:14 - 2015-07-14 08:14 - 00000000 ____D C:\Users\Default User\AppData\Local\Google
2015-07-13 21:40 - 2015-07-13 21:40 - 00558328 _____ (Safer-Networking Ltd. ) C:\Users\Hugh\Downloads\spybot2-license.exe
2015-07-13 20:39 - 2015-07-14 08:57 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2015-07-13 20:39 - 2015-07-14 08:11 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-07-13 20:39 - 2015-07-13 20:39 - 00001417 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-07-13 20:39 - 2015-07-13 20:39 - 00001405 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-07-13 20:39 - 2015-07-13 20:39 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2015-07-13 20:39 - 2015-07-13 20:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-07-13 20:39 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-07-13 20:27 - 2015-07-13 20:31 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Hugh\Downloads\spybot-2.4.exe
2015-07-13 15:02 - 2015-07-13 15:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-07-13 15:01 - 2015-07-13 15:01 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Hugh\Downloads\mbam-setup-2.1.8.1057.exe
2015-07-09 09:27 - 2015-07-09 09:27 - 00000000 ____D C:\Users\Public\Downloads\Norton
2015-07-07 20:14 - 2015-07-07 20:14 - 00000500 _____ C:\Users\Hugh\Desktop\asx options.csv
2015-07-07 15:01 - 2015-07-07 15:01 - 1092367527 _____ C:\Windows\MEMORY.DMP
2015-07-07 15:01 - 2015-07-07 15:01 - 01270288 _____ C:\Windows\Minidump\070715-12031-01.dmp
2015-07-07 15:01 - 2015-07-07 15:01 - 00000000 ____D C:\Windows\Minidump
2015-07-07 13:10 - 2015-07-07 13:10 - 03121152 _____ C:\Users\Hugh\Downloads\TWS API Install 972.03.msi
2015-07-06 08:24 - 2015-07-13 08:36 - 00009728 ___SH C:\Users\Hugh\Desktop\Thumbs.db
2015-06-28 13:34 - 2015-06-28 13:34 - 00000000 ____D C:\ProgramData\Samsung
2015-06-26 18:41 - 2015-06-26 18:41 - 00001086 _____ C:\Users\Hugh\Desktop\AmiBroker.lnk
2015-06-26 18:41 - 2015-06-26 18:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AmiBroker
2015-06-26 18:40 - 2015-07-24 22:08 - 00000000 ____D C:\Program Files (x86)\AmiBroker
2015-06-26 11:28 - 2015-06-26 11:28 - 00000000 ____D C:\Users\Hugh\AppData\Local\Microsoft Help
2015-06-26 11:23 - 2015-06-26 11:23 - 01104014 _____ () C:\Users\Hugh\Downloads\CodeCleaner.exe
2015-06-26 11:23 - 2015-06-26 11:23 - 00000000 ____D C:\Program Files (x86)\AppsPro
2015-06-26 11:23 - 2000-12-06 03:00 - 00209608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TABCTL32.OCX
2015-06-26 10:17 - 2015-06-26 10:56 - 00000931 _____ C:\Users\Hugh\Desktop\AmiBroker x64.lnk
2015-06-26 10:17 - 2015-06-26 10:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AmiBroker x64
2015-06-25 14:07 - 2015-06-25 14:07 - 00000000 ____D C:\Users\Hugh\AppData\Local\WinZip
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-25 08:54 - 2014-03-18 20:03 - 00865408 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-25 08:53 - 2015-06-07 17:44 - 00003934 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{3D2F1FB9-A0C3-47F9-8104-40390AB06AAF}
2015-07-25 08:48 - 2015-06-07 17:45 - 00000926 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-07-25 08:48 - 2015-06-07 17:09 - 00000000 ___RD C:\Users\Hugh\OneDrive
2015-07-25 08:47 - 2013-08-23 00:46 - 00056704 _____ C:\Windows\setupact.log
2015-07-25 08:47 - 2013-08-23 00:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-24 21:46 - 2015-06-07 17:45 - 00000930 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-07-24 20:42 - 2015-06-07 15:51 - 01347236 _____ C:\Windows\WindowsUpdate.log
2015-07-24 19:56 - 2015-06-07 17:09 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2823309964-2513555705-3651140861-1001
2015-07-24 19:37 - 2013-08-23 01:36 - 00000000 ____D C:\Windows\AppReadiness
2015-07-24 15:55 - 2015-06-07 19:14 - 00004980 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for HUGH_LAPTOP-Hugh Hugh_Laptop
2015-07-24 10:51 - 2015-06-07 19:30 - 00000000 ____D C:\Jts
2015-07-24 08:33 - 2013-08-23 01:36 - 00000000 ____D C:\Windows\rescache
2015-07-23 22:19 - 2015-06-07 17:02 - 00000000 ____D C:\Users\Hugh
2015-07-23 21:21 - 2014-03-18 19:54 - 00582768 _____ C:\Windows\PFRO.log
2015-07-23 18:18 - 2015-06-07 19:09 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-07-23 18:18 - 2013-08-23 00:44 - 00481880 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-23 18:18 - 2013-08-22 23:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2015-07-21 10:59 - 2013-08-23 01:20 - 00000000 ____D C:\Windows\CbsTemp
2015-07-21 09:22 - 2015-06-07 17:03 - 00000000 ____D C:\Users\Hugh\AppData\Local\Packages
2015-07-20 21:25 - 2015-06-07 19:22 - 00001692 _____ C:\Users\Hugh\Desktop\Google Drive.lnk
2015-07-20 08:27 - 2015-06-07 19:22 - 00000000 ___RD C:\Users\Hugh\Google Drive
2015-07-19 17:58 - 2015-06-07 17:45 - 00000000 ____D C:\Program Files (x86)\Google
2015-07-16 08:41 - 2015-06-07 17:45 - 00003902 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-07-16 08:41 - 2015-06-07 17:45 - 00003666 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-07-16 08:28 - 2013-08-23 01:36 - 00000000 ___RD C:\Windows\ToastData
2015-07-16 08:28 - 2013-08-23 01:36 - 00000000 ____D C:\Windows\WinStore
2015-07-15 09:43 - 2015-06-12 15:39 - 00000000 ____D C:\Windows\system32\appraiser
2015-07-15 09:43 - 2015-06-08 17:08 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-07-15 09:42 - 2015-06-08 16:59 - 00000000 ____D C:\Windows\system32\MRT
2015-07-15 09:39 - 2015-06-07 17:46 - 00002213 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-07-15 08:31 - 2014-11-05 10:48 - 00000000 ____D C:\ProgramData\Norton
2015-07-14 09:12 - 2015-06-08 17:08 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-07-14 09:12 - 2015-06-08 17:08 - 00000000 ___SD C:\Windows\system32\GWX
2015-07-14 08:14 - 2015-06-07 19:20 - 00002068 _____ C:\Users\Public\Desktop\Google Slides.lnk
2015-07-14 08:14 - 2015-06-07 19:20 - 00002066 _____ C:\Users\Public\Desktop\Google Sheets.lnk
2015-07-14 08:14 - 2015-06-07 19:20 - 00002056 _____ C:\Users\Public\Desktop\Google Docs.lnk
2015-07-14 08:14 - 2015-06-07 19:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-07-14 08:07 - 2014-11-05 10:49 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-07-14 08:05 - 2013-08-23 01:36 - 00000000 ___HD C:\Windows\ELAMBKUP
2015-07-14 08:05 - 2013-08-22 23:25 - 00262144 ___SH C:\Windows\system32\config\ELAM
2015-07-14 07:10 - 2015-06-08 17:17 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-14 07:10 - 2015-06-08 17:17 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-09 08:44 - 2013-08-23 01:36 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-07-07 13:16 - 2015-06-07 19:31 - 00000000 ____D C:\TWS API
2015-07-03 08:43 - 2015-06-08 16:59 - 130333168 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-25 14:07 - 2015-01-23 16:05 - 00000000 ____D C:\ProgramData\WinZip
2015-06-25 08:17 - 2013-08-23 01:36 - 00000000 ____D C:\Windows\LiveKernelReports
==================== Files in the root of some directories =======
2015-07-20 11:05 - 2015-07-20 11:05 - 0000017 _____ () C:\Users\Hugh\AppData\Local\resmon.resmoncfg
2015-01-23 15:12 - 2015-01-23 15:12 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Some files in TEMP:
====================
C:\Users\Hugh\AppData\Local\Temp\Quarantine.exe
C:\Users\Hugh\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-07-15 08:42
==================== End of log ============================
Additional scan result of Farbar Recovery Scan Tool (x64) Version:20-07-2015
Ran by Hugh at 2015-07-25 08:57:52
Running from C:\Users\Hugh\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-2823309964-2513555705-3651140861-500 - Administrator - Disabled)
Guest (S-1-5-21-2823309964-2513555705-3651140861-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2823309964-2513555705-3651140861-1003 - Limited - Enabled)
Hugh (S-1-5-21-2823309964-2513555705-3651140861-1001 - Administrator - Enabled) => C:\Users\Hugh
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Spybot - Search and Destroy (Enabled - Up to date) {20A26C15-1AF0-7CA3-9380-FAB824A7EE0D}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
AmiBroker 5.60.3 x64 (HKLM\...\AmiBroker64_is1) (Version: 5.60 - AmiBroker.com)
AmiBroker 5.90.1 (HKLM-x32\...\AmiBroker_is1) (Version: 5.90 - AmiBroker.com)
Battery Calibration (HKLM-x32\...\{619FA785-489B-4D22-911F-82D6EDF5BDB0}) (Version: 1.0.1405.0701 - Micro-Star International Co., Ltd.)
Boot Configure (HKLM-x32\...\{5563D674-6B02-43F4-B9D0-C2A944E84F3C}) (Version: 20.014.12127 - Micro-Star International Co., Ltd.)
BurnRecovery (HKLM-x32\...\{2892E1B7-E24D-4CCB-B8A7-B63D4B66F89F}) (Version: 4.0.1412.2301 - )
CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.5509.52 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dragon Gaming Center (HKLM-x32\...\InstallShield_{965B16C7-0778-4C45-B7D1-83A59E6FBBCB}) (Version: 1.0.1410.1301 - Micro-Star International Co., Ltd.)
Dragon Gaming Center (x32 Version: 1.0.1410.1301 - Micro-Star International Co., Ltd.) Hidden
ELAN Touchpad 11.13.11.4_X64_WHQL (HKLM\...\Elantech) (Version: 11.13.11.4 - ELAN Microelectronic Corp.)
Excel VBA Code Cleaner 5.0 (HKLM-x32\...\Excel VBA Code Cleaner 5.0) (Version: - )
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Galeria de Fotos (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Galería de fotos (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.134 - Google Inc.)
Google Drive (HKLM-x32\...\{6EA8B94E-D869-4D96-88DF-5E1ECE1D6876}) (Version: 1.23.9648.8824 - Google, Inc.)
Google Earth (HKLM-x32\...\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)
Google Update Helper (x32 Version: 1.3.21.115 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.28.1 - Google Inc.) Hidden
Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{0EC7F9CC-4741-45AE-9F55-6E9343F726F5}) (Version: 1.1.0.36960 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4170 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 13.5.0.1056 - Intel Corporation)
Intel(R) Wireless Bluetooth(R)(patch version 17.1.1434.2) (HKLM\...\{302600C1-6BDF-4FD1-1407-148929CC1385}) (Version: 17.1.1407.0480 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{85b9d34f-7397-4e39-8600-07942ef6ca04}) (Version: 17.0.5 - Intel Corporation)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
KB9X Radio Switch Driver (HKLM\...\5AADE1068CF70DD983F763B20CF2CAAB72883915) (Version: 1.1.0.0 - ENE TECHNOLOGY INC.)
KeePass Password Safe 1.29 (HKLM-x32\...\KeePass Password Safe_is1) (Version: 1.29 - Dominik Reichl)
KLM (HKLM-x32\...\InstallShield_{4DEA5B85-6C56-45F3-AE00-FED756B0D3B4}) (Version: 1.0.1411.1101 - Application)
KLM (x32 Version: 1.0.1411.1101 - Application) Hidden
MAGIX MX Suite (HKLM-x32\...\MAGIX_{43136332-880B-458A-966C-900C18752B66}) (Version: 1.13.0.121 - MAGIX AG)
MAGIX MX Suite (Version: 1.13.0.121 - MAGIX AG) Hidden
Malwarebytes Anti-Malware version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 15.0.4737.1003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\OneDriveSetup.exe) (Version: 17.3.5860.0512 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
MSI Remind Manager (HKLM-x32\...\InstallShield_{3E23F267-3E35-40F9-B6BF-BC034D214717}) (Version: 1.0.1412.1801 - Micro-Star International Co., Ltd.)
MSI Remind Manager (x32 Version: 1.0.1412.1801 - Micro-Star International Co., Ltd.) Hidden
MSI Social Media Collection (HKLM-x32\...\{7ADEC426-BE95-48EF-84D4-086BD0F4D331}) (Version: 1.14.2251 - Micro-Star International Co., Ltd.)
Nahimic APO (x32 Version: 1.0.401 - Nahimic) Hidden
Nahimic for MSI (HKLM-x32\...\{d790cc66-b17a-4c88-96a8-cb6506bfdfe4}) (Version: 1.0.4 - Nahimic)
Nahimic for MSI (Version: 1.0.401 - Nahimic) Hidden
NahimicSettingsConfigurator (Version: 1.0.401 - Nahimic) Hidden
NVIDIA GeForce Experience 2.1.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.5 - NVIDIA Corporation)
NVIDIA Graphics Driver 345.05 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 345.05 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
Qualcomm Atheros Bandwidth Control Filter Driver (Version: 1.1.46.1056 - Qualcomm Atheros) Hidden
Qualcomm Atheros Killer E220x Drivers (Version: 1.1.46.1056 - Qualcomm Atheros) Hidden
Qualcomm Atheros Killer Performance Suite (HKLM-x32\...\{E70DB50B-10B4-46BC-9DE2-AB8B49E061EE}) (Version: 1.1.46.1056 - Qualcomm Atheros)
Qualcomm Atheros Network Manager (Version: 1.1.46.1056 - Qualcomm Atheros) Hidden
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.21249 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7427 - Realtek Semiconductor Corp.)
SCM (HKLM\...\{9BC0C4F3-ACBB-42DF-9559-93175E3B4095}) (Version: 13.014.11068 - Application)
SHIELD Streaming (Version: 3.1.3000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.18.9 - NVIDIA Corporation) Hidden
Sizing Options (HKLM-x32\...\InstallShield_{DFAB6DE8-E45F-4D5D-95C0-E54C58993F9F}) (Version: 2.0.1412.1501 - Application)
Sizing Options (x32 Version: 2.0.1412.1501 - Application) Hidden
Skype™ 7.6 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.6.105 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
SUPER CHARGER (HKLM-x32\...\{7CDF10DD-A9B5-4DA3-AB95-E193248D4369}_is1) (Version: 1.2.024 - MSI)
Telstra Mobile Broadband Manager (HKLM-x32\...\Telstra Mobile Broadband Manager) (Version: 3.0.514 - Telstra)
Telstra Mobile Broadband Manager (x32 Version: 3.0.514 - Telstra) Hidden
Trader Workstation 4.0 (HKLM-x32\...\Trader Workstation 4.0) (Version: - )
Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 2.2.0 - Tweaking.com)
TWS API (HKLM-x32\...\{AF3F53E2-2766-45B4-9F2F-AA8A51AD5C85}) (Version: 9.72.03 - IBG LLC)
Windows Driver Package - Cmotech (cmusbnet) Net (06/11/2007 2.0.0.9) (HKLM\...\51208688C66699298C32E38B6BFF92816EE798CA) (Version: 06/11/2007 2.0.0.9 - Cmotech)
Windows Driver Package - Cmotech Modem (06/08/2007 2.0.3.9) (HKLM\...\7404D4336C2B621F88A2B25CE6577572A8BBD25A) (Version: 06/08/2007 2.0.3.9 - Cmotech)
Windows Driver Package - Cmotech Ports (06/08/2007 2.0.3.9) (HKLM\...\2021A90B4F2D70AB98CFBF428E09767703FD455E) (Version: 06/08/2007 2.0.3.9 - Cmotech)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinZip 17.5 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240DD}) (Version: 17.5.10562 - WinZip Computing, S.L. )
ZTE USB Driver (HKLM\...\ZTE USB Driver) (Version: 1.0.1.16+ - ZTE Corporation)
フォト ギャラリー (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
معرض الصور (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
사진 갤러리 (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
影像中心 (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
照片库 (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncApi64.dll (Microsoft Corporation)
==================== Restore Points =========================
14-07-2015 08:07:25 Removed Norton Online Backup
21-07-2015 10:59:03 Windows Update
22-07-2015 17:20:46 JRT Pre-Junkware Removal
23-07-2015 18:24:42 JRT Pre-Junkware Removal
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 23:25 - 2015-07-14 08:58 - 00450771 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
There are 1000 more lines.
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {0BE1DFE1-62AA-4F2F-B982-B96D91006FC7} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {4D53FB81-2EE9-4344-B1CA-10116BFA0FAC} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-01] (Microsoft Corporation)
Task: {5619C3C6-4E00-49A0-9DA1-8E201B3B9D51} - System32\Tasks\MSI_Dragon Gaming Center => C:\Program Files (x86)\MSI\Dragon Gaming Center\mDispatch.exe [2014-01-24] (TODO: <公司名稱>)
Task: {68F9B4FD-F709-4B87-8D5C-38F825D63DC5} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-06-09] (Microsoft Corporation)
Task: {6E7E4E9F-8D07-4885-901A-A97D0F9BDB5A} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-08] (Intel Corporation)
Task: {783F8E13-DD52-4936-8A7D-A91CA4F51052} - System32\Tasks\NahimicMSIsvc32Run => C:\Program Files\Nahimic\NahimicMSI\UserInterface\NahimicMSIsvc32.exe [2015-01-17] ()
Task: {7A468A53-C4AC-4A64-90ED-6952EEF05F3F} - System32\Tasks\NahimicMSIsvc64Run => C:\Program Files\Nahimic\NahimicMSI\UserInterface\x64\NahimicMSIsvc64.exe [2015-01-17] ()
Task: {8500105A-9006-4A7D-80FD-22F91811451D} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-07-03] (Microsoft Corporation)
Task: {86ED10AE-8A7F-41C6-B4A2-1B437337651D} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {A3C097C9-2D25-44E2-82A5-ED4D815E9BDC} - System32\Tasks\Microsoft Office 15 Sync Maintenance for HUGH_LAPTOP-Hugh Hugh_Laptop => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-06-02] (Microsoft Corporation)
Task: {B5AB7F8D-6F2E-4527-AAD5-CF1239851899} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-07] (Google Inc.)
Task: {BE35EB41-0163-479E-BCDF-C4D8167F4473} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-01] (Microsoft Corporation)
Task: {CBAAE99B-E34F-47E6-949D-20D5EF5B6EBE} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {D15818B0-3404-41A1-B95D-57185BCAF3EC} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-2823309964-2513555705-3651140861-1001 => %localappdata%\Microsoft\OneDrive\OneDrive.exe
Task: {D1FA0D76-962C-426A-8091-5E9C55A6320C} - System32\Tasks\NahimicMSIUILauncherRun => C:\Program Files\Nahimic\NahimicMSI\UserInterface\NahimicMSIUILauncher.exe [2015-01-17] ()
Task: {F51F4499-139A-4ABA-B336-4DA5FF0B93C4} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-07] (Google Inc.)
Task: {F61A8720-B7BB-423A-87F0-B0857571A774} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-08] (Intel Corporation)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (Whitelisted) ==============
2015-01-23 15:14 - 2014-12-24 20:38 - 00115912 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-06-22 05:24 - 2015-06-22 05:24 - 00022528 _____ () C:\Windows\System32\us005lm.dll
2015-06-07 19:09 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-06-08 17:34 - 2015-06-08 17:34 - 08898720 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2015-07-06 08:28 - 2015-07-06 08:28 - 00183296 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\ErrorReporting.dll
2014-01-23 04:44 - 2014-01-23 04:44 - 00075912 _____ () C:\Program Files (x86)\MSI\Dragon Gaming Center\WinIo64.dll
2013-05-24 03:15 - 2013-05-24 03:15 - 00025600 _____ () C:\Program Files (x86)\MSI\Dragon Gaming Center\CoreAudioApi.dll
2014-08-19 05:40 - 2014-08-19 05:40 - 00330240 _____ () C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe
2015-07-13 20:39 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-07-13 20:39 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-07-13 20:39 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-07-13 20:39 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-07-13 20:39 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2015-07-25 08:48 - 2015-07-25 08:48 - 00098816 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32api.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00110080 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\pywintypes27.dll
2015-07-25 08:48 - 2015-07-25 08:48 - 00364544 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\pythoncom27.dll
2015-07-25 08:48 - 2015-07-25 08:48 - 00045568 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\_socket.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 01161216 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\_ssl.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00320512 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32com.shell.shell.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00713216 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\_hashlib.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 01175040 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\wx._core_.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00805888 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\wx._gdi_.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00811008 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\wx._windows_.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 01062400 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\wx._controls_.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00735232 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\wx._misc_.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00682496 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\pysqlite2._sqlite.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00087552 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\_ctypes.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00119808 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32file.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00108544 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32security.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00007168 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\hashobjs_ext.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00068096 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\usb_ext.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00167936 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32gui.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00018432 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32event.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00128512 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\_elementtree.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00127488 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\pyexpat.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00013824 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\common.time34.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00036864 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\_psutil_windows.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00038912 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32inet.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00011264 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32crypt.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00070656 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\wx._html2.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00027136 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\_multiprocessing.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00020480 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\_yappi.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00035840 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32process.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00686080 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\unicodedata.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00122368 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\wx._wizard.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00024064 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32pipe.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00010240 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\select.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00025600 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32pdh.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00525640 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\windows._lib_cacheinvalidation.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00017408 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32profile.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00022528 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32ts.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00078336 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\wx._animate.pyd
2015-01-23 15:11 - 2013-09-17 06:17 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2015-06-07 19:09 - 2015-07-19 18:01 - 00122024 _____ () C:\Program Files\Microsoft Office 15\root\Office15\JitV.dll
2015-06-08 17:32 - 2015-06-08 17:32 - 00316576 _____ () C:\Program Files\Microsoft Office 15\root\Office15\AppVIsvStream32.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Users\Hugh\OneDrive:ms-properties
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com
There are 7866 more restricted sites.
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\System32\oobe\info\Wallpaper\backgroundDefault.jpg
DNS Servers: 10.0.0.138
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{5EC53328-DC21-462D-AACD-EA110DE468A3}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{9E47E124-3F88-45BC-AE0C-B3FD0241A99D}] => (Allow) LPort=2869
FirewallRules: [{7102CD25-47B4-47DE-A598-AEF69D10ECF0}] => (Allow) LPort=1900
FirewallRules: [{2D3AC92D-79CE-48F3-B94E-986B1DFA255D}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{6BF214AB-A286-4902-8A28-31EB04D7BF61}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{A716ED6C-4C75-42C2-9D3E-58027E049AE7}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{21288DD7-E4D4-4BF2-90BF-AB99B749D116}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{1972B00C-10E4-4AA2-8590-2765619747F0}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{CDC47814-1B28-4EC9-886F-668D7399C0F7}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{F20C674D-D846-4DDC-BC35-5A1A803A26AF}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{A9055384-AE0A-48C4-805D-B9F9D2DEE085}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{C6744919-EAC7-417A-B4D7-28F0A859701A}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{B6B6CA70-94FD-41DF-97BC-BF8A4F0B5A8D}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{7A705F37-593F-4CE8-8A69-8DFDEFED882A}] => (Allow) C:\Users\Hugh\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [TCP Query User{E08765E9-A930-48B9-B7E6-D05B4685593B}C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe
FirewallRules: [UDP Query User{62C52245-8937-43AA-878D-D9D83BCC5BEE}C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe
FirewallRules: [{ED900BEF-F6DE-49A4-899E-1A675247AA70}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [TCP Query User{06E9B8AC-47BD-4110-9090-423D07B682E7}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{0BBAB1B7-5F6B-432A-8195-FC5449330FBB}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{0610B524-831C-409A-AAE8-C7CA9EB537A9}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{C267FC24-0437-4945-AC60-DC8D8C16213B}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (07/25/2015 08:47:54 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: ZeroConfigService.exe, version: 17.0.5.0, time stamp: 0x5387ee07
Faulting module name: MurocApi.dll, version: 17.0.5.0, time stamp: 0x5387ed02
Exception code: 0xc0000005
Fault offset: 0x000000000002bd48
Faulting process id: 0xb30
Faulting application start time: 0xZeroConfigService.exe0
Faulting application path: ZeroConfigService.exe1
Faulting module path: ZeroConfigService.exe2
Report Id: ZeroConfigService.exe3
Faulting package full name: ZeroConfigService.exe4
Faulting package-relative application ID: ZeroConfigService.exe5
Error: (07/24/2015 08:33:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: KillerService.exe, version: 1.1.46.1056, time stamp: 0x53f22c94
Faulting module name: KillerService.exe, version: 1.1.46.1056, time stamp: 0x53f22c94
Exception code: 0xc0000005
Fault offset: 0x000000000001641d
Faulting process id: 0x91c
Faulting application start time: 0xKillerService.exe0
Faulting application path: KillerService.exe1
Faulting module path: KillerService.exe2
Report Id: KillerService.exe3
Faulting package full name: KillerService.exe4
Faulting package-relative application ID: KillerService.exe5
Error: (07/23/2015 09:22:26 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8
Error: (07/23/2015 09:15:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: wwahost.exe, version: 6.3.9600.17415, time stamp: 0x5450355f
Faulting module name: KERNELBASE.dll, version: 6.3.9600.17415, time stamp: 0x54504ade
Exception code: 0x00000004
Fault offset: 0x00014598
Faulting process id: 0x23c94
Faulting application start time: 0xwwahost.exe0
Faulting application path: wwahost.exe1
Faulting module path: wwahost.exe2
Report Id: wwahost.exe3
Faulting package full name: wwahost.exe4
Faulting package-relative application ID: wwahost.exe5
Error: (07/23/2015 09:03:43 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: HUGH_LAPTOP)
Description: Activation of app Microsoft.SkypeApp_kzf8qxf38zg5c!App failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.
