Total ad performance

Status
Not open for further replies.
Z

Zeus999

New member
Does anyone know how to get rid of Total Ad Performance? When browsing on Chrome the malware randomly opens up the total ad performance website. I have tried running Spybot but it hasn't managed to get rid of the malware.

scan logs

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:18-07-2015 01
Ran by Hugh (administrator) on HUGH_LAPTOP on 20-07-2015 11:09:30
Running from D:\FARBAR
Loaded Profiles: Hugh (Available Profiles: Hugh)
Platform: Windows 8.1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\SCM\MSIService.exe
(MSI) C:\Program Files (x86)\MSI\SUPER CHARGER\ChargeService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Qualcomm Atheros) C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.1\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.1\GoogleCrashHandler64.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(MSI) C:\Program Files (x86)\SCM\SCM.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\MSI\Dragon Gaming Center\Dragon Gaming Center.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
() C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\MSI\KLM\KLM.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(MSI) C:\Program Files (x86)\MSI\SUPER CHARGER\SUPER CHARGER.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Telstra) C:\Program Files (x86)\Telstra\Mobile Broadband Manager\TelstraUCM.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\excel.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\outlook.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\ismagent.exe
() C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\updateui.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Reader_6.3.9654.17499_x64__8wekyb3d8bbwe\glcnd.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Oracle Corporation) C:\Program Files (x86)\Java\jre1.8.0_45\bin\javaw.exe
(Oracle Corporation) C:\Program Files (x86)\Java\jre1.8.0_45\bin\javaw.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\msosync.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8446832 2015-01-22] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2015-01-22] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [322712 2014-10-10] (Intel Corporation)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [3281160 2015-01-22] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [SCM] => C:\Program Files (x86)\SCM\SCM.exe [405504 2014-11-07] (MSI)
HKLM-x32\...\Run: [KLM] => C:\Program Files (x86)\MSI\KLM\KLM.exe [1569416 2014-11-12] (Micro-Star International Co., Ltd.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-09] (CyberLink Corp.)
HKLM-x32\...\Run: [SUPER CHARGER] => C:\Program Files (x86)\MSI\SUPER CHARGER\SUPER CHARGER.exe [1047536 2014-02-22] (MSI)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM-x32\...\Run: [BigPondWirelessBroadbandCM] => C:\Program Files (x86)\Telstra\Mobile Broadband Manager\TelstraUCM.exe [4352408 2010-05-14] (Telstra)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22012688 2015-06-20] (Google)
HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53288576 2015-06-29] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Killer Network Manager.lnk [2015-01-23]
ShortcutTarget: Killer Network Manager.lnk -> C:\Windows\Installer\{5B62C353-75A3-463F-A52E-CC005846F3CE}\NetworkManager.exe_130C27D738F34C89BDDF21BCFD74B56D.exe (Flexera Software LLC)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://msi13.msn.com
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001 -> DefaultScope {E24B6B7F-4EEA-40BE-8286-5FE2CA130926} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-05-19] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-06-07] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-07] (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-06-08] (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 10.5.133.45 10.5.136.242
Tcpip\..\Interfaces\{6CA879F1-BA5A-40DB-96D7-FBC3D00CB47F}: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{EB9EA036-9040-49E8-8D13-9D0854090602}: [DhcpNameServer] 10.5.133.45 10.5.136.242

FireFox:
========
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-17] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-17] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-07] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-07] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-06-07] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-04-01] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)

Chrome:
=======
CHR Profile: C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-07-19]
CHR Extension: (Google Cast) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2015-06-07]
CHR Extension: (Adblock Super) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\knebimhcckndhiglamoabbnifdkijidd [2015-06-08]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-07]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2015-07-19]
CHR Extension: (Google Wallet) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-07]
CHR HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Hugh\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx [2015-06-07]
CHR HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2739888 2015-05-19] (Microsoft Corporation)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [101680 2015-01-22] (ELAN Microelectronics Corp.)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2015-01-22] (NVIDIA Corporation)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [18584 2014-10-10] (Intel Corporation)
R2 iBtSiva; C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe [122984 2015-01-22] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [345864 2015-03-19] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-28] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-28] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-17] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-17] (Intel Corporation)
R2 Micro Star SCM; C:\Program Files (x86)\SCM\MSIService.exe [160768 2014-11-07] (Micro-Star International Co., Ltd.) [File not signed]
R2 MSI_SuperCharger; C:\Program Files (x86)\MSI\SUPER CHARGER\ChargeService.exe [162800 2014-02-22] (MSI)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2014-05-30] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2015-01-22] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2015-01-22] (NVIDIA Corporation)
R2 Qualcomm Atheros Killer Service V2; C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe [360448 2014-08-19] (Qualcomm Atheros) [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1740760 2014-09-03] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3816176 2014-05-30] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 BfLwf; C:\Windows\system32\DRIVERS\bwcW8x64.sys [97968 2014-08-14] (Qualcomm Atheros, Inc.)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
S3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [141624 2014-05-14] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1424184 2014-06-18] (Motorola Solutions, Inc.)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [222664 2015-01-22] (Intel Corporation)
R3 Ke2200; C:\Windows\system32\DRIVERS\e22w8x64.sys [130224 2014-03-28] (Qualcomm Atheros, Inc.)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-17] (Intel Corporation)
R3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3446240 2014-06-19] (Intel Corporation)
R3 NTIOLib_1_0_3; C:\Program Files (x86)\MSI\SUPER CHARGER\NTIOLib_X64.sys [13368 2012-10-26] (MSI)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-01-22] (NVIDIA Corporation)
S3 NVSWCFilter; C:\Windows\System32\drivers\nvswcfilter.sys [19616 2015-01-22] (Windows (R) Win 7 DDK provider)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2015-01-22] (NVIDIA Corporation)
R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [466648 2015-01-22] (Realsil Semiconductor Corporation)
R1 SDHookDriver; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookDrv64.sys [64160 2014-04-25] ()
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
R3 WINIO; C:\Program Files (x86)\MSI\Dragon Gaming Center\winio64.sys [15160 2010-06-08] ()
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-20 11:07 - 2015-07-20 11:08 - 00045015 _____ C:\Users\Hugh\Downloads\Addition.txt
2015-07-20 11:06 - 2015-07-20 11:09 - 00000000 ____D C:\FRST
2015-07-20 11:06 - 2015-07-20 11:08 - 00045631 _____ C:\Users\Hugh\Downloads\FRST.txt
2015-07-20 11:06 - 2015-07-20 11:06 - 02134528 _____ (Farbar) C:\Users\Hugh\Downloads\FRST64.exe
2015-07-20 11:05 - 2015-07-20 11:05 - 00000017 _____ C:\Users\Hugh\AppData\Local\resmon.resmoncfg
2015-07-20 11:03 - 2015-07-20 11:03 - 00000207 _____ C:\Windows\tweaking.com-regbackup-HUGH_LAPTOP-Windows-8.1-(64-bit).dat
2015-07-20 11:02 - 2015-07-20 11:02 - 00000000 ____D C:\RegBackup
2015-07-20 11:01 - 2015-07-20 11:01 - 04720448 _____ C:\Users\Hugh\Downloads\tweaking.com_registry_backup_setup.exe
2015-07-20 11:01 - 2015-07-20 11:01 - 00002265 _____ C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2015-07-20 11:01 - 2015-07-20 11:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2015-07-20 11:01 - 2015-07-20 11:01 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2015-07-19 17:59 - 2015-07-19 17:59 - 00002186 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth.lnk
2015-07-19 17:58 - 2015-07-19 17:58 - 00931408 _____ (Google Inc.) C:\Users\Hugh\Downloads\GoogleEarthSetup.exe
2015-07-17 08:38 - 2015-07-17 08:38 - 00000000 ____D C:\Users\Hugh\Tracing
2015-07-16 22:32 - 2015-07-20 10:49 - 00000000 ____D C:\Users\Hugh\AppData\Roaming\Skype
2015-07-16 22:32 - 2015-07-20 08:26 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-07-16 22:32 - 2015-07-20 08:26 - 00000000 ____D C:\ProgramData\Skype
2015-07-16 22:32 - 2015-07-16 22:32 - 00002713 _____ C:\Users\Public\Desktop\Skype.lnk
2015-07-16 22:32 - 2015-07-16 22:32 - 00000000 ____D C:\Users\Hugh\AppData\Local\Skype
2015-07-16 22:32 - 2015-07-16 22:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-07-16 22:31 - 2015-05-12 10:24 - 00536920 _____ (Microsoft Corporation) C:\Windows\system32\mcupdate_GenuineIntel.dll
2015-07-16 22:31 - 2015-05-01 11:13 - 06521800 _____ (Microsoft Corporation) C:\Windows\system32\sppsvc.exe
2015-07-16 22:31 - 2015-05-01 11:13 - 01488000 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2015-07-16 22:31 - 2015-05-01 11:13 - 00261376 _____ (Microsoft Corporation) C:\Windows\system32\sppwinob.dll
2015-07-15 09:39 - 2015-07-10 05:51 - 00136904 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-07-15 09:39 - 2015-07-10 04:40 - 00359936 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-07-15 09:39 - 2015-07-10 02:03 - 03701760 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-07-15 09:39 - 2015-07-10 01:54 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-07-15 09:39 - 2015-07-10 01:53 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-07-15 09:39 - 2015-07-10 01:50 - 00409088 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2015-07-15 09:39 - 2015-07-10 01:50 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-07-15 09:39 - 2015-07-10 01:48 - 00891904 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-07-15 09:39 - 2015-07-10 01:46 - 02229248 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-07-15 09:39 - 2015-07-10 01:38 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-07-15 09:39 - 2015-07-10 01:37 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-07-15 09:39 - 2015-07-10 01:35 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-07-15 09:39 - 2015-07-10 01:34 - 00721920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-07-15 09:39 - 2015-06-27 13:08 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-07-15 09:39 - 2015-06-27 13:08 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-07-15 09:39 - 2015-06-27 12:14 - 00027136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-07-15 09:38 - 2015-07-03 23:52 - 00358912 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-07-15 09:38 - 2015-07-03 23:52 - 00044032 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-07-15 09:38 - 2015-07-03 23:50 - 00301056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-07-15 09:38 - 2015-07-03 23:50 - 00035840 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-07-15 09:38 - 2015-07-03 07:21 - 19877376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-07-15 09:38 - 2015-07-03 06:50 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-07-15 09:38 - 2015-07-03 06:49 - 25193984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-07-15 09:38 - 2015-07-03 06:23 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-07-15 09:38 - 2015-07-03 06:19 - 12855296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-07-15 09:38 - 2015-07-03 05:55 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-07-15 09:38 - 2015-07-03 05:20 - 14453248 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-07-15 09:38 - 2015-07-03 04:59 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-07-15 09:38 - 2015-07-02 08:08 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-07-15 09:38 - 2015-07-02 07:14 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-07-15 09:38 - 2015-06-30 08:43 - 00026288 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-07-15 09:38 - 2015-06-30 01:07 - 01145856 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 01084928 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 00764928 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 00433152 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-07-15 09:38 - 2015-06-28 15:07 - 00442712 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-07-15 09:38 - 2015-06-28 15:07 - 00178008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-07-15 09:38 - 2015-06-28 15:06 - 01311960 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-07-15 09:38 - 2015-06-28 15:06 - 00332120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-07-15 09:38 - 2015-06-28 02:42 - 00747520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-07-15 09:38 - 2015-06-27 13:13 - 00202240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-07-15 09:38 - 2015-06-27 13:12 - 00401408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-07-15 09:38 - 2015-06-27 13:12 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-07-15 09:38 - 2015-06-27 12:40 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-07-15 09:38 - 2015-06-27 12:05 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-07-15 09:38 - 2015-06-27 12:00 - 00989184 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-15 09:38 - 2015-06-27 11:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-07-15 09:38 - 2015-06-27 11:26 - 00802816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-07-15 09:38 - 2015-06-27 09:21 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-07-15 09:38 - 2015-06-27 09:21 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-07-15 09:38 - 2015-06-25 12:31 - 04177920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-07-15 09:38 - 2015-06-16 08:41 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-15 09:38 - 2015-06-16 08:24 - 03320320 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-15 09:38 - 2015-06-16 07:16 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-07-15 09:38 - 2015-06-16 07:09 - 03607552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-07-15 09:38 - 2015-06-16 06:50 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-07-15 09:38 - 2015-06-16 05:57 - 02460160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-07-15 09:38 - 2015-05-31 07:18 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll
2015-07-15 09:38 - 2015-05-31 05:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2015-07-15 09:38 - 2015-05-31 05:35 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-07-15 09:38 - 2015-05-12 04:17 - 01201664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys
2015-07-15 09:38 - 2015-05-08 03:50 - 22292672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-07-15 09:38 - 2015-05-08 03:00 - 03109376 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2015-07-15 09:38 - 2015-05-08 02:53 - 19734960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-07-15 09:38 - 2015-05-08 02:12 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2015-07-15 09:38 - 2015-05-08 01:21 - 00522240 _____ (Microsoft Corporation) C:\Windows\system32\GeofenceMonitorService.dll
2015-07-15 09:38 - 2015-05-08 01:05 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GeofenceMonitorService.dll
2015-07-15 09:38 - 2015-05-04 01:09 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-07-15 09:38 - 2015-05-04 00:58 - 00210944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-07-15 09:38 - 2015-05-04 00:55 - 00971776 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2015-07-15 09:38 - 2015-05-04 00:49 - 00811008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2015-07-15 09:38 - 2015-05-03 10:39 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-07-15 09:38 - 2015-04-30 09:22 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\WiFiDisplay.dll
2015-07-15 09:38 - 2015-04-25 12:25 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2015-07-15 09:37 - 2015-06-16 15:36 - 01661576 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-15 09:37 - 2015-06-16 15:36 - 01212248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-07-15 09:37 - 2015-06-16 08:39 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-07-15 09:37 - 2015-06-16 08:38 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-07-15 09:37 - 2015-06-16 08:26 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-07-15 09:37 - 2015-06-16 08:24 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-07-15 09:37 - 2015-06-16 08:02 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2015-07-15 09:37 - 2015-06-16 07:58 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-07-15 09:37 - 2015-06-16 07:57 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-07-15 09:37 - 2015-06-16 07:56 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-07-15 09:37 - 2015-06-16 07:55 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-07-15 09:37 - 2015-06-16 07:49 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-07-15 09:37 - 2015-06-16 07:41 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-07-15 09:37 - 2015-06-16 07:38 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-07-15 09:37 - 2015-06-16 07:36 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-07-15 09:37 - 2015-06-16 07:17 - 02880000 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-07-15 09:37 - 2015-06-16 07:16 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-07-15 09:37 - 2015-06-16 07:15 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-07-15 09:37 - 2015-06-16 07:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-07-15 09:37 - 2015-06-16 07:04 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-07-15 09:37 - 2015-06-16 07:03 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-07-15 09:37 - 2015-06-16 06:52 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-07-15 09:37 - 2015-06-16 06:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2015-07-15 09:37 - 2015-06-16 06:44 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-07-15 09:37 - 2015-06-16 06:43 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-07-15 09:37 - 2015-06-16 06:42 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-07-15 09:37 - 2015-06-16 06:41 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-07-15 09:37 - 2015-06-16 06:37 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-07-15 09:37 - 2015-06-16 06:32 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-07-15 09:37 - 2015-06-16 06:31 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-07-15 09:37 - 2015-06-16 06:30 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-07-15 09:37 - 2015-06-16 06:30 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-07-15 09:37 - 2015-06-16 06:17 - 01048576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2015-07-15 09:37 - 2015-06-16 06:07 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-07-15 09:37 - 2015-06-16 06:02 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-07-15 09:37 - 2015-06-11 13:49 - 01380600 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-15 09:37 - 2015-06-11 02:13 - 01097216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-07-15 09:37 - 2015-05-12 23:19 - 00294912 _____ (Microsoft Corporation) C:\Windows\system32\SystemEventsBrokerServer.dll
2015-07-15 09:37 - 2015-05-12 02:34 - 00332800 _____ (Microsoft Corporation) C:\Windows\system32\fhcpl.dll
2015-07-15 09:37 - 2015-05-08 02:47 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-07-15 09:37 - 2015-05-04 01:07 - 07784448 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Data.Pdf.dll
2015-07-15 09:37 - 2015-05-04 00:57 - 05264384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Data.Pdf.dll
2015-07-15 09:37 - 2015-05-02 09:33 - 00410739 _____ C:\Windows\system32\ApnDatabase.xml
2015-07-15 09:37 - 2015-04-28 23:13 - 00513480 _____ C:\Windows\SysWOW64\locale.nls
2015-07-15 09:37 - 2015-04-28 23:13 - 00513480 _____ C:\Windows\system32\locale.nls
2015-07-15 09:37 - 2015-04-24 01:47 - 03084288 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2015-07-15 09:37 - 2015-04-24 01:16 - 02471424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2015-07-14 20:59 - 2015-07-20 08:35 - 00000000 ____D C:\Users\Hugh\AppData\Local\CrashDumps
2015-07-14 08:58 - 2013-08-22 23:25 - 00000824 _____ C:\Windows\system32\Drivers\etc\hosts.20150714-085812.backup
2015-07-14 08:14 - 2015-07-14 08:14 - 00000000 ____D C:\Users\Default\AppData\Local\Google
2015-07-14 08:14 - 2015-07-14 08:14 - 00000000 ____D C:\Users\Default User\AppData\Local\Google
2015-07-13 21:40 - 2015-07-13 21:40 - 00558328 _____ (Safer-Networking Ltd. ) C:\Users\Hugh\Downloads\spybot2-license.exe
2015-07-13 20:39 - 2015-07-14 08:57 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2015-07-13 20:39 - 2015-07-14 08:11 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-07-13 20:39 - 2015-07-13 20:39 - 00001417 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-07-13 20:39 - 2015-07-13 20:39 - 00001405 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-07-13 20:39 - 2015-07-13 20:39 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2015-07-13 20:39 - 2015-07-13 20:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-07-13 20:39 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-07-13 20:27 - 2015-07-13 20:31 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Hugh\Downloads\spybot-2.4.exe
2015-07-13 15:02 - 2015-07-13 15:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-07-13 15:01 - 2015-07-13 15:01 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Hugh\Downloads\mbam-setup-2.1.8.1057.exe
2015-07-09 09:27 - 2015-07-09 09:27 - 00000000 ____D C:\Users\Public\Downloads\Norton
2015-07-07 20:14 - 2015-07-07 20:14 - 00000500 _____ C:\Users\Hugh\Desktop\asx options.csv
2015-07-07 15:01 - 2015-07-07 15:01 - 1092367527 _____ C:\Windows\MEMORY.DMP
2015-07-07 15:01 - 2015-07-07 15:01 - 01270288 _____ C:\Windows\Minidump\070715-12031-01.dmp
2015-07-07 15:01 - 2015-07-07 15:01 - 00000000 ____D C:\Windows\Minidump
2015-07-07 13:10 - 2015-07-07 13:10 - 03121152 _____ C:\Users\Hugh\Downloads\TWS API Install 972.03.msi
2015-07-06 08:24 - 2015-07-13 08:36 - 00009728 ___SH C:\Users\Hugh\Desktop\Thumbs.db
2015-06-28 13:34 - 2015-06-28 13:34 - 00000000 ____D C:\ProgramData\Samsung
2015-06-26 18:41 - 2015-06-26 18:41 - 00001086 _____ C:\Users\Hugh\Desktop\AmiBroker.lnk
2015-06-26 18:41 - 2015-06-26 18:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AmiBroker
2015-06-26 18:40 - 2015-07-17 17:40 - 00000000 ____D C:\Program Files (x86)\AmiBroker
2015-06-26 11:28 - 2015-06-26 11:28 - 00000000 ____D C:\Users\Hugh\AppData\Local\Microsoft Help
2015-06-26 11:23 - 2015-06-26 11:23 - 01104014 _____ () C:\Users\Hugh\Downloads\CodeCleaner.exe
2015-06-26 11:23 - 2015-06-26 11:23 - 00000000 ____D C:\Program Files (x86)\AppsPro
2015-06-26 11:23 - 2000-12-06 03:00 - 00209608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TABCTL32.OCX
2015-06-26 10:17 - 2015-06-26 10:56 - 00000931 _____ C:\Users\Hugh\Desktop\AmiBroker x64.lnk
2015-06-26 10:17 - 2015-06-26 10:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AmiBroker x64
2015-06-25 14:07 - 2015-06-25 14:07 - 00000000 ____D C:\Users\Hugh\AppData\Local\WinZip
2015-06-24 15:53 - 2015-06-24 15:53 - 01271296 _____ C:\Users\Hugh\Downloads\Span Margin Calculation.ppt
2015-06-23 16:57 - 2015-06-23 16:57 - 00140678 _____ C:\Users\Hugh\Downloads\Polaris_Trades (3).csv
2015-06-23 16:46 - 2015-06-23 16:46 - 00130743 _____ C:\Users\Hugh\Downloads\Polaris_Trades (2).csv
2015-06-23 16:28 - 2015-06-23 16:28 - 00129602 _____ C:\Users\Hugh\Downloads\Polaris_Trades (1).csv
2015-06-22 05:24 - 2015-06-22 05:24 - 00226424 _____ C:\Windows\system32\SBuySupplies.exe
2015-06-22 05:24 - 2015-06-22 05:24 - 00158016 _____ C:\Windows\system32\us005ci.exe
2015-06-22 05:24 - 2015-06-22 05:24 - 00089600 _____ (SS) C:\Windows\system32\us005ci.dll
2015-06-22 05:24 - 2015-06-22 05:24 - 00022528 _____ () C:\Windows\system32\us005lm.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-20 11:09 - 2015-06-07 19:14 - 00004980 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for HUGH_LAPTOP-Hugh Hugh_Laptop
2015-07-20 11:07 - 2015-06-07 17:09 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2823309964-2513555705-3651140861-1001
2015-07-20 10:46 - 2015-06-07 17:45 - 00000930 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-07-20 10:09 - 2015-06-07 19:30 - 00000000 ____D C:\Jts
2015-07-20 09:35 - 2014-03-18 20:03 - 00865408 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-20 08:46 - 2015-06-07 17:45 - 00000926 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-07-20 08:36 - 2013-08-23 00:46 - 00055312 _____ C:\Windows\setupact.log
2015-07-20 08:27 - 2015-06-07 19:22 - 00000000 ___RD C:\Users\Hugh\Google Drive
2015-07-20 08:27 - 2015-06-07 17:44 - 00003934 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{3D2F1FB9-A0C3-47F9-8104-40390AB06AAF}
2015-07-20 08:25 - 2015-06-07 17:09 - 00000000 ___RD C:\Users\Hugh\OneDrive
2015-07-19 18:05 - 2015-06-07 15:51 - 01960760 _____ C:\Windows\WindowsUpdate.log
2015-07-19 17:58 - 2015-06-07 17:45 - 00000000 ____D C:\Program Files (x86)\Google
2015-07-19 17:45 - 2013-08-23 01:36 - 00000000 ____D C:\Windows\AppReadiness
2015-07-19 17:45 - 2013-08-23 00:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-17 08:38 - 2015-06-07 17:02 - 00000000 ____D C:\Users\Hugh
2015-07-17 08:13 - 2013-08-22 23:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2015-07-17 08:12 - 2014-03-18 19:54 - 00581980 _____ C:\Windows\PFRO.log
2015-07-16 22:31 - 2013-08-23 01:20 - 00000000 ____D C:\Windows\CbsTemp
2015-07-16 08:41 - 2015-06-07 17:45 - 00003902 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-07-16 08:41 - 2015-06-07 17:45 - 00003666 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-07-16 08:29 - 2013-08-23 00:44 - 00481880 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-16 08:28 - 2013-08-23 01:36 - 00000000 ___RD C:\Windows\ToastData
2015-07-16 08:28 - 2013-08-23 01:36 - 00000000 ____D C:\Windows\WinStore
2015-07-15 09:43 - 2015-06-12 15:39 - 00000000 ____D C:\Windows\system32\appraiser
2015-07-15 09:43 - 2015-06-08 17:08 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-07-15 09:42 - 2015-06-08 16:59 - 00000000 ____D C:\Windows\system32\MRT
2015-07-15 09:39 - 2015-06-07 17:46 - 00002213 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-07-15 08:31 - 2014-11-05 10:48 - 00000000 ____D C:\ProgramData\Norton
2015-07-14 09:12 - 2015-06-08 17:08 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-07-14 09:12 - 2015-06-08 17:08 - 00000000 ___SD C:\Windows\system32\GWX
2015-07-14 08:14 - 2015-06-07 19:20 - 00002068 _____ C:\Users\Public\Desktop\Google Slides.lnk
2015-07-14 08:14 - 2015-06-07 19:20 - 00002066 _____ C:\Users\Public\Desktop\Google Sheets.lnk
2015-07-14 08:14 - 2015-06-07 19:20 - 00002056 _____ C:\Users\Public\Desktop\Google Docs.lnk
2015-07-14 08:14 - 2015-06-07 19:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-07-14 08:07 - 2014-11-05 10:49 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-07-14 08:05 - 2013-08-23 01:36 - 00000000 ___HD C:\Windows\ELAMBKUP
2015-07-14 08:05 - 2013-08-22 23:25 - 00262144 ___SH C:\Windows\system32\config\ELAM
2015-07-14 07:10 - 2015-06-08 17:17 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-14 07:10 - 2015-06-08 17:17 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-09 08:44 - 2013-08-23 01:36 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-07-07 13:16 - 2015-06-07 19:31 - 00000000 ____D C:\TWS API
2015-07-03 13:21 - 2015-06-07 17:03 - 00000000 ____D C:\Users\Hugh\AppData\Local\Packages
2015-07-03 08:43 - 2015-06-08 16:59 - 130333168 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-26 18:29 - 2015-06-07 19:09 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-06-25 14:07 - 2015-01-23 16:05 - 00000000 ____D C:\ProgramData\WinZip
2015-06-25 08:17 - 2013-08-23 01:36 - 00000000 ____D C:\Windows\LiveKernelReports
2015-06-24 13:20 - 2013-08-23 01:36 - 00000000 ____D C:\Windows\system32\sru