Error: (07/23/2015 08:55:22 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: The protocol handler Mapi15 cannot be loaded. Error description: A dynamic link library (DLL) initialization routine failed. (HRESULT : 0x8007045a).
Error: (07/23/2015 08:55:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: SearchProtocolHost.exe, version: 7.0.9600.17787, time stamp: 0x551b5d9c
Faulting module name: ntdll.dll, version: 6.3.9600.17736, time stamp: 0x550f42c2
Exception code: 0xc0000005
Fault offset: 0x0001df63
Faulting process id: 0x284c0
Faulting application start time: 0xSearchProtocolHost.exe0
Faulting application path: SearchProtocolHost.exe1
Faulting module path: SearchProtocolHost.exe2
Report Id: SearchProtocolHost.exe3
Faulting package full name: SearchProtocolHost.exe4
Faulting package-relative application ID: SearchProtocolHost.exe5
Error: (07/23/2015 08:48:43 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: HUGH_LAPTOP)
Description: Activation of app Microsoft.SkypeApp_kzf8qxf38zg5c!App failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.
Error: (07/23/2015 06:18:05 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: SDUpdSvc.exe, version: 2.4.40.77, time stamp: 0x53ad3eda
Faulting module name: KERNELBASE.dll, version: 6.3.9600.17415, time stamp: 0x54504ade
Exception code: 0x0eedfade
Fault offset: 0x00014598
Faulting process id: 0xd35c
Faulting application start time: 0xSDUpdSvc.exe0
Faulting application path: SDUpdSvc.exe1
Faulting module path: SDUpdSvc.exe2
Report Id: SDUpdSvc.exe3
Faulting package full name: SDUpdSvc.exe4
Faulting package-relative application ID: SDUpdSvc.exe5
Error: (07/23/2015 06:18:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: SDFSSvc.exe, version: 2.4.40.217, time stamp: 0x54071554
Faulting module name: KERNELBASE.dll, version: 6.3.9600.17415, time stamp: 0x54504ade
Exception code: 0x0eedfade
Fault offset: 0x00014598
Faulting process id: 0xd080
Faulting application start time: 0xSDFSSvc.exe0
Faulting application path: SDFSSvc.exe1
Faulting module path: SDFSSvc.exe2
Report Id: SDFSSvc.exe3
Faulting package full name: SDFSSvc.exe4
Faulting package-relative application ID: SDFSSvc.exe5
System errors:
=============
Error: (07/25/2015 08:47:58 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Intel(R) PROSet/Wireless Zero Configuration Service service terminated unexpectedly. It has done this 1 time(s).
Error: (07/25/2015 08:47:37 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 9:33:19 PM on 24/07/2015 was unexpected.
Error: (07/25/2015 08:47:27 AM) (Source: Microsoft-Windows-Kernel-Boot) (EventID: 29) (User: NT AUTHORITY)
Description: 32212256841182720
Error: (07/24/2015 08:33:25 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Qualcomm Atheros Killer Service V2 service terminated unexpectedly. It has done this 1 time(s).
Error: (07/24/2015 05:34:44 PM) (Source: Microsoft-Windows-NDIS) (EventID: 10317) (User: NT AUTHORITY)
Description: Miniport ZTE Wireless Ethernet Adapter #2, {EB9EA036-9040-49E8-8D13-9D0854090602}, had event 74
Error: (07/24/2015 07:58:49 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 10:11:27 PM on 23/07/2015 was unexpected.
Error: (07/23/2015 09:21:27 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 9:15:04 PM on 23/07/2015 was unexpected.
Error: (07/23/2015 09:03:38 PM) (Source: DCOM) (EventID: 10010) (User: HUGH_LAPTOP)
Description: App.AppX54xz6wnkhmw763c2y8tb018n7d71dtx7.wwa
Error: (07/23/2015 08:48:38 PM) (Source: DCOM) (EventID: 10010) (User: HUGH_LAPTOP)
Description: App.AppX54xz6wnkhmw763c2y8tb018n7d71dtx7.wwa
Error: (07/23/2015 06:43:45 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Media Player Network Sharing Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
Microsoft Office:
=========================
Error: (07/25/2015 08:47:54 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: ZeroConfigService.exe17.0.5.05387ee07MurocApi.dll17.0.5.05387ed02c0000005000000000002bd48b3001d0c662bff7845aC:\Program Files\Intel\WiFi\bin\ZeroConfigService.exeC:\Program Files\Intel\WiFi\bin\MurocApi.dll0517e40d-3256-11e5-827d-d8cb8a7e33a7
Error: (07/24/2015 08:33:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: KillerService.exe1.1.46.105653f22c94KillerService.exe1.1.46.105653f22c94c0000005000000000001641d91c01d0c592c30416e7C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exeC:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe68b08d98-31ef-11e5-827c-00a0c6000000
Error: (07/23/2015 09:22:26 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8
Error: (07/23/2015 09:15:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: wwahost.exe6.3.9600.174155450355fKERNELBASE.dll6.3.9600.1741554504ade000000040001459823c9401d0c538d0e5cbeeC:\Windows\syswow64\wwahost.exeC:\Windows\SYSTEM32\KERNELBASE.dll0e997e07-312c-11e5-827a-d8cb8a7e33a7Microsoft.SkypeApp_3.1.0.1016_x86__kzf8qxf38zg5cApp
Error: (07/23/2015 09:03:43 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: HUGH_LAPTOP)
Description: Microsoft.SkypeApp_kzf8qxf38zg5c!App-2144927141
Error: (07/23/2015 08:55:22 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: Mapi15A dynamic link library (DLL) initialization routine failed. (HRESULT : 0x8007045a)
Error: (07/23/2015 08:55:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: SearchProtocolHost.exe7.0.9600.17787551b5d9cntdll.dll6.3.9600.17736550f42c2c00000050001df63284c001d0c5360f491bd1C:\Windows\sysWow64\SearchProtocolHost.exeC:\Windows\SYSTEM32\ntdll.dll4d52a1d4-3129-11e5-827a-d8cb8a7e33a7
Error: (07/23/2015 08:48:43 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: HUGH_LAPTOP)
Description: Microsoft.SkypeApp_kzf8qxf38zg5c!App-2144927141
Error: (07/23/2015 06:18:05 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: SDUpdSvc.exe2.4.40.7753ad3edaKERNELBASE.dll6.3.9600.1741554504ade0eedfade00014598d35c01d0c52019b9b31bC:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exeC:\Windows\SYSTEM32\KERNELBASE.dll576fc7bc-3113-11e5-8279-d8cb8a7e33a7
Error: (07/23/2015 06:18:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: SDFSSvc.exe2.4.40.21754071554KERNELBASE.dll6.3.9600.1741554504ade0eedfade00014598d08001d0c520193db9f2C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exeC:\Windows\SYSTEM32\KERNELBASE.dll56f89282-3113-11e5-8279-d8cb8a7e33a7
CodeIntegrity Errors:
===================================
Date: 2015-07-25 08:56:33.071
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-07-25 08:48:45.635
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-07-24 21:57:37.796
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-07-24 21:03:30.346
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-07-24 19:28:24.680
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-07-24 18:24:57.199
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-07-24 16:15:09.500
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-07-24 15:18:14.033
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-07-24 14:27:33.741
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-07-24 14:14:33.558
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-4720HQ CPU @ 2.60GHz
Percentage of memory in use: 32%
Total physical RAM: 8109.81 MB
Available physical RAM: 5503.35 MB
Total Virtual: 16301.81 MB
Available Virtual: 13231.04 MB
==================== Drives ================================
Drive c: (OS_Install) (Fixed) (Total:118.24 GB) (Free:58.36 GB) NTFS
Drive d: (DATA) (Fixed) (Total:915.12 GB) (Free:888.03 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 4E9EEB76)
Partition: GPT Partition Type.
========================================================
Disk: 1 (Size: 119.2 GB) (Disk ID: 4E9EEB6B)
Partition: GPT Partition Type.
==================== End of log ============================
Part of this fix will fix your hosts file which is infected, it will also unhide Windows Essentials which looks like it came from China, after its unhidden see if you can uninstall it
Open notepad , Go to Start --> All Programs --> Accessories --> Notepad.
Please copy the entire contents Inside of the code box below beginning with START and ending with END
(To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste).
Name the file Fixlist, Save it to your desktop where you have FRST/FRST64 or the fix wont work, . Then open up FRST/FRST64 and click on FIX (Not Scan) It won't take long, after your computer reboots you will find a FIXLOG.TXT on your desktop, post it please
Start
CloseProcesses:
CreateRestorePoint:
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
CHR Extension: (No Name) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2015-07-23]
2015-07-14 08:58 - 2013-08-22 23:25 - 00000824 _____ C:\Windows\system32\Drivers\etc\hosts.20150714-085812.backup
フォト ギャラリー (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
معرض الصور (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
사진 갤러리 (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
影像中心 (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
照片库 (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Hosts:
CMD: ipconfig /flushdns
EmptyTemp:
End
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
Thanks Ken, the log is attached.
Fix result of Farbar Recovery Scan Tool (x64) Version:26-07-2015
Ran by Hugh at 2015-07-27 18:54:22 Run:1
Running from C:\Users\Hugh\Desktop
Loaded Profiles: Hugh (Available Profiles: Hugh)
Boot Mode: Normal
==============================================
fixlist content:
*****************
Start
CloseProcesses:
CreateRestorePoint:
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
CHR Extension: (No Name) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2015-07-23]
2015-07-14 08:58 - 2013-08-22 23:25 - 00000824 _____ C:\Windows\system32\Drivers\etc\hosts.20150714-085812.backup
??? ????? (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
???? ????? (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
?? ??? (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
???? (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
??? (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Hosts:
CMD: ipconfig /flushdns
EmptyTemp:
End
*****************
Processes closed successfully.
Restore point was successfully created.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh => moved successfully.
C:\Windows\system32\Drivers\etc\hosts.20150714-085812.backup => moved successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\\SystemComponent => value not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\\SystemComponent => value not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\\SystemComponent => value not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\\SystemComponent => value not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\\SystemComponent => value not found.
C:\Windows\System32\Drivers\etc\hosts => moved successfully.
Hosts restored successfully.
========= ipconfig /flushdns =========
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
========= End of CMD: =========
EmptyTemp: => 1.3 GB temporary data Removed.
The system needed a reboot..
==== End of Fixlog 18:55:11 ====
Morning, did you try to uninstall Windows Essentials ??
Open up FRST, checkmark Additions, run a new scan and post both logs please
Hi Ken, logs are attached. Tks for the help.
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:26-07-2015
Ran by Hugh (administrator) on HUGH_LAPTOP (28-07-2015 19:44:41)
Running from C:\Users\Hugh\Desktop
Loaded Profiles: Hugh (Available Profiles: Hugh)
Platform: Windows 8.1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\SCM\MSIService.exe
(MSI) C:\Program Files (x86)\MSI\SUPER CHARGER\ChargeService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.1\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.1\GoogleCrashHandler64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(MSI) C:\Program Files (x86)\SCM\SCM.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\MSI\Dragon Gaming Center\Dragon Gaming Center.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\MSI\KLM\KLM.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(MSI) C:\Program Files (x86)\MSI\SUPER CHARGER\SUPER CHARGER.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Telstra) C:\Program Files (x86)\Telstra\Mobile Broadband Manager\TelstraUCM.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\ismagent.exe
() C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\updateui.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Reader_6.3.9654.17499_x64__8wekyb3d8bbwe\glcnd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8446832 2015-01-22] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2015-01-22] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [322712 2014-10-10] (Intel Corporation)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [3281160 2015-01-22] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [SCM] => C:\Program Files (x86)\SCM\SCM.exe [405504 2014-11-07] (MSI)
HKLM-x32\...\Run: [KLM] => C:\Program Files (x86)\MSI\KLM\KLM.exe [1569416 2014-11-12] (Micro-Star International Co., Ltd.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-09] (CyberLink Corp.)
HKLM-x32\...\Run: [SUPER CHARGER] => C:\Program Files (x86)\MSI\SUPER CHARGER\SUPER CHARGER.exe [1047536 2014-02-22] (MSI)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM-x32\...\Run: [BigPondWirelessBroadbandCM] => C:\Program Files (x86)\Telstra\Mobile Broadband Manager\TelstraUCM.exe [4352408 2010-05-14] (Telstra)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22012688 2015-06-20] (Google)
HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53288576 2015-06-29] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Killer Network Manager.lnk [2015-01-23]
ShortcutTarget: Killer Network Manager.lnk -> C:\Windows\Installer\{5B62C353-75A3-463F-A52E-CC005846F3CE}\NetworkManager.exe_130C27D738F34C89BDDF21BCFD74B56D.exe (Flexera Software LLC)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://msi13.msn.com
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-06-09] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-06-17] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-06-07] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-07] (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-06-08] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{6CA879F1-BA5A-40DB-96D7-FBC3D00CB47F}: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{EB9EA036-9040-49E8-8D13-9D0854090602}: [DhcpNameServer] 10.5.136.242 10.5.133.45
FireFox:
========
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-17] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-17] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-07] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-07] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-06-07] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
Chrome:
=======
CHR Profile: C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-07-19]
CHR Extension: (Google Cast) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2015-06-07]
CHR Extension: (Adblock Super) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\knebimhcckndhiglamoabbnifdkijidd [2015-06-08]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-07]
CHR Extension: (No Name) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2015-07-27]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-07]
CHR HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Hugh\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx [2015-06-07]
CHR HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2753720 2015-07-01] (Microsoft Corporation)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [101680 2015-01-22] (ELAN Microelectronics Corp.)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2015-01-22] (NVIDIA Corporation)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [18584 2014-10-10] (Intel Corporation)
R2 iBtSiva; C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe [122984 2015-01-22] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [345864 2015-03-19] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-28] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-28] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-17] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-17] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 Micro Star SCM; C:\Program Files (x86)\SCM\MSIService.exe [160768 2014-11-07] (Micro-Star International Co., Ltd.) [File not signed]
R2 MSI_SuperCharger; C:\Program Files (x86)\MSI\SUPER CHARGER\ChargeService.exe [162800 2014-02-22] (MSI)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2014-05-30] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2015-01-22] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2015-01-22] (NVIDIA Corporation)
S2 Qualcomm Atheros Killer Service V2; C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe [360448 2014-08-19] (Qualcomm Atheros) [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1740760 2014-09-03] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3816176 2014-05-30] (Intel® Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R1 BfLwf; C:\Windows\system32\DRIVERS\bwcW8x64.sys [97968 2014-08-14] (Qualcomm Atheros, Inc.)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
S3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [141624 2014-05-14] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1424184 2014-06-18] (Motorola Solutions, Inc.)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [222664 2015-01-22] (Intel Corporation)
R3 Ke2200; C:\Windows\system32\DRIVERS\e22w8x64.sys [130224 2014-03-28] (Qualcomm Atheros, Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-07-28] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-17] (Intel Corporation)
R3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3446240 2014-06-19] (Intel Corporation)
R3 NTIOLib_1_0_3; C:\Program Files (x86)\MSI\SUPER CHARGER\NTIOLib_X64.sys [13368 2012-10-26] (MSI)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-01-22] (NVIDIA Corporation)
S3 NVSWCFilter; C:\Windows\System32\drivers\nvswcfilter.sys [19616 2015-01-22] (Windows (R) Win 7 DDK provider)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2015-01-22] (NVIDIA Corporation)
R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [466648 2015-01-22] (Realsil Semiconductor Corporation)
R1 SDHookDriver; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookDrv64.sys [64160 2014-04-25] ()
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
R3 WINIO; C:\Program Files (x86)\MSI\Dragon Gaming Center\winio64.sys [15160 2010-06-08] ()
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-28 09:08 - 2015-07-28 09:08 - 00000000 ____D C:\Users\Hugh\AppData\Local\Windows Live
2015-07-27 09:49 - 2015-07-27 09:50 - 00000000 ____D C:\Users\Hugh\AppData\Local\CutePDF Writer
2015-07-27 09:48 - 2015-07-27 09:48 - 00000000 ____D C:\Program Files (x86)\GPLGS
2015-07-27 09:46 - 2015-07-27 09:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CutePDF
2015-07-27 09:46 - 2015-07-27 09:46 - 00000000 ____D C:\Program Files (x86)\Acro Software
2015-07-27 09:46 - 2013-10-23 15:24 - 00087600 _____ C:\Windows\system32\cpwmon64.dll
2015-07-27 09:43 - 2015-07-27 09:44 - 02446176 _____ (Acro Software Inc. ) C:\Users\Hugh\Downloads\CuteWriter.exe
2015-07-25 08:57 - 2015-07-28 19:44 - 00019031 _____ C:\Users\Hugh\Desktop\FRST.txt
2015-07-25 08:57 - 2015-07-27 18:54 - 00000000 ____D C:\Users\Hugh\Desktop\FRST-OlderVersion
2015-07-25 08:57 - 2015-07-25 09:00 - 00043446 _____ C:\Users\Hugh\Desktop\Addition.txt
2015-07-24 20:34 - 2015-07-24 20:34 - 00033263 _____ C:\Users\Hugh\Downloads\table (1).csv
2015-07-24 18:10 - 2015-07-24 18:11 - 00029538 _____ C:\Users\Hugh\Downloads\table.csv
2015-07-23 20:33 - 2015-07-23 20:33 - 00001055 _____ C:\Users\Hugh\Desktop\JRT.txt
2015-07-22 17:30 - 2015-07-28 18:49 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-22 17:30 - 2015-07-22 17:30 - 00001128 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-07-22 17:30 - 2015-07-22 17:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-07-22 17:30 - 2015-07-22 17:30 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-07-22 17:30 - 2015-06-18 08:42 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-07-22 17:30 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-07-22 17:30 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-07-22 17:18 - 2015-07-23 18:17 - 00000000 ____D C:\AdwCleaner
2015-07-22 17:17 - 2015-07-22 17:17 - 02248704 _____ C:\Users\Hugh\Downloads\AdwCleaner.exe
2015-07-22 17:16 - 2015-07-22 17:16 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Hugh\Downloads\mbam-setup-2.1.8.1057 (2).exe
2015-07-22 17:15 - 2015-07-22 17:16 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Hugh\Downloads\mbam-setup-2.1.8.1057 (1).exe
2015-07-22 17:14 - 2015-07-22 17:15 - 01798288 _____ (Malwarebytes Corporation) C:\Users\Hugh\Downloads\JRT.exe
2015-07-21 10:47 - 2015-07-15 00:14 - 00358912 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-07-21 10:47 - 2015-07-15 00:14 - 00301056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-07-21 10:47 - 2015-07-15 00:14 - 00035840 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-07-21 10:47 - 2015-07-15 00:13 - 00044032 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-07-20 11:13 - 2015-07-20 11:14 - 05198336 _____ (AVAST Software) C:\Users\Hugh\Desktop\aswMBR.exe
2015-07-20 11:09 - 2015-07-27 18:54 - 02146816 _____ (Farbar) C:\Users\Hugh\Desktop\FRST64.exe
2015-07-20 11:07 - 2015-07-20 11:08 - 00045015 _____ C:\Users\Hugh\Downloads\Addition.txt
2015-07-20 11:06 - 2015-07-28 19:44 - 00000000 ____D C:\FRST
2015-07-20 11:06 - 2015-07-20 11:08 - 00045631 _____ C:\Users\Hugh\Downloads\FRST.txt
2015-07-20 11:06 - 2015-07-20 11:06 - 02134528 _____ (Farbar) C:\Users\Hugh\Downloads\FRST64.exe
2015-07-20 11:05 - 2015-07-20 11:05 - 00000017 _____ C:\Users\Hugh\AppData\Local\resmon.resmoncfg
2015-07-20 11:03 - 2015-07-20 11:03 - 00000207 _____ C:\Windows\tweaking.com-regbackup-HUGH_LAPTOP-Windows-8.1-(64-bit).dat
2015-07-20 11:02 - 2015-07-20 11:02 - 00000000 ____D C:\RegBackup
2015-07-20 11:01 - 2015-07-20 11:01 - 04720448 _____ C:\Users\Hugh\Downloads\tweaking.com_registry_backup_setup.exe
2015-07-20 11:01 - 2015-07-20 11:01 - 00002265 _____ C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2015-07-20 11:01 - 2015-07-20 11:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2015-07-20 11:01 - 2015-07-20 11:01 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2015-07-19 17:59 - 2015-07-19 17:59 - 00002186 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth.lnk
2015-07-19 17:58 - 2015-07-19 17:58 - 00931408 _____ (Google Inc.) C:\Users\Hugh\Downloads\GoogleEarthSetup.exe
2015-07-17 08:38 - 2015-07-17 08:38 - 00000000 ____D C:\Users\Hugh\Tracing
2015-07-16 22:32 - 2015-07-28 19:44 - 00000000 ____D C:\Users\Hugh\AppData\Roaming\Skype
2015-07-16 22:32 - 2015-07-20 08:26 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-07-16 22:32 - 2015-07-20 08:26 - 00000000 ____D C:\ProgramData\Skype
2015-07-16 22:32 - 2015-07-16 22:32 - 00002713 _____ C:\Users\Public\Desktop\Skype.lnk
2015-07-16 22:32 - 2015-07-16 22:32 - 00000000 ____D C:\Users\Hugh\AppData\Local\Skype
2015-07-16 22:32 - 2015-07-16 22:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-07-16 22:31 - 2015-05-12 10:24 - 00536920 _____ (Microsoft Corporation) C:\Windows\system32\mcupdate_GenuineIntel.dll
2015-07-16 22:31 - 2015-05-01 11:13 - 06521800 _____ (Microsoft Corporation) C:\Windows\system32\sppsvc.exe
2015-07-16 22:31 - 2015-05-01 11:13 - 01488000 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2015-07-16 22:31 - 2015-05-01 11:13 - 00261376 _____ (Microsoft Corporation) C:\Windows\system32\sppwinob.dll