==================== Files in the root of some directories =======

2015-07-20 11:05 - 2015-07-20 11:05 - 0000017 _____ () C:\Users\Hugh\AppData\Local\resmon.resmoncfg
2015-01-23 15:12 - 2015-01-23 15:12 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-07-15 08:42

==================== End of log ============================

aswMBR version 1.0.1.2252 Copyright(c) 2014 AVAST Software
Run date: 2015-07-20 11:15:09
-----------------------------
11:15:09.385 OS Version: Windows x64 6.2.9200
11:15:09.385 Number of processors: 8 586 0x3C03
11:15:09.400 ComputerName: HUGH_LAPTOP UserName: Hugh
11:15:11.021 Initialize success
11:15:11.036 VM: initialized successfully
11:15:11.036 VM: Intel CPU supported
11:15:28.239 VM: disk I/O iaStorA.sys
11:28:58.312 AVAST engine defs: 15071902
11:31:08.712 Disk 0 \Device\Harddisk0\DR0 -> \Device\0000003b
11:31:08.712 Disk 0 Vendor: HGST_HTS721010A9E630 JB0OA3J0 Size: 953869MB BusType: 11
11:31:08.727 Disk 1 (boot) \Device\Harddisk1\DR1 -> \Device\0000003c
11:31:08.727 Disk 1 Vendor: ADATA_SP310 5.2 Size: 122104MB BusType: 11
11:31:08.743 Disk 1 MBR read successfully
11:31:08.743 Disk 1 MBR scan
11:31:08.759 Disk 1 unknown MBR code
11:31:08.759 Disk 1 Partition 1 00 EE GPT 2097151 MB offset 1
11:31:08.790 Disk 1 scanning C:\Windows\system32\drivers
11:31:13.893 Service scanning
11:31:28.405 Modules scanning
11:31:28.429 Disk 1 trace - called modules:
11:31:28.444 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll iaStorA.sys
11:31:28.452 1 nt!IofCallDriver -> \Device\Harddisk1\DR1[0xffffe0004d91f770]
11:31:28.456 3 CLASSPNP.SYS[fffff80169602170] -> nt!IofCallDriver -> [0xffffe0004b19ea50]
11:31:28.461 5 ACPI.sys[fffff8016917ac21] -> nt!IofCallDriver -> \Device\0000003c[0xffffe0004b19c060]
11:31:29.854 AVAST engine scan C:\Windows
11:31:31.595 AVAST engine scan C:\Windows\system32
11:33:17.684 AVAST engine scan C:\Windows\system32\drivers
11:33:26.863 AVAST engine scan C:\Users\Hugh
11:37:53.426 AVAST engine scan C:\ProgramData
11:38:03.615 Disk 1 statistics 3842835/0/0 @ 692.90 MB/s
11:38:03.620 Scan finished successfully
11:41:25.538 Disk 1 MBR has been saved successfully to "D:\FARBAR\MBR.dat"
11:41:25.554 The log file has been saved successfully to "D:\FARBAR\aswMBR.txt"
 

Attachments

Last edited by a moderator:
:snwelcome:

Just reply to this topic only by pressing Submit Reply and please dont start any new topics

Lets run these programs as you have some things to remove, I am posting the entire instructions for Malwarebytes, just bypass the download part and follow all the instructions to set it up and run the scan



-AdwCleaner-by Xplode


Click on this link to download : ADWCleaner TO YOUR DESKTOP
Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.
Use my link only, do not do a search for AdwCleaner as there is a bogus copy going around by scammers




Do not click on any links in the top Advertisment.






  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.





===============================================================================




thisisujrt.gif
Please download Junkware Removal Tool TO YOUR DESKTOP

  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.







===============================================================================


Download Malwarebytes' Anti-Malware TO YOUR DESKTOP



  • Windows XP : Double click on the icon to run it.
  • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"







  • On the Dashboard click on Update Now
  • Go to the Setting Tab
  • Under Setting go to Detection and Protection
  • Under PUP and PUM make sure both are set to show Treat Detections as Malware
  • Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
  • Then on the Dashboard click on Scan
  • Make sure to select THREAT SCAN
  • Then click on Scan
  • When the scan is finished and the log pops up...select Copy to Clipboard
  • Please paste the log back into this thread for review
  • Exit Malwarebytes
 
ken545 said:
:snwelcome:

Just reply to this topic only by pressing Submit Reply and please dont start any new topics

Lets run these programs as you have some things to remove, I am posting the entire instructions for Malwarebytes, just bypass the download part and follow all the instructions to set it up and run the scan



-AdwCleaner-by Xplode


Click on this link to download : ADWCleaner TO YOUR DESKTOP
Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.
Use my link only, do not do a search for AdwCleaner as there is a bogus copy going around by scammers




Do not click on any links in the top Advertisment.






  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.





===============================================================================




thisisujrt.gif
Please download Junkware Removal Tool TO YOUR DESKTOP

  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.







===============================================================================


Download Malwarebytes' Anti-Malware TO YOUR DESKTOP



  • Windows XP : Double click on the icon to run it.
  • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"







  • On the Dashboard click on Update Now
  • Go to the Setting Tab
  • Under Setting go to Detection and Protection
  • Under PUP and PUM make sure both are set to show Treat Detections as Malware
  • Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
  • Then on the Dashboard click on Scan
  • Make sure to select THREAT SCAN
  • Then click on Scan
  • When the scan is finished and the log pops up...select Copy to Clipboard
  • Please paste the log back into this thread for review
  • Exit Malwarebytes
Click to expand...




Thanks for the help. I have run the scans, the logs are attached. zeus.
 

Attachments

Hey

No need to quote what I post, just taking up more space on the server, whatever I post is not deleted so you can always go back and look at it

Not much removed

Your running FRST64 from D:\FARBAR, our tools and scanners work more efficiently when run from the Desktop in lieu of being buried in some folder, so go to D:\FARBAR and look for FRST64, right click on it and select CUT, then come back to your Desktop and right click on a blank space and select PASTE, then we will have FRST64 exactly where we want it to be.


Then open up FRST, be sure to put a checkmark in Additions, run a new scan and post both logs please. In lieu of attaching them I prefer if you can just to copy and paste them in
 
Thanks for the feedback, I've run the app from the desktop and here are the logs:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:20-07-2015
Ran by Hugh (administrator) on HUGH_LAPTOP on 25-07-2015 08:57:27
Running from C:\Users\Hugh\Desktop
Loaded Profiles: Hugh (Available Profiles: Hugh)
Platform: Windows 8.1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\SCM\MSIService.exe
(MSI) C:\Program Files (x86)\MSI\SUPER CHARGER\ChargeService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Qualcomm Atheros) C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.1\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.1\GoogleCrashHandler64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\MSI\Dragon Gaming Center\Dragon Gaming Center.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(MSI) C:\Program Files (x86)\SCM\SCM.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\MSI\KLM\KLM.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(MSI) C:\Program Files (x86)\MSI\SUPER CHARGER\SUPER CHARGER.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Telstra) C:\Program Files (x86)\Telstra\Mobile Broadband Manager\TelstraUCM.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8446832 2015-01-22] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2015-01-22] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [322712 2014-10-10] (Intel Corporation)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [3281160 2015-01-22] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [SCM] => C:\Program Files (x86)\SCM\SCM.exe [405504 2014-11-07] (MSI)
HKLM-x32\...\Run: [KLM] => C:\Program Files (x86)\MSI\KLM\KLM.exe [1569416 2014-11-12] (Micro-Star International Co., Ltd.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-09] (CyberLink Corp.)
HKLM-x32\...\Run: [SUPER CHARGER] => C:\Program Files (x86)\MSI\SUPER CHARGER\SUPER CHARGER.exe [1047536 2014-02-22] (MSI)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM-x32\...\Run: [BigPondWirelessBroadbandCM] => C:\Program Files (x86)\Telstra\Mobile Broadband Manager\TelstraUCM.exe [4352408 2010-05-14] (Telstra)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22012688 2015-06-20] (Google)
HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53288576 2015-06-29] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Killer Network Manager.lnk [2015-01-23]
ShortcutTarget: Killer Network Manager.lnk -> C:\Windows\Installer\{5B62C353-75A3-463F-A52E-CC005846F3CE}\NetworkManager.exe_130C27D738F34C89BDDF21BCFD74B56D.exe (Flexera Software LLC)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://msi13.msn.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-06-09] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-06-17] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-06-07] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-07] (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-06-08] (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{6CA879F1-BA5A-40DB-96D7-FBC3D00CB47F}: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{EB9EA036-9040-49E8-8D13-9D0854090602}: [DhcpNameServer] 10.5.133.45 10.5.136.242

FireFox:
========
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-17] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-17] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-07] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-07] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-06-07] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-04-01] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)

Chrome:
=======
CHR Profile: C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-07-19]
CHR Extension: (Google Cast) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2015-06-07]
CHR Extension: (Adblock Super) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\knebimhcckndhiglamoabbnifdkijidd [2015-06-08]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-07]
CHR Extension: (No Name) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2015-07-23]
CHR Extension: (Google Wallet) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-07]
CHR HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Hugh\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx [2015-06-07]
CHR HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2753720 2015-07-01] (Microsoft Corporation)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [101680 2015-01-22] (ELAN Microelectronics Corp.)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2015-01-22] (NVIDIA Corporation)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [18584 2014-10-10] (Intel Corporation)
R2 iBtSiva; C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe [122984 2015-01-22] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [345864 2015-03-19] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-28] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-28] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-17] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-17] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 Micro Star SCM; C:\Program Files (x86)\SCM\MSIService.exe [160768 2014-11-07] (Micro-Star International Co., Ltd.) [File not signed]
R2 MSI_SuperCharger; C:\Program Files (x86)\MSI\SUPER CHARGER\ChargeService.exe [162800 2014-02-22] (MSI)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2014-05-30] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2015-01-22] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2015-01-22] (NVIDIA Corporation)
R2 Qualcomm Atheros Killer Service V2; C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe [360448 2014-08-19] (Qualcomm Atheros) [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1740760 2014-09-03] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3816176 2014-05-30] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 BfLwf; C:\Windows\system32\DRIVERS\bwcW8x64.sys [97968 2014-08-14] (Qualcomm Atheros, Inc.)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
S3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [141624 2014-05-14] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1424184 2014-06-18] (Motorola Solutions, Inc.)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [222664 2015-01-22] (Intel Corporation)
R3 Ke2200; C:\Windows\system32\DRIVERS\e22w8x64.sys [130224 2014-03-28] (Qualcomm Atheros, Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-07-25] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-17] (Intel Corporation)
R3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3446240 2014-06-19] (Intel Corporation)
R3 NTIOLib_1_0_3; C:\Program Files (x86)\MSI\SUPER CHARGER\NTIOLib_X64.sys [13368 2012-10-26] (MSI)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-01-22] (NVIDIA Corporation)
S3 NVSWCFilter; C:\Windows\System32\drivers\nvswcfilter.sys [19616 2015-01-22] (Windows (R) Win 7 DDK provider)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2015-01-22] (NVIDIA Corporation)
R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [466648 2015-01-22] (Realsil Semiconductor Corporation)
R1 SDHookDriver; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookDrv64.sys [64160 2014-04-25] ()
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
R3 WINIO; C:\Program Files (x86)\MSI\Dragon Gaming Center\winio64.sys [15160 2010-06-08] ()