2015-07-15 09:39 - 2015-07-10 05:51 - 00136904 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-07-15 09:39 - 2015-07-10 04:40 - 00359936 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-07-15 09:39 - 2015-07-10 02:03 - 03701760 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-07-15 09:39 - 2015-07-10 01:54 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-07-15 09:39 - 2015-07-10 01:53 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-07-15 09:39 - 2015-07-10 01:50 - 00409088 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2015-07-15 09:39 - 2015-07-10 01:50 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-07-15 09:39 - 2015-07-10 01:48 - 00891904 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-07-15 09:39 - 2015-07-10 01:46 - 02229248 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-07-15 09:39 - 2015-07-10 01:38 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-07-15 09:39 - 2015-07-10 01:37 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-07-15 09:39 - 2015-07-10 01:35 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-07-15 09:39 - 2015-07-10 01:34 - 00721920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-07-15 09:39 - 2015-06-27 13:08 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-07-15 09:39 - 2015-06-27 13:08 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-07-15 09:39 - 2015-06-27 12:14 - 00027136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-07-15 09:38 - 2015-07-03 07:21 - 19877376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-07-15 09:38 - 2015-07-03 06:50 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-07-15 09:38 - 2015-07-03 06:49 - 25193984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-07-15 09:38 - 2015-07-03 06:23 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-07-15 09:38 - 2015-07-03 06:19 - 12855296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-07-15 09:38 - 2015-07-03 05:55 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-07-15 09:38 - 2015-07-03 05:20 - 14453248 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-07-15 09:38 - 2015-07-03 04:59 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-07-15 09:38 - 2015-07-02 08:08 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-07-15 09:38 - 2015-07-02 07:14 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-07-15 09:38 - 2015-06-30 08:43 - 00026288 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-07-15 09:38 - 2015-06-30 01:07 - 01145856 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 01084928 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 00764928 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 00433152 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-07-15 09:38 - 2015-06-28 15:07 - 00442712 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-07-15 09:38 - 2015-06-28 15:07 - 00178008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-07-15 09:38 - 2015-06-28 15:06 - 01311960 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-07-15 09:38 - 2015-06-28 15:06 - 00332120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-07-15 09:38 - 2015-06-28 02:42 - 00747520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-07-15 09:38 - 2015-06-27 13:13 - 00202240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-07-15 09:38 - 2015-06-27 13:12 - 00401408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-07-15 09:38 - 2015-06-27 13:12 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-07-15 09:38 - 2015-06-27 12:40 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-07-15 09:38 - 2015-06-27 12:05 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-07-15 09:38 - 2015-06-27 12:00 - 00989184 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-15 09:38 - 2015-06-27 11:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-07-15 09:38 - 2015-06-27 11:26 - 00802816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-07-15 09:38 - 2015-06-27 09:21 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-07-15 09:38 - 2015-06-27 09:21 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-07-15 09:38 - 2015-06-25 12:31 - 04177920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-07-15 09:38 - 2015-06-16 08:41 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-15 09:38 - 2015-06-16 08:24 - 03320320 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-15 09:38 - 2015-06-16 07:16 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-07-15 09:38 - 2015-06-16 07:09 - 03607552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-07-15 09:38 - 2015-06-16 06:50 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-07-15 09:38 - 2015-06-16 05:57 - 02460160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-07-15 09:38 - 2015-05-31 07:18 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll
2015-07-15 09:38 - 2015-05-31 05:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2015-07-15 09:38 - 2015-05-31 05:35 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-07-15 09:38 - 2015-05-12 04:17 - 01201664 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys
2015-07-15 09:38 - 2015-05-08 03:50 - 22292672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-07-15 09:38 - 2015-05-08 03:00 - 03109376 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2015-07-15 09:38 - 2015-05-08 02:53 - 19734960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-07-15 09:38 - 2015-05-08 02:12 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2015-07-15 09:38 - 2015-05-08 01:21 - 00522240 _____ (Microsoft Corporation) C:\Windows\system32\GeofenceMonitorService.dll
2015-07-15 09:38 - 2015-05-08 01:05 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GeofenceMonitorService.dll
2015-07-15 09:38 - 2015-05-04 01:09 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-07-15 09:38 - 2015-05-04 00:58 - 00210944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-07-15 09:38 - 2015-05-04 00:55 - 00971776 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2015-07-15 09:38 - 2015-05-04 00:49 - 00811008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2015-07-15 09:38 - 2015-05-03 10:39 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-07-15 09:38 - 2015-04-30 09:22 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\WiFiDisplay.dll
2015-07-15 09:38 - 2015-04-25 12:25 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2015-07-15 09:37 - 2015-06-16 15:36 - 01661576 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-15 09:37 - 2015-06-16 15:36 - 01212248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-07-15 09:37 - 2015-06-16 08:39 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-07-15 09:37 - 2015-06-16 08:38 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-07-15 09:37 - 2015-06-16 08:26 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-07-15 09:37 - 2015-06-16 08:24 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-07-15 09:37 - 2015-06-16 08:02 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2015-07-15 09:37 - 2015-06-16 07:58 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-07-15 09:37 - 2015-06-16 07:57 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-07-15 09:37 - 2015-06-16 07:56 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-07-15 09:37 - 2015-06-16 07:55 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-07-15 09:37 - 2015-06-16 07:49 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-07-15 09:37 - 2015-06-16 07:41 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-07-15 09:37 - 2015-06-16 07:38 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-07-15 09:37 - 2015-06-16 07:36 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-07-15 09:37 - 2015-06-16 07:17 - 02880000 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-07-15 09:37 - 2015-06-16 07:16 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-07-15 09:37 - 2015-06-16 07:15 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-07-15 09:37 - 2015-06-16 07:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-07-15 09:37 - 2015-06-16 07:04 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-07-15 09:37 - 2015-06-16 07:03 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-07-15 09:37 - 2015-06-16 06:52 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-07-15 09:37 - 2015-06-16 06:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2015-07-15 09:37 - 2015-06-16 06:44 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-07-15 09:37 - 2015-06-16 06:43 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-07-15 09:37 - 2015-06-16 06:42 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-07-15 09:37 - 2015-06-16 06:41 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-07-15 09:37 - 2015-06-16 06:37 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-07-15 09:37 - 2015-06-16 06:32 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-07-15 09:37 - 2015-06-16 06:31 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-07-15 09:37 - 2015-06-16 06:30 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-07-15 09:37 - 2015-06-16 06:30 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-07-15 09:37 - 2015-06-16 06:17 - 01048576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2015-07-15 09:37 - 2015-06-16 06:07 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-07-15 09:37 - 2015-06-16 06:02 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-07-15 09:37 - 2015-06-11 13:49 - 01380600 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-15 09:37 - 2015-06-11 02:13 - 01097216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-07-15 09:37 - 2015-05-12 23:19 - 00294912 _____ (Microsoft Corporation) C:\Windows\system32\SystemEventsBrokerServer.dll
2015-07-15 09:37 - 2015-05-12 02:34 - 00332800 _____ (Microsoft Corporation) C:\Windows\system32\fhcpl.dll
2015-07-15 09:37 - 2015-05-08 02:47 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-07-15 09:37 - 2015-05-04 01:07 - 07784448 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Data.Pdf.dll
2015-07-15 09:37 - 2015-05-04 00:57 - 05264384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Data.Pdf.dll
2015-07-15 09:37 - 2015-05-02 09:33 - 00410739 _____ C:\Windows\system32\ApnDatabase.xml
2015-07-15 09:37 - 2015-04-28 23:13 - 00513480 _____ C:\Windows\SysWOW64\locale.nls
2015-07-15 09:37 - 2015-04-28 23:13 - 00513480 _____ C:\Windows\system32\locale.nls
2015-07-15 09:37 - 2015-04-24 01:47 - 03084288 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2015-07-15 09:37 - 2015-04-24 01:16 - 02471424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2015-07-14 20:59 - 2015-07-23 20:55 - 00000000 ____D C:\Users\Hugh\AppData\Local\CrashDumps
2015-07-14 08:14 - 2015-07-14 08:14 - 00000000 ____D C:\Users\Default\AppData\Local\Google
2015-07-14 08:14 - 2015-07-14 08:14 - 00000000 ____D C:\Users\Default User\AppData\Local\Google
2015-07-13 21:40 - 2015-07-13 21:40 - 00558328 _____ (Safer-Networking Ltd. ) C:\Users\Hugh\Downloads\spybot2-license.exe
2015-07-13 20:39 - 2015-07-14 08:57 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2015-07-13 20:39 - 2015-07-14 08:11 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-07-13 20:39 - 2015-07-13 20:39 - 00001417 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-07-13 20:39 - 2015-07-13 20:39 - 00001405 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-07-13 20:39 - 2015-07-13 20:39 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2015-07-13 20:39 - 2015-07-13 20:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-07-13 20:39 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-07-13 20:27 - 2015-07-13 20:31 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Hugh\Downloads\spybot-2.4.exe
2015-07-13 15:02 - 2015-07-13 15:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-07-13 15:01 - 2015-07-13 15:01 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Hugh\Downloads\mbam-setup-2.1.8.1057.exe
2015-07-09 09:27 - 2015-07-09 09:27 - 00000000 ____D C:\Users\Public\Downloads\Norton
2015-07-07 20:14 - 2015-07-07 20:14 - 00000500 _____ C:\Users\Hugh\Desktop\asx options.csv
2015-07-07 15:01 - 2015-07-07 15:01 - 1092367527 _____ C:\Windows\MEMORY.DMP
2015-07-07 15:01 - 2015-07-07 15:01 - 01270288 _____ C:\Windows\Minidump\070715-12031-01.dmp
2015-07-07 15:01 - 2015-07-07 15:01 - 00000000 ____D C:\Windows\Minidump
2015-07-07 13:10 - 2015-07-07 13:10 - 03121152 _____ C:\Users\Hugh\Downloads\TWS API Install 972.03.msi
2015-07-06 08:24 - 2015-07-27 18:55 - 00009728 ___SH C:\Users\Hugh\Desktop\Thumbs.db
2015-06-28 13:34 - 2015-06-28 13:34 - 00000000 ____D C:\ProgramData\Samsung
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-28 19:40 - 2015-06-07 17:03 - 00000000 ____D C:\Users\Hugh\AppData\Local\Packages
2015-07-28 19:38 - 2015-06-07 19:14 - 00004980 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for HUGH_LAPTOP-Hugh Hugh_Laptop
2015-07-28 18:46 - 2015-06-07 17:45 - 00000930 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-07-28 13:41 - 2015-06-07 17:44 - 00003934 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{3D2F1FB9-A0C3-47F9-8104-40390AB06AAF}
2015-07-28 10:49 - 2015-06-07 15:51 - 01437386 _____ C:\Windows\WindowsUpdate.log
2015-07-28 10:38 - 2013-08-23 01:36 - 00000000 ____D C:\Windows\AppReadiness
2015-07-28 10:05 - 2015-06-07 19:30 - 00000000 ____D C:\Jts
2015-07-28 09:17 - 2015-06-07 17:09 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2823309964-2513555705-3651140861-1001
2015-07-28 09:03 - 2013-08-23 01:36 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-07-28 08:54 - 2014-03-18 20:03 - 00865408 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-27 18:56 - 2015-06-07 17:45 - 00000926 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-07-27 18:56 - 2015-06-07 17:09 - 00000000 ___RD C:\Users\Hugh\OneDrive
2015-07-27 18:55 - 2014-03-18 19:54 - 00583446 _____ C:\Windows\PFRO.log
2015-07-27 18:55 - 2013-08-23 00:46 - 00057052 _____ C:\Windows\setupact.log
2015-07-27 18:55 - 2013-08-23 00:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-27 18:55 - 2013-08-22 23:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2015-07-27 18:51 - 2015-06-26 18:40 - 00000000 ____D C:\Program Files (x86)\AmiBroker
2015-07-27 08:48 - 2015-06-07 17:46 - 00002213 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-07-27 08:32 - 2015-06-08 17:08 - 00000000 ___SD C:\Windows\system32\GWX
2015-07-27 08:30 - 2015-06-07 19:14 - 00003100 _____ C:\Windows\System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-2823309964-2513555705-3651140861-1001
2015-07-24 08:33 - 2013-08-23 01:36 - 00000000 ____D C:\Windows\rescache
2015-07-23 22:19 - 2015-06-07 17:02 - 00000000 ____D C:\Users\Hugh
2015-07-23 18:18 - 2015-06-07 19:09 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-07-23 18:18 - 2013-08-23 00:44 - 00481880 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-21 10:59 - 2013-08-23 01:20 - 00000000 ____D C:\Windows\CbsTemp
2015-07-20 21:25 - 2015-06-07 19:22 - 00001692 _____ C:\Users\Hugh\Desktop\Google Drive.lnk
2015-07-20 08:27 - 2015-06-07 19:22 - 00000000 ___RD C:\Users\Hugh\Google Drive
2015-07-19 17:58 - 2015-06-07 17:45 - 00000000 ____D C:\Program Files (x86)\Google
2015-07-16 08:41 - 2015-06-07 17:45 - 00003902 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-07-16 08:41 - 2015-06-07 17:45 - 00003666 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-07-16 08:28 - 2013-08-23 01:36 - 00000000 ___RD C:\Windows\ToastData
2015-07-16 08:28 - 2013-08-23 01:36 - 00000000 ____D C:\Windows\WinStore
2015-07-15 09:43 - 2015-06-12 15:39 - 00000000 ____D C:\Windows\system32\appraiser
2015-07-15 09:43 - 2015-06-08 17:08 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-07-15 09:42 - 2015-06-08 16:59 - 00000000 ____D C:\Windows\system32\MRT
2015-07-15 08:31 - 2014-11-05 10:48 - 00000000 ____D C:\ProgramData\Norton
2015-07-14 09:12 - 2015-06-08 17:08 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-07-14 08:14 - 2015-06-07 19:20 - 00002068 _____ C:\Users\Public\Desktop\Google Slides.lnk
2015-07-14 08:14 - 2015-06-07 19:20 - 00002066 _____ C:\Users\Public\Desktop\Google Sheets.lnk
2015-07-14 08:14 - 2015-06-07 19:20 - 00002056 _____ C:\Users\Public\Desktop\Google Docs.lnk
2015-07-14 08:14 - 2015-06-07 19:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-07-14 08:07 - 2014-11-05 10:49 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-07-14 08:05 - 2013-08-23 01:36 - 00000000 ___HD C:\Windows\ELAMBKUP
2015-07-14 08:05 - 2013-08-22 23:25 - 00262144 ___SH C:\Windows\system32\config\ELAM
2015-07-14 07:10 - 2015-06-08 17:17 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-14 07:10 - 2015-06-08 17:17 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-07 13:16 - 2015-06-07 19:31 - 00000000 ____D C:\TWS API
2015-07-03 08:43 - 2015-06-08 16:59 - 130333168 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
==================== Files in the root of some directories =======
2015-07-20 11:05 - 2015-07-20 11:05 - 0000017 _____ () C:\Users\Hugh\AppData\Local\resmon.resmoncfg
2015-01-23 15:12 - 2015-01-23 15:12 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-07-15 08:42
==================== End of log ============================
Additional scan result of Farbar Recovery Scan Tool (x64) Version:26-07-2015
Ran by Hugh at 2015-07-28 19:45:16
Running from C:\Users\Hugh\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-2823309964-2513555705-3651140861-500 - Administrator - Disabled)
Guest (S-1-5-21-2823309964-2513555705-3651140861-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2823309964-2513555705-3651140861-1003 - Limited - Enabled)
Hugh (S-1-5-21-2823309964-2513555705-3651140861-1001 - Administrator - Enabled) => C:\Users\Hugh
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Spybot - Search and Destroy (Enabled - Up to date) {20A26C15-1AF0-7CA3-9380-FAB824A7EE0D}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
AmiBroker 5.60.3 x64 (HKLM\...\AmiBroker64_is1) (Version: 5.60 - AmiBroker.com)
AmiBroker 5.90.1 (HKLM-x32\...\AmiBroker_is1) (Version: 5.90 - AmiBroker.com)
Battery Calibration (HKLM-x32\...\{619FA785-489B-4D22-911F-82D6EDF5BDB0}) (Version: 1.0.1405.0701 - Micro-Star International Co., Ltd.)
Boot Configure (HKLM-x32\...\{5563D674-6B02-43F4-B9D0-C2A944E84F3C}) (Version: 20.014.12127 - Micro-Star International Co., Ltd.)
BurnRecovery (HKLM-x32\...\{2892E1B7-E24D-4CCB-B8A7-B63D4B66F89F}) (Version: 4.0.1412.2301 - )
CutePDF Writer 3.0 (HKLM\...\CutePDF Writer Installation) (Version: 3.0 - Acro Software Inc.)
CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.5509.52 - CyberLink Corp.)
Dragon Gaming Center (HKLM-x32\...\InstallShield_{965B16C7-0778-4C45-B7D1-83A59E6FBBCB}) (Version: 1.0.1410.1301 - Micro-Star International Co., Ltd.)
Dragon Gaming Center (x32 Version: 1.0.1410.1301 - Micro-Star International Co., Ltd.) Hidden
ELAN Touchpad 11.13.11.4_X64_WHQL (HKLM\...\Elantech) (Version: 11.13.11.4 - ELAN Microelectronic Corp.)
Excel VBA Code Cleaner 5.0 (HKLM-x32\...\Excel VBA Code Cleaner 5.0) (Version: - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 44.0.2403.107 - Google Inc.)
Google Drive (HKLM-x32\...\{6EA8B94E-D869-4D96-88DF-5E1ECE1D6876}) (Version: 1.23.9648.8824 - Google, Inc.)
Google Earth (HKLM-x32\...\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)
Google Update Helper (x32 Version: 1.3.21.115 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.28.1 - Google Inc.) Hidden
Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{0EC7F9CC-4741-45AE-9F55-6E9343F726F5}) (Version: 1.1.0.36960 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4170 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 13.5.0.1056 - Intel Corporation)
Intel(R) Wireless Bluetooth(R)(patch version 17.1.1434.2) (HKLM\...\{302600C1-6BDF-4FD1-1407-148929CC1385}) (Version: 17.1.1407.0480 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{85b9d34f-7397-4e39-8600-07942ef6ca04}) (Version: 17.0.5 - Intel Corporation)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
KB9X Radio Switch Driver (HKLM\...\5AADE1068CF70DD983F763B20CF2CAAB72883915) (Version: 1.1.0.0 - ENE TECHNOLOGY INC.)
KeePass Password Safe 1.29 (HKLM-x32\...\KeePass Password Safe_is1) (Version: 1.29 - Dominik Reichl)
KLM (HKLM-x32\...\InstallShield_{4DEA5B85-6C56-45F3-AE00-FED756B0D3B4}) (Version: 1.0.1411.1101 - Application)
KLM (x32 Version: 1.0.1411.1101 - Application) Hidden
MAGIX MX Suite (HKLM-x32\...\MAGIX_{43136332-880B-458A-966C-900C18752B66}) (Version: 1.13.0.121 - MAGIX AG)
MAGIX MX Suite (Version: 1.13.0.121 - MAGIX AG) Hidden
Malwarebytes Anti-Malware version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 15.0.4737.1003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\OneDriveSetup.exe) (Version: 17.3.5907.0716 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
MSI Remind Manager (HKLM-x32\...\InstallShield_{3E23F267-3E35-40F9-B6BF-BC034D214717}) (Version: 1.0.1412.1801 - Micro-Star International Co., Ltd.)
MSI Remind Manager (x32 Version: 1.0.1412.1801 - Micro-Star International Co., Ltd.) Hidden
MSI Social Media Collection (HKLM-x32\...\{7ADEC426-BE95-48EF-84D4-086BD0F4D331}) (Version: 1.14.2251 - Micro-Star International Co., Ltd.)
Nahimic APO (x32 Version: 1.0.401 - Nahimic) Hidden
Nahimic for MSI (HKLM-x32\...\{d790cc66-b17a-4c88-96a8-cb6506bfdfe4}) (Version: 1.0.4 - Nahimic)
Nahimic for MSI (Version: 1.0.401 - Nahimic) Hidden
NahimicSettingsConfigurator (Version: 1.0.401 - Nahimic) Hidden
NVIDIA GeForce Experience 2.1.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.5 - NVIDIA Corporation)
NVIDIA Graphics Driver 345.05 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 345.05 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
Qualcomm Atheros Bandwidth Control Filter Driver (Version: 1.1.46.1056 - Qualcomm Atheros) Hidden
Qualcomm Atheros Killer E220x Drivers (Version: 1.1.46.1056 - Qualcomm Atheros) Hidden
Qualcomm Atheros Killer Performance Suite (HKLM-x32\...\{E70DB50B-10B4-46BC-9DE2-AB8B49E061EE}) (Version: 1.1.46.1056 - Qualcomm Atheros)
Qualcomm Atheros Network Manager (Version: 1.1.46.1056 - Qualcomm Atheros) Hidden
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.21249 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7427 - Realtek Semiconductor Corp.)
SCM (HKLM\...\{9BC0C4F3-ACBB-42DF-9559-93175E3B4095}) (Version: 13.014.11068 - Application)
SHIELD Streaming (Version: 3.1.3000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.18.9 - NVIDIA Corporation) Hidden
Sizing Options (HKLM-x32\...\InstallShield_{DFAB6DE8-E45F-4D5D-95C0-E54C58993F9F}) (Version: 2.0.1412.1501 - Application)
Sizing Options (x32 Version: 2.0.1412.1501 - Application) Hidden
Skype™ 7.6 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.6.105 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
SUPER CHARGER (HKLM-x32\...\{7CDF10DD-A9B5-4DA3-AB95-E193248D4369}_is1) (Version: 1.2.024 - MSI)
Telstra Mobile Broadband Manager (HKLM-x32\...\Telstra Mobile Broadband Manager) (Version: 3.0.514 - Telstra)
Telstra Mobile Broadband Manager (x32 Version: 3.0.514 - Telstra) Hidden
Trader Workstation 4.0 (HKLM-x32\...\Trader Workstation 4.0) (Version: - )
Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 2.2.0 - Tweaking.com)
TWS API (HKLM-x32\...\{AF3F53E2-2766-45B4-9F2F-AA8A51AD5C85}) (Version: 9.72.03 - IBG LLC)
Windows Driver Package - Cmotech (cmusbnet) Net (06/11/2007 2.0.0.9) (HKLM\...\51208688C66699298C32E38B6BFF92816EE798CA) (Version: 06/11/2007 2.0.0.9 - Cmotech)
Windows Driver Package - Cmotech Modem (06/08/2007 2.0.3.9) (HKLM\...\7404D4336C2B621F88A2B25CE6577572A8BBD25A) (Version: 06/08/2007 2.0.3.9 - Cmotech)
Windows Driver Package - Cmotech Ports (06/08/2007 2.0.3.9) (HKLM\...\2021A90B4F2D70AB98CFBF428E09767703FD455E) (Version: 06/08/2007 2.0.3.9 - Cmotech)
WinZip 17.5 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240DD}) (Version: 17.5.10562 - WinZip Computing, S.L. )
ZTE USB Driver (HKLM\...\ZTE USB Driver) (Version: 1.0.1.16+ - ZTE Corporation)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5907.0716\amd64\FileSyncApi64.dll (Microsoft Corporation)
==================== Restore Points =========================
14-07-2015 08:07:25 Removed Norton Online Backup
21-07-2015 10:59:03 Windows Update
22-07-2015 17:20:46 JRT Pre-Junkware Removal
23-07-2015 18:24:42 JRT Pre-Junkware Removal
27-07-2015 18:54:35 Restore Point Created by FRST
28-07-2015 09:03:42 WLSetup
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 23:25 - 2015-07-27 18:54 - 00000035 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {0B8D66F8-C18F-4C06-A1DE-46C1CEC81B8B} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-07-03] (Microsoft Corporation)
Task: {0BE1DFE1-62AA-4F2F-B982-B96D91006FC7} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {4D53FB81-2EE9-4344-B1CA-10116BFA0FAC} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-01] (Microsoft Corporation)
Task: {5619C3C6-4E00-49A0-9DA1-8E201B3B9D51} - System32\Tasks\MSI_Dragon Gaming Center => C:\Program Files (x86)\MSI\Dragon Gaming Center\mDispatch.exe [2014-01-24] (TODO: <公司名稱>)
Task: {68F9B4FD-F709-4B87-8D5C-38F825D63DC5} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-06-09] (Microsoft Corporation)
Task: {6E7E4E9F-8D07-4885-901A-A97D0F9BDB5A} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-08] (Intel Corporation)
Task: {783F8E13-DD52-4936-8A7D-A91CA4F51052} - System32\Tasks\NahimicMSIsvc32Run => C:\Program Files\Nahimic\NahimicMSI\UserInterface\NahimicMSIsvc32.exe [2015-01-17] ()
Task: {7A468A53-C4AC-4A64-90ED-6952EEF05F3F} - System32\Tasks\NahimicMSIsvc64Run => C:\Program Files\Nahimic\NahimicMSI\UserInterface\x64\NahimicMSIsvc64.exe [2015-01-17] ()
Task: {86ED10AE-8A7F-41C6-B4A2-1B437337651D} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {A3C097C9-2D25-44E2-82A5-ED4D815E9BDC} - System32\Tasks\Microsoft Office 15 Sync Maintenance for HUGH_LAPTOP-Hugh Hugh_Laptop => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-06-02] (Microsoft Corporation)
Task: {AD396995-5451-47DC-9242-0FEE5430D802} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-2823309964-2513555705-3651140861-1001 => %localappdata%\Microsoft\OneDrive\OneDrive.exe
Task: {B5AB7F8D-6F2E-4527-AAD5-CF1239851899} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-07] (Google Inc.)
Task: {BE35EB41-0163-479E-BCDF-C4D8167F4473} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-01] (Microsoft Corporation)
Task: {CBAAE99B-E34F-47E6-949D-20D5EF5B6EBE} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {D1FA0D76-962C-426A-8091-5E9C55A6320C} - System32\Tasks\NahimicMSIUILauncherRun => C:\Program Files\Nahimic\NahimicMSI\UserInterface\NahimicMSIUILauncher.exe [2015-01-17] ()
Task: {F51F4499-139A-4ABA-B336-4DA5FF0B93C4} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-07] (Google Inc.)
Task: {F61A8720-B7BB-423A-87F0-B0857571A774} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-08] (Intel Corporation)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (Whitelisted) ==============
2015-01-23 15:14 - 2014-12-24 20:38 - 00115912 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-07-27 09:46 - 2013-10-23 15:24 - 00087600 _____ () C:\Windows\System32\cpwmon64.dll
2015-06-22 05:24 - 2015-06-22 05:24 - 00022528 _____ () C:\Windows\System32\us005lm.dll
2015-06-07 19:09 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-06-08 17:34 - 2015-06-08 17:34 - 08898720 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2014-01-23 04:44 - 2014-01-23 04:44 - 00075912 _____ () C:\Program Files (x86)\MSI\Dragon Gaming Center\WinIo64.dll
2013-05-24 03:15 - 2013-05-24 03:15 - 00025600 _____ () C:\Program Files (x86)\MSI\Dragon Gaming Center\CoreAudioApi.dll
2014-08-19 05:40 - 2014-08-19 05:40 - 00330240 _____ () C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe
2013-05-10 11:58 - 2013-05-10 11:58 - 00119808 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\updateui.exe
2015-07-06 08:28 - 2015-07-06 08:28 - 00183296 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\ErrorReporting.dll
2015-07-13 20:39 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-07-13 20:39 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-07-13 20:39 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-07-13 20:39 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-07-13 20:39 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2015-07-27 18:56 - 2015-07-27 18:56 - 00098816 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32api.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00110080 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\pywintypes27.dll
2015-07-27 18:56 - 2015-07-27 18:56 - 00364544 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\pythoncom27.dll
2015-07-27 18:56 - 2015-07-27 18:56 - 00045568 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\_socket.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 01161216 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\_ssl.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00320512 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32com.shell.shell.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00713216 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\_hashlib.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 01175040 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\wx._core_.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00805888 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\wx._gdi_.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00811008 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\wx._windows_.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 01062400 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\wx._controls_.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00735232 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\wx._misc_.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00682496 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\pysqlite2._sqlite.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00087552 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\_ctypes.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00119808 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32file.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00108544 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32security.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00007168 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\hashobjs_ext.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00068096 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\usb_ext.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00167936 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32gui.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00018432 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32event.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00128512 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\_elementtree.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00127488 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\pyexpat.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00013824 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\common.time34.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00036864 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\_psutil_windows.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00038912 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32inet.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00011264 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32crypt.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00070656 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\wx._html2.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00027136 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\_multiprocessing.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00020480 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\_yappi.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00035840 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32process.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00686080 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\unicodedata.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00122368 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\wx._wizard.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00024064 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32pipe.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00010240 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\select.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00025600 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32pdh.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00525640 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\windows._lib_cacheinvalidation.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00017408 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32profile.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00022528 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32ts.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00078336 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\wx._animate.pyd
2015-01-23 15:11 - 2013-09-17 06:17 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2010-12-18 06:56 - 2010-12-18 06:56 - 02603520 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\QtCore4.dll
2013-03-08 06:53 - 2013-03-08 06:53 - 00015872 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\featureController.dll
2010-12-18 06:56 - 2010-12-18 06:56 - 01006592 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\QtNetwork4.dll
2010-12-18 06:56 - 2010-12-18 06:56 - 00382464 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\QtXml4.dll
2010-01-13 10:55 - 2010-01-13 10:55 - 00400384 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\sqlite3.dll
2010-01-13 10:55 - 2010-01-13 10:55 - 00322048 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\log4cplus.dll
2010-12-17 06:16 - 2010-12-17 06:16 - 00195584 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\libgsoap.dll
2010-01-18 17:34 - 2010-01-18 17:34 - 00062464 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\zlib1.dll
2013-03-08 06:55 - 2013-03-08 06:55 - 00472576 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\DeviceProfile.dll
2013-03-08 06:58 - 2013-03-08 06:58 - 00499488 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\plugin\PServerPlugin.dll
2013-03-08 06:54 - 2013-03-08 06:54 - 00013824 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\eventsSender.dll
2010-12-18 06:56 - 2010-12-18 06:56 - 14978048 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\QtWebKit4.dll
2010-12-18 06:56 - 2010-12-18 06:56 - 09224704 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\QtGui4.dll
2010-12-18 06:56 - 2010-12-18 06:56 - 00317952 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\phonon4.dll
2015-07-27 08:48 - 2015-07-24 08:39 - 01405768 _____ () C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.107\libglesv2.dll
2015-07-27 08:48 - 2015-07-24 08:39 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.107\libegl.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Users\Hugh\OneDrive:ms-properties
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com
There are 7866 more restricted sites.
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\System32\oobe\info\Wallpaper\backgroundDefault.jpg
DNS Servers: 10.0.0.138
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{2D3AC92D-79CE-48F3-B94E-986B1DFA255D}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{6BF214AB-A286-4902-8A28-31EB04D7BF61}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{A716ED6C-4C75-42C2-9D3E-58027E049AE7}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{21288DD7-E4D4-4BF2-90BF-AB99B749D116}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{1972B00C-10E4-4AA2-8590-2765619747F0}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{CDC47814-1B28-4EC9-886F-668D7399C0F7}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{F20C674D-D846-4DDC-BC35-5A1A803A26AF}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{A9055384-AE0A-48C4-805D-B9F9D2DEE085}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{C6744919-EAC7-417A-B4D7-28F0A859701A}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{B6B6CA70-94FD-41DF-97BC-BF8A4F0B5A8D}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{7A705F37-593F-4CE8-8A69-8DFDEFED882A}] => (Allow) C:\Users\Hugh\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [TCP Query User{E08765E9-A930-48B9-B7E6-D05B4685593B}C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe
FirewallRules: [UDP Query User{62C52245-8937-43AA-878D-D9D83BCC5BEE}C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe
FirewallRules: [TCP Query User{06E9B8AC-47BD-4110-9090-423D07B682E7}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{0BBAB1B7-5F6B-432A-8195-FC5449330FBB}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{0610B524-831C-409A-AAE8-C7CA9EB537A9}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{C267FC24-0437-4945-AC60-DC8D8C16213B}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{2E70FEAA-283E-47EE-832F-6621B0FD33E6}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (07/28/2015 05:52:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: KillerService.exe, version: 1.1.46.1056, time stamp: 0x53f22c94
Faulting module name: KillerService.exe, version: 1.1.46.1056, time stamp: 0x53f22c94
Exception code: 0xc0000005
Fault offset: 0x00000000000160c9
Faulting process id: 0x8c8
Faulting application start time: 0xKillerService.exe0
Faulting application path: KillerService.exe1
Faulting module path: KillerService.exe2
Report Id: KillerService.exe3
Faulting package full name: KillerService.exe4
Faulting package-relative application ID: KillerService.exe5
Error: (07/27/2015 10:01:20 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT AUTHORITY)
Description: There was an error with the Windows Location Provider database
Error: (07/27/2015 06:56:34 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8
Error: (07/27/2015 06:55:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: SDOnAccess.exe, version: 2.4.40.11, time stamp: 0x535a5123
Faulting module name: KERNELBASE.dll, version: 6.3.9600.17415, time stamp: 0x54504ade
Exception code: 0x0eedfade
Fault offset: 0x00014598
Faulting process id: 0x39b84
Faulting application start time: 0xSDOnAccess.exe0
Faulting application path: SDOnAccess.exe1
Faulting module path: SDOnAccess.exe2
Report Id: SDOnAccess.exe3
Faulting package full name: SDOnAccess.exe4
Faulting package-relative application ID: SDOnAccess.exe5
Error: (07/27/2015 06:54:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: SDOnAccess.exe, version: 2.4.40.11, time stamp: 0x535a5123
Faulting module name: KERNELBASE.dll, version: 6.3.9600.17415, time stamp: 0x54504ade
Exception code: 0x0eedfade
Fault offset: 0x00014598
Faulting process id: 0x25d40
Faulting application start time: 0xSDOnAccess.exe0
Faulting application path: SDOnAccess.exe1
Faulting module path: SDOnAccess.exe2
Report Id: SDOnAccess.exe3
Faulting package full name: SDOnAccess.exe4
Faulting package-relative application ID: SDOnAccess.exe5
Error: (07/27/2015 06:54:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: SDOnAccess.exe, version: 2.4.40.11, time stamp: 0x535a5123
Faulting module name: KERNELBASE.dll, version: 6.3.9600.17415, time stamp: 0x54504ade
Exception code: 0x0eedfade
Fault offset: 0x00014598
Faulting process id: 0x2bc78
Faulting application start time: 0xSDOnAccess.exe0
Faulting application path: SDOnAccess.exe1
Faulting module path: SDOnAccess.exe2
Report Id: SDOnAccess.exe3
Faulting package full name: SDOnAccess.exe4
Faulting package-relative application ID: SDOnAccess.exe5
Error: (07/27/2015 06:54:27 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.
Operation:
Gathering Writer Data
Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {9ee319ee-9c7c-47a7-8379-b08516b9c2f7}
Error: (07/27/2015 06:54:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: SDOnAccess.exe, version: 2.4.40.11, time stamp: 0x535a5123
Faulting module name: KERNELBASE.dll, version: 6.3.9600.17415, time stamp: 0x54504ade
Exception code: 0x0eedfade
Fault offset: 0x00014598
Faulting process id: 0x3c4c8
Faulting application start time: 0xSDOnAccess.exe0
Faulting application path: SDOnAccess.exe1
Faulting module path: SDOnAccess.exe2
Report Id: SDOnAccess.exe3
Faulting package full name: SDOnAccess.exe4
Faulting package-relative application ID: SDOnAccess.exe5
Error: (07/27/2015 09:46:08 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_a9edf09f013934e0.manifest.
Error: (07/27/2015 08:47:43 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: EXCEL.EXE, version: 15.0.4737.1000, time stamp: 0x55801e38
Faulting module name: EXCEL.EXE, version: 15.0.4737.1000, time stamp: 0x55801e38
Exception code: 0xc0000005
Fault offset: 0x000075e9
Faulting process id: 0x8818
Faulting application start time: 0xEXCEL.EXE0
Faulting application path: EXCEL.EXE1
Faulting module path: EXCEL.EXE2
Report Id: EXCEL.EXE3
Faulting package full name: EXCEL.EXE4
Faulting package-relative application ID: EXCEL.EXE5
System errors:
=============
Error: (07/28/2015 05:52:12 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Qualcomm Atheros Killer Service V2 service terminated unexpectedly. It has done this 1 time(s).
Error: (07/27/2015 06:55:24 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Spybot-S&D 2 Security Center Service service depends on the Security Center service which failed to start because of the following error:
%%1068
Error: (07/27/2015 06:55:24 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Security Center service depends on the Windows Management Instrumentation service which failed to start because of the following error:
%%1115
Error: (07/27/2015 06:55:24 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Spybot-S&D 2 Updating Service service failed to start due to the following error:
%%1053
Error: (07/27/2015 06:55:24 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Spybot-S&D 2 Updating Service service to connect.
Error: (07/27/2015 06:55:24 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Spybot-S&D 2 Scanner Service service failed to start due to the following error:
%%1053
Error: (07/27/2015 06:55:24 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Spybot-S&D 2 Scanner Service service to connect.
Error: (07/27/2015 06:55:21 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.
Module Path: C:\Windows\System32\IWMSSvc.dll
Error: (07/27/2015 06:55:21 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.
Module Path: C:\Windows\System32\IWMSSvc.dll
Error: (07/27/2015 06:55:20 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.
Module Path: C:\Windows\System32\IWMSSvc.dll
Microsoft Office:
=========================
Error: (07/28/2015 05:52:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: KillerService.exe1.1.46.105653f22c94KillerService.exe1.1.46.105653f22c94c000000500000000000160c98c801d0c84a0740003aC:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exeC:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe8c31cd59-34fd-11e5-827f-d8cb8a7e33a7
Error: (07/27/2015 10:01:20 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT AUTHORITY)
Description: -2147024883
Error: (07/27/2015 06:56:34 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8
Error: (07/27/2015 06:55:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: SDOnAccess.exe2.4.40.11535a5123KERNELBASE.dll6.3.9600.1741554504ade0eedfade0001459839b8401d0c849efb96264C:\Program Files (x86)\Spybot - Search & Destroy 2\SDOnAccess.exeC:\Windows\SYSTEM32\KERNELBASE.dll2d6d154a-343d-11e5-827e-d8cb8a7e33a7
Error: (07/27/2015 06:54:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: SDOnAccess.exe2.4.40.11535a5123KERNELBASE.dll6.3.9600.1741554504ade0eedfade0001459825d4001d0c849e602fadaC:\Program Files (x86)\Spybot - Search & Destroy 2\SDOnAccess.exeC:\Windows\SYSTEM32\KERNELBASE.dll23b44b6b-343d-11e5-827e-d8cb8a7e33a7
Error: (07/27/2015 06:54:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: SDOnAccess.exe2.4.40.11535a5123KERNELBASE.dll6.3.9600.1741554504ade0eedfade000145982bc7801d0c849e5da72c3C:\Program Files (x86)\Spybot - Search & Destroy 2\SDOnAccess.exeC:\Windows\SYSTEM32\KERNELBASE.dll238bc3e7-343d-11e5-827e-d8cb8a7e33a7
Error: (07/27/2015 06:54:27 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Access is denied.
Operation:
Gathering Writer Data
Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {9ee319ee-9c7c-47a7-8379-b08516b9c2f7}
Error: (07/27/2015 06:54:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: SDOnAccess.exe2.4.40.11535a5123KERNELBASE.dll6.3.9600.1741554504ade0eedfade000145983c4c801d0c849d59a4e29C:\Program Files (x86)\Spybot - Search & Destroy 2\SDOnAccess.exeC:\Windows\SYSTEM32\KERNELBASE.dll138e611b-343d-11e5-827e-d8cb8a7e33a7
Error: (07/27/2015 09:46:08 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_a9edf09f013934e0.manifestC:\Users\Hugh\AppData\Local\Temp\is-33AG9.tmp\Offercast3410_ARS_.exe
Error: (07/27/2015 08:47:43 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: EXCEL.EXE15.0.4737.100055801e38EXCEL.EXE15.0.4737.100055801e38c0000005000075e9881801d0c7f4fde3a7d5C:\Program Files\Microsoft Office 15\root\office15\EXCEL.EXEC:\Program Files\Microsoft Office 15\root\office15\EXCEL.EXE5319cf14-33e8-11e5-827e-d8cb8a7e33a7
CodeIntegrity Error:
===================================
Date: 2015-07-28 19:42:52.577
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-07-28 17:52:07.221
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-07-28 15:50:47.907
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-07-28 14:44:46.900
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-07-28 14:27:09.132
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-07-28 13:55:14.254
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-07-28 13:26:42.554
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-07-28 13:01:21.507
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-07-28 10:55:56.930
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-07-28 10:46:54.870
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-4720HQ CPU @ 2.60GHz
Percentage of memory in use: 49%
Total physical RAM: 8109.81 MB
Available physical RAM: 4082 MB
Total Virtual: 16301.81 MB
Available Virtual: 11367.88 MB
==================== Drives ================================
Drive c: (OS_Install) (Fixed) (Total:118.24 GB) (Free:58.23 GB) NTFS
Drive d: (DATA) (Fixed) (Total:915.12 GB) (Free:888.03 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 4E9EEB76)
Partition: GPT Partition Type.
========================================================
Disk: 1 (Size: 119.2 GB) (Disk ID: 4E9EEB6B)
Partition: GPT Partition Type.
==================== End of log ============================
:bigthumb:
How is your system behaving now ?
So far I haven't had a problem. Thanks again for the help, I appreciate your time and effort. Hopefully its gone for good.
:cool:
Great, I'll leave this thread open for a couple of days for you in case it comes back, after that if you still need help just start a new topic
Ken :)
Ken, I am getting less occurrences of the malware, but it hasn't gone completely...
What should I do next?
Morning,
Lets try a few things
Download Avast-browser-cleanup (http://files.avast.com/files/tools/avast-browser-cleanup.exe) to your desktop
There is nothing to install, just right click on it and Run As Adminstrator
When its finished scanning it will list Browser Add ONs
If if finds Total Ad Performance or any other bogus toolbars
Just high light them and select REMOVE
Close out the program
Reboot your system and test your browsers
=============================================
Open Internet Explorer
Click on Tools up on the top right
Click on Manage Add Ons from the dropdown list
In this window you can manage the Internet Explorer add-ons
Click on Search Providers
Click on the option Toolbars and Extensions on left side of the window.
Then click on the malicious items to remove Total Ad Performance
Make Google you default
Close IE and then open it again and see if Total Ad Performance are gone
==============================================
Open Chrome
Click the Chrome menu http://i24.photobucket.com/albums/c30/ken545/Clipboard01_zps2e55f676.jpgon the browser toolbar.
Click on Settings
Then Manage Search Engines
Highlite Total Ad Performance and select Delete
Then go to Other Search Engines and remove all you dont want
=========================================================
Open Firefox
Up on the Top Right in the Search Box , click on the down arrow and select Manage Search Engines
Highlite Total Ad Performance and select Delete
If all of the above doesn't fix it, then lets try setting all your browsers back to defaults
Open IE
Go to Tools> Internet Options > Advanced Tab
Reset Internet Explorer Setting
Reset
This will take a few seconds
Close IE and then reopen it and see if it helped
Click the Chrome menu http://i24.photobucket.com/albums/c30/ken545/Clipboard01_zps2e55f676.jpgon the browser toolbar.
Select Settings.
Scroll down to Show advanced settings...
Down on the bottom you will see an option for RESET BROWSER SETTINGS
Click on it and it will set Chome back to defaults
Open Firefox
Click on Help > Troubleshooting Information > Reset Firefox to its default state
Thanks Ken, one of these steps has helped. If it still causes a problem I'll contact you again.
:bigthumb:
Again I will leave this thread open for about 3 days for you, lets hope this pest is gone
$%^&&^%$$....its still there, time to reformat hard drive? or any other ideas? tks again Ken
Morning
Lets try something else, you will need to run the 64 bit version of this program.
Download and Run SystemLook
Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1 (http://jpshortstuff.247fixes.com/SystemLook.exe)
Download Mirror #2 (http://images.malwareremoval.com/jpshortstuff/SystemLook.exe)
64 Bit Version (http://jpshortstuff.247Fixes.com/SystemLook_x64.exe)
Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
:folderfind
Total Ad Performance
:filefind
Total Ad Performance
:regfind
Total Ad Performance
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
If SystemLook does not find it than it maybe spelled wrong, run it again with this
TotalAdPerformance
It didn't find anything using both spellings.
It may not be totaladperformance opening up random pages anymore. foxstories opened up randomly. Maybe there is another malware running?
Lets take another look, open up FRST, checkmark Additions, run a new scan and post both logs
Ken, I ran the logs but they exceed the forum's file size limit and I couldn't upload them. How can I attach them?
A new page in Chrome called totaltradeexchange was opened....could this be a new malware?
Good Morning,
If you look through this thread you attached the SystemLook report just fine.
Click on Reply to Thread, then up on the top toolbar look for the attachment logo, choose file from your computer than upload it, do this both for FRST and Additions, take two reply, one for each
The files exceed the size limit for the forum by a couple of kBs. Will deleting old uploads help?
I am going to see about increasing the size of what can be posted. You had windows 8.1, did you by chance upgrade to Windows 10, if you did it makes the FRST log very large with all the new files
Do the FRST and Additions logs separately, post a new reply for each one
Right click on FRST and select Send To Compressed Zip folder and attach it and post, then do the same thing for Additions
Ken you are right, I've just updated to Win 10. Both zipped files are attached.
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:09-08-2015
Ran by Hugh (administrator) on HUGH_LAPTOP (10-08-2015 20:06:29)
Running from C:\Users\Hugh\Desktop
Loaded Profiles: Hugh (Available Profiles: Hugh)
Platform: Windows 10 Home (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\SCM\MSIService.exe
(MSI) C:\Program Files (x86)\MSI\SUPER CHARGER\ChargeService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Qualcomm Atheros) C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.1\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.1\GoogleCrashHandler64.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\System32\taskhostw.exe
(Microsoft Corporation) C:\Windows\System32\sihost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Oracle Corporation) C:\Program Files (x86)\Java\jre1.8.0_51\bin\javaw.exe
(MSI) C:\Program Files (x86)\SCM\SCM.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\MSI\Dragon Gaming Center\Dragon Gaming Center.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Microsoft Corporation) C:\Windows\System32\fontdrvhost.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\MSI\KLM\KLM.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(MSI) C:\Program Files (x86)\MSI\SUPER CHARGER\SUPER CHARGER.exe
(Telstra) C:\Program Files (x86)\Telstra\Mobile Broadband Manager\TelstraUCM.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Windows\System32\ApplicationFrameHost.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\ismagent.exe
() C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\updateui.exe
(Microsoft Corporation) C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\outlook.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\AppVShNotify.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.803.16240.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_2015.8.3.0_x64__8wekyb3d8bbwe\WinStore.Mobile.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe
(Microsoft Corporation) C:\Windows\System32\SystemSettingsBroker.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\NetworkUXBroker.exe
(Cisco WebEx LLC) C:\ProgramData\webex\WebEx\500\nbrplay.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\winword.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\excel.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [3347688 2015-08-09] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8492800 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2015-01-22] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [322712 2014-10-10] (Intel Corporation)
HKLM\...\Run: [SCM] => C:\Program Files (x86)\SCM\SCM.exe [405504 2014-11-07] (MSI)
HKLM-x32\...\Run: [KLM] => C:\Program Files (x86)\MSI\KLM\KLM.exe [1569416 2014-11-12] (Micro-Star International Co., Ltd.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-09] (CyberLink Corp.)
HKLM-x32\...\Run: [SUPER CHARGER] => C:\Program Files (x86)\MSI\SUPER CHARGER\SUPER CHARGER.exe [1047536 2014-02-22] (MSI)
HKLM-x32\...\Run: [BigPondWirelessBroadbandCM] => C:\Program Files (x86)\Telstra\Mobile Broadband Manager\TelstraUCM.exe [4352408 2010-05-14] (Telstra)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4127488 2015-06-16] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-06-08] (Oracle Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-19\...\Run: [OneDriveSetup] => C:\Windows\SysWOW64\OneDriveSetup.exe [7805120 2015-07-10] (Microsoft Corporation)
HKU\S-1-5-20\...\Run: [OneDriveSetup] => C:\Windows\SysWOW64\OneDriveSetup.exe [7805120 2015-07-10] (Microsoft Corporation)
HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22012688 2015-06-20] (Google)
HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53288576 2015-06-29] (Skype Technologies S.A.)
HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Killer Network Manager.lnk [2015-01-23]
ShortcutTarget: Killer Network Manager.lnk -> C:\Windows\Installer\{5B62C353-75A3-463F-A52E-CC005846F3CE}\NetworkManager.exe_130C27D738F34C89BDDF21BCFD74B56D.exe (Flexera Software LLC)
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\amd64\FileSyncShell64.dll [2015-08-09] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\amd64\FileSyncShell64.dll [2015-08-09] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\amd64\FileSyncShell64.dll [2015-08-09] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\amd64\FileSyncShell64.dll [2015-08-09] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\amd64\FileSyncShell64.dll [2015-08-09] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\FileSyncShell.dll [2015-08-09] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\FileSyncShell.dll [2015-08-09] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\FileSyncShell.dll [2015-08-09] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\FileSyncShell.dll [2015-08-09] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\FileSyncShell.dll [2015-08-09] (Microsoft Corporation)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://msi13.msn.com
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-06-09] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-06-17] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\ssv.dll [2015-08-09] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-08-09] (Oracle Corporation)
DPF: HKLM-x32 {E06E2E99-0AA1-11D4-ABA6-0060082AA75C}
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-06-08] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{331e6046-b900-422c-8a43-f7072bc1d017}: [DhcpNameServer] 10.5.133.45 10.5.136.242
Tcpip\..\Interfaces\{6ca879f1-ba5a-40db-96d7-fbc3d00cb47f}: [DhcpNameServer] 10.0.0.138
FireFox:
========
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-17] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-17] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll [2015-08-09] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\plugin2\npjp2.dll [2015-08-09] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-06-07] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
Chrome:
=======
CHR Profile: C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-07-19]
CHR Extension: (Google Cast) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2015-06-07]
CHR Extension: (Adblock Super) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\knebimhcckndhiglamoabbnifdkijidd [2015-06-08]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-07]
CHR Extension: (No Name) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2015-07-27]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-07]
CHR HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Hugh\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx [2015-06-07]
CHR HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 AJRouter; C:\Windows\System32\AJRouter.dll [23040 2015-07-10] (Microsoft Corporation)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [326144 2015-07-10] (Microsoft Corporation)
S3 CDPSvc; C:\Windows\System32\CDPSvc.dll [134144 2015-07-10] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2753720 2015-07-01] (Microsoft Corporation)
R3 ClipSVC; C:\Windows\System32\ClipSVC.dll [658568 2015-08-10] (Microsoft Corporation)
R2 CoreMessagingRegistrar; C:\Windows\system32\coremessaging.dll [808856 2015-08-10] (Microsoft Corporation)
R2 CoreMessagingRegistrar; C:\Windows\SysWOW64\coremessaging.dll [510976 2015-08-10] (Microsoft Corporation)
S3 DcpSvc; C:\Windows\system32\dcpsvc.dll [196096 2015-07-10] (Microsoft Corporation)
S3 DevQueryBroker; C:\Windows\system32\DevQueryBroker.dll [33280 2015-07-10] (Microsoft Corporation)
S3 diagnosticshub.standardcollector.service; C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe [27136 2015-07-10] (Microsoft Corporation)
S3 DmEnrollmentSvc; C:\Windows\system32\Windows.Internal.Management.dll [267776 2015-07-10] (Microsoft Corporation)
S3 DmEnrollmentSvc; C:\Windows\SysWOW64\Windows.Internal.Management.dll [193024 2015-07-10] (Microsoft Corporation)
S2 dmwappushservice; C:\Windows\system32\dmwappushsvc.dll [63488 2015-07-10] (Microsoft Corporation)
S2 DoSvc; C:\Windows\system32\dosvc.dll [1169408 2015-08-10] (Microsoft Corporation)
R3 DsSvc; C:\Windows\System32\DsSvc.dll [143872 2015-07-10] (Microsoft Corporation)
S3 embeddedmode; C:\Windows\System32\embeddedmodesvc.dll [87040 2015-07-10] (Microsoft Corporation)
S3 EntAppSvc; C:\Windows\system32\EnterpriseAppMgmtSvc.dll [275456 2015-07-10] (Microsoft Corporation)
S2 ETDService; C:\Program Files\Elantech\ETDService.exe [144104 2015-08-09] (ELAN Microelectronics Corp.)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2015-01-22] (NVIDIA Corporation)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [18584 2014-10-10] (Intel Corporation)
R2 iBtSiva; C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe [122984 2015-01-22] (Intel Corporation)
S3 icssvc; C:\Windows\System32\tetheringservice.dll [148992 2015-08-10] (Microsoft Corporation)
R2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [351120 2015-07-18] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-28] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-28] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-17] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-17] (Intel Corporation)
R3 lfsvc; C:\Windows\System32\lfsvc.dll [27136 2015-07-10] (Microsoft Corporation)
R3 lfsvc; C:\Windows\SysWOW64\lfsvc.dll [22528 2015-07-10] (Microsoft Corporation)
R3 LicenseManager; C:\Windows\system32\LicenseManagerSvc.dll [21504 2015-07-10] (Microsoft Corporation)
S2 MapsBroker; C:\Windows\System32\moshost.dll [62464 2015-07-10] (Microsoft Corporation)
R2 Micro Star SCM; C:\Program Files (x86)\SCM\MSIService.exe [160768 2014-11-07] (Micro-Star International Co., Ltd.) [File not signed]
R2 MSI_SuperCharger; C:\Program Files (x86)\MSI\SUPER CHARGER\ChargeService.exe [162800 2014-02-22] (MSI)
S3 NetSetupSvc; C:\Windows\System32\NetSetupSvc.dll [186368 2015-07-10] (Microsoft Corporation)
S3 NgcCtnrSvc; C:\Windows\System32\NgcCtnrSvc.dll [268800 2015-07-10] (Microsoft Corporation)
S3 NgcSvc; C:\Windows\system32\ngcsvc.dll [512000 2015-07-10] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2015-01-22] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2015-01-22] (NVIDIA Corporation)
S2 OneSyncSvc; C:\Windows\System32\APHostService.dll [296960 2015-07-10] (Microsoft Corporation)
R2 OneSyncSvc_Session2; C:\WINDOWS\system32\svchost.exe [39856 2015-07-10] (Microsoft Corporation)
R2 OneSyncSvc_Session2; C:\WINDOWS\SysWOW64\svchost.exe [35176 2015-07-10] (Microsoft Corporation)
S3 PimIndexMaintenanceSvc; C:\Windows\System32\PimIndexMaintenance.dll [289280 2015-07-10] (Microsoft Corporation)
R3 PimIndexMaintenanceSvc_Session2; C:\WINDOWS\system32\svchost.exe [39856 2015-07-10] (Microsoft Corporation)
R3 PimIndexMaintenanceSvc_Session2; C:\WINDOWS\SysWOW64\svchost.exe [35176 2015-07-10] (Microsoft Corporation)
R2 Qualcomm Atheros Killer Service V2; C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe [360448 2014-08-19] (Qualcomm Atheros) [File not signed]
S3 RetailDemo; C:\Windows\system32\RDXService.dll [988672 2015-08-10] (Microsoft Corporation)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1750712 2015-06-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2102496 2015-06-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [224712 2015-07-24] (Safer-Networking Ltd.)