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-25 08:57 - 2015-07-25 08:57 - 00018868 _____ C:\Users\Hugh\Desktop\FRST.txt
2015-07-25 08:57 - 2015-07-25 08:57 - 00000000 ____D C:\Users\Hugh\Desktop\FRST-OlderVersion
2015-07-24 20:34 - 2015-07-24 20:34 - 00033263 _____ C:\Users\Hugh\Downloads\table (1).csv
2015-07-24 18:10 - 2015-07-24 18:11 - 00029538 _____ C:\Users\Hugh\Downloads\table.csv
2015-07-23 20:33 - 2015-07-23 20:33 - 00001055 _____ C:\Users\Hugh\Desktop\JRT.txt
2015-07-22 17:30 - 2015-07-25 08:47 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-22 17:30 - 2015-07-22 17:30 - 00001128 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-07-22 17:30 - 2015-07-22 17:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-07-22 17:30 - 2015-07-22 17:30 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-07-22 17:30 - 2015-06-18 08:42 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-07-22 17:30 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-07-22 17:30 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-07-22 17:18 - 2015-07-23 18:17 - 00000000 ____D C:\AdwCleaner
2015-07-22 17:17 - 2015-07-22 17:17 - 02248704 _____ C:\Users\Hugh\Downloads\AdwCleaner.exe
2015-07-22 17:16 - 2015-07-22 17:16 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Hugh\Downloads\mbam-setup-2.1.8.1057 (2).exe
2015-07-22 17:15 - 2015-07-22 17:16 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Hugh\Downloads\mbam-setup-2.1.8.1057 (1).exe
2015-07-22 17:14 - 2015-07-22 17:15 - 01798288 _____ (Malwarebytes Corporation) C:\Users\Hugh\Downloads\JRT.exe
2015-07-21 10:47 - 2015-07-15 00:14 - 00358912 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-07-21 10:47 - 2015-07-15 00:14 - 00301056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-07-21 10:47 - 2015-07-15 00:14 - 00035840 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-07-21 10:47 - 2015-07-15 00:13 - 00044032 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-07-20 11:13 - 2015-07-20 11:14 - 05198336 _____ (AVAST Software) C:\Users\Hugh\Desktop\aswMBR.exe
2015-07-20 11:09 - 2015-07-25 08:57 - 02135552 _____ (Farbar) C:\Users\Hugh\Desktop\FRST64.exe
2015-07-20 11:07 - 2015-07-20 11:08 - 00045015 _____ C:\Users\Hugh\Downloads\Addition.txt
2015-07-20 11:06 - 2015-07-25 08:57 - 00000000 ____D C:\FRST
2015-07-20 11:06 - 2015-07-20 11:08 - 00045631 _____ C:\Users\Hugh\Downloads\FRST.txt
2015-07-20 11:06 - 2015-07-20 11:06 - 02134528 _____ (Farbar) C:\Users\Hugh\Downloads\FRST64.exe
2015-07-20 11:05 - 2015-07-20 11:05 - 00000017 _____ C:\Users\Hugh\AppData\Local\resmon.resmoncfg
2015-07-20 11:03 - 2015-07-20 11:03 - 00000207 _____ C:\Windows\tweaking.com-regbackup-HUGH_LAPTOP-Windows-8.1-(64-bit).dat
2015-07-20 11:02 - 2015-07-20 11:02 - 00000000 ____D C:\RegBackup
2015-07-20 11:01 - 2015-07-20 11:01 - 04720448 _____ C:\Users\Hugh\Downloads\tweaking.com_registry_backup_setup.exe
2015-07-20 11:01 - 2015-07-20 11:01 - 00002265 _____ C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2015-07-20 11:01 - 2015-07-20 11:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2015-07-20 11:01 - 2015-07-20 11:01 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2015-07-19 17:59 - 2015-07-19 17:59 - 00002186 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth.lnk
2015-07-19 17:58 - 2015-07-19 17:58 - 00931408 _____ (Google Inc.) C:\Users\Hugh\Downloads\GoogleEarthSetup.exe
2015-07-17 08:38 - 2015-07-17 08:38 - 00000000 ____D C:\Users\Hugh\Tracing
2015-07-16 22:32 - 2015-07-25 08:49 - 00000000 ____D C:\Users\Hugh\AppData\Roaming\Skype
2015-07-16 22:32 - 2015-07-20 08:26 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-07-16 22:32 - 2015-07-20 08:26 - 00000000 ____D C:\ProgramData\Skype
2015-07-16 22:32 - 2015-07-16 22:32 - 00002713 _____ C:\Users\Public\Desktop\Skype.lnk
2015-07-16 22:32 - 2015-07-16 22:32 - 00000000 ____D C:\Users\Hugh\AppData\Local\Skype
2015-07-16 22:32 - 2015-07-16 22:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-07-16 22:31 - 2015-05-12 10:24 - 00536920 _____ (Microsoft Corporation) C:\Windows\system32\mcupdate_GenuineIntel.dll
2015-07-16 22:31 - 2015-05-01 11:13 - 06521800 _____ (Microsoft Corporation) C:\Windows\system32\sppsvc.exe
2015-07-16 22:31 - 2015-05-01 11:13 - 01488000 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2015-07-16 22:31 - 2015-05-01 11:13 - 00261376 _____ (Microsoft Corporation) C:\Windows\system32\sppwinob.dll
2015-07-15 09:39 - 2015-07-10 05:51 - 00136904 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-07-15 09:39 - 2015-07-10 04:40 - 00359936 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-07-15 09:39 - 2015-07-10 02:03 - 03701760 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-07-15 09:39 - 2015-07-10 01:54 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-07-15 09:39 - 2015-07-10 01:53 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-07-15 09:39 - 2015-07-10 01:50 - 00409088 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2015-07-15 09:39 - 2015-07-10 01:50 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-07-15 09:39 - 2015-07-10 01:48 - 00891904 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-07-15 09:39 - 2015-07-10 01:46 - 02229248 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-07-15 09:39 - 2015-07-10 01:38 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-07-15 09:39 - 2015-07-10 01:37 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-07-15 09:39 - 2015-07-10 01:35 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-07-15 09:39 - 2015-07-10 01:34 - 00721920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-07-15 09:39 - 2015-06-27 13:08 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-07-15 09:39 - 2015-06-27 13:08 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-07-15 09:39 - 2015-06-27 12:14 - 00027136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-07-15 09:38 - 2015-07-03 07:21 - 19877376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-07-15 09:38 - 2015-07-03 06:50 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-07-15 09:38 - 2015-07-03 06:49 - 25193984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-07-15 09:38 - 2015-07-03 06:23 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-07-15 09:38 - 2015-07-03 06:19 - 12855296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-07-15 09:38 - 2015-07-03 05:55 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-07-15 09:38 - 2015-07-03 05:20 - 14453248 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-07-15 09:38 - 2015-07-03 04:59 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-07-15 09:38 - 2015-07-02 08:08 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-07-15 09:38 - 2015-07-02 07:14 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-07-15 09:38 - 2015-06-30 08:43 - 00026288 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-07-15 09:38 - 2015-06-30 01:07 - 01145856 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 01084928 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 00764928 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 00433152 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-07-15 09:38 - 2015-06-28 15:07 - 00442712 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-07-15 09:38 - 2015-06-28 15:07 - 00178008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-07-15 09:38 - 2015-06-28 15:06 - 01311960 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-07-15 09:38 - 2015-06-28 15:06 - 00332120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-07-15 09:38 - 2015-06-28 02:42 - 00747520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-07-15 09:38 - 2015-06-27 13:13 - 00202240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-07-15 09:38 - 2015-06-27 13:12 - 00401408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-07-15 09:38 - 2015-06-27 13:12 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-07-15 09:38 - 2015-06-27 12:40 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-07-15 09:38 - 2015-06-27 12:05 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-07-15 09:38 - 2015-06-27 12:00 - 00989184 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-15 09:38 - 2015-06-27 11:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-07-15 09:38 - 2015-06-27 11:26 - 00802816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-07-15 09:38 - 2015-06-27 09:21 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-07-15 09:38 - 2015-06-27 09:21 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-07-15 09:38 - 2015-06-25 12:31 - 04177920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-07-15 09:38 - 2015-06-16 08:41 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-15 09:38 - 2015-06-16 08:24 - 03320320 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-15 09:38 - 2015-06-16 07:16 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-07-15 09:38 - 2015-06-16 07:09 - 03607552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-07-15 09:38 - 2015-06-16 06:50 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-07-15 09:38 - 2015-06-16 05:57 - 02460160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-07-15 09:38 - 2015-05-31 07:18 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll
2015-07-15 09:38 - 2015-05-31 05:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2015-07-15 09:38 - 2015-05-31 05:35 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-07-15 09:38 - 2015-05-12 04:17 - 01201664 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys
2015-07-15 09:38 - 2015-05-08 03:50 - 22292672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-07-15 09:38 - 2015-05-08 03:00 - 03109376 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2015-07-15 09:38 - 2015-05-08 02:53 - 19734960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-07-15 09:38 - 2015-05-08 02:12 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2015-07-15 09:38 - 2015-05-08 01:21 - 00522240 _____ (Microsoft Corporation) C:\Windows\system32\GeofenceMonitorService.dll
2015-07-15 09:38 - 2015-05-08 01:05 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GeofenceMonitorService.dll
2015-07-15 09:38 - 2015-05-04 01:09 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-07-15 09:38 - 2015-05-04 00:58 - 00210944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-07-15 09:38 - 2015-05-04 00:55 - 00971776 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2015-07-15 09:38 - 2015-05-04 00:49 - 00811008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2015-07-15 09:38 - 2015-05-03 10:39 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-07-15 09:38 - 2015-04-30 09:22 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\WiFiDisplay.dll
2015-07-15 09:38 - 2015-04-25 12:25 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2015-07-15 09:37 - 2015-06-16 15:36 - 01661576 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-15 09:37 - 2015-06-16 15:36 - 01212248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-07-15 09:37 - 2015-06-16 08:39 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-07-15 09:37 - 2015-06-16 08:38 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-07-15 09:37 - 2015-06-16 08:26 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-07-15 09:37 - 2015-06-16 08:24 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-07-15 09:37 - 2015-06-16 08:02 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2015-07-15 09:37 - 2015-06-16 07:58 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-07-15 09:37 - 2015-06-16 07:57 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-07-15 09:37 - 2015-06-16 07:56 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-07-15 09:37 - 2015-06-16 07:55 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-07-15 09:37 - 2015-06-16 07:49 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-07-15 09:37 - 2015-06-16 07:41 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-07-15 09:37 - 2015-06-16 07:38 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-07-15 09:37 - 2015-06-16 07:36 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-07-15 09:37 - 2015-06-16 07:17 - 02880000 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-07-15 09:37 - 2015-06-16 07:16 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-07-15 09:37 - 2015-06-16 07:15 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-07-15 09:37 - 2015-06-16 07:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-07-15 09:37 - 2015-06-16 07:04 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-07-15 09:37 - 2015-06-16 07:03 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-07-15 09:37 - 2015-06-16 06:52 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-07-15 09:37 - 2015-06-16 06:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2015-07-15 09:37 - 2015-06-16 06:44 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-07-15 09:37 - 2015-06-16 06:43 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-07-15 09:37 - 2015-06-16 06:42 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-07-15 09:37 - 2015-06-16 06:41 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-07-15 09:37 - 2015-06-16 06:37 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-07-15 09:37 - 2015-06-16 06:32 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-07-15 09:37 - 2015-06-16 06:31 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-07-15 09:37 - 2015-06-16 06:30 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-07-15 09:37 - 2015-06-16 06:30 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-07-15 09:37 - 2015-06-16 06:17 - 01048576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2015-07-15 09:37 - 2015-06-16 06:07 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-07-15 09:37 - 2015-06-16 06:02 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-07-15 09:37 - 2015-06-11 13:49 - 01380600 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-15 09:37 - 2015-06-11 02:13 - 01097216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-07-15 09:37 - 2015-05-12 23:19 - 00294912 _____ (Microsoft Corporation) C:\Windows\system32\SystemEventsBrokerServer.dll
2015-07-15 09:37 - 2015-05-12 02:34 - 00332800 _____ (Microsoft Corporation) C:\Windows\system32\fhcpl.dll
2015-07-15 09:37 - 2015-05-08 02:47 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-07-15 09:37 - 2015-05-04 01:07 - 07784448 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Data.Pdf.dll
2015-07-15 09:37 - 2015-05-04 00:57 - 05264384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Data.Pdf.dll
2015-07-15 09:37 - 2015-05-02 09:33 - 00410739 _____ C:\Windows\system32\ApnDatabase.xml
2015-07-15 09:37 - 2015-04-28 23:13 - 00513480 _____ C:\Windows\SysWOW64\locale.nls
2015-07-15 09:37 - 2015-04-28 23:13 - 00513480 _____ C:\Windows\system32\locale.nls
2015-07-15 09:37 - 2015-04-24 01:47 - 03084288 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2015-07-15 09:37 - 2015-04-24 01:16 - 02471424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2015-07-14 20:59 - 2015-07-23 20:55 - 00000000 ____D C:\Users\Hugh\AppData\Local\CrashDumps
2015-07-14 08:58 - 2013-08-22 23:25 - 00000824 _____ C:\Windows\system32\Drivers\etc\hosts.20150714-085812.backup
2015-07-14 08:14 - 2015-07-14 08:14 - 00000000 ____D C:\Users\Default\AppData\Local\Google
2015-07-14 08:14 - 2015-07-14 08:14 - 00000000 ____D C:\Users\Default User\AppData\Local\Google
2015-07-13 21:40 - 2015-07-13 21:40 - 00558328 _____ (Safer-Networking Ltd. ) C:\Users\Hugh\Downloads\spybot2-license.exe
2015-07-13 20:39 - 2015-07-14 08:57 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2015-07-13 20:39 - 2015-07-14 08:11 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-07-13 20:39 - 2015-07-13 20:39 - 00001417 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-07-13 20:39 - 2015-07-13 20:39 - 00001405 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-07-13 20:39 - 2015-07-13 20:39 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2015-07-13 20:39 - 2015-07-13 20:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-07-13 20:39 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-07-13 20:27 - 2015-07-13 20:31 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Hugh\Downloads\spybot-2.4.exe
2015-07-13 15:02 - 2015-07-13 15:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-07-13 15:01 - 2015-07-13 15:01 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Hugh\Downloads\mbam-setup-2.1.8.1057.exe
2015-07-09 09:27 - 2015-07-09 09:27 - 00000000 ____D C:\Users\Public\Downloads\Norton
2015-07-07 20:14 - 2015-07-07 20:14 - 00000500 _____ C:\Users\Hugh\Desktop\asx options.csv
2015-07-07 15:01 - 2015-07-07 15:01 - 1092367527 _____ C:\Windows\MEMORY.DMP
2015-07-07 15:01 - 2015-07-07 15:01 - 01270288 _____ C:\Windows\Minidump\070715-12031-01.dmp
2015-07-07 15:01 - 2015-07-07 15:01 - 00000000 ____D C:\Windows\Minidump
2015-07-07 13:10 - 2015-07-07 13:10 - 03121152 _____ C:\Users\Hugh\Downloads\TWS API Install 972.03.msi
2015-07-06 08:24 - 2015-07-13 08:36 - 00009728 ___SH C:\Users\Hugh\Desktop\Thumbs.db
2015-06-28 13:34 - 2015-06-28 13:34 - 00000000 ____D C:\ProgramData\Samsung
2015-06-26 18:41 - 2015-06-26 18:41 - 00001086 _____ C:\Users\Hugh\Desktop\AmiBroker.lnk
2015-06-26 18:41 - 2015-06-26 18:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AmiBroker
2015-06-26 18:40 - 2015-07-24 22:08 - 00000000 ____D C:\Program Files (x86)\AmiBroker
2015-06-26 11:28 - 2015-06-26 11:28 - 00000000 ____D C:\Users\Hugh\AppData\Local\Microsoft Help
2015-06-26 11:23 - 2015-06-26 11:23 - 01104014 _____ () C:\Users\Hugh\Downloads\CodeCleaner.exe
2015-06-26 11:23 - 2015-06-26 11:23 - 00000000 ____D C:\Program Files (x86)\AppsPro
2015-06-26 11:23 - 2000-12-06 03:00 - 00209608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TABCTL32.OCX
2015-06-26 10:17 - 2015-06-26 10:56 - 00000931 _____ C:\Users\Hugh\Desktop\AmiBroker x64.lnk
2015-06-26 10:17 - 2015-06-26 10:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AmiBroker x64
2015-06-25 14:07 - 2015-06-25 14:07 - 00000000 ____D C:\Users\Hugh\AppData\Local\WinZip