S3 SensorDataService; C:\Windows\System32\SensorDataService.exe [1031680 2015-08-10] (Microsoft Corporation)
S3 SensorService; C:\Windows\system32\SensorService.dll [229376 2015-08-10] (Microsoft Corporation)
S3 SmsRouter; C:\Windows\system32\SmsRouterSvc.dll [583680 2015-07-10] (Microsoft Corporation)
R3 StateRepository; C:\Windows\system32\windows.staterepository.dll [2674176 2015-07-10] (Microsoft Corporation)
R3 StateRepository; C:\Windows\SysWOW64\windows.staterepository.dll [2049024 2015-07-10] (Microsoft Corporation)
R2 tiledatamodelsvc; C:\Windows\system32\tileobjserver.dll [503808 2015-08-10] (Microsoft Corporation)
S3 UnistoreSvc; C:\Windows\System32\unistore.dll [1203200 2015-08-10] (Microsoft Corporation)
S3 UnistoreSvc; C:\Windows\SysWOW64\unistore.dll [925696 2015-08-10] (Microsoft Corporation)
R3 UnistoreSvc_Session2; C:\WINDOWS\System32\svchost.exe [39856 2015-07-10] (Microsoft Corporation)
R3 UnistoreSvc_Session2; C:\WINDOWS\SysWOW64\svchost.exe [35176 2015-07-10] (Microsoft Corporation)
S3 UserDataSvc; C:\Windows\System32\userdataservice.dll [1420288 2015-08-10] (Microsoft Corporation)
R3 UserDataSvc_Session2; C:\WINDOWS\system32\svchost.exe [39856 2015-07-10] (Microsoft Corporation)
R3 UserDataSvc_Session2; C:\WINDOWS\SysWOW64\svchost.exe [35176 2015-07-10] (Microsoft Corporation)
R2 UserManager; C:\Windows\System32\usermgr.dll [717312 2015-07-10] (Microsoft Corporation)
S3 UsoSvc; C:\Windows\system32\usocore.dll [343040 2015-08-10] (Microsoft Corporation)
S3 vmicvmsession; C:\Windows\System32\ICSvc.dll [506880 2015-07-10] (Microsoft Corporation)
S3 WalletService; C:\Windows\system32\WalletService.dll [504320 2015-07-10] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation)
S3 WpnService; C:\Windows\system32\WpnService.dll [49152 2015-07-10] (Microsoft Corporation)
S3 XblAuthManager; C:\Windows\System32\XblAuthManager.dll [918016 2015-07-10] (Microsoft Corporation)
S3 XblGameSave; C:\Windows\System32\XblGameSave.dll [1149440 2015-07-10] (Microsoft Corporation)
S3 XboxNetApiSvc; C:\Windows\system32\XboxNetApiSvc.dll [1019392 2015-07-10] (Microsoft Corporation)
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R1 BfLwf; C:\Windows\system32\DRIVERS\bwcW8x64.sys [97968 2014-08-14] (Qualcomm Atheros, Inc.)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [237568 2015-07-10] (Microsoft Corporation)
S3 buttonconverter; C:\Windows\System32\drivers\buttonconverter.sys [32256 2015-07-10] (Microsoft Corporation)
S3 CapImg; C:\Windows\System32\drivers\capimg.sys [116736 2015-07-10] (Microsoft Corporation)
S4 cnghwassist; C:\Windows\System32\DRIVERS\cnghwassist.sys [39264 2015-07-10] (Microsoft Corporation)
R3 CompositeBus; C:\Windows\System32\DriverStore\FileRepository\compositebus.inf_amd64_98334ba6e76853ba\CompositeBus.sys [39936 2015-07-10] (Microsoft Corporation)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3436896 2015-07-10] (QLogic Corporation)
S3 fcvsc; C:\Windows\System32\drivers\fcvsc.sys [31232 2015-07-10] (Microsoft Corporation)
R1 FileCrypt; C:\Windows\System32\drivers\filecrypt.sys [83968 2015-07-10] (Microsoft Corporation)
S3 genericusbfn; C:\Windows\System32\drivers\genericusbfn.sys [20992 2015-07-10] (Microsoft Corporation)
R1 GpuEnergyDrv; C:\Windows\System32\drivers\gpuenergydrv.sys [8192 2015-07-10] (Microsoft Corporation)
S3 hidinterrupt; C:\Windows\System32\drivers\hidinterrupt.sys [50016 2015-07-10] (Microsoft Corporation)
S3 ibbus; C:\Windows\System32\drivers\ibbus.sys [424800 2015-07-10] (Mellanox)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [263952 2015-07-14] (Intel Corporation)
S3 IoQos; C:\Windows\System32\drivers\ioqos.sys [26624 2015-07-10] (Microsoft Corporation)
R3 Ke2200; C:\Windows\System32\drivers\e22w8x64.sys [130224 2014-03-28] (Qualcomm Atheros, Inc.)
S0 LSI_SAS2i; C:\Windows\System32\drivers\lsi_sas2i.sys [104800 2015-07-10] (LSI Corporation)
S0 LSI_SAS3i; C:\Windows\System32\drivers\lsi_sas3i.sys [99168 2015-07-10] (Avago Technologies)
S0 megasas; C:\Windows\System32\drivers\megasas.sys [59744 2015-07-10] (Avago Technologies)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-17] (Intel Corporation)
S3 mlx4_bus; C:\Windows\System32\drivers\mlx4_bus.sys [705376 2015-07-10] (Mellanox)
R2 MMCSS; C:\Windows\system32\drivers\mmcss.sys [48128 2015-07-10] (Microsoft Corporation)
S3 ndfltr; C:\Windows\System32\drivers\ndfltr.sys [76128 2015-07-10] (Mellanox)
S3 netvsc; C:\Windows\System32\drivers\netvsc.sys [94720 2015-07-10] (Microsoft Corporation)
R3 NETwNb64; C:\Windows\System32\drivers\Netwbw02.sys [3496216 2015-07-10] (Intel Corporation)
R3 NTIOLib_1_0_3; C:\Program Files (x86)\MSI\SUPER CHARGER\NTIOLib_X64.sys [13368 2012-10-26] (MSI)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-01-22] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2015-01-22] (NVIDIA Corporation)
S0 percsas2i; C:\Windows\System32\drivers\percsas2i.sys [58208 2015-07-10] (LSI Corporation)
S0 percsas3i; C:\Windows\System32\drivers\percsas3i.sys [58720 2015-07-10] (Avago Technologies)
S3 ReFSv1; C:\Windows\System32\Drivers\ReFSv1.sys [934752 2015-08-10] (Microsoft Corporation)
R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [466648 2015-01-22] (Realsil Semiconductor Corporation)
R1 SDHookDriver; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookDrv64.sys [65576 2015-06-16] (Safer-Networking Ltd.)
R2 storqosflt; C:\Windows\System32\drivers\storqosflt.sys [61952 2015-07-10] (Microsoft Corporation)
S0 storufs; C:\Windows\System32\drivers\storufs.sys [40288 2015-07-10] (Microsoft Corporation)
R3 swenum; C:\Windows\System32\DriverStore\FileRepository\swenum.inf_amd64_2a699e44676b7781\swenum.sys [17760 2015-07-10] (Microsoft Corporation)
S3 UcmCx0101; C:\Windows\System32\Drivers\UcmCx.sys [61952 2015-07-10] (Microsoft Corporation)
S3 UcmUcsi; C:\Windows\System32\drivers\UcmUcsi.sys [46080 2015-08-10] (Microsoft Corporation)
S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] ()
S3 Ufx01000; C:\Windows\System32\drivers\ufx01000.sys [245088 2015-07-10] (Microsoft Corporation)
S3 UfxChipidea; C:\Windows\System32\drivers\UfxChipidea.sys [94048 2015-07-10] (Microsoft Corporation)
S3 ufxsynopsys; C:\Windows\System32\drivers\ufxsynopsys.sys [127840 2015-07-10] (Microsoft Corporation)
S3 UrsChipidea; C:\Windows\System32\drivers\urschipidea.sys [28512 2015-07-10] (Microsoft Corporation)
S3 UrsCx01000; C:\Windows\System32\drivers\urscx01000.sys [57696 2015-07-10] (Microsoft Corporation)
S3 UrsSynopsys; C:\Windows\System32\drivers\urssynopsys.sys [27488 2015-07-10] (Microsoft Corporation)
S3 vhf; C:\Windows\System32\drivers\vhf.sys [31744 2015-07-10] (Microsoft Corporation)
S3 wdiwifi; C:\Windows\System32\DRIVERS\wdiwifi.sys [685056 2015-07-10] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation)
R0 WindowsTrustedRT; C:\Windows\System32\drivers\WindowsTrustedRT.sys [106520 2015-07-10] (Microsoft Corporation)
R0 WindowsTrustedRTProxy; C:\Windows\System32\drivers\WindowsTrustedRTProxy.sys [17944 2015-07-10] (Microsoft Corporation)
R3 WINIO; C:\Program Files (x86)\MSI\Dragon Gaming Center\winio64.sys [15160 2010-06-08] ()
S3 WinMad; C:\Windows\System32\drivers\winmad.sys [26976 2015-07-10] (Mellanox)
S3 WinVerbs; C:\Windows\System32\drivers\winverbs.sys [59232 2015-07-10] (Mellanox)
S3 xboxgip; C:\Windows\System32\drivers\xboxgip.sys [222720 2015-07-10] (Microsoft Corporation)
S3 xinputhid; C:\Windows\System32\drivers\xinputhid.sys [25600 2015-07-10] (Microsoft Corporation)
S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
NETSVC: dosvc -> C:\Windows\system32\dosvc.dll (Microsoft Corporation)
NETSVC: DcpSvc -> C:\Windows\system32\dcpsvc.dll (Microsoft Corporation)
NETSVC: NetSetupSvc -> C:\Windows\System32\NetSetupSvc.dll (Microsoft Corporation)
NETSVC: dmwappushservice -> C:\Windows\system32\dmwappushsvc.dll (Microsoft Corporation)
NETSVC: XblGameSave -> C:\Windows\System32\XblGameSave.dll (Microsoft Corporation)
NETSVC: XboxNetApiSvc -> C:\Windows\system32\XboxNetApiSvc.dll (Microsoft Corporation)
NETSVC: UsoSvc -> C:\Windows\system32\usocore.dll (Microsoft Corporation)
NETSVC: UserManager -> C:\Windows\System32\usermgr.dll (Microsoft Corporation)
NETSVC: DmEnrollmentSvc -> C:\Windows\system32\Windows.Internal.Management.dll (Microsoft Corporation)
NETSVC: XblAuthManager -> C:\Windows\System32\XblAuthManager.dll (Microsoft Corporation)
NETSVC: RetailDemo -> C:\Windows\system32\RDXService.dll (Microsoft Corporation)
NETSVCx32: NetSetupSvc -> C:\Windows\SysWOW64\NetSetupSvc.dll ==> No File
NETSVCx32: UserManager -> C:\Windows\SysWOW64\usermgr.dll ==> No File
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-08-10 19:48 - 2015-08-10 19:48 - 00016148 _____ C:\WINDOWS\system32\HUGH_LAPTOP_Hugh_HistoryPrediction.bin
2015-08-10 18:57 - 2015-08-10 18:57 - 00000165 ____H C:\Users\Hugh\Desktop\~$test.xlsm
2015-08-10 18:45 - 2015-08-10 18:57 - 00012021 _____ C:\Users\Hugh\Desktop\test.xlsm
2015-08-10 18:42 - 2015-08-10 18:42 - 00007660 _____ C:\Users\Hugh\Desktop\test.xlsx
2015-08-10 11:25 - 2015-08-10 11:25 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2015-08-10 08:26 - 2015-08-10 08:26 - 00000000 ____D C:\Users\Hugh\AppData\Local\NetworkTiles
2015-08-10 04:38 - 2015-08-09 13:44 - 00000000 ___DC C:\WINDOWS\Panther
2015-08-10 04:36 - 2015-08-10 04:36 - 00000000 ____D C:\Windows.old
2015-08-10 04:35 - 2015-08-10 04:35 - 24591872 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 22319520 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 21873664 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 20854776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 19333632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 18803712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 16707072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 14241792 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 13024256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 12589056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 12502016 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 11557888 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 11260928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 09889792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 08020832 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 07569408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 07523328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 07051264 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 06488312 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 06305792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 06101504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 05454848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 05118024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 05076480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 04791296 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 04760576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 04611584 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 04532304 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 04398080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 04350464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 04169728 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIRibbon.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 04047288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 03780096 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 03687936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 03620736 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 03589632 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2015-08-10 04:35 - 2015-08-10 04:35 - 03579904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 03443200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIRibbon.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 03362816 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 03248640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 03248128 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 02878000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 02741760 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 02662400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 02646528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 02606080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 02558976 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 02498808 _____ C:\WINDOWS\system32\CoreUIComponents.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 02462136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 02446336 _____ C:\WINDOWS\system32\InputService.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 02416640 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 02415616 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 02235904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 02224128 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 02207744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 02178560 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 02150696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 02147080 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d9.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 02125312 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 02116448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2015-08-10 04:35 - 2015-08-10 04:35 - 02112512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01985024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01983328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2015-08-10 04:35 - 2015-08-10 04:35 - 01964544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01914880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01890304 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01867160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d9.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01823232 _____ C:\WINDOWS\SysWOW64\InputService.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01822280 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01795072 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01773056 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01769056 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01714176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01680896 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01643872 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01611264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01602560 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01601024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01593856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01591856 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01562968 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpmde.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01561872 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01533496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01521664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActiveSyncProvider.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01420288 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01418240 _____ (Microsoft Corporation) C:\WINDOWS\system32\RecoveryDrive.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 01417216 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01411072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Editing.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01396064 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01382912 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2015-08-10 04:35 - 2015-08-10 04:35 - 01380864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01365072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01356368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01334784 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCore.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01294352 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2015-08-10 04:35 - 2015-08-10 04:35 - 01290752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01274880 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01212928 _____ (Microsoft Corporation) C:\WINDOWS\system32\RemoteNaturalLanguage.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01203200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Bluetooth.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01203200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01201664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Cred.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01200400 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01177600 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01169408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01168736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2015-08-10 04:35 - 2015-08-10 04:35 - 01161728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01135312 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipUp.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 01123400 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 01112064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCore.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01101792 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01085776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01067520 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01061888 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01043968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Editing.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01043872 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01031680 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorDataService.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 01025840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsrcsnk.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01018568 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2015-08-10 04:35 - 2015-08-10 04:35 - 00991584 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00988672 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2015-08-10 04:35 - 2015-08-10 04:35 - 00966424 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00962400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00934752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\refsv1.sys
2015-08-10 04:35 - 2015-08-10 04:35 - 00925696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00916800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModel.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00902656 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00898560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RemoteNaturalLanguage.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00896144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsrcsnk.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00877016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00872448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntshrui.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00869376 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00859136 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00858408 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00856064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContactApis.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00850432 _____ (Microsoft Corporation) C:\WINDOWS\system32\comdlg32.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00846336 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpncore.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00845664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00841728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Import.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00832512 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00828416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Bluetooth.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00823336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00816576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00808856 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00801632 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00799232 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpccpl.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00798208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntshrui.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00783872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00783112 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00777728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00762896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00754688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Cred.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00752640 _____ (Microsoft Corporation) C:\WINDOWS\system32\efscore.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00750592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00713312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00712192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00705520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00700256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00695136 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimgapi.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00680448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.Connectivity.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00679424 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppContracts.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00677888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00670208 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00667136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00658568 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipSVC.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00654848 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToManager.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00643616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00632168 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00630160 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00623616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContactApis.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00607008 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00606392 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00601344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2015-08-10 04:35 - 2015-08-10 04:35 - 00599552 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnapps.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00596992 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00594472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Shell.Broker.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00593920 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\MessagingDataModel2.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00589824 _____ (Microsoft Corporation) C:\WINDOWS\system32\uxtheme.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00589312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\efscore.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00585728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00584704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIRibbonRes.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00584704 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Sensors.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00584704 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIRibbonRes.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00584544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wimgapi.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00578048 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00575488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Import.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00573440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Cortana.Desktop.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00569344 _____ (Microsoft Corporation) C:\WINDOWS\system32\MCRecvSrc.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00565088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\acpi.sys
2015-08-10 04:35 - 2015-08-10 04:35 - 00562688 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApi.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00553472 _____ (Microsoft Corporation) C:\WINDOWS\system32\GamePanel.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00542720 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchFolder.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00539216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00527952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00521568 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimserv.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00521216 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00518144 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationController.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00516960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2015-08-10 04:35 - 2015-08-10 04:35 - 00510976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00507696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00505696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2015-08-10 04:35 - 2015-08-10 04:35 - 00505344 _____ C:\WINDOWS\system32\EditionUpgradeManagerObj.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00503808 _____ (Microsoft Corporation) C:\WINDOWS\system32\tileobjserver.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.Connectivity.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00501008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00498016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys
2015-08-10 04:35 - 2015-08-10 04:35 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToManager.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00495616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00494592 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00487424 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmkvsrcsnk.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00485888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00480256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MCRecvSrc.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00473088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpnapps.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00465920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MessagingDataModel2.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00458752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uxtheme.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00452608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchFolder.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00448512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MbaeApi.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00446976 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00445240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00441344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppContracts.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00437248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Sensors.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00430592 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcomapi.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00425824 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00421888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Bluetooth.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00420352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GamePanel.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00416256 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcdedit.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00414720 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BioFeedback.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00412672 _____ C:\WINDOWS\system32\diagtrack_win.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00407616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00407040 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredProvDataModel.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00403968 _____ C:\WINDOWS\system32\diagtrack_wininternal.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00393568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2015-08-10 04:35 - 2015-08-10 04:35 - 00384000 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppBroker.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00373248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmkvsrcsnk.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00366592 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00365056 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00356352 _____ (Microsoft Corporation) C:\WINDOWS\system32\stobject.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00343040 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00342528 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00335360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredProvDataModel.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00335248 _____ (Microsoft Corporation) C:\WINDOWS\system32\wintrust.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00333168 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFPlay.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00329728 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00328704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00325984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2015-08-10 04:35 - 2015-08-10 04:35 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00322048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00322048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\stobject.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\ConhostV2.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00311808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppBroker.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00310784 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsApi.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00303616 _____ (Microsoft Corporation) C:\WINDOWS\system32\MBMediaManager.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00303104 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00296960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Bluetooth.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00294912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00291840 _____ (Microsoft Corporation) C:\WINDOWS\system32\systemcpl.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00290312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininit.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00289248 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppHost.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00287744 _____ (Microsoft Corporation) C:\WINDOWS\system32\provhandlers.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00285632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFPlay.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00283648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BioFeedback.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00282112 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEEventDispatcher.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00280064 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00279552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\systemcpl.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00275456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\ConsoleLogon.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00265480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wintrust.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00263168 _____ (Microsoft Corporation) C:\WINDOWS\system32\DisplayManager.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00253952 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_UserAccount.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00252768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContentDeliveryManager.Utilities.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00251392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SensorsApi.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00247808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00243760 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00242264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppHost.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00242176 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00235008 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_Notifications.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00232960 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevicesFlowBroker.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00229376 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorService.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00217088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEEventDispatcher.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00208736 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00208384 _____ (Microsoft Corporation) C:\WINDOWS\system32\srumsvc.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\OmaDmAgent.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\system32\fwpolicyiomgr.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModelShim.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00193024 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseModernAppMgmtCSP.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00191488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DisplayManager.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00190464 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReInfo.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00187904 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00186880 _____ (Microsoft Corporation) C:\WINDOWS\system32\BootMenuUX.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00185856 _____ (Microsoft Corporation) C:\WINDOWS\system32\psmsrv.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00185344 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00181760 _____ (Microsoft Corporation) C:\WINDOWS\system32\shutdownux.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00181088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00179712 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_SignInOptions.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00179200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\srumsvc.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00176640 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcdboot.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00169984 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_Privacy.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00163328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fwpolicyiomgr.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReInfo.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\SubscriptionMgr.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00155136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tunnel.sys
2015-08-10 04:35 - 2015-08-10 04:35 - 00151040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TabSvc.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00150528 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00148992 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00137216 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEStoreEventHandlers.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00122880 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEDataLayerHelpers.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00120832 _____ (Microsoft Corporation) C:\WINDOWS\system32\omadmclient.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00116736 _____ (Microsoft Corporation) C:\WINDOWS\system32\sendmail.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmapi.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00104960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sendmail.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00097128 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcd.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmapi.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsNativeApi.V2.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\spbcd.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00082616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcd.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEDataLayerHelpers.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00080384 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxSysprep.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00078336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SensorsNativeApi.V2.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ACPBackgroundManagerPolicy.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\system32\setbcdlocale.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00069120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\spbcd.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00068096 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Cortana.ProxyStub.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbser.sys
2015-08-10 04:35 - 2015-08-10 04:35 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthhfenum.sys
2015-08-10 04:35 - 2015-08-10 04:35 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\unenrollhook.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00061280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dam.sys
2015-08-10 04:35 - 2015-08-10 04:35 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Cortana.OneCore.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msiexec.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00057856 _____ (Microsoft Corporation) C:\WINDOWS\system32\hmkd.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Cortana.PAL.Desktop.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00055296 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\omadmprc.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00046080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\UcmUcsi.sys
2015-08-10 04:35 - 2015-08-10 04:35 - 00045568 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00045056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hmkd.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00041984 _____ (Microsoft Corporation) C:\WINDOWS\system32\VoiceActivationManager.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00037376 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00034816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VoiceActivationManager.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00032768 _____ C:\WINDOWS\system32\LicenseManagerApi.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00032768 _____ (Microsoft Corporation) C:\WINDOWS\system32\calc.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\calc.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationControllerPS.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00024576 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManagerShellext.exe
2015-08-10 04:34 - 2015-08-10 04:34 - 00008192 _____ C:\WINDOWS\system32\config\userdiff
2015-08-10 04:32 - 2015-08-10 04:32 - 00000000 ____D C:\Program Files\Reference Assemblies
2015-08-10 04:32 - 2015-08-10 04:32 - 00000000 ____D C:\Program Files\MSBuild
2015-08-10 04:32 - 2015-08-10 04:32 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies
2015-08-10 04:32 - 2015-08-10 04:32 - 00000000 ____D C:\Program Files (x86)\MSBuild
2015-08-10 04:32 - 2015-06-18 12:10 - 01166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2015-08-10 04:32 - 2015-06-18 12:10 - 00124112 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2015-08-10 04:32 - 2015-06-18 12:10 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2015-08-10 04:32 - 2015-05-30 15:07 - 00778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2015-08-10 04:32 - 2015-05-30 15:07 - 00102608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-08-10 04:32 - 2015-05-30 15:07 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2015-08-09 18:44 - 2015-08-09 18:53 - 00000964 _____ C:\Users\Hugh\Desktop\SystemLook.txt
2015-08-09 18:42 - 2015-08-09 18:44 - 00139264 _____ C:\Users\Hugh\Desktop\SystemLook.exe
2015-08-09 18:33 - 2015-08-09 18:33 - 00002390 _____ C:\Users\Hugh\Desktop\Chrome App Launcher.lnk
2015-08-09 18:33 - 2015-08-09 18:33 - 00000000 ____D C:\Users\Hugh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-08-09 13:53 - 2015-08-09 13:53 - 00053992 _____ (ELAN Microelectronics Corp.) C:\WINDOWS\system32\ETDCoInstaller.dll
2015-08-09 13:53 - 2015-08-09 13:53 - 00000000 ____D C:\WINDOWS\LastGood
2015-08-09 13:50 - 2015-08-09 13:50 - 00000000 ____D C:\Users\Hugh\AppData\Local\MicrosoftEdge
2015-08-09 11:04 - 2015-08-09 11:04 - 00001474 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-08-09 11:04 - 2015-08-09 11:04 - 00001462 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-08-09 11:04 - 2015-08-09 11:04 - 00000000 ____D C:\WINDOWS\System32\Tasks\Safer-Networking
2015-08-09 11:04 - 2015-08-09 11:04 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2015-08-09 11:04 - 2015-08-09 11:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-08-09 11:04 - 2015-06-16 17:32 - 00020760 _____ (Safer-Networking Ltd.) C:\WINDOWS\system32\sdnclean64.exe
2015-08-09 11:02 - 2015-08-09 11:02 - 00001061 _____ C:\Users\Hugh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Optional Features.lnk
2015-08-09 10:57 - 2015-08-09 10:57 - 00047288 _____ (ELAN Microelectronics Corp.) C:\WINDOWS\system32\ETDCoInstaller01000.dll
2015-08-09 10:56 - 2015-08-10 08:36 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-08-09 10:56 - 2015-08-09 10:56 - 00002388 _____ C:\Users\Hugh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2015-08-09 10:54 - 2015-08-09 10:56 - 00000000 ____D C:\Users\Hugh\AppData\Local\Comms
2015-08-09 10:54 - 2015-08-09 10:54 - 00000020 ___SH C:\Users\Hugh\ntuser.ini
2015-08-09 10:54 - 2015-08-09 10:54 - 00000000 ____D C:\Users\Hugh\AppData\Local\TileDataLayer
2015-08-09 10:54 - 2015-08-09 10:54 - 00000000 ____D C:\Users\Hugh\AppData\Local\Publishers
2015-08-09 10:53 - 2015-08-10 08:25 - 00876942 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-08-09 10:50 - 2015-08-09 10:50 - 00000000 __SHD C:\Recovery
2015-08-09 10:49 - 2015-08-09 10:49 - 00022744 _____ C:\WINDOWS\system32\emptyregdb.dat
2015-08-09 10:45 - 2015-08-09 10:45 - 00001576 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-08-09 10:45 - 2015-08-09 10:45 - 00000000 ____D C:\Users\Default\AppData\Local\Google
2015-08-09 10:45 - 2015-08-09 10:45 - 00000000 ____D C:\Users\Default User\AppData\Local\Google
2015-08-09 10:43 - 2015-08-09 10:43 - 00000000 ____D C:\WINDOWS\system32\config\bbimigrate
2015-08-09 10:42 - 2015-08-09 20:44 - 00000000 ____D C:\Users\Hugh
2015-08-09 10:42 - 2015-08-09 10:54 - 00000000 ___RD C:\Users\Hugh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-08-09 10:42 - 2015-07-10 21:04 - 00000000 __RSD C:\Users\Hugh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell
2015-08-09 10:42 - 2015-07-10 21:04 - 00000000 ___RD C:\Users\Hugh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-08-09 10:42 - 2015-07-10 21:04 - 00000000 ___RD C:\Users\Hugh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-08-09 10:42 - 2015-07-10 21:04 - 00000000 ____D C:\Users\Hugh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-08-09 10:42 - 2015-07-10 20:59 - 02718208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2015-08-09 10:41 - 2015-08-09 13:53 - 00000000 ____D C:\Program Files\Elantech
2015-08-09 10:41 - 2015-08-09 10:43 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2015-08-09 10:41 - 2015-08-09 10:41 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_TeeDriverx64_01011.Wdf
2015-08-09 10:41 - 2015-08-09 10:41 - 00000000 ____H C:\ProgramData\DP45977C.lfl
2015-08-09 10:41 - 2015-08-09 10:41 - 00000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2015-08-09 10:41 - 2015-08-09 10:41 - 00000000 ____D C:\WINDOWS\system32\DAX2
2015-08-09 10:41 - 2015-08-09 10:41 - 00000000 ____D C:\ProgramData\NVIDIA
2015-08-09 10:41 - 2015-08-09 10:41 - 00000000 ____D C:\Program Files\Realtek
2015-08-09 10:41 - 2015-07-23 11:10 - 06873928 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcpl.dll
2015-08-09 10:41 - 2015-07-23 11:10 - 03493008 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvc64.dll
2015-08-09 10:41 - 2015-07-23 11:10 - 02558608 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvcr.dll
2015-08-09 10:41 - 2015-07-23 11:10 - 01059984 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshext.dll
2015-08-09 10:41 - 2015-07-23 11:10 - 00937800 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvvsvc.exe
2015-08-09 10:41 - 2015-07-23 11:10 - 00385168 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvmctray.dll
2015-08-09 10:41 - 2015-07-23 11:10 - 00074896 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshextr.dll
2015-08-09 10:41 - 2015-07-23 11:10 - 00062608 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvshext.dll
2015-08-09 10:41 - 2015-07-22 14:29 - 05121613 _____ C:\WINDOWS\system32\nvcoproc.bin
2015-08-09 10:40 - 2015-08-10 08:24 - 00000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2015-08-09 10:40 - 2015-08-09 10:43 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2015-08-09 10:40 - 2015-08-09 10:43 - 00000000 ____D C:\Program Files\Intel
2015-08-09 10:40 - 2015-08-09 10:40 - 00000200 _____ C:\WINDOWS\system32\{EC94D02F-D200-4428-9531-05AF7F9799CB}.bat
2015-08-09 10:40 - 2015-07-17 23:58 - 00086528 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.DLL
2015-08-09 10:40 - 2015-07-17 23:58 - 00082432 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.DLL
2015-08-09 10:39 - 2015-08-09 10:40 - 00044538 _____ C:\WINDOWS\system32\NetSetupMig.log
2015-08-09 10:38 - 2015-08-09 13:41 - 00003714 _____ C:\WINDOWS\PFRO.log
2015-08-09 10:26 - 2015-08-09 10:49 - 00009528 _____ C:\WINDOWS\diagwrn.xml
2015-08-09 10:26 - 2015-08-09 10:49 - 00009528 _____ C:\WINDOWS\diagerr.xml
2015-08-09 10:26 - 2015-08-09 10:49 - 00006634 _____ C:\WINDOWS\comsetup.log
2015-08-06 17:12 - 2015-08-06 17:13 - 42157344 _____ (Microsoft Corporation) C:\Users\Hugh\Downloads\MouseKeyboardCenter_64bit_ENG_2.5.166.exe
2015-08-05 14:02 - 2015-08-05 14:09 - 00001188 _____ C:\Users\Public\Desktop\Install Microsoft Mouse and Keyboard Center.lnk
2015-08-05 09:14 - 2015-08-05 09:14 - 03912086 _____ C:\Users\Hugh\Downloads\U608020_20140701_20150630.xls
2015-08-04 15:52 - 2015-08-04 15:52 - 00000000 ____D C:\Users\Hugh\Documents\Add-in Express
2015-08-04 15:30 - 2015-08-09 10:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2015-08-04 15:30 - 2015-08-04 15:30 - 00000000 ____D C:\Program Files\7-Zip
2015-08-04 10:28 - 2015-08-09 10:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WebEx
2015-08-04 10:28 - 2015-08-04 10:28 - 00001890 _____ C:\Users\Public\Desktop\Network Recording Player.lnk
2015-08-04 10:28 - 2015-08-04 10:28 - 00000000 ____D C:\ProgramData\webex
2015-08-04 10:13 - 2015-08-04 10:17 - 15034880 _____ C:\Users\Hugh\Downloads\nbr2player.msi
2015-08-03 18:31 - 2015-08-03 18:31 - 02953520 _____ (AVAST Software) C:\Users\Hugh\Desktop\avast-browser-cleanup.exe
2015-07-29 08:58 - 2015-07-28 17:52 - 00821920 _____ (Safer-Networking Ltd. ) C:\Users\Public\Desktop\Post Win10 Spybot-install.exe
2015-07-28 22:09 - 2015-07-28 22:19 - 00010339 _____ C:\Users\Hugh\Desktop\NZ holiday.xlsx
2015-07-28 09:08 - 2015-07-28 09:08 - 00000000 ____D C:\Users\Hugh\AppData\Local\Windows Live
2015-07-27 09:49 - 2015-07-27 09:50 - 00000000 ____D C:\Users\Hugh\AppData\Local\CutePDF Writer
2015-07-27 09:48 - 2015-07-27 09:48 - 00000000 ____D C:\Program Files (x86)\GPLGS
2015-07-27 09:46 - 2015-08-09 10:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CutePDF
2015-07-27 09:46 - 2015-07-27 09:46 - 00000000 ____D C:\Program Files (x86)\Acro Software
2015-07-27 09:46 - 2013-10-23 15:24 - 00087600 _____ C:\WINDOWS\system32\cpwmon64.dll
2015-07-27 09:43 - 2015-07-27 09:44 - 02446176 _____ (Acro Software Inc. ) C:\Users\Hugh\Downloads\CuteWriter.exe
2015-07-25 08:57 - 2015-08-10 20:06 - 00031388 _____ C:\Users\Hugh\Desktop\FRST.txt
2015-07-25 08:57 - 2015-08-10 20:05 - 00000000 ____D C:\Users\Hugh\Desktop\FRST-OlderVersion
2015-07-25 08:57 - 2015-07-28 19:49 - 00045059 _____ C:\Users\Hugh\Desktop\Addition.txt
2015-07-24 20:34 - 2015-07-24 20:34 - 00033263 _____ C:\Users\Hugh\Downloads\table (1).csv
2015-07-24 18:10 - 2015-07-24 18:11 - 00029538 _____ C:\Users\Hugh\Downloads\table.csv
2015-07-23 20:33 - 2015-07-23 20:33 - 00001055 _____ C:\Users\Hugh\Desktop\JRT.txt
2015-07-23 04:02 - 2015-07-23 04:02 - 42730312 _____ C:\WINDOWS\system32\nvcompiler.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 37749064 _____ C:\WINDOWS\SysWOW64\nvcompiler.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 30518928 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglv64.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 22973584 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglv32.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 18376584 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvwgf2umx.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 16160440 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvopencl.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 16011680 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvd3dumx.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 15754192 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvwgf2um.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 14511608 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuda.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 13274904 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvopencl.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 12973680 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvd3dum.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 11843384 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuda.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 11142984 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvlddmkm.sys
2015-07-23 04:02 - 2015-07-23 04:02 - 03351864 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvapi64.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 02963208 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvapi.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 02360976 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuvid.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 02164040 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuvid.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 01898128 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispco6435362.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 01557648 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispgenco6435362.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 01061008 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFR64.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 01053000 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvFBC64.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 00983368 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFR.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 00976528 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvFBC.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 00787384 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncMFTH264.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 00632664 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncMFTH264.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 00408208 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFROpenGL.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 00384464 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncodeAPI64.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 00364360 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFROpenGL.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 00314936 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncodeAPI.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 00176904 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvinitx.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 00155280 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvinit.dll
2015-07-23 04:02 - 2015-07-23 04:02 - 00031976 _____ C:\WINDOWS\system32\nvinfo.pb
2015-07-22 17:18 - 2015-07-23 18:17 - 00000000 ____D C:\AdwCleaner
2015-07-22 17:17 - 2015-07-22 17:17 - 02248704 _____ C:\Users\Hugh\Downloads\AdwCleaner.exe
2015-07-22 17:16 - 2015-07-22 17:16 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Hugh\Downloads\mbam-setup-2.1.8.1057 (2).exe
2015-07-22 17:15 - 2015-07-22 17:16 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Hugh\Downloads\mbam-setup-2.1.8.1057 (1).exe
2015-07-22 17:14 - 2015-07-22 17:15 - 01798288 _____ (Malwarebytes Corporation) C:\Users\Hugh\Downloads\JRT.exe
2015-07-20 11:13 - 2015-07-20 11:14 - 05198336 _____ (AVAST Software) C:\Users\Hugh\Desktop\aswMBR.exe
2015-07-20 11:09 - 2015-08-10 20:05 - 02171392 _____ (Farbar) C:\Users\Hugh\Desktop\FRST64.exe
2015-07-20 11:07 - 2015-07-20 11:08 - 00045015 _____ C:\Users\Hugh\Downloads\Addition.txt
2015-07-20 11:06 - 2015-08-10 20:06 - 00000000 ____D C:\FRST
2015-07-20 11:06 - 2015-07-20 11:08 - 00045631 _____ C:\Users\Hugh\Downloads\FRST.txt
2015-07-20 11:06 - 2015-07-20 11:06 - 02134528 _____ (Farbar) C:\Users\Hugh\Downloads\FRST64.exe
2015-07-20 11:05 - 2015-07-20 11:05 - 00000017 _____ C:\Users\Hugh\AppData\Local\resmon.resmoncfg
2015-07-20 11:03 - 2015-07-20 11:03 - 00000207 _____ C:\WINDOWS\tweaking.com-regbackup-HUGH_LAPTOP-Windows-8.1-(64-bit).dat
2015-07-20 11:02 - 2015-07-20 11:02 - 00000000 ____D C:\RegBackup
2015-07-20 11:01 - 2015-08-09 10:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2015-07-20 11:01 - 2015-07-20 11:01 - 04720448 _____ C:\Users\Hugh\Downloads\tweaking.com_registry_backup_setup.exe
2015-07-20 11:01 - 2015-07-20 11:01 - 00002265 _____ C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2015-07-20 11:01 - 2015-07-20 11:01 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2015-07-19 17:59 - 2015-07-19 17:59 - 00002186 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth.lnk
2015-07-19 17:58 - 2015-07-19 17:58 - 00931408 _____ (Google Inc.) C:\Users\Hugh\Downloads\GoogleEarthSetup.exe
2015-07-18 00:36 - 2015-07-18 00:36 - 06389688 _____ (Intel Corporation) C:\WINDOWS\system32\Drivers\igdkmd64.sys
2015-07-18 00:36 - 2015-07-18 00:36 - 00519056 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiUMS64.exe
2015-07-18 00:36 - 2015-07-18 00:36 - 00283024 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\IntelCpHeciSvc.exe
2015-07-18 00:35 - 2015-07-18 00:35 - 01008016 _____ C:\WINDOWS\system32\igfxSDK.exe
2015-07-18 00:35 - 2015-07-18 00:35 - 00927120 _____ (Intel Corporation) C:\WINDOWS\system32\Gfxv4_0.exe
2015-07-18 00:35 - 2015-07-18 00:35 - 00923536 _____ (Intel Corporation) C:\WINDOWS\system32\Gfxv2_0.exe
2015-07-18 00:35 - 2015-07-18 00:35 - 00589712 _____ C:\WINDOWS\system32\IntelCpHDCPSvc.exe
2015-07-18 00:35 - 2015-07-18 00:35 - 00448912 _____ (Intel Corporation) C:\WINDOWS\system32\GfxUIEx.exe
2015-07-18 00:35 - 2015-07-18 00:35 - 00396688 _____ C:\WINDOWS\system32\igfxTray.exe
2015-07-18 00:35 - 2015-07-18 00:35 - 00351120 _____ (Intel Corporation) C:\WINDOWS\system32\igfxCUIService.exe
2015-07-18 00:35 - 2015-07-18 00:35 - 00328080 _____ (Intel Corporation) C:\WINDOWS\system32\igfxEM.exe
2015-07-18 00:35 - 2015-07-18 00:35 - 00249232 _____ (Intel Corporation) C:\WINDOWS\system32\igfxHK.exe
2015-07-18 00:35 - 2015-07-18 00:35 - 00219024 _____ (Intel Corporation) C:\WINDOWS\system32\igfxext.exe
2015-07-18 00:35 - 2015-07-18 00:35 - 00214416 _____ (Intel Corporation) C:\WINDOWS\system32\DPTopologyApp.exe
2015-07-18 00:35 - 2015-07-18 00:35 - 00213904 _____ (Intel Corporation) C:\WINDOWS\system32\DPTopologyAppv2_0.exe
2015-07-18 00:35 - 2015-07-18 00:35 - 00157072 _____ (Intel Corporation) C:\WINDOWS\system32\difx64.exe
2015-07-18 00:34 - 2015-07-18 00:34 - 36681912 _____ (Intel Corporation) C:\WINDOWS\system32\igdumdim64.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 35768808 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdumdim32.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 30404056 _____ (Intel Corporation) C:\WINDOWS\system32\igd11dxva64.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 29613040 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igd11dxva32.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 13727296 _____ (Intel Corporation) C:\WINDOWS\system32\igd10iumd64.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 12880160 _____ (Intel Corporation) C:\WINDOWS\system32\igc64.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 11276968 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igd10iumd32.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 10528136 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igc32.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 06305696 _____ (Intel Corporation) C:\WINDOWS\system32\igdusc64.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 05121136 _____ (Intel Corporation) C:\WINDOWS\system32\igd12umd64.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 05092320 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igd12umd32.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 04841488 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdusc32.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 01858632 _____ (Intel Corporation) C:\WINDOWS\system32\igdmd64.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 01767992 _____ (Intel Corporation) C:\WINDOWS\system32\iglhsip64.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 01765408 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\iglhsip32.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 01456408 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdmd32.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 00284280 _____ (Intel Corporation) C:\WINDOWS\system32\igd10idpp64.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 00269360 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igd10idpp32.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 00220432 _____ (Intel Corporation) C:\WINDOWS\system32\iglhcp64.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 00200856 _____ (Intel Corporation) C:\WINDOWS\system32\igdde64.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 00184352 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\iglhcp32.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 00163776 _____ (Intel Corporation) C:\WINDOWS\system32\igfxcmrt64.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 00162752 _____ (Intel Corporation) C:\WINDOWS\system32\igfx11cmrt64.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 00160680 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdde32.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 00141080 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igfxcmrt32.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 00140056 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igfx11cmrt32.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 00036616 _____ (Intel Corporation) C:\WINDOWS\system32\igfxexps.dll