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-25 08:54 - 2014-03-18 20:03 - 00865408 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-25 08:53 - 2015-06-07 17:44 - 00003934 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{3D2F1FB9-A0C3-47F9-8104-40390AB06AAF}
2015-07-25 08:48 - 2015-06-07 17:45 - 00000926 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-07-25 08:48 - 2015-06-07 17:09 - 00000000 ___RD C:\Users\Hugh\OneDrive
2015-07-25 08:47 - 2013-08-23 00:46 - 00056704 _____ C:\Windows\setupact.log
2015-07-25 08:47 - 2013-08-23 00:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-24 21:46 - 2015-06-07 17:45 - 00000930 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-07-24 20:42 - 2015-06-07 15:51 - 01347236 _____ C:\Windows\WindowsUpdate.log
2015-07-24 19:56 - 2015-06-07 17:09 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2823309964-2513555705-3651140861-1001
2015-07-24 19:37 - 2013-08-23 01:36 - 00000000 ____D C:\Windows\AppReadiness
2015-07-24 15:55 - 2015-06-07 19:14 - 00004980 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for HUGH_LAPTOP-Hugh Hugh_Laptop
2015-07-24 10:51 - 2015-06-07 19:30 - 00000000 ____D C:\Jts
2015-07-24 08:33 - 2013-08-23 01:36 - 00000000 ____D C:\Windows\rescache
2015-07-23 22:19 - 2015-06-07 17:02 - 00000000 ____D C:\Users\Hugh
2015-07-23 21:21 - 2014-03-18 19:54 - 00582768 _____ C:\Windows\PFRO.log
2015-07-23 18:18 - 2015-06-07 19:09 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-07-23 18:18 - 2013-08-23 00:44 - 00481880 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-23 18:18 - 2013-08-22 23:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2015-07-21 10:59 - 2013-08-23 01:20 - 00000000 ____D C:\Windows\CbsTemp
2015-07-21 09:22 - 2015-06-07 17:03 - 00000000 ____D C:\Users\Hugh\AppData\Local\Packages
2015-07-20 21:25 - 2015-06-07 19:22 - 00001692 _____ C:\Users\Hugh\Desktop\Google Drive.lnk
2015-07-20 08:27 - 2015-06-07 19:22 - 00000000 ___RD C:\Users\Hugh\Google Drive
2015-07-19 17:58 - 2015-06-07 17:45 - 00000000 ____D C:\Program Files (x86)\Google
2015-07-16 08:41 - 2015-06-07 17:45 - 00003902 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-07-16 08:41 - 2015-06-07 17:45 - 00003666 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-07-16 08:28 - 2013-08-23 01:36 - 00000000 ___RD C:\Windows\ToastData
2015-07-16 08:28 - 2013-08-23 01:36 - 00000000 ____D C:\Windows\WinStore
2015-07-15 09:43 - 2015-06-12 15:39 - 00000000 ____D C:\Windows\system32\appraiser
2015-07-15 09:43 - 2015-06-08 17:08 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-07-15 09:42 - 2015-06-08 16:59 - 00000000 ____D C:\Windows\system32\MRT
2015-07-15 09:39 - 2015-06-07 17:46 - 00002213 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-07-15 08:31 - 2014-11-05 10:48 - 00000000 ____D C:\ProgramData\Norton
2015-07-14 09:12 - 2015-06-08 17:08 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-07-14 09:12 - 2015-06-08 17:08 - 00000000 ___SD C:\Windows\system32\GWX
2015-07-14 08:14 - 2015-06-07 19:20 - 00002068 _____ C:\Users\Public\Desktop\Google Slides.lnk
2015-07-14 08:14 - 2015-06-07 19:20 - 00002066 _____ C:\Users\Public\Desktop\Google Sheets.lnk
2015-07-14 08:14 - 2015-06-07 19:20 - 00002056 _____ C:\Users\Public\Desktop\Google Docs.lnk
2015-07-14 08:14 - 2015-06-07 19:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-07-14 08:07 - 2014-11-05 10:49 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-07-14 08:05 - 2013-08-23 01:36 - 00000000 ___HD C:\Windows\ELAMBKUP
2015-07-14 08:05 - 2013-08-22 23:25 - 00262144 ___SH C:\Windows\system32\config\ELAM
2015-07-14 07:10 - 2015-06-08 17:17 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-14 07:10 - 2015-06-08 17:17 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-09 08:44 - 2013-08-23 01:36 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-07-07 13:16 - 2015-06-07 19:31 - 00000000 ____D C:\TWS API
2015-07-03 08:43 - 2015-06-08 16:59 - 130333168 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-25 14:07 - 2015-01-23 16:05 - 00000000 ____D C:\ProgramData\WinZip
2015-06-25 08:17 - 2013-08-23 01:36 - 00000000 ____D C:\Windows\LiveKernelReports

==================== Files in the root of some directories =======

2015-07-20 11:05 - 2015-07-20 11:05 - 0000017 _____ () C:\Users\Hugh\AppData\Local\resmon.resmoncfg
2015-01-23 15:12 - 2015-01-23 15:12 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some files in TEMP:
====================
C:\Users\Hugh\AppData\Local\Temp\Quarantine.exe
C:\Users\Hugh\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-07-15 08:42

==================== End of log ============================


Additional scan result of Farbar Recovery Scan Tool (x64) Version:20-07-2015
Ran by Hugh at 2015-07-25 08:57:52
Running from C:\Users\Hugh\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2823309964-2513555705-3651140861-500 - Administrator - Disabled)
Guest (S-1-5-21-2823309964-2513555705-3651140861-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2823309964-2513555705-3651140861-1003 - Limited - Enabled)
Hugh (S-1-5-21-2823309964-2513555705-3651140861-1001 - Administrator - Enabled) => C:\Users\Hugh

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Spybot - Search and Destroy (Enabled - Up to date) {20A26C15-1AF0-7CA3-9380-FAB824A7EE0D}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AmiBroker 5.60.3 x64 (HKLM\...\AmiBroker64_is1) (Version: 5.60 - AmiBroker.com)
AmiBroker 5.90.1 (HKLM-x32\...\AmiBroker_is1) (Version: 5.90 - AmiBroker.com)
Battery Calibration (HKLM-x32\...\{619FA785-489B-4D22-911F-82D6EDF5BDB0}) (Version: 1.0.1405.0701 - Micro-Star International Co., Ltd.)
Boot Configure (HKLM-x32\...\{5563D674-6B02-43F4-B9D0-C2A944E84F3C}) (Version: 20.014.12127 - Micro-Star International Co., Ltd.)
BurnRecovery (HKLM-x32\...\{2892E1B7-E24D-4CCB-B8A7-B63D4B66F89F}) (Version: 4.0.1412.2301 - )
CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.5509.52 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dragon Gaming Center (HKLM-x32\...\InstallShield_{965B16C7-0778-4C45-B7D1-83A59E6FBBCB}) (Version: 1.0.1410.1301 - Micro-Star International Co., Ltd.)
Dragon Gaming Center (x32 Version: 1.0.1410.1301 - Micro-Star International Co., Ltd.) Hidden
ELAN Touchpad 11.13.11.4_X64_WHQL (HKLM\...\Elantech) (Version: 11.13.11.4 - ELAN Microelectronic Corp.)
Excel VBA Code Cleaner 5.0 (HKLM-x32\...\Excel VBA Code Cleaner 5.0) (Version: - )
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Galeria de Fotos (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Galería de fotos (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.134 - Google Inc.)
Google Drive (HKLM-x32\...\{6EA8B94E-D869-4D96-88DF-5E1ECE1D6876}) (Version: 1.23.9648.8824 - Google, Inc.)
Google Earth (HKLM-x32\...\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)
Google Update Helper (x32 Version: 1.3.21.115 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.28.1 - Google Inc.) Hidden
Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{0EC7F9CC-4741-45AE-9F55-6E9343F726F5}) (Version: 1.1.0.36960 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4170 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 13.5.0.1056 - Intel Corporation)
Intel(R) Wireless Bluetooth(R)(patch version 17.1.1434.2) (HKLM\...\{302600C1-6BDF-4FD1-1407-148929CC1385}) (Version: 17.1.1407.0480 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{85b9d34f-7397-4e39-8600-07942ef6ca04}) (Version: 17.0.5 - Intel Corporation)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
KB9X Radio Switch Driver (HKLM\...\5AADE1068CF70DD983F763B20CF2CAAB72883915) (Version: 1.1.0.0 - ENE TECHNOLOGY INC.)
KeePass Password Safe 1.29 (HKLM-x32\...\KeePass Password Safe_is1) (Version: 1.29 - Dominik Reichl)
KLM (HKLM-x32\...\InstallShield_{4DEA5B85-6C56-45F3-AE00-FED756B0D3B4}) (Version: 1.0.1411.1101 - Application)
KLM (x32 Version: 1.0.1411.1101 - Application) Hidden
MAGIX MX Suite (HKLM-x32\...\MAGIX_{43136332-880B-458A-966C-900C18752B66}) (Version: 1.13.0.121 - MAGIX AG)
MAGIX MX Suite (Version: 1.13.0.121 - MAGIX AG) Hidden
Malwarebytes Anti-Malware version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 15.0.4737.1003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\OneDriveSetup.exe) (Version: 17.3.5860.0512 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
MSI Remind Manager (HKLM-x32\...\InstallShield_{3E23F267-3E35-40F9-B6BF-BC034D214717}) (Version: 1.0.1412.1801 - Micro-Star International Co., Ltd.)
MSI Remind Manager (x32 Version: 1.0.1412.1801 - Micro-Star International Co., Ltd.) Hidden
MSI Social Media Collection (HKLM-x32\...\{7ADEC426-BE95-48EF-84D4-086BD0F4D331}) (Version: 1.14.2251 - Micro-Star International Co., Ltd.)
Nahimic APO (x32 Version: 1.0.401 - Nahimic) Hidden
Nahimic for MSI (HKLM-x32\...\{d790cc66-b17a-4c88-96a8-cb6506bfdfe4}) (Version: 1.0.4 - Nahimic)
Nahimic for MSI (Version: 1.0.401 - Nahimic) Hidden
NahimicSettingsConfigurator (Version: 1.0.401 - Nahimic) Hidden
NVIDIA GeForce Experience 2.1.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.5 - NVIDIA Corporation)
NVIDIA Graphics Driver 345.05 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 345.05 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
Qualcomm Atheros Bandwidth Control Filter Driver (Version: 1.1.46.1056 - Qualcomm Atheros) Hidden
Qualcomm Atheros Killer E220x Drivers (Version: 1.1.46.1056 - Qualcomm Atheros) Hidden
Qualcomm Atheros Killer Performance Suite (HKLM-x32\...\{E70DB50B-10B4-46BC-9DE2-AB8B49E061EE}) (Version: 1.1.46.1056 - Qualcomm Atheros)
Qualcomm Atheros Network Manager (Version: 1.1.46.1056 - Qualcomm Atheros) Hidden
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.21249 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7427 - Realtek Semiconductor Corp.)
SCM (HKLM\...\{9BC0C4F3-ACBB-42DF-9559-93175E3B4095}) (Version: 13.014.11068 - Application)
SHIELD Streaming (Version: 3.1.3000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.18.9 - NVIDIA Corporation) Hidden
Sizing Options (HKLM-x32\...\InstallShield_{DFAB6DE8-E45F-4D5D-95C0-E54C58993F9F}) (Version: 2.0.1412.1501 - Application)
Sizing Options (x32 Version: 2.0.1412.1501 - Application) Hidden
Skype™ 7.6 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.6.105 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
SUPER CHARGER (HKLM-x32\...\{7CDF10DD-A9B5-4DA3-AB95-E193248D4369}_is1) (Version: 1.2.024 - MSI)
Telstra Mobile Broadband Manager (HKLM-x32\...\Telstra Mobile Broadband Manager) (Version: 3.0.514 - Telstra)
Telstra Mobile Broadband Manager (x32 Version: 3.0.514 - Telstra) Hidden
Trader Workstation 4.0 (HKLM-x32\...\Trader Workstation 4.0) (Version: - )
Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 2.2.0 - Tweaking.com)
TWS API (HKLM-x32\...\{AF3F53E2-2766-45B4-9F2F-AA8A51AD5C85}) (Version: 9.72.03 - IBG LLC)
Windows Driver Package - Cmotech (cmusbnet) Net (06/11/2007 2.0.0.9) (HKLM\...\51208688C66699298C32E38B6BFF92816EE798CA) (Version: 06/11/2007 2.0.0.9 - Cmotech)
Windows Driver Package - Cmotech Modem (06/08/2007 2.0.3.9) (HKLM\...\7404D4336C2B621F88A2B25CE6577572A8BBD25A) (Version: 06/08/2007 2.0.3.9 - Cmotech)
Windows Driver Package - Cmotech Ports (06/08/2007 2.0.3.9) (HKLM\...\2021A90B4F2D70AB98CFBF428E09767703FD455E) (Version: 06/08/2007 2.0.3.9 - Cmotech)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinZip 17.5 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240DD}) (Version: 17.5.10562 - WinZip Computing, S.L. )
ZTE USB Driver (HKLM\...\ZTE USB Driver) (Version: 1.0.1.16+ - ZTE Corporation)
フォト ギャラリー (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
معرض الصور (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
사진 갤러리 (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
影像中心 (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
照片库 (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points =========================

14-07-2015 08:07:25 Removed Norton Online Backup
21-07-2015 10:59:03 Windows Update
22-07-2015 17:20:46 JRT Pre-Junkware Removal
23-07-2015 18:24:42 JRT Pre-Junkware Removal

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 23:25 - 2015-07-14 08:58 - 00450771 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com

There are 1000 more lines.


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0BE1DFE1-62AA-4F2F-B982-B96D91006FC7} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {4D53FB81-2EE9-4344-B1CA-10116BFA0FAC} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-01] (Microsoft Corporation)
Task: {5619C3C6-4E00-49A0-9DA1-8E201B3B9D51} - System32\Tasks\MSI_Dragon Gaming Center => C:\Program Files (x86)\MSI\Dragon Gaming Center\mDispatch.exe [2014-01-24] (TODO: <公司名稱>)
Task: {68F9B4FD-F709-4B87-8D5C-38F825D63DC5} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-06-09] (Microsoft Corporation)
Task: {6E7E4E9F-8D07-4885-901A-A97D0F9BDB5A} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-08] (Intel Corporation)
Task: {783F8E13-DD52-4936-8A7D-A91CA4F51052} - System32\Tasks\NahimicMSIsvc32Run => C:\Program Files\Nahimic\NahimicMSI\UserInterface\NahimicMSIsvc32.exe [2015-01-17] ()
Task: {7A468A53-C4AC-4A64-90ED-6952EEF05F3F} - System32\Tasks\NahimicMSIsvc64Run => C:\Program Files\Nahimic\NahimicMSI\UserInterface\x64\NahimicMSIsvc64.exe [2015-01-17] ()
Task: {8500105A-9006-4A7D-80FD-22F91811451D} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-07-03] (Microsoft Corporation)
Task: {86ED10AE-8A7F-41C6-B4A2-1B437337651D} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {A3C097C9-2D25-44E2-82A5-ED4D815E9BDC} - System32\Tasks\Microsoft Office 15 Sync Maintenance for HUGH_LAPTOP-Hugh Hugh_Laptop => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-06-02] (Microsoft Corporation)
Task: {B5AB7F8D-6F2E-4527-AAD5-CF1239851899} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-07] (Google Inc.)
Task: {BE35EB41-0163-479E-BCDF-C4D8167F4473} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-01] (Microsoft Corporation)
Task: {CBAAE99B-E34F-47E6-949D-20D5EF5B6EBE} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {D15818B0-3404-41A1-B95D-57185BCAF3EC} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-2823309964-2513555705-3651140861-1001 => %localappdata%\Microsoft\OneDrive\OneDrive.exe
Task: {D1FA0D76-962C-426A-8091-5E9C55A6320C} - System32\Tasks\NahimicMSIUILauncherRun => C:\Program Files\Nahimic\NahimicMSI\UserInterface\NahimicMSIUILauncher.exe [2015-01-17] ()
Task: {F51F4499-139A-4ABA-B336-4DA5FF0B93C4} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-07] (Google Inc.)
Task: {F61A8720-B7BB-423A-87F0-B0857571A774} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-08] (Intel Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2015-01-23 15:14 - 2014-12-24 20:38 - 00115912 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-06-22 05:24 - 2015-06-22 05:24 - 00022528 _____ () C:\Windows\System32\us005lm.dll
2015-06-07 19:09 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-06-08 17:34 - 2015-06-08 17:34 - 08898720 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2015-07-06 08:28 - 2015-07-06 08:28 - 00183296 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\ErrorReporting.dll
2014-01-23 04:44 - 2014-01-23 04:44 - 00075912 _____ () C:\Program Files (x86)\MSI\Dragon Gaming Center\WinIo64.dll
2013-05-24 03:15 - 2013-05-24 03:15 - 00025600 _____ () C:\Program Files (x86)\MSI\Dragon Gaming Center\CoreAudioApi.dll
2014-08-19 05:40 - 2014-08-19 05:40 - 00330240 _____ () C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe
2015-07-13 20:39 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-07-13 20:39 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-07-13 20:39 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-07-13 20:39 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-07-13 20:39 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2015-07-25 08:48 - 2015-07-25 08:48 - 00098816 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32api.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00110080 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\pywintypes27.dll
2015-07-25 08:48 - 2015-07-25 08:48 - 00364544 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\pythoncom27.dll
2015-07-25 08:48 - 2015-07-25 08:48 - 00045568 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\_socket.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 01161216 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\_ssl.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00320512 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32com.shell.shell.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00713216 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\_hashlib.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 01175040 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\wx._core_.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00805888 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\wx._gdi_.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00811008 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\wx._windows_.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 01062400 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\wx._controls_.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00735232 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\wx._misc_.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00682496 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\pysqlite2._sqlite.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00087552 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\_ctypes.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00119808 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32file.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00108544 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32security.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00007168 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\hashobjs_ext.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00068096 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\usb_ext.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00167936 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32gui.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00018432 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32event.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00128512 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\_elementtree.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00127488 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\pyexpat.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00013824 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\common.time34.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00036864 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\_psutil_windows.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00038912 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32inet.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00011264 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32crypt.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00070656 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\wx._html2.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00027136 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\_multiprocessing.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00020480 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\_yappi.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00035840 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32process.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00686080 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\unicodedata.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00122368 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\wx._wizard.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00024064 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32pipe.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00010240 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\select.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00025600 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32pdh.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00525640 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\windows._lib_cacheinvalidation.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00017408 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32profile.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00022528 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\win32ts.pyd
2015-07-25 08:48 - 2015-07-25 08:48 - 00078336 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI89722\wx._animate.pyd
2015-01-23 15:11 - 2013-09-17 06:17 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2015-06-07 19:09 - 2015-07-19 18:01 - 00122024 _____ () C:\Program Files\Microsoft Office 15\root\Office15\JitV.dll
2015-06-08 17:32 - 2015-06-08 17:32 - 00316576 _____ () C:\Program Files\Microsoft Office 15\root\Office15\AppVIsvStream32.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Hugh\OneDrive:ms-properties

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

There are 7866 more restricted sites.