2015-07-18 00:34 - 2015-07-18 00:34 - 00004682 _____ C:\WINDOWS\system32\iglhxs64.vp
2015-07-18 00:29 - 2015-07-18 00:29 - 11384832 _____ (Intel Corporation) C:\WINDOWS\system32\ig75icd64.dll
2015-07-18 00:29 - 2015-07-18 00:29 - 04443136 _____ (Intel Corporation) C:\WINDOWS\system32\igdrcl64.dll
2015-07-18 00:29 - 2015-07-18 00:29 - 00425472 _____ (Intel Corporation) C:\WINDOWS\system32\igdbcl64.dll
2015-07-18 00:29 - 2015-07-18 00:29 - 00397824 _____ (Intel Corporation) C:\WINDOWS\system32\IntelOpenCL64.dll
2015-07-18 00:28 - 2015-07-18 00:28 - 29084160 _____ (Intel Corporation) C:\WINDOWS\system32\common_clang64.dll
2015-07-18 00:28 - 2015-07-18 00:28 - 06741482 _____ C:\WINDOWS\system32\igdclbif.bin
2015-07-18 00:28 - 2015-07-18 00:28 - 05467648 _____ (Intel Corporation) C:\WINDOWS\system32\igdmcl64.dll
2015-07-18 00:28 - 2015-07-18 00:28 - 05245440 _____ (Intel Corporation) C:\WINDOWS\system32\GfxResources.dll
2015-07-18 00:28 - 2015-07-18 00:28 - 02028032 _____ (Intel Corporation) C:\WINDOWS\system32\igfxLHM.dll
2015-07-18 00:28 - 2015-07-18 00:28 - 01216000 _____ (Intel Corporation) C:\WINDOWS\system32\igdfcl64.dll
2015-07-18 00:28 - 2015-07-18 00:28 - 00723456 _____ (Intel Corporation) C:\WINDOWS\system32\igfxDH.dll
2015-07-18 00:28 - 2015-07-18 00:28 - 00641530 _____ C:\WINDOWS\system32\FilmModeDetection.wmv
2015-07-18 00:28 - 2015-07-18 00:28 - 00624128 _____ (Intel Corporation) C:\WINDOWS\system32\MetroIntelGenericUIFramework.dll
2015-07-18 00:28 - 2015-07-18 00:28 - 00403671 _____ C:\WINDOWS\system32\ImageStabilization.wmv
2015-07-18 00:28 - 2015-07-18 00:28 - 00386048 _____ (Intel Corporation) C:\WINDOWS\system32\igfxOSP.dll
2015-07-18 00:28 - 2015-07-18 00:28 - 00375173 _____ C:\WINDOWS\system32\ColorImageEnhancement.wmv
2015-07-18 00:28 - 2015-07-18 00:28 - 00353280 _____ (Intel Corporation) C:\WINDOWS\system32\igfxDI.dll
2015-07-18 00:28 - 2015-07-18 00:28 - 00256000 _____ C:\WINDOWS\system32\igfxCPL.cpl
2015-07-18 00:28 - 2015-07-18 00:28 - 00243200 _____ (Intel Corporation) C:\WINDOWS\system32\igfxDTCM.dll
2015-07-18 00:28 - 2015-07-18 00:28 - 00172032 _____ (Intel Corporation) C:\WINDOWS\system32\igdail64.dll
2015-07-18 00:28 - 2015-07-18 00:28 - 00090112 _____ ( ) C:\WINDOWS\system32\igfxSDKLibv2_0.dll
2015-07-18 00:28 - 2015-07-18 00:28 - 00086016 _____ C:\WINDOWS\system32\igfxCUIServicePS.dll
2015-07-18 00:28 - 2015-07-18 00:28 - 00082944 _____ ( ) C:\WINDOWS\system32\igfxSDKLib.dll
2015-07-18 00:28 - 2015-07-18 00:28 - 00073728 _____ ( ) C:\WINDOWS\system32\igfxDHLibv2_0.dll
2015-07-18 00:28 - 2015-07-18 00:28 - 00064512 _____ ( ) C:\WINDOWS\system32\igfxDHLib.dll
2015-07-18 00:28 - 2015-07-18 00:28 - 00011776 _____ ( ) C:\WINDOWS\system32\igfxDILib.dll
2015-07-18 00:28 - 2015-07-18 00:28 - 00011264 _____ ( ) C:\WINDOWS\system32\igfxDILibv2_0.dll
2015-07-18 00:28 - 2015-07-18 00:28 - 00010240 _____ ( ) C:\WINDOWS\system32\igfxEMLibv2_0.dll
2015-07-18 00:28 - 2015-07-18 00:28 - 00010240 _____ ( ) C:\WINDOWS\system32\igfxEMLib.dll
2015-07-18 00:28 - 2015-07-18 00:28 - 00005120 _____ ( ) C:\WINDOWS\system32\igfxLHMLibv2_0.dll
2015-07-18 00:28 - 2015-07-18 00:28 - 00005120 _____ ( ) C:\WINDOWS\system32\igfxLHMLib.dll
2015-07-18 00:24 - 2015-07-18 00:24 - 00153600 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdail32.dll
2015-07-18 00:18 - 2015-07-18 00:18 - 03873280 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdrcl32.dll
2015-07-18 00:17 - 2015-07-18 00:17 - 00373248 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdbcl32.dll
2015-07-18 00:17 - 2015-07-18 00:17 - 00300032 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\IntelOpenCL32.dll
2015-07-18 00:16 - 2015-07-18 00:16 - 03801600 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdmcl32.dll
2015-07-18 00:16 - 2015-07-18 00:16 - 00970752 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdfcl32.dll
2015-07-18 00:09 - 2015-07-18 00:09 - 08507392 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\ig75icd32.dll
2015-07-18 00:03 - 2015-07-18 00:03 - 00035328 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igfxexps32.dll
2015-07-17 23:58 - 2015-07-17 23:58 - 02813952 _____ C:\WINDOWS\system32\iglhxa64.cpa
2015-07-17 23:58 - 2015-07-17 23:58 - 01565696 _____ (Intel Corporation) C:\WINDOWS\system32\igfxcmjit64.dll
2015-07-17 23:58 - 2015-07-17 23:58 - 01156608 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igfxcmjit32.dll
2015-07-17 23:58 - 2015-07-17 23:58 - 00803113 _____ C:\WINDOWS\system32\DisplayAudiox64.cab
2015-07-17 23:58 - 2015-07-17 23:58 - 00511260 _____ C:\WINDOWS\system32\cp_resources.bin
2015-07-17 23:58 - 2015-07-17 23:58 - 00331808 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiMCComp64.dll
2015-07-17 23:58 - 2015-07-17 23:58 - 00313888 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiUtils64.dll
2015-07-17 23:58 - 2015-07-17 23:58 - 00143904 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiLogServer64.dll
2015-07-17 23:58 - 2015-07-17 23:58 - 00086528 _____ (Khronos Group) C:\WINDOWS\SysWOW64\Intel_OpenCL_ICD32.dll
2015-07-17 23:58 - 2015-07-17 23:58 - 00082432 _____ (Khronos Group) C:\WINDOWS\system32\Intel_OpenCL_ICD64.dll
2015-07-17 23:58 - 2015-07-17 23:58 - 00044025 _____ C:\WINDOWS\system32\iglhxo64.vp
2015-07-17 23:58 - 2015-07-17 23:58 - 00043816 _____ C:\WINDOWS\system32\iglhxc64_dev.vp
2015-07-17 23:58 - 2015-07-17 23:58 - 00043494 _____ C:\WINDOWS\system32\iglhxc64.vp
2015-07-17 23:58 - 2015-07-17 23:58 - 00043298 _____ C:\WINDOWS\system32\iglhxg64_dev.vp
2015-07-17 23:58 - 2015-07-17 23:58 - 00043256 _____ C:\WINDOWS\system32\iglhxg64.vp
2015-07-17 23:58 - 2015-07-17 23:58 - 00042079 _____ C:\WINDOWS\system32\iglhxo64_dev.vp
2015-07-17 23:58 - 2015-07-17 23:58 - 00001125 _____ C:\WINDOWS\system32\iglhxa64.vp
2015-07-17 08:38 - 2015-07-17 08:38 - 00000000 ____D C:\Users\Hugh\Tracing
2015-07-16 22:32 - 2015-08-10 20:04 - 00000000 ____D C:\Users\Hugh\AppData\Roaming\Skype
2015-07-16 22:32 - 2015-08-09 10:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-07-16 22:32 - 2015-07-20 08:26 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-07-16 22:32 - 2015-07-20 08:26 - 00000000 ____D C:\ProgramData\Skype
2015-07-16 22:32 - 2015-07-16 22:32 - 00002713 _____ C:\Users\Public\Desktop\Skype.lnk
2015-07-16 22:32 - 2015-07-16 22:32 - 00000000 ____D C:\Users\Hugh\AppData\Local\Skype
2015-07-14 20:59 - 2015-08-08 21:38 - 00000000 ____D C:\Users\Hugh\AppData\Local\CrashDumps
2015-07-14 20:27 - 2015-07-14 20:27 - 00263952 _____ (Intel Corporation) C:\WINDOWS\system32\Drivers\ibtusb.sys
2015-07-14 20:27 - 2015-07-14 20:27 - 00242448 _____ (Intel Corporation) C:\WINDOWS\system32\ibtproppage.dll
2015-07-13 21:40 - 2015-07-13 21:40 - 00558328 _____ (Safer-Networking Ltd. ) C:\Users\Hugh\Downloads\spybot2-license.exe
2015-07-13 20:27 - 2015-07-13 20:31 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Hugh\Downloads\spybot-2.4.exe
2015-07-13 15:02 - 2015-07-13 15:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-07-13 15:01 - 2015-07-13 15:01 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Hugh\Downloads\mbam-setup-2.1.8.1057.exe
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-08-10 19:51 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\sru
2015-08-10 19:03 - 2015-07-10 22:22 - 00000275 _____ C:\WINDOWS\WindowsUpdate.log
2015-08-10 18:46 - 2015-06-07 17:45 - 00000930 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-08-10 14:49 - 2015-06-07 17:44 - 00004158 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{3D2F1FB9-A0C3-47F9-8104-40390AB06AAF}
2015-08-10 12:39 - 2015-06-07 19:14 - 00005238 _____ C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for HUGH_LAPTOP-Hugh Hugh_Laptop
2015-08-10 09:49 - 2015-06-07 17:03 - 00000000 ____D C:\Users\Hugh\AppData\Local\Packages
2015-08-10 08:56 - 2015-06-07 19:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-08-10 08:46 - 2015-06-07 17:45 - 00000926 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-08-10 08:31 - 2015-06-07 19:30 - 00000000 ____D C:\Jts
2015-08-10 08:25 - 2015-07-10 22:20 - 00022028 _____ C:\WINDOWS\setupact.log
2015-08-10 08:25 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\appcompat
2015-08-10 04:38 - 2015-07-10 21:04 - 00028672 _____ C:\WINDOWS\system32\config\BCD-Template
2015-08-10 04:36 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\SysWOW64\oobe
2015-08-10 04:36 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2015-08-10 04:36 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2015-08-10 04:36 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-08-10 04:36 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\Provisioning
2015-08-10 04:36 - 2015-07-10 19:05 - 00000000 ____D C:\WINDOWS\SysWOW64\Dism
2015-08-10 04:36 - 2015-07-10 19:05 - 00000000 ____D C:\WINDOWS\system32\Dism
2015-08-10 04:35 - 2015-07-10 21:06 - 00792568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-08-10 04:35 - 2015-07-10 21:06 - 00178168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-08-09 14:15 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-08-09 13:53 - 2015-07-10 20:55 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-08-09 13:53 - 2015-01-22 19:56 - 00454744 _____ (ELAN Microelectronics Corp.) C:\WINDOWS\system32\Drivers\ETD.sys
2015-08-09 13:50 - 2015-06-07 20:30 - 00000000 ____D C:\ProgramData\Oracle
2015-08-09 13:49 - 2015-06-07 20:30 - 00000000 ____D C:\Program Files (x86)\Java
2015-08-09 13:48 - 2015-06-07 20:31 - 00097888 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2015-08-09 13:41 - 2015-07-10 22:21 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-08-09 13:41 - 2015-07-10 22:20 - 00347400 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-08-09 11:02 - 2015-07-10 23:12 - 00000000 ____D C:\WINDOWS\OCR
2015-08-09 10:57 - 2015-01-22 19:56 - 00428216 _____ (ELAN Microelectronics Corp.) C:\WINDOWS\system32\Drivers\SET6CDE.tmp
2015-08-09 10:56 - 2015-06-07 17:09 - 00000000 ___RD C:\Users\Hugh\OneDrive
2015-08-09 10:54 - 2015-07-10 21:04 - 00000000 ___RD C:\WINDOWS\PurchaseDialog
2015-08-09 10:54 - 2015-07-10 21:04 - 00000000 ___RD C:\WINDOWS\PrintDialog
2015-08-09 10:54 - 2015-07-10 21:04 - 00000000 ___RD C:\WINDOWS\MiracastView
2015-08-09 10:54 - 2015-07-10 21:04 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2015-08-09 10:49 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\Registration
2015-08-09 10:49 - 2015-06-07 17:45 - 00004012 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-08-09 10:49 - 2015-06-07 17:45 - 00003776 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-08-09 10:49 - 2015-06-07 17:09 - 00003710 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2823309964-2513555705-3651140861-1001
2015-08-09 10:49 - 2015-01-23 15:39 - 00003338 _____ C:\WINDOWS\System32\Tasks\NahimicMSIsvc64Run
2015-08-09 10:49 - 2015-01-23 15:39 - 00003330 _____ C:\WINDOWS\System32\Tasks\NahimicMSIsvc32Run
2015-08-09 10:49 - 2015-01-23 15:30 - 00003340 _____ C:\WINDOWS\System32\Tasks\NahimicMSIUILauncherRun
2015-08-09 10:49 - 2015-01-23 15:26 - 00003282 _____ C:\WINDOWS\System32\Tasks\MSI_Dragon Gaming Center
2015-08-09 10:49 - 2015-01-23 15:11 - 00004046 _____ C:\WINDOWS\System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d
2015-08-09 10:49 - 2015-01-23 15:11 - 00003800 _____ C:\WINDOWS\System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon
2015-08-09 10:47 - 2015-07-10 21:04 - 00000000 __RHD C:\Users\Public\Libraries
2015-08-09 10:45 - 2015-07-10 22:20 - 00000355 _____ C:\WINDOWS\setuperr.log
2015-08-09 10:45 - 2015-07-10 21:05 - 00004362 _____ C:\WINDOWS\DtcInstall.log
2015-08-09 10:45 - 2015-07-10 19:05 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2015-08-09 10:45 - 2015-07-10 19:05 - 00032768 ___SH C:\WINDOWS\system32\config\ELAM
2015-08-09 10:45 - 2015-07-10 19:05 - 00000000 __RHD C:\Users\Default
2015-08-09 10:45 - 2015-06-26 18:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AmiBroker
2015-08-09 10:45 - 2015-06-26 10:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AmiBroker x64
2015-08-09 10:45 - 2015-06-08 17:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Telstra
2015-08-09 10:45 - 2015-06-07 20:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-08-09 10:45 - 2015-06-07 19:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Interactive Brokers
2015-08-09 10:45 - 2015-06-07 19:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-08-09 10:45 - 2015-06-07 17:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-08-09 10:45 - 2015-01-23 16:01 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 10
2015-08-09 10:45 - 2015-01-23 16:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BurnRecovery
2015-08-09 10:45 - 2015-01-23 15:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nahimic for MSI
2015-08-09 10:45 - 2015-01-23 15:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSI
2015-08-09 10:45 - 2015-01-23 15:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-08-09 10:45 - 2015-01-23 15:11 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
2015-08-09 10:45 - 2013-08-22 23:36 - 00000000 ____D C:\Users\Default.migrated
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\SysWOW64\zh-HK
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\SysWOW64\uk-UA
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\SysWOW64\tr-TR
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\SysWOW64\th-TH
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\SysWOW64\sr-Latn-RS
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\SysWOW64\sl-SI
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\SysWOW64\sk-SK
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\SysWOW64\ro-RO
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\SysWOW64\lv-LV
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\SysWOW64\lt-LT
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\SysWOW64\hr-HR
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\SysWOW64\he-IL
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\SysWOW64\et-EE
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\SysWOW64\en-GB
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\SysWOW64\bg-BG
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\SysWOW64\ar-SA
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\zh-HK
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\uk-UA
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\tr-TR
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\th-TH
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\sr-Latn-RS
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\spool
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\sl-SI
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\sk-SK
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\ro-RO
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\Recovery
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\oobe
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\NDF
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\lv-LV
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\lt-LT
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\InputMethod
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\hr-HR
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\he-IL
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\et-EE
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\en-GB
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\bg-BG
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\system32\ar-SA
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\InputMethod
2015-08-09 10:43 - 2015-07-10 21:04 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-08-09 10:43 - 2015-01-23 16:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MAGIX
2015-08-09 10:43 - 2015-01-23 15:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Qualcomm Atheros
2015-08-09 10:43 - 2015-01-23 15:15 - 00000000 ____D C:\WINDOWS\SysWOW64\sda
2015-08-09 10:43 - 2015-01-23 15:10 - 00000000 ____D C:\Program Files (x86)\Intel
2015-08-09 10:43 - 2013-08-23 01:36 - 00000000 ____D C:\WINDOWS\system32\WindowsInternal.Inbox.Shared
2015-08-09 10:43 - 2013-08-23 01:36 - 00000000 ____D C:\WINDOWS\system32\WindowsInternal.Inbox.Media.Shared
2015-08-09 10:43 - 2013-08-23 01:36 - 00000000 ____D C:\WINDOWS\MediaViewer
2015-08-09 10:43 - 2013-08-23 01:36 - 00000000 ____D C:\WINDOWS\ADFS
2015-08-09 10:42 - 2015-07-10 19:05 - 00000000 ____D C:\WINDOWS\system32\Sysprep
2015-08-09 10:41 - 2015-07-10 21:04 - 00000000 ____D C:\WINDOWS\Help
2015-08-09 10:29 - 2015-06-07 15:51 - 01102239 _____ C:\WINDOWS\WindowsUpdate (1).log
2015-08-09 10:26 - 2015-07-10 23:39 - 00000000 ___HD C:\$Windows.~BT
2015-08-07 16:30 - 2015-06-26 18:40 - 00000000 ____D C:\Program Files (x86)\AmiBroker
2015-08-06 13:47 - 2015-06-07 17:46 - 00002213 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-07-29 08:58 - 2015-06-19 08:44 - 00000000 ____D C:\Program Files\Common Files\AV
2015-07-27 18:55 - 2015-07-06 08:24 - 00009728 ___SH C:\Users\Hugh\Desktop\Thumbs.db
2015-07-23 18:18 - 2015-06-07 19:09 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-07-20 21:25 - 2015-06-07 19:22 - 00001692 _____ C:\Users\Hugh\Desktop\Google Drive.lnk
2015-07-20 08:27 - 2015-06-07 19:22 - 00000000 ___RD C:\Users\Hugh\Google Drive
2015-07-19 17:58 - 2015-06-07 17:45 - 00000000 ____D C:\Program Files (x86)\Google
2015-07-16 08:28 - 2013-08-23 01:36 - 00000000 ___RD C:\WINDOWS\ToastData
2015-07-15 09:42 - 2015-06-08 16:59 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-07-15 08:31 - 2014-11-05 10:48 - 00000000 ____D C:\ProgramData\Norton
2015-07-14 08:14 - 2015-06-07 19:20 - 00002068 _____ C:\Users\Public\Desktop\Google Slides.lnk
2015-07-14 08:14 - 2015-06-07 19:20 - 00002066 _____ C:\Users\Public\Desktop\Google Sheets.lnk
2015-07-14 08:14 - 2015-06-07 19:20 - 00002056 _____ C:\Users\Public\Desktop\Google Docs.lnk
2015-07-14 08:07 - 2014-11-05 10:49 - 00000000 ____D C:\ProgramData\boost_interprocess
==================== Files in the root of some directories =======
2015-07-20 11:05 - 2015-07-20 11:05 - 0000017 _____ () C:\Users\Hugh\AppData\Local\resmon.resmoncfg
2015-08-09 10:41 - 2015-08-09 10:41 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Some files in TEMP:
====================
C:\Users\Hugh\AppData\Local\Temp\jre-8u51-windows-au.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-08-09 11:01
==================== End of log ============================
Additional scan result of Farbar Recovery Scan Tool (x64) Version:09-08-2015
Ran by Hugh (2015-08-10 20:06:57)
Running from C:\Users\Hugh\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-2823309964-2513555705-3651140861-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-2823309964-2513555705-3651140861-503 - Limited - Disabled)
Guest (S-1-5-21-2823309964-2513555705-3651140861-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2823309964-2513555705-3651140861-1003 - Limited - Enabled)
Hugh (S-1-5-21-2823309964-2513555705-3651140861-1001 - Administrator - Enabled) => C:\Users\Hugh
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Spybot - Search and Destroy (Enabled - Up to date) {1A0DDE8C-B4BA-EFDD-22A8-0F557C7985F0}
AS: Spybot - Search and Destroy (Enabled - Up to date) {A16C3F68-9280-E053-1818-342707FECF4D}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 15.05 beta x64 (HKLM\...\7-Zip) (Version: - )
AmiBroker 5.60.3 x64 (HKLM\...\AmiBroker64_is1) (Version: 5.60 - AmiBroker.com)
AmiBroker 5.90.1 (HKLM-x32\...\AmiBroker_is1) (Version: 5.90 - AmiBroker.com)
Battery Calibration (HKLM-x32\...\{619FA785-489B-4D22-911F-82D6EDF5BDB0}) (Version: 1.0.1405.0701 - Micro-Star International Co., Ltd.)
Boot Configure (HKLM-x32\...\{5563D674-6B02-43F4-B9D0-C2A944E84F3C}) (Version: 20.014.12127 - Micro-Star International Co., Ltd.)
BurnRecovery (HKLM-x32\...\{2892E1B7-E24D-4CCB-B8A7-B63D4B66F89F}) (Version: 4.0.1412.2301 - )
CutePDF Writer 3.0 (HKLM\...\CutePDF Writer Installation) (Version: 3.0 - Acro Software Inc.)
CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.5509.52 - CyberLink Corp.)
Dragon Gaming Center (HKLM-x32\...\InstallShield_{965B16C7-0778-4C45-B7D1-83A59E6FBBCB}) (Version: 1.0.1410.1301 - Micro-Star International Co., Ltd.)
Dragon Gaming Center (x32 Version: 1.0.1410.1301 - Micro-Star International Co., Ltd.) Hidden
ELAN Touchpad 15.13.1.1_X64_WHQL (HKLM\...\Elantech) (Version: 15.13.1.1 - ELAN Microelectronic Corp.)
Excel VBA Code Cleaner 5.0 (HKLM-x32\...\Excel VBA Code Cleaner 5.0) (Version: - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 44.0.2403.130 - Google Inc.)
Google Drive (HKLM-x32\...\{6EA8B94E-D869-4D96-88DF-5E1ECE1D6876}) (Version: 1.23.9648.8824 - Google, Inc.)
Google Earth (HKLM-x32\...\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)
Google Update Helper (x32 Version: 1.3.21.115 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.28.1 - Google Inc.) Hidden
Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{0EC7F9CC-4741-45AE-9F55-6E9343F726F5}) (Version: 1.1.0.36960 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4170 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 13.5.0.1056 - Intel Corporation)
Intel(R) Wireless Bluetooth(R)(patch version 17.1.1434.2) (HKLM\...\{302600C1-6BDF-4FD1-1407-148929CC1385}) (Version: 17.1.1407.0480 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{85b9d34f-7397-4e39-8600-07942ef6ca04}) (Version: 17.0.5 - Intel Corporation)
Java 8 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218051F0}) (Version: 8.0.510 - Oracle Corporation)
KB9X Radio Switch Driver (HKLM\...\5AADE1068CF70DD983F763B20CF2CAAB72883915) (Version: 1.1.0.0 - ENE TECHNOLOGY INC.)
KeePass Password Safe 1.29 (HKLM-x32\...\KeePass Password Safe_is1) (Version: 1.29 - Dominik Reichl)
KLM (HKLM-x32\...\InstallShield_{4DEA5B85-6C56-45F3-AE00-FED756B0D3B4}) (Version: 1.0.1411.1101 - Application)
KLM (x32 Version: 1.0.1411.1101 - Application) Hidden
MAGIX MX Suite (HKLM-x32\...\MAGIX_{43136332-880B-458A-966C-900C18752B66}) (Version: 1.13.0.121 - MAGIX AG)
MAGIX MX Suite (Version: 1.13.0.121 - MAGIX AG) Hidden
Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 15.0.4737.1003 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
MSI Remind Manager (HKLM-x32\...\InstallShield_{3E23F267-3E35-40F9-B6BF-BC034D214717}) (Version: 1.0.1412.1801 - Micro-Star International Co., Ltd.)
MSI Remind Manager (x32 Version: 1.0.1412.1801 - Micro-Star International Co., Ltd.) Hidden
MSI Social Media Collection (HKLM-x32\...\{7ADEC426-BE95-48EF-84D4-086BD0F4D331}) (Version: 1.14.2251 - Micro-Star International Co., Ltd.)
Nahimic APO (x32 Version: 1.0.401 - Nahimic) Hidden
Nahimic for MSI (HKLM-x32\...\{d790cc66-b17a-4c88-96a8-cb6506bfdfe4}) (Version: 1.0.4 - Nahimic)
Nahimic for MSI (Version: 1.0.401 - Nahimic) Hidden
NahimicSettingsConfigurator (Version: 1.0.401 - Nahimic) Hidden
Network Recording Player (HKLM-x32\...\{21706D5B-A09C-42F1-95B5-CBDFE20F9852}) (Version: 29.10.1.10115 - Cisco WebEx LLC)
NVIDIA GeForce Experience 2.1.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.5 - NVIDIA Corporation)
NVIDIA Graphics Driver 345.05 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 345.05 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
Qualcomm Atheros Bandwidth Control Filter Driver (Version: 1.1.46.1056 - Qualcomm Atheros) Hidden
Qualcomm Atheros Killer E220x Drivers (Version: 1.1.46.1056 - Qualcomm Atheros) Hidden
Qualcomm Atheros Killer Performance Suite (HKLM-x32\...\{E70DB50B-10B4-46BC-9DE2-AB8B49E061EE}) (Version: 1.1.46.1056 - Qualcomm Atheros)
Qualcomm Atheros Network Manager (Version: 1.1.46.1056 - Qualcomm Atheros) Hidden
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.21249 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7535 - Realtek Semiconductor Corp.)
SCM (HKLM\...\{9BC0C4F3-ACBB-42DF-9559-93175E3B4095}) (Version: 13.014.11068 - Application)
SHIELD Streaming (Version: 3.1.3000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.18.9 - NVIDIA Corporation) Hidden
Sizing Options (HKLM-x32\...\InstallShield_{DFAB6DE8-E45F-4D5D-95C0-E54C58993F9F}) (Version: 2.0.1412.1501 - Application)
Sizing Options (x32 Version: 2.0.1412.1501 - Application) Hidden
Skype™ 7.6 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.6.105 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.5.43 - Safer-Networking Ltd.)
SUPER CHARGER (HKLM-x32\...\{7CDF10DD-A9B5-4DA3-AB95-E193248D4369}_is1) (Version: 1.2.024 - MSI)
Telstra Mobile Broadband Manager (HKLM-x32\...\Telstra Mobile Broadband Manager) (Version: 3.0.514 - Telstra)
Telstra Mobile Broadband Manager (x32 Version: 3.0.514 - Telstra) Hidden
Trader Workstation 4.0 (HKLM-x32\...\Trader Workstation 4.0) (Version: - )
Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 2.2.0 - Tweaking.com)
TWS API (HKLM-x32\...\{AF3F53E2-2766-45B4-9F2F-AA8A51AD5C85}) (Version: 9.72.03 - IBG LLC)
Windows Driver Package - Cmotech (cmusbnet) Net (06/11/2007 2.0.0.9) (HKLM\...\51208688C66699298C32E38B6BFF92816EE798CA) (Version: 06/11/2007 2.0.0.9 - Cmotech)
Windows Driver Package - Cmotech Modem (06/08/2007 2.0.3.9) (HKLM\...\7404D4336C2B621F88A2B25CE6577572A8BBD25A) (Version: 06/08/2007 2.0.3.9 - Cmotech)
Windows Driver Package - Cmotech Ports (06/08/2007 2.0.3.9) (HKLM\...\2021A90B4F2D70AB98CFBF428E09767703FD455E) (Version: 06/08/2007 2.0.3.9 - Cmotech)
ZTE USB Driver (HKLM\...\ZTE USB Driver) (Version: 1.0.1.16+ - ZTE Corporation)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InprocServer32 -> C:\Windows\system32\shell32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32 -> C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32 -> C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5907.0716_1\amd64\FileSyncApi64.dll (Microsoft Corporation)
==================== Restore Points =========================
ATTENTION: System Restore is disabled
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 23:25 - 2015-07-27 18:54 - 00000035 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {00EEBA9C-F9EF-4272-B793-C830FBADD359} - System32\Tasks\Microsoft\Windows\ApplicationData\DsSvcCleanup => C:\Windows\system32\dstokenclean.exe [2015-07-10] (Microsoft Corporation)
Task: {0CCA7916-2916-4F12-BD32-1E3BE31E1269} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Device-Join => C:\Windows\System32\dsregcmd.exe [2015-07-10] (Microsoft Corporation)
Task: {0D3AC8D1-1AFF-495D-893F-79BF18C74ED2} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {0DD79B14-5247-458B-894B-2BC035F74A3C} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {1641F54C-1E57-4902-AB65-EE2B65E5629D} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan => C:\Windows\system32\usoclient.exe [2015-07-10] (Microsoft Corporation)
Task: {19865544-CE08-40BE-8B8C-87C47681433D} - System32\Tasks\Microsoft\Windows\WindowsUpdate\sihboot => C:\Windows\System32\sihclient.exe [2015-07-10] (Microsoft Corporation)
Task: {1D3D099E-EE1E-4907-8BA2-BA8F12D11AA6} - System32\Tasks\Microsoft\Windows\Location\Notifications => C:\Windows\System32\LocationNotificationWindows.exe [2015-07-10] (Microsoft Corporation)
Task: {1FB1FC13-CD43-4DE0-AB19-B4D87FCE8B64} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2015-06-16] (Safer-Networking Ltd.)
Task: {2048E66F-7002-4384-8D84-ADF698DA6193} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {2C97A00A-1C5C-4318-B5CC-8A1A126B77F9} - System32\Tasks\Microsoft\Windows\CertificateServicesClient\KeyPreGenTask
Task: {3F6E048D-6404-433B-8F5F-CFF4D89BF89E} - System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser => Rundll32.exe generaltel.dll,RunTelemetryW
Task: {41160EA0-208B-4C3E-B4DB-805BBABC6B93} - System32\Tasks\Microsoft\Windows\Feedback\Siuf\DmClient => C:\Windows\system32\dmclient.exe [2015-07-10] (Microsoft Corporation)
Task: {4454A8D0-2E4E-4A02-BF67-48DF6A7BFAB4} - System32\Tasks\Microsoft\Windows\Maps\MapsUpdateTask
Task: {49FA9514-2ED1-4A63-A5C1-A6FAB35D7CBB} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2015-06-16] (Safer-Networking Ltd.)