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\System32\oobe\info\Wallpaper\backgroundDefault.jpg
DNS Servers: 10.0.0.138
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{5EC53328-DC21-462D-AACD-EA110DE468A3}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{9E47E124-3F88-45BC-AE0C-B3FD0241A99D}] => (Allow) LPort=2869
FirewallRules: [{7102CD25-47B4-47DE-A598-AEF69D10ECF0}] => (Allow) LPort=1900
FirewallRules: [{2D3AC92D-79CE-48F3-B94E-986B1DFA255D}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{6BF214AB-A286-4902-8A28-31EB04D7BF61}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{A716ED6C-4C75-42C2-9D3E-58027E049AE7}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{21288DD7-E4D4-4BF2-90BF-AB99B749D116}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{1972B00C-10E4-4AA2-8590-2765619747F0}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{CDC47814-1B28-4EC9-886F-668D7399C0F7}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{F20C674D-D846-4DDC-BC35-5A1A803A26AF}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{A9055384-AE0A-48C4-805D-B9F9D2DEE085}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{C6744919-EAC7-417A-B4D7-28F0A859701A}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{B6B6CA70-94FD-41DF-97BC-BF8A4F0B5A8D}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{7A705F37-593F-4CE8-8A69-8DFDEFED882A}] => (Allow) C:\Users\Hugh\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [TCP Query User{E08765E9-A930-48B9-B7E6-D05B4685593B}C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe
FirewallRules: [UDP Query User{62C52245-8937-43AA-878D-D9D83BCC5BEE}C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe
FirewallRules: [{ED900BEF-F6DE-49A4-899E-1A675247AA70}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [TCP Query User{06E9B8AC-47BD-4110-9090-423D07B682E7}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{0BBAB1B7-5F6B-432A-8195-FC5449330FBB}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{0610B524-831C-409A-AAE8-C7CA9EB537A9}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{C267FC24-0437-4945-AC60-DC8D8C16213B}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/25/2015 08:47:54 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: ZeroConfigService.exe, version: 17.0.5.0, time stamp: 0x5387ee07
Faulting module name: MurocApi.dll, version: 17.0.5.0, time stamp: 0x5387ed02
Exception code: 0xc0000005
Fault offset: 0x000000000002bd48
Faulting process id: 0xb30
Faulting application start time: 0xZeroConfigService.exe0
Faulting application path: ZeroConfigService.exe1
Faulting module path: ZeroConfigService.exe2
Report Id: ZeroConfigService.exe3
Faulting package full name: ZeroConfigService.exe4
Faulting package-relative application ID: ZeroConfigService.exe5

Error: (07/24/2015 08:33:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: KillerService.exe, version: 1.1.46.1056, time stamp: 0x53f22c94
Faulting module name: KillerService.exe, version: 1.1.46.1056, time stamp: 0x53f22c94
Exception code: 0xc0000005
Fault offset: 0x000000000001641d
Faulting process id: 0x91c
Faulting application start time: 0xKillerService.exe0
Faulting application path: KillerService.exe1
Faulting module path: KillerService.exe2
Report Id: KillerService.exe3
Faulting package full name: KillerService.exe4
Faulting package-relative application ID: KillerService.exe5

Error: (07/23/2015 09:22:26 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8

Error: (07/23/2015 09:15:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: wwahost.exe, version: 6.3.9600.17415, time stamp: 0x5450355f
Faulting module name: KERNELBASE.dll, version: 6.3.9600.17415, time stamp: 0x54504ade
Exception code: 0x00000004
Fault offset: 0x00014598
Faulting process id: 0x23c94
Faulting application start time: 0xwwahost.exe0
Faulting application path: wwahost.exe1
Faulting module path: wwahost.exe2
Report Id: wwahost.exe3
Faulting package full name: wwahost.exe4
Faulting package-relative application ID: wwahost.exe5

Error: (07/23/2015 09:03:43 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: HUGH_LAPTOP)
Description: Activation of app Microsoft.SkypeApp_kzf8qxf38zg5c!App failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (07/23/2015 08:55:22 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: The protocol handler Mapi15 cannot be loaded. Error description: A dynamic link library (DLL) initialization routine failed. (HRESULT : 0x8007045a).

Error: (07/23/2015 08:55:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: SearchProtocolHost.exe, version: 7.0.9600.17787, time stamp: 0x551b5d9c
Faulting module name: ntdll.dll, version: 6.3.9600.17736, time stamp: 0x550f42c2
Exception code: 0xc0000005
Fault offset: 0x0001df63
Faulting process id: 0x284c0
Faulting application start time: 0xSearchProtocolHost.exe0
Faulting application path: SearchProtocolHost.exe1
Faulting module path: SearchProtocolHost.exe2
Report Id: SearchProtocolHost.exe3
Faulting package full name: SearchProtocolHost.exe4
Faulting package-relative application ID: SearchProtocolHost.exe5

Error: (07/23/2015 08:48:43 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: HUGH_LAPTOP)
Description: Activation of app Microsoft.SkypeApp_kzf8qxf38zg5c!App failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (07/23/2015 06:18:05 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: SDUpdSvc.exe, version: 2.4.40.77, time stamp: 0x53ad3eda
Faulting module name: KERNELBASE.dll, version: 6.3.9600.17415, time stamp: 0x54504ade
Exception code: 0x0eedfade
Fault offset: 0x00014598
Faulting process id: 0xd35c
Faulting application start time: 0xSDUpdSvc.exe0
Faulting application path: SDUpdSvc.exe1
Faulting module path: SDUpdSvc.exe2
Report Id: SDUpdSvc.exe3
Faulting package full name: SDUpdSvc.exe4
Faulting package-relative application ID: SDUpdSvc.exe5

Error: (07/23/2015 06:18:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: SDFSSvc.exe, version: 2.4.40.217, time stamp: 0x54071554
Faulting module name: KERNELBASE.dll, version: 6.3.9600.17415, time stamp: 0x54504ade
Exception code: 0x0eedfade
Fault offset: 0x00014598
Faulting process id: 0xd080
Faulting application start time: 0xSDFSSvc.exe0
Faulting application path: SDFSSvc.exe1
Faulting module path: SDFSSvc.exe2
Report Id: SDFSSvc.exe3
Faulting package full name: SDFSSvc.exe4
Faulting package-relative application ID: SDFSSvc.exe5


System errors:
=============
Error: (07/25/2015 08:47:58 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Intel(R) PROSet/Wireless Zero Configuration Service service terminated unexpectedly. It has done this 1 time(s).

Error: (07/25/2015 08:47:37 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 9:33:19 PM on ‎24/‎07/‎2015 was unexpected.

Error: (07/25/2015 08:47:27 AM) (Source: Microsoft-Windows-Kernel-Boot) (EventID: 29) (User: NT AUTHORITY)
Description: 32212256841182720

Error: (07/24/2015 08:33:25 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Qualcomm Atheros Killer Service V2 service terminated unexpectedly. It has done this 1 time(s).

Error: (07/24/2015 05:34:44 PM) (Source: Microsoft-Windows-NDIS) (EventID: 10317) (User: NT AUTHORITY)
Description: Miniport ZTE Wireless Ethernet Adapter #2, {EB9EA036-9040-49E8-8D13-9D0854090602}, had event 74

Error: (07/24/2015 07:58:49 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 10:11:27 PM on ‎23/‎07/‎2015 was unexpected.

Error: (07/23/2015 09:21:27 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 9:15:04 PM on ‎23/‎07/‎2015 was unexpected.

Error: (07/23/2015 09:03:38 PM) (Source: DCOM) (EventID: 10010) (User: HUGH_LAPTOP)
Description: App.AppX54xz6wnkhmw763c2y8tb018n7d71dtx7.wwa

Error: (07/23/2015 08:48:38 PM) (Source: DCOM) (EventID: 10010) (User: HUGH_LAPTOP)
Description: App.AppX54xz6wnkhmw763c2y8tb018n7d71dtx7.wwa

Error: (07/23/2015 06:43:45 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Media Player Network Sharing Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.


Microsoft Office:
=========================
Error: (07/25/2015 08:47:54 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: ZeroConfigService.exe17.0.5.05387ee07MurocApi.dll17.0.5.05387ed02c0000005000000000002bd48b3001d0c662bff7845aC:\Program Files\Intel\WiFi\bin\ZeroConfigService.exeC:\Program Files\Intel\WiFi\bin\MurocApi.dll0517e40d-3256-11e5-827d-d8cb8a7e33a7

Error: (07/24/2015 08:33:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: KillerService.exe1.1.46.105653f22c94KillerService.exe1.1.46.105653f22c94c0000005000000000001641d91c01d0c592c30416e7C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exeC:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe68b08d98-31ef-11e5-827c-00a0c6000000

Error: (07/23/2015 09:22:26 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8

Error: (07/23/2015 09:15:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: wwahost.exe6.3.9600.174155450355fKERNELBASE.dll6.3.9600.1741554504ade000000040001459823c9401d0c538d0e5cbeeC:\Windows\syswow64\wwahost.exeC:\Windows\SYSTEM32\KERNELBASE.dll0e997e07-312c-11e5-827a-d8cb8a7e33a7Microsoft.SkypeApp_3.1.0.1016_x86__kzf8qxf38zg5cApp

Error: (07/23/2015 09:03:43 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: HUGH_LAPTOP)
Description: Microsoft.SkypeApp_kzf8qxf38zg5c!App-2144927141

Error: (07/23/2015 08:55:22 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: Mapi15A dynamic link library (DLL) initialization routine failed. (HRESULT : 0x8007045a)

Error: (07/23/2015 08:55:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: SearchProtocolHost.exe7.0.9600.17787551b5d9cntdll.dll6.3.9600.17736550f42c2c00000050001df63284c001d0c5360f491bd1C:\Windows\sysWow64\SearchProtocolHost.exeC:\Windows\SYSTEM32\ntdll.dll4d52a1d4-3129-11e5-827a-d8cb8a7e33a7

Error: (07/23/2015 08:48:43 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: HUGH_LAPTOP)
Description: Microsoft.SkypeApp_kzf8qxf38zg5c!App-2144927141

Error: (07/23/2015 06:18:05 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: SDUpdSvc.exe2.4.40.7753ad3edaKERNELBASE.dll6.3.9600.1741554504ade0eedfade00014598d35c01d0c52019b9b31bC:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exeC:\Windows\SYSTEM32\KERNELBASE.dll576fc7bc-3113-11e5-8279-d8cb8a7e33a7

Error: (07/23/2015 06:18:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: SDFSSvc.exe2.4.40.21754071554KERNELBASE.dll6.3.9600.1741554504ade0eedfade00014598d08001d0c520193db9f2C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exeC:\Windows\SYSTEM32\KERNELBASE.dll56f89282-3113-11e5-8279-d8cb8a7e33a7


CodeIntegrity Errors:
===================================
Date: 2015-07-25 08:56:33.071
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-07-25 08:48:45.635
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-07-24 21:57:37.796
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-07-24 21:03:30.346
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-07-24 19:28:24.680
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-07-24 18:24:57.199
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-07-24 16:15:09.500
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-07-24 15:18:14.033
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-07-24 14:27:33.741
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-07-24 14:14:33.558
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7-4720HQ CPU @ 2.60GHz
Percentage of memory in use: 32%
Total physical RAM: 8109.81 MB
Available physical RAM: 5503.35 MB
Total Virtual: 16301.81 MB
Available Virtual: 13231.04 MB

==================== Drives ================================

Drive c: (OS_Install) (Fixed) (Total:118.24 GB) (Free:58.36 GB) NTFS
Drive d: (DATA) (Fixed) (Total:915.12 GB) (Free:888.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 4E9EEB76)

Partition: GPT Partition Type.

========================================================
Disk: 1 (Size: 119.2 GB) (Disk ID: 4E9EEB6B)

Partition: GPT Partition Type.

==================== End of log ============================
 
Part of this fix will fix your hosts file which is infected, it will also unhide Windows Essentials which looks like it came from China, after its unhidden see if you can uninstall it

Open notepad , Go to Start --> All Programs --> Accessories --> Notepad.
Please copy the entire contents Inside of the code box below beginning with START and ending with END
(To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste).
Name the file Fixlist, Save it to your desktop where you have FRST/FRST64 or the fix wont work, . Then open up FRST/FRST64 and click on FIX (Not Scan) It won't take long, after your computer reboots you will find a FIXLOG.TXT on your desktop, post it please


Code: 
Start
CloseProcesses:
CreateRestorePoint: 
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
CHR Extension: (No Name) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2015-07-23]
2015-07-14 08:58 - 2013-08-22 23:25 - 00000824 _____ C:\Windows\system32\Drivers\etc\hosts.20150714-085812.backup
フォト ギャラリー (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
معرض الصور (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
사진 갤러리 (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
影像中心 (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
照片库 (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Hosts:
CMD: ipconfig /flushdns
EmptyTemp:
End


NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
 
Thanks Ken, the log is attached.

Fix result of Farbar Recovery Scan Tool (x64) Version:26-07-2015
Ran by Hugh at 2015-07-27 18:54:22 Run:1
Running from C:\Users\Hugh\Desktop
Loaded Profiles: Hugh (Available Profiles: Hugh)
Boot Mode: Normal
==============================================


fixlist content:
*****************
Start
CloseProcesses:
CreateRestorePoint:
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
CHR Extension: (No Name) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2015-07-23]
2015-07-14 08:58 - 2013-08-22 23:25 - 00000824 _____ C:\Windows\system32\Drivers\etc\hosts.20150714-085812.backup
??? ????? (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
???? ????? (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
?? ??? (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
???? (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
??? (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Hosts:
CMD: ipconfig /flushdns
EmptyTemp:
End
*****************


Processes closed successfully.
Restore point was successfully created.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh => moved successfully.
C:\Windows\system32\Drivers\etc\hosts.20150714-085812.backup => moved successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\\SystemComponent => value not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\\SystemComponent => value not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\\SystemComponent => value not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\\SystemComponent => value not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\\SystemComponent => value not found.
C:\Windows\System32\Drivers\etc\hosts => moved successfully.
Hosts restored successfully.


========= ipconfig /flushdns =========




Windows IP Configuration


Successfully flushed the DNS Resolver Cache.


========= End of CMD: =========


EmptyTemp: => 1.3 GB temporary data Removed.




The system needed a reboot..


==== End of Fixlog 18:55:11 ====
 

Attachments

Last edited by a moderator:
Morning, did you try to uninstall Windows Essentials ??

Open up FRST, checkmark Additions, run a new scan and post both logs please
 
Hi Ken, logs are attached. Tks for the help.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:26-07-2015
Ran by Hugh (administrator) on HUGH_LAPTOP (28-07-2015 19:44:41)
Running from C:\Users\Hugh\Desktop
Loaded Profiles: Hugh (Available Profiles: Hugh)
Platform: Windows 8.1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/


==================== Processes (Whitelisted) =================


(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)


(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\SCM\MSIService.exe
(MSI) C:\Program Files (x86)\MSI\SUPER CHARGER\ChargeService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.1\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.1\GoogleCrashHandler64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(MSI) C:\Program Files (x86)\SCM\SCM.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\MSI\Dragon Gaming Center\Dragon Gaming Center.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\MSI\KLM\KLM.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(MSI) C:\Program Files (x86)\MSI\SUPER CHARGER\SUPER CHARGER.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Telstra) C:\Program Files (x86)\Telstra\Mobile Broadband Manager\TelstraUCM.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\ismagent.exe
() C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\updateui.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Reader_6.3.9654.17499_x64__8wekyb3d8bbwe\glcnd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe




==================== Registry (Whitelisted) ==================


(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)


HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8446832 2015-01-22] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2015-01-22] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [322712 2014-10-10] (Intel Corporation)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [3281160 2015-01-22] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [SCM] => C:\Program Files (x86)\SCM\SCM.exe [405504 2014-11-07] (MSI)
HKLM-x32\...\Run: [KLM] => C:\Program Files (x86)\MSI\KLM\KLM.exe [1569416 2014-11-12] (Micro-Star International Co., Ltd.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-09] (CyberLink Corp.)
HKLM-x32\...\Run: [SUPER CHARGER] => C:\Program Files (x86)\MSI\SUPER CHARGER\SUPER CHARGER.exe [1047536 2014-02-22] (MSI)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM-x32\...\Run: [BigPondWirelessBroadbandCM] => C:\Program Files (x86)\Telstra\Mobile Broadband Manager\TelstraUCM.exe [4352408 2010-05-14] (Telstra)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22012688 2015-06-20] (Google)
HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53288576 2015-06-29] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Killer Network Manager.lnk [2015-01-23]
ShortcutTarget: Killer Network Manager.lnk -> C:\Windows\Installer\{5B62C353-75A3-463F-A52E-CC005846F3CE}\NetworkManager.exe_130C27D738F34C89BDDF21BCFD74B56D.exe (Flexera Software LLC)
BootExecute: autocheck autochk * sdnclean64.exe


==================== Internet (Whitelisted) ====================


(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)


HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://msi13.msn.com
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-06-09] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-06-17] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-06-07] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-07] (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-06-08] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{6CA879F1-BA5A-40DB-96D7-FBC3D00CB47F}: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{EB9EA036-9040-49E8-8D13-9D0854090602}: [DhcpNameServer] 10.5.136.242 10.5.133.45


FireFox:
========
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-17] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-17] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-07] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-07] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-06-07] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)


Chrome:
=======
CHR Profile: C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-07-19]
CHR Extension: (Google Cast) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2015-06-07]
CHR Extension: (Adblock Super) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\knebimhcckndhiglamoabbnifdkijidd [2015-06-08]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-07]
CHR Extension: (No Name) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2015-07-27]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Hugh\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-07]
CHR HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Hugh\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx [2015-06-07]
CHR HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx


==================== Services (Whitelisted) =================


(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2753720 2015-07-01] (Microsoft Corporation)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [101680 2015-01-22] (ELAN Microelectronics Corp.)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2015-01-22] (NVIDIA Corporation)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [18584 2014-10-10] (Intel Corporation)
R2 iBtSiva; C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe [122984 2015-01-22] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [345864 2015-03-19] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-28] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-28] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-17] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-17] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 Micro Star SCM; C:\Program Files (x86)\SCM\MSIService.exe [160768 2014-11-07] (Micro-Star International Co., Ltd.) [File not signed]
R2 MSI_SuperCharger; C:\Program Files (x86)\MSI\SUPER CHARGER\ChargeService.exe [162800 2014-02-22] (MSI)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2014-05-30] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2015-01-22] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2015-01-22] (NVIDIA Corporation)
S2 Qualcomm Atheros Killer Service V2; C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe [360448 2014-08-19] (Qualcomm Atheros) [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1740760 2014-09-03] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3816176 2014-05-30] (Intel® Corporation)


==================== Drivers (Whitelisted) ====================


(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


R1 BfLwf; C:\Windows\system32\DRIVERS\bwcW8x64.sys [97968 2014-08-14] (Qualcomm Atheros, Inc.)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
S3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [141624 2014-05-14] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1424184 2014-06-18] (Motorola Solutions, Inc.)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [222664 2015-01-22] (Intel Corporation)
R3 Ke2200; C:\Windows\system32\DRIVERS\e22w8x64.sys [130224 2014-03-28] (Qualcomm Atheros, Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-07-28] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-17] (Intel Corporation)
R3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3446240 2014-06-19] (Intel Corporation)
R3 NTIOLib_1_0_3; C:\Program Files (x86)\MSI\SUPER CHARGER\NTIOLib_X64.sys [13368 2012-10-26] (MSI)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-01-22] (NVIDIA Corporation)
S3 NVSWCFilter; C:\Windows\System32\drivers\nvswcfilter.sys [19616 2015-01-22] (Windows (R) Win 7 DDK provider)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2015-01-22] (NVIDIA Corporation)
R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [466648 2015-01-22] (Realsil Semiconductor Corporation)
R1 SDHookDriver; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookDrv64.sys [64160 2014-04-25] ()
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
R3 WINIO; C:\Program Files (x86)\MSI\Dragon Gaming Center\winio64.sys [15160 2010-06-08] ()


==================== NetSvcs (Whitelisted) ===================


(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)




==================== One Month Created files and folders ========


(If an entry is included in the fixlist, the file/folder will be moved.)


2015-07-28 09:08 - 2015-07-28 09:08 - 00000000 ____D C:\Users\Hugh\AppData\Local\Windows Live
2015-07-27 09:49 - 2015-07-27 09:50 - 00000000 ____D C:\Users\Hugh\AppData\Local\CutePDF Writer
2015-07-27 09:48 - 2015-07-27 09:48 - 00000000 ____D C:\Program Files (x86)\GPLGS
2015-07-27 09:46 - 2015-07-27 09:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CutePDF
2015-07-27 09:46 - 2015-07-27 09:46 - 00000000 ____D C:\Program Files (x86)\Acro Software
2015-07-27 09:46 - 2013-10-23 15:24 - 00087600 _____ C:\Windows\system32\cpwmon64.dll
2015-07-27 09:43 - 2015-07-27 09:44 - 02446176 _____ (Acro Software Inc. ) C:\Users\Hugh\Downloads\CuteWriter.exe
2015-07-25 08:57 - 2015-07-28 19:44 - 00019031 _____ C:\Users\Hugh\Desktop\FRST.txt
2015-07-25 08:57 - 2015-07-27 18:54 - 00000000 ____D C:\Users\Hugh\Desktop\FRST-OlderVersion
2015-07-25 08:57 - 2015-07-25 09:00 - 00043446 _____ C:\Users\Hugh\Desktop\Addition.txt
2015-07-24 20:34 - 2015-07-24 20:34 - 00033263 _____ C:\Users\Hugh\Downloads\table (1).csv
2015-07-24 18:10 - 2015-07-24 18:11 - 00029538 _____ C:\Users\Hugh\Downloads\table.csv
2015-07-23 20:33 - 2015-07-23 20:33 - 00001055 _____ C:\Users\Hugh\Desktop\JRT.txt
2015-07-22 17:30 - 2015-07-28 18:49 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-22 17:30 - 2015-07-22 17:30 - 00001128 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-07-22 17:30 - 2015-07-22 17:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-07-22 17:30 - 2015-07-22 17:30 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-07-22 17:30 - 2015-06-18 08:42 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-07-22 17:30 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-07-22 17:30 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-07-22 17:18 - 2015-07-23 18:17 - 00000000 ____D C:\AdwCleaner
2015-07-22 17:17 - 2015-07-22 17:17 - 02248704 _____ C:\Users\Hugh\Downloads\AdwCleaner.exe
2015-07-22 17:16 - 2015-07-22 17:16 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Hugh\Downloads\mbam-setup-2.1.8.1057 (2).exe
2015-07-22 17:15 - 2015-07-22 17:16 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Hugh\Downloads\mbam-setup-2.1.8.1057 (1).exe
2015-07-22 17:14 - 2015-07-22 17:15 - 01798288 _____ (Malwarebytes Corporation) C:\Users\Hugh\Downloads\JRT.exe
2015-07-21 10:47 - 2015-07-15 00:14 - 00358912 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-07-21 10:47 - 2015-07-15 00:14 - 00301056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-07-21 10:47 - 2015-07-15 00:14 - 00035840 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-07-21 10:47 - 2015-07-15 00:13 - 00044032 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-07-20 11:13 - 2015-07-20 11:14 - 05198336 _____ (AVAST Software) C:\Users\Hugh\Desktop\aswMBR.exe
2015-07-20 11:09 - 2015-07-27 18:54 - 02146816 _____ (Farbar) C:\Users\Hugh\Desktop\FRST64.exe
2015-07-20 11:07 - 2015-07-20 11:08 - 00045015 _____ C:\Users\Hugh\Downloads\Addition.txt
2015-07-20 11:06 - 2015-07-28 19:44 - 00000000 ____D C:\FRST
2015-07-20 11:06 - 2015-07-20 11:08 - 00045631 _____ C:\Users\Hugh\Downloads\FRST.txt
2015-07-20 11:06 - 2015-07-20 11:06 - 02134528 _____ (Farbar) C:\Users\Hugh\Downloads\FRST64.exe
2015-07-20 11:05 - 2015-07-20 11:05 - 00000017 _____ C:\Users\Hugh\AppData\Local\resmon.resmoncfg
2015-07-20 11:03 - 2015-07-20 11:03 - 00000207 _____ C:\Windows\tweaking.com-regbackup-HUGH_LAPTOP-Windows-8.1-(64-bit).dat
2015-07-20 11:02 - 2015-07-20 11:02 - 00000000 ____D C:\RegBackup
2015-07-20 11:01 - 2015-07-20 11:01 - 04720448 _____ C:\Users\Hugh\Downloads\tweaking.com_registry_backup_setup.exe
2015-07-20 11:01 - 2015-07-20 11:01 - 00002265 _____ C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2015-07-20 11:01 - 2015-07-20 11:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2015-07-20 11:01 - 2015-07-20 11:01 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2015-07-19 17:59 - 2015-07-19 17:59 - 00002186 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth.lnk
2015-07-19 17:58 - 2015-07-19 17:58 - 00931408 _____ (Google Inc.) C:\Users\Hugh\Downloads\GoogleEarthSetup.exe
2015-07-17 08:38 - 2015-07-17 08:38 - 00000000 ____D C:\Users\Hugh\Tracing
2015-07-16 22:32 - 2015-07-28 19:44 - 00000000 ____D C:\Users\Hugh\AppData\Roaming\Skype
2015-07-16 22:32 - 2015-07-20 08:26 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-07-16 22:32 - 2015-07-20 08:26 - 00000000 ____D C:\ProgramData\Skype
2015-07-16 22:32 - 2015-07-16 22:32 - 00002713 _____ C:\Users\Public\Desktop\Skype.lnk
2015-07-16 22:32 - 2015-07-16 22:32 - 00000000 ____D C:\Users\Hugh\AppData\Local\Skype
2015-07-16 22:32 - 2015-07-16 22:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-07-16 22:31 - 2015-05-12 10:24 - 00536920 _____ (Microsoft Corporation) C:\Windows\system32\mcupdate_GenuineIntel.dll
2015-07-16 22:31 - 2015-05-01 11:13 - 06521800 _____ (Microsoft Corporation) C:\Windows\system32\sppsvc.exe
2015-07-16 22:31 - 2015-05-01 11:13 - 01488000 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2015-07-16 22:31 - 2015-05-01 11:13 - 00261376 _____ (Microsoft Corporation) C:\Windows\system32\sppwinob.dll
2015-07-15 09:39 - 2015-07-10 05:51 - 00136904 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-07-15 09:39 - 2015-07-10 04:40 - 00359936 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-07-15 09:39 - 2015-07-10 02:03 - 03701760 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-07-15 09:39 - 2015-07-10 01:54 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-07-15 09:39 - 2015-07-10 01:53 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-07-15 09:39 - 2015-07-10 01:50 - 00409088 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2015-07-15 09:39 - 2015-07-10 01:50 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-07-15 09:39 - 2015-07-10 01:48 - 00891904 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-07-15 09:39 - 2015-07-10 01:46 - 02229248 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-07-15 09:39 - 2015-07-10 01:38 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-07-15 09:39 - 2015-07-10 01:37 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-07-15 09:39 - 2015-07-10 01:35 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-07-15 09:39 - 2015-07-10 01:34 - 00721920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-07-15 09:39 - 2015-06-27 13:08 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-07-15 09:39 - 2015-06-27 13:08 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-07-15 09:39 - 2015-06-27 12:14 - 00027136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-07-15 09:38 - 2015-07-03 07:21 - 19877376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-07-15 09:38 - 2015-07-03 06:50 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-07-15 09:38 - 2015-07-03 06:49 - 25193984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-07-15 09:38 - 2015-07-03 06:23 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-07-15 09:38 - 2015-07-03 06:19 - 12855296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-07-15 09:38 - 2015-07-03 05:55 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-07-15 09:38 - 2015-07-03 05:20 - 14453248 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-07-15 09:38 - 2015-07-03 04:59 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-07-15 09:38 - 2015-07-02 08:08 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-07-15 09:38 - 2015-07-02 07:14 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-07-15 09:38 - 2015-06-30 08:43 - 00026288 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-07-15 09:38 - 2015-06-30 01:07 - 01145856 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 01084928 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 00764928 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 00433152 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-07-15 09:38 - 2015-06-30 01:07 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-07-15 09:38 - 2015-06-28 15:07 - 00442712 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-07-15 09:38 - 2015-06-28 15:07 - 00178008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-07-15 09:38 - 2015-06-28 15:06 - 01311960 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-07-15 09:38 - 2015-06-28 15:06 - 00332120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-07-15 09:38 - 2015-06-28 02:42 - 00747520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-07-15 09:38 - 2015-06-27 13:13 - 00202240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-07-15 09:38 - 2015-06-27 13:12 - 00401408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-07-15 09:38 - 2015-06-27 13:12 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-07-15 09:38 - 2015-06-27 12:40 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-07-15 09:38 - 2015-06-27 12:05 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-07-15 09:38 - 2015-06-27 12:00 - 00989184 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-15 09:38 - 2015-06-27 11:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-07-15 09:38 - 2015-06-27 11:26 - 00802816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-07-15 09:38 - 2015-06-27 09:21 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-07-15 09:38 - 2015-06-27 09:21 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-07-15 09:38 - 2015-06-25 12:31 - 04177920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-07-15 09:38 - 2015-06-16 08:41 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-15 09:38 - 2015-06-16 08:24 - 03320320 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-15 09:38 - 2015-06-16 07:16 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-07-15 09:38 - 2015-06-16 07:09 - 03607552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-07-15 09:38 - 2015-06-16 06:50 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-07-15 09:38 - 2015-06-16 05:57 - 02460160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-07-15 09:38 - 2015-05-31 07:18 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll
2015-07-15 09:38 - 2015-05-31 05:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2015-07-15 09:38 - 2015-05-31 05:35 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-07-15 09:38 - 2015-05-12 04:17 - 01201664 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys
2015-07-15 09:38 - 2015-05-08 03:50 - 22292672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-07-15 09:38 - 2015-05-08 03:00 - 03109376 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2015-07-15 09:38 - 2015-05-08 02:53 - 19734960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-07-15 09:38 - 2015-05-08 02:12 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2015-07-15 09:38 - 2015-05-08 01:21 - 00522240 _____ (Microsoft Corporation) C:\Windows\system32\GeofenceMonitorService.dll
2015-07-15 09:38 - 2015-05-08 01:05 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GeofenceMonitorService.dll
2015-07-15 09:38 - 2015-05-04 01:09 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-07-15 09:38 - 2015-05-04 00:58 - 00210944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-07-15 09:38 - 2015-05-04 00:55 - 00971776 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2015-07-15 09:38 - 2015-05-04 00:49 - 00811008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2015-07-15 09:38 - 2015-05-03 10:39 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-07-15 09:38 - 2015-04-30 09:22 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\WiFiDisplay.dll
2015-07-15 09:38 - 2015-04-25 12:25 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2015-07-15 09:37 - 2015-06-16 15:36 - 01661576 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-15 09:37 - 2015-06-16 15:36 - 01212248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-07-15 09:37 - 2015-06-16 08:39 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-07-15 09:37 - 2015-06-16 08:38 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-07-15 09:37 - 2015-06-16 08:26 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-07-15 09:37 - 2015-06-16 08:24 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-07-15 09:37 - 2015-06-16 08:02 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2015-07-15 09:37 - 2015-06-16 07:58 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-07-15 09:37 - 2015-06-16 07:57 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-07-15 09:37 - 2015-06-16 07:56 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-07-15 09:37 - 2015-06-16 07:55 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-07-15 09:37 - 2015-06-16 07:49 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-07-15 09:37 - 2015-06-16 07:41 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-07-15 09:37 - 2015-06-16 07:38 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-07-15 09:37 - 2015-06-16 07:36 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-07-15 09:37 - 2015-06-16 07:17 - 02880000 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-07-15 09:37 - 2015-06-16 07:16 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-07-15 09:37 - 2015-06-16 07:15 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-07-15 09:37 - 2015-06-16 07:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-07-15 09:37 - 2015-06-16 07:04 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-07-15 09:37 - 2015-06-16 07:03 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-07-15 09:37 - 2015-06-16 06:52 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-07-15 09:37 - 2015-06-16 06:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2015-07-15 09:37 - 2015-06-16 06:44 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-07-15 09:37 - 2015-06-16 06:43 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-07-15 09:37 - 2015-06-16 06:42 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-07-15 09:37 - 2015-06-16 06:41 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-07-15 09:37 - 2015-06-16 06:37 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-07-15 09:37 - 2015-06-16 06:32 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-07-15 09:37 - 2015-06-16 06:31 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-07-15 09:37 - 2015-06-16 06:30 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-07-15 09:37 - 2015-06-16 06:30 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-07-15 09:37 - 2015-06-16 06:17 - 01048576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2015-07-15 09:37 - 2015-06-16 06:07 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-07-15 09:37 - 2015-06-16 06:02 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-07-15 09:37 - 2015-06-11 13:49 - 01380600 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-15 09:37 - 2015-06-11 02:13 - 01097216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-07-15 09:37 - 2015-05-12 23:19 - 00294912 _____ (Microsoft Corporation) C:\Windows\system32\SystemEventsBrokerServer.dll
2015-07-15 09:37 - 2015-05-12 02:34 - 00332800 _____ (Microsoft Corporation) C:\Windows\system32\fhcpl.dll
2015-07-15 09:37 - 2015-05-08 02:47 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-07-15 09:37 - 2015-05-04 01:07 - 07784448 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Data.Pdf.dll
2015-07-15 09:37 - 2015-05-04 00:57 - 05264384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Data.Pdf.dll
2015-07-15 09:37 - 2015-05-02 09:33 - 00410739 _____ C:\Windows\system32\ApnDatabase.xml
2015-07-15 09:37 - 2015-04-28 23:13 - 00513480 _____ C:\Windows\SysWOW64\locale.nls
2015-07-15 09:37 - 2015-04-28 23:13 - 00513480 _____ C:\Windows\system32\locale.nls
2015-07-15 09:37 - 2015-04-24 01:47 - 03084288 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2015-07-15 09:37 - 2015-04-24 01:16 - 02471424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2015-07-14 20:59 - 2015-07-23 20:55 - 00000000 ____D C:\Users\Hugh\AppData\Local\CrashDumps
2015-07-14 08:14 - 2015-07-14 08:14 - 00000000 ____D C:\Users\Default\AppData\Local\Google
2015-07-14 08:14 - 2015-07-14 08:14 - 00000000 ____D C:\Users\Default User\AppData\Local\Google
2015-07-13 21:40 - 2015-07-13 21:40 - 00558328 _____ (Safer-Networking Ltd. ) C:\Users\Hugh\Downloads\spybot2-license.exe
2015-07-13 20:39 - 2015-07-14 08:57 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2015-07-13 20:39 - 2015-07-14 08:11 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-07-13 20:39 - 2015-07-13 20:39 - 00001417 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-07-13 20:39 - 2015-07-13 20:39 - 00001405 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-07-13 20:39 - 2015-07-13 20:39 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2015-07-13 20:39 - 2015-07-13 20:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-07-13 20:39 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-07-13 20:27 - 2015-07-13 20:31 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Hugh\Downloads\spybot-2.4.exe
2015-07-13 15:02 - 2015-07-13 15:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-07-13 15:01 - 2015-07-13 15:01 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Hugh\Downloads\mbam-setup-2.1.8.1057.exe
2015-07-09 09:27 - 2015-07-09 09:27 - 00000000 ____D C:\Users\Public\Downloads\Norton
2015-07-07 20:14 - 2015-07-07 20:14 - 00000500 _____ C:\Users\Hugh\Desktop\asx options.csv
2015-07-07 15:01 - 2015-07-07 15:01 - 1092367527 _____ C:\Windows\MEMORY.DMP
2015-07-07 15:01 - 2015-07-07 15:01 - 01270288 _____ C:\Windows\Minidump\070715-12031-01.dmp
2015-07-07 15:01 - 2015-07-07 15:01 - 00000000 ____D C:\Windows\Minidump
2015-07-07 13:10 - 2015-07-07 13:10 - 03121152 _____ C:\Users\Hugh\Downloads\TWS API Install 972.03.msi
2015-07-06 08:24 - 2015-07-27 18:55 - 00009728 ___SH C:\Users\Hugh\Desktop\Thumbs.db
2015-06-28 13:34 - 2015-06-28 13:34 - 00000000 ____D C:\ProgramData\Samsung


==================== One Month Modified files and folders ========


(If an entry is included in the fixlist, the file/folder will be moved.)