Task: {4D53FB81-2EE9-4344-B1CA-10116BFA0FAC} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-01] (Microsoft Corporation)
Task: {516AD84A-5EB5-4B1D-B421-D5A425DED3A3} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-06-09] (Microsoft Corporation)
Task: {55A3592F-84CC-4DAB-9267-5C912FA9A6C1} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {5619C3C6-4E00-49A0-9DA1-8E201B3B9D51} - System32\Tasks\MSI_Dragon Gaming Center => C:\Program Files (x86)\MSI\Dragon Gaming Center\mDispatch.exe [2014-01-24] (TODO: <公司名稱>)
Task: {5E5515C1-7D87-4904-B9CE-FD29EB2ADB72} - System32\Tasks\Microsoft\Windows\Sysmain\ResPriStaticDbSync
Task: {611C823C-437B-46E7-9683-5312DFFCFD7B} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Policy Install => C:\Windows\system32\usoclient.exe [2015-07-10] (Microsoft Corporation)
Task: {6E7E4E9F-8D07-4885-901A-A97D0F9BDB5A} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-08] (Intel Corporation)
Task: {711EE2F9-A611-4773-AF8E-D4B278A6718D} - System32\Tasks\Microsoft\Windows\CertificateServicesClient\AikCertEnrollTask
Task: {73551810-E5F4-433E-9494-0D00B55C855E} - System32\Tasks\Microsoft\Windows\Maps\MapsToastTask
Task: {744C9FEA-08B7-43E1-A729-0F94647D655C} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Resume On Boot => C:\Windows\system32\usoclient.exe [2015-07-10] (Microsoft Corporation)
Task: {783F8E13-DD52-4936-8A7D-A91CA4F51052} - System32\Tasks\NahimicMSIsvc32Run => C:\Program Files\Nahimic\NahimicMSI\UserInterface\NahimicMSIsvc32.exe [2015-01-17] ()
Task: {78B77FA3-9D97-441D-97B6-68CEA40B4F74} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe generaltel.dll,RunTelemetry -maintenance
Task: {7A003965-A297-4DC6-B15B-852D798391E0} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot => C:\Windows\system32\MusNotification.exe [2015-08-10] (Microsoft Corporation)
Task: {7A468A53-C4AC-4A64-90ED-6952EEF05F3F} - System32\Tasks\NahimicMSIsvc64Run => C:\Program Files\Nahimic\NahimicMSI\UserInterface\x64\NahimicMSIsvc64.exe [2015-01-17] ()
Task: {848DCC36-520C-4946-BF68-C7EFFEFA2F84} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_ReadyToReboot => C:\windows\system32\MusNotification.exe [2015-08-10] (Microsoft Corporation)
Task: {8DF84CB3-D8E0-4307-A35B-CA74E21786DB} - System32\Tasks\Microsoft\Windows\Clip\License Validation => C:\Windows\system32\ClipUp.exe [2015-08-10] (Microsoft Corporation)
Task: {8EBE772D-F653-493C-8EB8-847E7496C3C5} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {96A57529-6720-4356-A162-4BABAF080DF9} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {9A68F6C1-717E-47D4-B99B-CD05941C30CE} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {A364E297-00AD-490D-900E-22AC34598C71} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Maintenance Install => C:\Windows\system32\usoclient.exe [2015-07-10] (Microsoft Corporation)
Task: {A3C097C9-2D25-44E2-82A5-ED4D815E9BDC} - System32\Tasks\Microsoft Office 15 Sync Maintenance for HUGH_LAPTOP-Hugh Hugh_Laptop => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-06-02] (Microsoft Corporation)
Task: {A5B6CD85-1B57-49B9-BA80-5D5D65F02826} - System32\Tasks\Microsoft\Windows\AppID\EDP Policy Manager
Task: {AB81E42D-7B4A-428C-BF0D-0C35A919B84E} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {AC29E64E-3271-47BA-B8F1-914523CF379B} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Automatic App Update
Task: {B16B8A85-0EF5-4553-937B-AF6BD8561457} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {B5AB7F8D-6F2E-4527-AAD5-CF1239851899} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-07] (Google Inc.)
Task: {B9B36D41-C776-424E-9A13-5387E17A2CEB} - System32\Tasks\Microsoft\Windows\WCM\WiFiTask => C:\Windows\System32\WiFiTask.exe [2015-07-10] (Microsoft Corporation)
Task: {BE35EB41-0163-479E-BCDF-C4D8167F4473} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-01] (Microsoft Corporation)
Task: {C0006503-DD75-40C5-BF0A-8A4FE18656DE} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-07-03] (Microsoft Corporation)
Task: {C2162702-FFEB-48C0-AA5F-2DA3A8887D61} - System32\Tasks\Microsoft\Windows\LanguageComponentsInstaller\Installation
Task: {C56AFFD3-06B8-4A16-AF7E-F7A6EB3FAE9E} - System32\Tasks\Microsoft\Windows\TPM\Tpm-HASCertRetr
Task: {C5EE2EA2-5312-4D1F-B9D0-41B18DF31B78} - System32\Tasks\Microsoft\Windows\WindowsUpdate\sih => C:\Windows\System32\sihclient.exe [2015-07-10] (Microsoft Corporation)
Task: {C7A236B2-12E1-46DC-9501-3B1B0209CC09} - System32\Tasks\Microsoft\Windows\Location\WindowsActionDialog => C:\Windows\System32\WindowsActionDialog.exe [2015-07-10] (Microsoft Corporation)
Task: {CA6CBB86-C6FE-4458-9A04-3AA1ED68B80D} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {D1FA0D76-962C-426A-8091-5E9C55A6320C} - System32\Tasks\NahimicMSIUILauncherRun => C:\Program Files\Nahimic\NahimicMSI\UserInterface\NahimicMSIUILauncher.exe [2015-01-17] ()
Task: {D2401052-A382-42DE-9C79-D1CF3563F654} - System32\Tasks\Microsoft\Windows\LanguageComponentsInstaller\Uninstallation
Task: {DAF2BAE3-1C5B-4CB5-9F62-0911C031A15A} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics => C:\Windows\system32\disksnapshot.exe [2015-07-10] (Microsoft Corporation)
Task: {E0B6A5CB-CD7B-4680-BD0A-F62752C38656} - System32\Tasks\Microsoft\Windows\RetailDemo\CleanupOfflineContent
Task: {E83BFE70-7C41-426B-ACA1-B7E29B966B94} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {EA3F661E-B31C-44A9-B40C-E3D5D56149D4} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_Display => C:\windows\system32\MusNotification.exe [2015-08-10] (Microsoft Corporation)
Task: {F2D1245F-D401-4F03-B308-E53334DBFDF8} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2015-06-16] (Safer-Networking Ltd.)
Task: {F51F4499-139A-4ABA-B336-4DA5FF0B93C4} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-07] (Google Inc.)
Task: {F5F53463-F11C-4A5F-9028-BB7FA9AB5413} - System32\Tasks\Microsoft\Windows\SetupSQMTask => C:\WINDOWS\SYSTEM32\OOBE\SETUPSQM.EXE [2015-07-10] (Microsoft Corporation)
Task: {F61A8720-B7BB-423A-87F0-B0857571A774} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-08] (Intel Corporation)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (Whitelisted) ==============
2015-07-10 21:00 - 2015-07-10 21:00 - 00028160 _____ () C:\WINDOWS\SYSTEM32\efsext.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00032768 _____ () C:\WINDOWS\SYSTEM32\licensemanagerapi.dll
2015-07-27 09:46 - 2013-10-23 15:24 - 00087600 _____ () C:\WINDOWS\System32\cpwmon64.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00403968 _____ () C:\WINDOWS\System32\diagtrack_wininternal.dll
2015-06-07 19:09 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-08-09 10:41 - 2015-07-23 11:10 - 00116552 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 02498808 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2014-01-23 04:44 - 2014-01-23 04:44 - 00075912 _____ () C:\Program Files (x86)\MSI\Dragon Gaming Center\WinIo64.dll
2014-08-19 05:40 - 2014-08-19 05:40 - 00330240 _____ () C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe
2013-05-10 11:58 - 2013-05-10 11:58 - 00119808 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\updateui.exe
2015-08-10 04:35 - 2015-08-10 04:35 - 02498808 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2015-06-08 17:34 - 2015-06-08 17:34 - 08898720 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2015-07-10 20:59 - 2015-07-10 20:59 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 00642048 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\MtcUvc.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2015-07-10 21:00 - 2015-07-10 23:14 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 01806848 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2015-08-10 04:35 - 2015-08-10 04:35 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-08-09 14:10 - 2015-08-09 14:10 - 00007168 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.803.16240.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2015-08-09 14:10 - 2015-08-09 14:10 - 11284480 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.803.16240.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2015-07-10 23:17 - 2015-07-10 23:17 - 07897088 _____ () C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\SharedLibrary.dll
2015-08-09 14:10 - 2015-08-09 14:10 - 07824896 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_2015.8.3.0_x64__8wekyb3d8bbwe\WinStore.Entertainment.Mobile.dll
2015-08-09 14:10 - 2015-08-09 14:10 - 02062336 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_2015.8.3.0_x64__8wekyb3d8bbwe\MS.Entertainment.Common.Mobile.dll
2015-08-09 11:04 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-08-09 11:04 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-08-09 11:04 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-01-23 15:11 - 2013-09-17 06:17 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-09-24 16:43 - 2014-09-24 16:43 - 00258048 _____ () C:\Windows\ddedll.dll
2015-08-10 08:25 - 2015-08-10 08:25 - 00098816 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\win32api.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00110080 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\pywintypes27.dll
2015-08-10 08:25 - 2015-08-10 08:25 - 00364544 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\pythoncom27.dll
2015-08-10 08:25 - 2015-08-10 08:25 - 00045568 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\_socket.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 01161216 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\_ssl.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00320512 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\win32com.shell.shell.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00713216 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\_hashlib.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 01175040 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\wx._core_.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00805888 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\wx._gdi_.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00811008 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\wx._windows_.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 01062400 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\wx._controls_.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00735232 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\wx._misc_.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00682496 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\pysqlite2._sqlite.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00087552 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\_ctypes.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00119808 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\win32file.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00108544 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\win32security.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00007168 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\hashobjs_ext.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00068096 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\usb_ext.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00167936 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\win32gui.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00018432 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\win32event.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00128512 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\_elementtree.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00127488 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\pyexpat.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00013824 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\common.time34.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00036864 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\_psutil_windows.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00038912 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\win32inet.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00011264 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\win32crypt.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00070656 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\wx._html2.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00027136 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\_multiprocessing.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00020480 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\_yappi.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00035840 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\win32process.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00686080 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\unicodedata.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00122368 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\wx._wizard.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00024064 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\win32pipe.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00010240 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\select.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00025600 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\win32pdh.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00525640 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\windows._lib_cacheinvalidation.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00017408 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\win32profile.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00022528 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\win32ts.pyd
2015-08-10 08:25 - 2015-08-10 08:25 - 00078336 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI146642\wx._animate.pyd
2015-08-09 11:04 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2010-12-18 06:56 - 2010-12-18 06:56 - 02603520 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\QtCore4.dll
2013-03-08 06:53 - 2013-03-08 06:53 - 00015872 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\featureController.dll
2010-12-18 06:56 - 2010-12-18 06:56 - 01006592 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\QtNetwork4.dll
2010-12-18 06:56 - 2010-12-18 06:56 - 00382464 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\QtXml4.dll
2010-01-13 10:55 - 2010-01-13 10:55 - 00400384 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\sqlite3.dll
2010-01-13 10:55 - 2010-01-13 10:55 - 00322048 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\log4cplus.dll
2010-12-17 06:16 - 2010-12-17 06:16 - 00195584 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\libgsoap.dll
2010-01-18 17:34 - 2010-01-18 17:34 - 00062464 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\zlib1.dll
2013-03-08 06:55 - 2013-03-08 06:55 - 00472576 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\DeviceProfile.dll
2013-03-08 06:58 - 2013-03-08 06:58 - 00499488 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\plugin\PServerPlugin.dll
2013-03-08 06:54 - 2013-03-08 06:54 - 00013824 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\eventsSender.dll
2010-12-18 06:56 - 2010-12-18 06:56 - 14978048 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\QtWebKit4.dll
2010-12-18 06:56 - 2010-12-18 06:56 - 09224704 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\QtGui4.dll
2010-12-18 06:56 - 2010-12-18 06:56 - 00317952 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\phonon4.dll
2015-06-08 17:32 - 2015-06-08 17:32 - 00316576 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream32.dll
2015-06-24 09:13 - 2015-06-17 00:08 - 01032360 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\ADDINS\UmOutlookAddin.dll
2014-10-10 02:56 - 2014-10-10 02:56 - 00099840 _____ () C:\ProgramData\webex\WebEx\500\ATJPEG60.DLL
2015-06-07 19:09 - 2015-06-07 19:10 - 00196264 _____ () C:\Program Files\Microsoft Office 15\root\office15\IEAWSDC.DLL
2015-08-06 13:47 - 2015-07-31 16:19 - 01405768 _____ () C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.130\libglesv2.dll
2015-08-06 13:47 - 2015-07-31 16:19 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.130\libegl.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Users\Hugh\OneDrive:ms-properties
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ahcache.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CoreMessagingRegistrar => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\StateRepository => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TileDataModelSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\UserManager => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Ahcache.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CoreMessagingRegistrar => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\StateRepository => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TileDataModelSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\UserManager => ""="Service"
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
IE restricted site: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\123simsen.com -> www.123simsen.com
There are 7866 more restricted sites.
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Hugh\AppData\Roaming\Microsoft\Windows Photo Viewer\Windows Photo Viewer Wallpaper.jpg
DNS Servers: 10.0.0.138
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{CB139DFD-8A07-4899-94D9-8F9EE01F8010}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [UDP Query User{C267FC24-0437-4945-AC60-DC8D8C16213B}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{0610B524-831C-409A-AAE8-C7CA9EB537A9}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{0BBAB1B7-5F6B-432A-8195-FC5449330FBB}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{06E9B8AC-47BD-4110-9090-423D07B682E7}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{62C52245-8937-43AA-878D-D9D83BCC5BEE}C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe
FirewallRules: [TCP Query User{E08765E9-A930-48B9-B7E6-D05B4685593B}C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe
FirewallRules: [{7A705F37-593F-4CE8-8A69-8DFDEFED882A}] => (Allow) C:\Users\Hugh\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{B6B6CA70-94FD-41DF-97BC-BF8A4F0B5A8D}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{C6744919-EAC7-417A-B4D7-28F0A859701A}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{A9055384-AE0A-48C4-805D-B9F9D2DEE085}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{F20C674D-D846-4DDC-BC35-5A1A803A26AF}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{CDC47814-1B28-4EC9-886F-668D7399C0F7}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{1972B00C-10E4-4AA2-8590-2765619747F0}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{21288DD7-E4D4-4BF2-90BF-AB99B749D116}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{A716ED6C-4C75-42C2-9D3E-58027E049AE7}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{6BF214AB-A286-4902-8A28-31EB04D7BF61}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{2D3AC92D-79CE-48F3-B94E-986B1DFA255D}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [TCP Query User{F07C8168-BD99-4928-A5BA-1B2A203381E9}C:\program files (x86)\java\jre1.8.0_51\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_51\bin\javaw.exe
FirewallRules: [UDP Query User{63F77518-E68F-4DC2-97DE-63EC37C58CCE}C:\program files (x86)\java\jre1.8.0_51\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_51\bin\javaw.exe
FirewallRules: [TCP Query User{C50A75AB-5541-4E8B-85A8-594800C43EA5}C:\program files (x86)\java\jre1.8.0_51\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_51\bin\javaw.exe
FirewallRules: [UDP Query User{05046D40-1B10-4CC0-8B24-B463B7E827A7}C:\program files (x86)\java\jre1.8.0_51\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_51\bin\javaw.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (08/10/2015 03:16:12 PM) (Source: ESENT) (EventID: 413) (User: )
Description: SettingSyncHost (7596) Unable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error -1032.
Error: (08/10/2015 03:16:12 PM) (Source: ESENT) (EventID: 488) (User: )
Description: SettingSyncHost (7596) An attempt to create the file "C:\WINDOWS\system32\edbtmp.log" failed with system error 5 (0x00000005): "Access is denied. ". The create file operation will fail with error -1032 (0xfffffbf8).
Error: (08/10/2015 03:16:02 PM) (Source: ESENT) (EventID: 413) (User: )
Description: SettingSyncHost (7596) Unable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error -1032.
Error: (08/10/2015 03:16:02 PM) (Source: ESENT) (EventID: 488) (User: )
Description: SettingSyncHost (7596) An attempt to create the file "C:\WINDOWS\system32\edbtmp.log" failed with system error 5 (0x00000005): "Access is denied. ". The create file operation will fail with error -1032 (0xfffffbf8).
Error: (08/10/2015 03:15:52 PM) (Source: ESENT) (EventID: 413) (User: )
Description: SettingSyncHost (7596) Unable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error -1032.
Error: (08/10/2015 03:15:52 PM) (Source: ESENT) (EventID: 488) (User: )
Description: SettingSyncHost (7596) An attempt to create the file "C:\WINDOWS\system32\edbtmp.log" failed with system error 5 (0x00000005): "Access is denied. ". The create file operation will fail with error -1032 (0xfffffbf8).
Error: (08/10/2015 03:15:41 PM) (Source: ESENT) (EventID: 413) (User: )
Description: SettingSyncHost (7596) Unable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error -1032.
Error: (08/10/2015 03:15:41 PM) (Source: ESENT) (EventID: 488) (User: )
Description: SettingSyncHost (7596) An attempt to create the file "C:\WINDOWS\system32\edbtmp.log" failed with system error 5 (0x00000005): "Access is denied. ". The create file operation will fail with error -1032 (0xfffffbf8).
Error: (08/10/2015 03:15:31 PM) (Source: ESENT) (EventID: 413) (User: )
Description: SettingSyncHost (7596) Unable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error -1032.
Error: (08/10/2015 03:15:31 PM) (Source: ESENT) (EventID: 488) (User: )
Description: SettingSyncHost (7596) An attempt to create the file "C:\WINDOWS\system32\edbtmp.log" failed with system error 5 (0x00000005): "Access is denied. ". The create file operation will fail with error -1032 (0xfffffbf8).
System errors:
=============
Error: (08/10/2015 08:21:49 AM) (Source: Microsoft-Windows-NDIS) (EventID: 10317) (User: NT AUTHORITY)
Description: Miniport ZTE Wireless Ethernet Adapter, {88CEDBDD-042F-4099-A5C0-59821EEED7AD}, had event 76
Error: (08/09/2015 08:44:35 PM) (Source: DCOM) (EventID: 10010) (User: HUGH_LAPTOP)
Description: Windows.Security.Authentication.Web.Core.BackgroundGetTokenTask.ClassId.WebAccountProvider
Error: (08/09/2015 08:44:35 PM) (Source: DCOM) (EventID: 10010) (User: HUGH_LAPTOP)
Description: Windows.Security.Authentication.Web.Core.BackgroundGetTokenTask.ClassId.WebAccountProvider
Error: (08/09/2015 08:44:34 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Sync Host_Session1 service to connect.
Error: (08/09/2015 08:44:34 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the User Data Storage_Session1 service to connect.
Error: (08/09/2015 08:44:34 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the User Data Storage_Session1 service, but this action failed with the following error:
%%1056
Error: (08/09/2015 08:44:31 PM) (Source: DCOM) (EventID: 10010) (User: HUGH_LAPTOP)
Description: CortanaUI.AppXn73w0hsq3g4wx1h9fhf7q02vw2wta6qc.mca
Error: (08/09/2015 08:44:29 PM) (Source: DCOM) (EventID: 10010) (User: HUGH_LAPTOP)
Description: CortanaUI.AppXtpp90jhw9p0njjb85kvhxpppgrqfp117.mca
Error: (08/09/2015 08:44:24 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The User Data Access_Session1 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
Error: (08/09/2015 08:44:24 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The User Data Storage_Session1 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
Microsoft Office:
=========================
Error: (08/10/2015 03:16:12 PM) (Source: ESENT) (EventID: 413) (User: )
Description: SettingSyncHost7596-1032
Error: (08/10/2015 03:16:12 PM) (Source: ESENT) (EventID: 488) (User: )
Description: SettingSyncHost7596C:\WINDOWS\system32\edbtmp.log-1032 (0xfffffbf8)5 (0x00000005)Access is denied.
Error: (08/10/2015 03:16:02 PM) (Source: ESENT) (EventID: 413) (User: )
Description: SettingSyncHost7596-1032
Error: (08/10/2015 03:16:02 PM) (Source: ESENT) (EventID: 488) (User: )
Description: SettingSyncHost7596C:\WINDOWS\system32\edbtmp.log-1032 (0xfffffbf8)5 (0x00000005)Access is denied.
Error: (08/10/2015 03:15:52 PM) (Source: ESENT) (EventID: 413) (User: )
Description: SettingSyncHost7596-1032
Error: (08/10/2015 03:15:52 PM) (Source: ESENT) (EventID: 488) (User: )
Description: SettingSyncHost7596C:\WINDOWS\system32\edbtmp.log-1032 (0xfffffbf8)5 (0x00000005)Access is denied.
Error: (08/10/2015 03:15:41 PM) (Source: ESENT) (EventID: 413) (User: )
Description: SettingSyncHost7596-1032
Error: (08/10/2015 03:15:41 PM) (Source: ESENT) (EventID: 488) (User: )
Description: SettingSyncHost7596C:\WINDOWS\system32\edbtmp.log-1032 (0xfffffbf8)5 (0x00000005)Access is denied.
Error: (08/10/2015 03:15:31 PM) (Source: ESENT) (EventID: 413) (User: )
Description: SettingSyncHost7596-1032
Error: (08/10/2015 03:15:31 PM) (Source: ESENT) (EventID: 488) (User: )
Description: SettingSyncHost7596C:\WINDOWS\system32\edbtmp.log-1032 (0xfffffbf8)5 (0x00000005)Access is denied.
CodeIntegrity:
===================================
Date: 2015-08-10 18:45:30.158
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-08-10 18:45:30.147
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-08-10 18:45:30.136
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-08-10 15:13:17.843
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-08-10 15:13:17.834
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-08-10 15:13:17.826
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-08-10 14:46:21.368
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-08-10 14:46:21.357
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-08-10 14:46:21.345
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-08-10 13:31:34.015
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-4720HQ CPU @ 2.60GHz
Percentage of memory in use: 46%
Total physical RAM: 8109.81 MB
Available physical RAM: 4298.91 MB
Total Virtual: 9389.81 MB
Available Virtual: 4126.13 MB
==================== Drives ================================
Drive c: (OS_Install) (Fixed) (Total:117.8 GB) (Free:53.72 GB) NTFS
Drive d: (DATA) (Fixed) (Total:915.12 GB) (Free:874.42 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 4E9EEB76)
Partition: GPT.
========================================================
Disk: 1 (Size: 119.2 GB) (Disk ID: 4E9EEB6B)
Partition: GPT.
==================== End of log ============================
Great, thanks
Open notepad , Go to Start --> All Programs --> Accessories --> Notepad.
Please copy the entire contents Inside of the code box below beginning with START and ending with END
(To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste).
Name the file Fixlist, Save it to your desktop where you have FRST/FRST64 or the fix wont work, . Then open up FRST/FRST64 and click on FIX (Not Scan) It won't take long, after your computer reboots you will find a FIXLOG.TXT on your desktop, post it please
Start
CloseProcesses:
CreateRestorePoint:
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
Hosts:
CMD: ipconfig /flushdns
EmptyTemp:
End
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
After the fix let me know whats still going on
Thanks Ken, I ran the fix and the log is attached.
After the fix let me know whats still going on
And ??
...no problems yet. I really hope its gone, will let you know if it comes back. Tks again for all the help.
Your very welcome, I am going to close this thread in a couple of days so if it returns and the thread is closed you can PM me to reopen it or start a new topic
Double click on AdwCleaner.exe to run the tool again.
Click on the Uninstall button.
Click Yes when asked are you sure you want to uninstall.
Both AdwCleaner.exe, its folder and all logs will be removed.
==========================================================
Please download DelFix (http://general-changelog-team.fr/en/downloads/finish/20-outils-de-xplode/9-delfix) and save the file to your Desktop.
http://i24.photobucket.com/albums/c30/ken545/DelFix_zps139e2ea1.jpg (http://s24.photobucket.com/user/ken545/media/DelFix_zps139e2ea1.jpg.html)
Windows XP Double Click DelFix.exe to run the program.
Windows Vista > Win 7 > Win 8 Right Click on DelFix.exe and select RUN AS ADMINISTRATOR
Checkmark " Remove Disinfection Tools"
Click the Run button
This will remove the specialised tools we used to clean your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually
==========================================================
How did I get infected in the first place ?
WhattheTech (http://forums.whatthetech.com/index.php?showtopic=97186")
Grinler BleepingComputer (http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/)
GeeksTo Go (http://www.geekstogo.com/forum/index.php?autocom=custom&page=How_did_I)
Dslreports (http://www.dslreports.com/faq/10002)
Safe Surfn
Ken