2015-07-28 19:40 - 2015-06-07 17:03 - 00000000 ____D C:\Users\Hugh\AppData\Local\Packages
2015-07-28 19:38 - 2015-06-07 19:14 - 00004980 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for HUGH_LAPTOP-Hugh Hugh_Laptop
2015-07-28 18:46 - 2015-06-07 17:45 - 00000930 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-07-28 13:41 - 2015-06-07 17:44 - 00003934 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{3D2F1FB9-A0C3-47F9-8104-40390AB06AAF}
2015-07-28 10:49 - 2015-06-07 15:51 - 01437386 _____ C:\Windows\WindowsUpdate.log
2015-07-28 10:38 - 2013-08-23 01:36 - 00000000 ____D C:\Windows\AppReadiness
2015-07-28 10:05 - 2015-06-07 19:30 - 00000000 ____D C:\Jts
2015-07-28 09:17 - 2015-06-07 17:09 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2823309964-2513555705-3651140861-1001
2015-07-28 09:03 - 2013-08-23 01:36 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-07-28 08:54 - 2014-03-18 20:03 - 00865408 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-27 18:56 - 2015-06-07 17:45 - 00000926 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-07-27 18:56 - 2015-06-07 17:09 - 00000000 ___RD C:\Users\Hugh\OneDrive
2015-07-27 18:55 - 2014-03-18 19:54 - 00583446 _____ C:\Windows\PFRO.log
2015-07-27 18:55 - 2013-08-23 00:46 - 00057052 _____ C:\Windows\setupact.log
2015-07-27 18:55 - 2013-08-23 00:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-27 18:55 - 2013-08-22 23:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2015-07-27 18:51 - 2015-06-26 18:40 - 00000000 ____D C:\Program Files (x86)\AmiBroker
2015-07-27 08:48 - 2015-06-07 17:46 - 00002213 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-07-27 08:32 - 2015-06-08 17:08 - 00000000 ___SD C:\Windows\system32\GWX
2015-07-27 08:30 - 2015-06-07 19:14 - 00003100 _____ C:\Windows\System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-2823309964-2513555705-3651140861-1001
2015-07-24 08:33 - 2013-08-23 01:36 - 00000000 ____D C:\Windows\rescache
2015-07-23 22:19 - 2015-06-07 17:02 - 00000000 ____D C:\Users\Hugh
2015-07-23 18:18 - 2015-06-07 19:09 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-07-23 18:18 - 2013-08-23 00:44 - 00481880 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-21 10:59 - 2013-08-23 01:20 - 00000000 ____D C:\Windows\CbsTemp
2015-07-20 21:25 - 2015-06-07 19:22 - 00001692 _____ C:\Users\Hugh\Desktop\Google Drive.lnk
2015-07-20 08:27 - 2015-06-07 19:22 - 00000000 ___RD C:\Users\Hugh\Google Drive
2015-07-19 17:58 - 2015-06-07 17:45 - 00000000 ____D C:\Program Files (x86)\Google
2015-07-16 08:41 - 2015-06-07 17:45 - 00003902 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-07-16 08:41 - 2015-06-07 17:45 - 00003666 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-07-16 08:28 - 2013-08-23 01:36 - 00000000 ___RD C:\Windows\ToastData
2015-07-16 08:28 - 2013-08-23 01:36 - 00000000 ____D C:\Windows\WinStore
2015-07-15 09:43 - 2015-06-12 15:39 - 00000000 ____D C:\Windows\system32\appraiser
2015-07-15 09:43 - 2015-06-08 17:08 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-07-15 09:42 - 2015-06-08 16:59 - 00000000 ____D C:\Windows\system32\MRT
2015-07-15 08:31 - 2014-11-05 10:48 - 00000000 ____D C:\ProgramData\Norton
2015-07-14 09:12 - 2015-06-08 17:08 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-07-14 08:14 - 2015-06-07 19:20 - 00002068 _____ C:\Users\Public\Desktop\Google Slides.lnk
2015-07-14 08:14 - 2015-06-07 19:20 - 00002066 _____ C:\Users\Public\Desktop\Google Sheets.lnk
2015-07-14 08:14 - 2015-06-07 19:20 - 00002056 _____ C:\Users\Public\Desktop\Google Docs.lnk
2015-07-14 08:14 - 2015-06-07 19:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-07-14 08:07 - 2014-11-05 10:49 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-07-14 08:05 - 2013-08-23 01:36 - 00000000 ___HD C:\Windows\ELAMBKUP
2015-07-14 08:05 - 2013-08-22 23:25 - 00262144 ___SH C:\Windows\system32\config\ELAM
2015-07-14 07:10 - 2015-06-08 17:17 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-14 07:10 - 2015-06-08 17:17 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-07 13:16 - 2015-06-07 19:31 - 00000000 ____D C:\TWS API
2015-07-03 08:43 - 2015-06-08 16:59 - 130333168 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe


==================== Files in the root of some directories =======


2015-07-20 11:05 - 2015-07-20 11:05 - 0000017 _____ () C:\Users\Hugh\AppData\Local\resmon.resmoncfg
2015-01-23 15:12 - 2015-01-23 15:12 - 0000000 ____H () C:\ProgramData\DP45977C.lfl


==================== Bamital & volsnap Check =================


(There is no automatic fix for files that do not pass verification.)


C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed




LastRegBack: 2015-07-15 08:42


==================== End of log ============================




Additional scan result of Farbar Recovery Scan Tool (x64) Version:26-07-2015
Ran by Hugh at 2015-07-28 19:45:16
Running from C:\Users\Hugh\Desktop
Boot Mode: Normal
==========================================================




==================== Accounts: =============================


Administrator (S-1-5-21-2823309964-2513555705-3651140861-500 - Administrator - Disabled)
Guest (S-1-5-21-2823309964-2513555705-3651140861-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2823309964-2513555705-3651140861-1003 - Limited - Enabled)
Hugh (S-1-5-21-2823309964-2513555705-3651140861-1001 - Administrator - Enabled) => C:\Users\Hugh


==================== Security Center ========================


(If an entry is included in the fixlist, it will be removed.)


AV: Spybot - Search and Destroy (Enabled - Up to date) {20A26C15-1AF0-7CA3-9380-FAB824A7EE0D}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}


==================== Installed Programs ======================


(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)


AmiBroker 5.60.3 x64 (HKLM\...\AmiBroker64_is1) (Version: 5.60 - AmiBroker.com)
AmiBroker 5.90.1 (HKLM-x32\...\AmiBroker_is1) (Version: 5.90 - AmiBroker.com)
Battery Calibration (HKLM-x32\...\{619FA785-489B-4D22-911F-82D6EDF5BDB0}) (Version: 1.0.1405.0701 - Micro-Star International Co., Ltd.)
Boot Configure (HKLM-x32\...\{5563D674-6B02-43F4-B9D0-C2A944E84F3C}) (Version: 20.014.12127 - Micro-Star International Co., Ltd.)
BurnRecovery (HKLM-x32\...\{2892E1B7-E24D-4CCB-B8A7-B63D4B66F89F}) (Version: 4.0.1412.2301 - )
CutePDF Writer 3.0 (HKLM\...\CutePDF Writer Installation) (Version: 3.0 - Acro Software Inc.)
CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.5509.52 - CyberLink Corp.)
Dragon Gaming Center (HKLM-x32\...\InstallShield_{965B16C7-0778-4C45-B7D1-83A59E6FBBCB}) (Version: 1.0.1410.1301 - Micro-Star International Co., Ltd.)
Dragon Gaming Center (x32 Version: 1.0.1410.1301 - Micro-Star International Co., Ltd.) Hidden
ELAN Touchpad 11.13.11.4_X64_WHQL (HKLM\...\Elantech) (Version: 11.13.11.4 - ELAN Microelectronic Corp.)
Excel VBA Code Cleaner 5.0 (HKLM-x32\...\Excel VBA Code Cleaner 5.0) (Version: - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 44.0.2403.107 - Google Inc.)
Google Drive (HKLM-x32\...\{6EA8B94E-D869-4D96-88DF-5E1ECE1D6876}) (Version: 1.23.9648.8824 - Google, Inc.)
Google Earth (HKLM-x32\...\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)
Google Update Helper (x32 Version: 1.3.21.115 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.28.1 - Google Inc.) Hidden
Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{0EC7F9CC-4741-45AE-9F55-6E9343F726F5}) (Version: 1.1.0.36960 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4170 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 13.5.0.1056 - Intel Corporation)
Intel(R) Wireless Bluetooth(R)(patch version 17.1.1434.2) (HKLM\...\{302600C1-6BDF-4FD1-1407-148929CC1385}) (Version: 17.1.1407.0480 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{85b9d34f-7397-4e39-8600-07942ef6ca04}) (Version: 17.0.5 - Intel Corporation)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
KB9X Radio Switch Driver (HKLM\...\5AADE1068CF70DD983F763B20CF2CAAB72883915) (Version: 1.1.0.0 - ENE TECHNOLOGY INC.)
KeePass Password Safe 1.29 (HKLM-x32\...\KeePass Password Safe_is1) (Version: 1.29 - Dominik Reichl)
KLM (HKLM-x32\...\InstallShield_{4DEA5B85-6C56-45F3-AE00-FED756B0D3B4}) (Version: 1.0.1411.1101 - Application)
KLM (x32 Version: 1.0.1411.1101 - Application) Hidden
MAGIX MX Suite (HKLM-x32\...\MAGIX_{43136332-880B-458A-966C-900C18752B66}) (Version: 1.13.0.121 - MAGIX AG)
MAGIX MX Suite (Version: 1.13.0.121 - MAGIX AG) Hidden
Malwarebytes Anti-Malware version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 15.0.4737.1003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\...\OneDriveSetup.exe) (Version: 17.3.5907.0716 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
MSI Remind Manager (HKLM-x32\...\InstallShield_{3E23F267-3E35-40F9-B6BF-BC034D214717}) (Version: 1.0.1412.1801 - Micro-Star International Co., Ltd.)
MSI Remind Manager (x32 Version: 1.0.1412.1801 - Micro-Star International Co., Ltd.) Hidden
MSI Social Media Collection (HKLM-x32\...\{7ADEC426-BE95-48EF-84D4-086BD0F4D331}) (Version: 1.14.2251 - Micro-Star International Co., Ltd.)
Nahimic APO (x32 Version: 1.0.401 - Nahimic) Hidden
Nahimic for MSI (HKLM-x32\...\{d790cc66-b17a-4c88-96a8-cb6506bfdfe4}) (Version: 1.0.4 - Nahimic)
Nahimic for MSI (Version: 1.0.401 - Nahimic) Hidden
NahimicSettingsConfigurator (Version: 1.0.401 - Nahimic) Hidden
NVIDIA GeForce Experience 2.1.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.5 - NVIDIA Corporation)
NVIDIA Graphics Driver 345.05 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 345.05 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
Qualcomm Atheros Bandwidth Control Filter Driver (Version: 1.1.46.1056 - Qualcomm Atheros) Hidden
Qualcomm Atheros Killer E220x Drivers (Version: 1.1.46.1056 - Qualcomm Atheros) Hidden
Qualcomm Atheros Killer Performance Suite (HKLM-x32\...\{E70DB50B-10B4-46BC-9DE2-AB8B49E061EE}) (Version: 1.1.46.1056 - Qualcomm Atheros)
Qualcomm Atheros Network Manager (Version: 1.1.46.1056 - Qualcomm Atheros) Hidden
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.21249 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7427 - Realtek Semiconductor Corp.)
SCM (HKLM\...\{9BC0C4F3-ACBB-42DF-9559-93175E3B4095}) (Version: 13.014.11068 - Application)
SHIELD Streaming (Version: 3.1.3000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.18.9 - NVIDIA Corporation) Hidden
Sizing Options (HKLM-x32\...\InstallShield_{DFAB6DE8-E45F-4D5D-95C0-E54C58993F9F}) (Version: 2.0.1412.1501 - Application)
Sizing Options (x32 Version: 2.0.1412.1501 - Application) Hidden
Skype™ 7.6 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.6.105 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
SUPER CHARGER (HKLM-x32\...\{7CDF10DD-A9B5-4DA3-AB95-E193248D4369}_is1) (Version: 1.2.024 - MSI)
Telstra Mobile Broadband Manager (HKLM-x32\...\Telstra Mobile Broadband Manager) (Version: 3.0.514 - Telstra)
Telstra Mobile Broadband Manager (x32 Version: 3.0.514 - Telstra) Hidden
Trader Workstation 4.0 (HKLM-x32\...\Trader Workstation 4.0) (Version: - )
Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 2.2.0 - Tweaking.com)
TWS API (HKLM-x32\...\{AF3F53E2-2766-45B4-9F2F-AA8A51AD5C85}) (Version: 9.72.03 - IBG LLC)
Windows Driver Package - Cmotech (cmusbnet) Net (06/11/2007 2.0.0.9) (HKLM\...\51208688C66699298C32E38B6BFF92816EE798CA) (Version: 06/11/2007 2.0.0.9 - Cmotech)
Windows Driver Package - Cmotech Modem (06/08/2007 2.0.3.9) (HKLM\...\7404D4336C2B621F88A2B25CE6577572A8BBD25A) (Version: 06/08/2007 2.0.3.9 - Cmotech)
Windows Driver Package - Cmotech Ports (06/08/2007 2.0.3.9) (HKLM\...\2021A90B4F2D70AB98CFBF428E09767703FD455E) (Version: 06/08/2007 2.0.3.9 - Cmotech)
WinZip 17.5 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240DD}) (Version: 17.5.10562 - WinZip Computing, S.L. )
ZTE USB Driver (HKLM\...\ZTE USB Driver) (Version: 1.0.1.16+ - ZTE Corporation)


==================== Custom CLSID (Whitelisted): ==========================


(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


CustomCLSID: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-2823309964-2513555705-3651140861-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Hugh\AppData\Local\Microsoft\OneDrive\17.3.5907.0716\amd64\FileSyncApi64.dll (Microsoft Corporation)


==================== Restore Points =========================


14-07-2015 08:07:25 Removed Norton Online Backup
21-07-2015 10:59:03 Windows Update
22-07-2015 17:20:46 JRT Pre-Junkware Removal
23-07-2015 18:24:42 JRT Pre-Junkware Removal
27-07-2015 18:54:35 Restore Point Created by FRST
28-07-2015 09:03:42 WLSetup


==================== Hosts content: ===============================


(If needed Hosts: directive could be included in the fixlist to reset Hosts.)


2013-08-22 23:25 - 2015-07-27 18:54 - 00000035 ____A C:\Windows\system32\Drivers\etc\hosts


==================== Scheduled Tasks (Whitelisted) =============


(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


Task: {0B8D66F8-C18F-4C06-A1DE-46C1CEC81B8B} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-07-03] (Microsoft Corporation)
Task: {0BE1DFE1-62AA-4F2F-B982-B96D91006FC7} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {4D53FB81-2EE9-4344-B1CA-10116BFA0FAC} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-01] (Microsoft Corporation)
Task: {5619C3C6-4E00-49A0-9DA1-8E201B3B9D51} - System32\Tasks\MSI_Dragon Gaming Center => C:\Program Files (x86)\MSI\Dragon Gaming Center\mDispatch.exe [2014-01-24] (TODO: <公司名稱>)
Task: {68F9B4FD-F709-4B87-8D5C-38F825D63DC5} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-06-09] (Microsoft Corporation)
Task: {6E7E4E9F-8D07-4885-901A-A97D0F9BDB5A} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-08] (Intel Corporation)
Task: {783F8E13-DD52-4936-8A7D-A91CA4F51052} - System32\Tasks\NahimicMSIsvc32Run => C:\Program Files\Nahimic\NahimicMSI\UserInterface\NahimicMSIsvc32.exe [2015-01-17] ()
Task: {7A468A53-C4AC-4A64-90ED-6952EEF05F3F} - System32\Tasks\NahimicMSIsvc64Run => C:\Program Files\Nahimic\NahimicMSI\UserInterface\x64\NahimicMSIsvc64.exe [2015-01-17] ()
Task: {86ED10AE-8A7F-41C6-B4A2-1B437337651D} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {A3C097C9-2D25-44E2-82A5-ED4D815E9BDC} - System32\Tasks\Microsoft Office 15 Sync Maintenance for HUGH_LAPTOP-Hugh Hugh_Laptop => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-06-02] (Microsoft Corporation)
Task: {AD396995-5451-47DC-9242-0FEE5430D802} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-2823309964-2513555705-3651140861-1001 => %localappdata%\Microsoft\OneDrive\OneDrive.exe
Task: {B5AB7F8D-6F2E-4527-AAD5-CF1239851899} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-07] (Google Inc.)
Task: {BE35EB41-0163-479E-BCDF-C4D8167F4473} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-01] (Microsoft Corporation)
Task: {CBAAE99B-E34F-47E6-949D-20D5EF5B6EBE} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {D1FA0D76-962C-426A-8091-5E9C55A6320C} - System32\Tasks\NahimicMSIUILauncherRun => C:\Program Files\Nahimic\NahimicMSI\UserInterface\NahimicMSIUILauncher.exe [2015-01-17] ()
Task: {F51F4499-139A-4ABA-B336-4DA5FF0B93C4} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-07] (Google Inc.)
Task: {F61A8720-B7BB-423A-87F0-B0857571A774} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-08] (Intel Corporation)


(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe


==================== Loaded Modules (Whitelisted) ==============


2015-01-23 15:14 - 2014-12-24 20:38 - 00115912 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-07-27 09:46 - 2013-10-23 15:24 - 00087600 _____ () C:\Windows\System32\cpwmon64.dll
2015-06-22 05:24 - 2015-06-22 05:24 - 00022528 _____ () C:\Windows\System32\us005lm.dll
2015-06-07 19:09 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-06-08 17:34 - 2015-06-08 17:34 - 08898720 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2014-01-23 04:44 - 2014-01-23 04:44 - 00075912 _____ () C:\Program Files (x86)\MSI\Dragon Gaming Center\WinIo64.dll
2013-05-24 03:15 - 2013-05-24 03:15 - 00025600 _____ () C:\Program Files (x86)\MSI\Dragon Gaming Center\CoreAudioApi.dll
2014-08-19 05:40 - 2014-08-19 05:40 - 00330240 _____ () C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe
2013-05-10 11:58 - 2013-05-10 11:58 - 00119808 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\updateui.exe
2015-07-06 08:28 - 2015-07-06 08:28 - 00183296 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\ErrorReporting.dll
2015-07-13 20:39 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-07-13 20:39 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-07-13 20:39 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-07-13 20:39 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-07-13 20:39 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2015-07-27 18:56 - 2015-07-27 18:56 - 00098816 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32api.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00110080 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\pywintypes27.dll
2015-07-27 18:56 - 2015-07-27 18:56 - 00364544 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\pythoncom27.dll
2015-07-27 18:56 - 2015-07-27 18:56 - 00045568 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\_socket.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 01161216 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\_ssl.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00320512 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32com.shell.shell.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00713216 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\_hashlib.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 01175040 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\wx._core_.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00805888 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\wx._gdi_.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00811008 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\wx._windows_.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 01062400 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\wx._controls_.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00735232 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\wx._misc_.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00682496 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\pysqlite2._sqlite.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00087552 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\_ctypes.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00119808 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32file.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00108544 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32security.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00007168 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\hashobjs_ext.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00068096 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\usb_ext.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00167936 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32gui.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00018432 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32event.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00128512 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\_elementtree.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00127488 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\pyexpat.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00013824 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\common.time34.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00036864 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\_psutil_windows.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00038912 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32inet.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00011264 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32crypt.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00070656 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\wx._html2.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00027136 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\_multiprocessing.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00020480 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\_yappi.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00035840 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32process.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00686080 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\unicodedata.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00122368 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\wx._wizard.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00024064 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32pipe.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00010240 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\select.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00025600 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32pdh.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00525640 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\windows._lib_cacheinvalidation.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00017408 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32profile.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00022528 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\win32ts.pyd
2015-07-27 18:56 - 2015-07-27 18:56 - 00078336 _____ () C:\Users\Hugh\AppData\Local\Temp\_MEI77682\wx._animate.pyd
2015-01-23 15:11 - 2013-09-17 06:17 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2010-12-18 06:56 - 2010-12-18 06:56 - 02603520 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\QtCore4.dll
2013-03-08 06:53 - 2013-03-08 06:53 - 00015872 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\featureController.dll
2010-12-18 06:56 - 2010-12-18 06:56 - 01006592 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\QtNetwork4.dll
2010-12-18 06:56 - 2010-12-18 06:56 - 00382464 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\QtXml4.dll
2010-01-13 10:55 - 2010-01-13 10:55 - 00400384 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\sqlite3.dll
2010-01-13 10:55 - 2010-01-13 10:55 - 00322048 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\log4cplus.dll
2010-12-17 06:16 - 2010-12-17 06:16 - 00195584 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\libgsoap.dll
2010-01-18 17:34 - 2010-01-18 17:34 - 00062464 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\zlib1.dll
2013-03-08 06:55 - 2013-03-08 06:55 - 00472576 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\DeviceProfile.dll
2013-03-08 06:58 - 2013-03-08 06:58 - 00499488 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\plugin\PServerPlugin.dll
2013-03-08 06:54 - 2013-03-08 06:54 - 00013824 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\eventsSender.dll
2010-12-18 06:56 - 2010-12-18 06:56 - 14978048 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\QtWebKit4.dll
2010-12-18 06:56 - 2010-12-18 06:56 - 09224704 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\QtGui4.dll
2010-12-18 06:56 - 2010-12-18 06:56 - 00317952 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\phonon4.dll
2015-07-27 08:48 - 2015-07-24 08:39 - 01405768 _____ () C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.107\libglesv2.dll
2015-07-27 08:48 - 2015-07-24 08:39 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.107\libegl.dll


==================== Alternate Data Streams (Whitelisted) =========


(If an entry is included in the fixlist, only the ADS will be removed.)


AlternateDataStreams: C:\Users\Hugh\OneDrive:ms-properties


==================== Safe Mode (Whitelisted) ===================


(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)




==================== EXE Association (Whitelisted) ===============


(If an entry is included in the fixlist, the registry item will be restored to default or removed.)




==================== Internet Explorer trusted/restricted ===============


(If an entry is included in the fixlist, it will be removed from the registry.)


IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com


There are 7866 more restricted sites.


==================== Other Areas ============================


(Currently there is no automatic fix for this section.)


HKU\S-1-5-21-2823309964-2513555705-3651140861-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\System32\oobe\info\Wallpaper\backgroundDefault.jpg
DNS Servers: 10.0.0.138
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.


==================== MSCONFIG/TASK MANAGER disabled items ==


(Currently there is no automatic fix for this section.)




==================== FirewallRules (Whitelisted) ===============


(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{2D3AC92D-79CE-48F3-B94E-986B1DFA255D}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{6BF214AB-A286-4902-8A28-31EB04D7BF61}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{A716ED6C-4C75-42C2-9D3E-58027E049AE7}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{21288DD7-E4D4-4BF2-90BF-AB99B749D116}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{1972B00C-10E4-4AA2-8590-2765619747F0}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{CDC47814-1B28-4EC9-886F-668D7399C0F7}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{F20C674D-D846-4DDC-BC35-5A1A803A26AF}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{A9055384-AE0A-48C4-805D-B9F9D2DEE085}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{C6744919-EAC7-417A-B4D7-28F0A859701A}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{B6B6CA70-94FD-41DF-97BC-BF8A4F0B5A8D}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{7A705F37-593F-4CE8-8A69-8DFDEFED882A}] => (Allow) C:\Users\Hugh\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [TCP Query User{E08765E9-A930-48B9-B7E6-D05B4685593B}C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe
FirewallRules: [UDP Query User{62C52245-8937-43AA-878D-D9D83BCC5BEE}C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_45\bin\javaw.exe
FirewallRules: [TCP Query User{06E9B8AC-47BD-4110-9090-423D07B682E7}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{0BBAB1B7-5F6B-432A-8195-FC5449330FBB}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{0610B524-831C-409A-AAE8-C7CA9EB537A9}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{C267FC24-0437-4945-AC60-DC8D8C16213B}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{2E70FEAA-283E-47EE-832F-6621B0FD33E6}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service


==================== Faulty Device Manager Devices =============




==================== Event log errors: =========================


Application errors:
==================
Error: (07/28/2015 05:52:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: KillerService.exe, version: 1.1.46.1056, time stamp: 0x53f22c94
Faulting module name: KillerService.exe, version: 1.1.46.1056, time stamp: 0x53f22c94
Exception code: 0xc0000005
Fault offset: 0x00000000000160c9
Faulting process id: 0x8c8
Faulting application start time: 0xKillerService.exe0
Faulting application path: KillerService.exe1
Faulting module path: KillerService.exe2
Report Id: KillerService.exe3
Faulting package full name: KillerService.exe4
Faulting package-relative application ID: KillerService.exe5


Error: (07/27/2015 10:01:20 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT AUTHORITY)
Description: There was an error with the Windows Location Provider database


Error: (07/27/2015 06:56:34 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8


Error: (07/27/2015 06:55:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: SDOnAccess.exe, version: 2.4.40.11, time stamp: 0x535a5123
Faulting module name: KERNELBASE.dll, version: 6.3.9600.17415, time stamp: 0x54504ade
Exception code: 0x0eedfade
Fault offset: 0x00014598
Faulting process id: 0x39b84
Faulting application start time: 0xSDOnAccess.exe0
Faulting application path: SDOnAccess.exe1
Faulting module path: SDOnAccess.exe2
Report Id: SDOnAccess.exe3
Faulting package full name: SDOnAccess.exe4
Faulting package-relative application ID: SDOnAccess.exe5


Error: (07/27/2015 06:54:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: SDOnAccess.exe, version: 2.4.40.11, time stamp: 0x535a5123
Faulting module name: KERNELBASE.dll, version: 6.3.9600.17415, time stamp: 0x54504ade
Exception code: 0x0eedfade
Fault offset: 0x00014598
Faulting process id: 0x25d40
Faulting application start time: 0xSDOnAccess.exe0
Faulting application path: SDOnAccess.exe1
Faulting module path: SDOnAccess.exe2
Report Id: SDOnAccess.exe3
Faulting package full name: SDOnAccess.exe4
Faulting package-relative application ID: SDOnAccess.exe5


Error: (07/27/2015 06:54:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: SDOnAccess.exe, version: 2.4.40.11, time stamp: 0x535a5123
Faulting module name: KERNELBASE.dll, version: 6.3.9600.17415, time stamp: 0x54504ade
Exception code: 0x0eedfade
Fault offset: 0x00014598
Faulting process id: 0x2bc78
Faulting application start time: 0xSDOnAccess.exe0
Faulting application path: SDOnAccess.exe1
Faulting module path: SDOnAccess.exe2
Report Id: SDOnAccess.exe3
Faulting package full name: SDOnAccess.exe4
Faulting package-relative application ID: SDOnAccess.exe5


Error: (07/27/2015 06:54:27 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.




Operation:
Gathering Writer Data


Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {9ee319ee-9c7c-47a7-8379-b08516b9c2f7}


Error: (07/27/2015 06:54:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: SDOnAccess.exe, version: 2.4.40.11, time stamp: 0x535a5123
Faulting module name: KERNELBASE.dll, version: 6.3.9600.17415, time stamp: 0x54504ade
Exception code: 0x0eedfade
Fault offset: 0x00014598
Faulting process id: 0x3c4c8
Faulting application start time: 0xSDOnAccess.exe0
Faulting application path: SDOnAccess.exe1
Faulting module path: SDOnAccess.exe2
Report Id: SDOnAccess.exe3
Faulting package full name: SDOnAccess.exe4
Faulting package-relative application ID: SDOnAccess.exe5


Error: (07/27/2015 09:46:08 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_a9edf09f013934e0.manifest.


Error: (07/27/2015 08:47:43 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: EXCEL.EXE, version: 15.0.4737.1000, time stamp: 0x55801e38
Faulting module name: EXCEL.EXE, version: 15.0.4737.1000, time stamp: 0x55801e38
Exception code: 0xc0000005
Fault offset: 0x000075e9
Faulting process id: 0x8818
Faulting application start time: 0xEXCEL.EXE0
Faulting application path: EXCEL.EXE1
Faulting module path: EXCEL.EXE2
Report Id: EXCEL.EXE3
Faulting package full name: EXCEL.EXE4
Faulting package-relative application ID: EXCEL.EXE5




System errors:
=============
Error: (07/28/2015 05:52:12 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Qualcomm Atheros Killer Service V2 service terminated unexpectedly. It has done this 1 time(s).


Error: (07/27/2015 06:55:24 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Spybot-S&D 2 Security Center Service service depends on the Security Center service which failed to start because of the following error:
%%1068


Error: (07/27/2015 06:55:24 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Security Center service depends on the Windows Management Instrumentation service which failed to start because of the following error:
%%1115


Error: (07/27/2015 06:55:24 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Spybot-S&D 2 Updating Service service failed to start due to the following error:
%%1053


Error: (07/27/2015 06:55:24 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Spybot-S&D 2 Updating Service service to connect.


Error: (07/27/2015 06:55:24 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Spybot-S&D 2 Scanner Service service failed to start due to the following error:
%%1053


Error: (07/27/2015 06:55:24 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Spybot-S&D 2 Scanner Service service to connect.


Error: (07/27/2015 06:55:21 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.


Module Path: C:\Windows\System32\IWMSSvc.dll


Error: (07/27/2015 06:55:21 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.


Module Path: C:\Windows\System32\IWMSSvc.dll


Error: (07/27/2015 06:55:20 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.


Module Path: C:\Windows\System32\IWMSSvc.dll




Microsoft Office:
=========================
Error: (07/28/2015 05:52:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: KillerService.exe1.1.46.105653f22c94KillerService.exe1.1.46.105653f22c94c000000500000000000160c98c801d0c84a0740003aC:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exeC:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe8c31cd59-34fd-11e5-827f-d8cb8a7e33a7


Error: (07/27/2015 10:01:20 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT AUTHORITY)
Description: -2147024883


Error: (07/27/2015 06:56:34 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8


Error: (07/27/2015 06:55:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: SDOnAccess.exe2.4.40.11535a5123KERNELBASE.dll6.3.9600.1741554504ade0eedfade0001459839b8401d0c849efb96264C:\Program Files (x86)\Spybot - Search & Destroy 2\SDOnAccess.exeC:\Windows\SYSTEM32\KERNELBASE.dll2d6d154a-343d-11e5-827e-d8cb8a7e33a7


Error: (07/27/2015 06:54:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: SDOnAccess.exe2.4.40.11535a5123KERNELBASE.dll6.3.9600.1741554504ade0eedfade0001459825d4001d0c849e602fadaC:\Program Files (x86)\Spybot - Search & Destroy 2\SDOnAccess.exeC:\Windows\SYSTEM32\KERNELBASE.dll23b44b6b-343d-11e5-827e-d8cb8a7e33a7


Error: (07/27/2015 06:54:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: SDOnAccess.exe2.4.40.11535a5123KERNELBASE.dll6.3.9600.1741554504ade0eedfade000145982bc7801d0c849e5da72c3C:\Program Files (x86)\Spybot - Search & Destroy 2\SDOnAccess.exeC:\Windows\SYSTEM32\KERNELBASE.dll238bc3e7-343d-11e5-827e-d8cb8a7e33a7


Error: (07/27/2015 06:54:27 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Access is denied.




Operation:
Gathering Writer Data


Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {9ee319ee-9c7c-47a7-8379-b08516b9c2f7}


Error: (07/27/2015 06:54:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: SDOnAccess.exe2.4.40.11535a5123KERNELBASE.dll6.3.9600.1741554504ade0eedfade000145983c4c801d0c849d59a4e29C:\Program Files (x86)\Spybot - Search & Destroy 2\SDOnAccess.exeC:\Windows\SYSTEM32\KERNELBASE.dll138e611b-343d-11e5-827e-d8cb8a7e33a7


Error: (07/27/2015 09:46:08 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_a9edf09f013934e0.manifestC:\Users\Hugh\AppData\Local\Temp\is-33AG9.tmp\Offercast3410_ARS_.exe


Error: (07/27/2015 08:47:43 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: EXCEL.EXE15.0.4737.100055801e38EXCEL.EXE15.0.4737.100055801e38c0000005000075e9881801d0c7f4fde3a7d5C:\Program Files\Microsoft Office 15\root\office15\EXCEL.EXEC:\Program Files\Microsoft Office 15\root\office15\EXCEL.EXE5319cf14-33e8-11e5-827e-d8cb8a7e33a7




CodeIntegrity Error:
===================================
Date: 2015-07-28 19:42:52.577
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.


Date: 2015-07-28 17:52:07.221
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.


Date: 2015-07-28 15:50:47.907
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.


Date: 2015-07-28 14:44:46.900
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.


Date: 2015-07-28 14:27:09.132
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.


Date: 2015-07-28 13:55:14.254
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.


Date: 2015-07-28 13:26:42.554
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.


Date: 2015-07-28 13:01:21.507
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.


Date: 2015-07-28 10:55:56.930
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.


Date: 2015-07-28 10:46:54.870
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.




==================== Memory info ===========================


Processor: Intel(R) Core(TM) i7-4720HQ CPU @ 2.60GHz
Percentage of memory in use: 49%
Total physical RAM: 8109.81 MB
Available physical RAM: 4082 MB
Total Virtual: 16301.81 MB
Available Virtual: 11367.88 MB


==================== Drives ================================


Drive c: (OS_Install) (Fixed) (Total:118.24 GB) (Free:58.23 GB) NTFS
Drive d: (DATA) (Fixed) (Total:915.12 GB) (Free:888.03 GB) NTFS


==================== MBR & Partition Table ==================


========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 4E9EEB76)


Partition: GPT Partition Type.


========================================================
Disk: 1 (Size: 119.2 GB) (Disk ID: 4E9EEB6B)


Partition: GPT Partition Type.


==================== End of log ============================
 

Attachments

Last edited by a moderator:
So far I haven't had a problem. Thanks again for the help, I appreciate your time and effort. Hopefully its gone for good.


:cool:
 
Great, I'll leave this thread open for a couple of days for you in case it comes back, after that if you still need help just start a new topic

Ken :)
 
Morning,

Lets try a few things

Download Avast-browser-cleanup to your desktop



  • There is nothing to install, just right click on it and Run As Adminstrator
  • When its finished scanning it will list Browser Add ONs
  • If if finds Total Ad Performance or any other bogus toolbars
  • Just high light them and select REMOVE
  • Close out the program
  • Reboot your system and test your browsers



=============================================



  • Open Internet Explorer
  • Click on Tools up on the top right
  • Click on Manage Add Ons from the dropdown list
  • In this window you can manage the Internet Explorer add-ons
  • Click on Search Providers
  • Click on the option Toolbars and Extensions on left side of the window.
  • Then click on the malicious items to remove Total Ad Performance
  • Make Google you default
  • Close IE and then open it again and see if Total Ad Performance are gone





==============================================



  • Open Chrome
  • Click the Chrome menu
    Clipboard01_zps2e55f676.jpg
    on the browser toolbar.
  • Click on Settings
  • Then Manage Search Engines
  • Highlite Total Ad Performance and select Delete
  • Then go to Other Search Engines and remove all you dont want






=========================================================





  • Open Firefox
  • Up on the Top Right in the Search Box , click on the down arrow and select Manage Search Engines
  • Highlite Total Ad Performance and select Delete






If all of the above doesn't fix it, then lets try setting all your browsers back to defaults




  • Open IE
  • Go to Tools> Internet Options > Advanced Tab
  • Reset Internet Explorer Setting
  • Reset
  • This will take a few seconds
  • Close IE and then reopen it and see if it helped








  • Click the Chrome menu
    Clipboard01_zps2e55f676.jpg
    on the browser toolbar.
  • Select Settings.
  • Scroll down to Show advanced settings...
  • Down on the bottom you will see an option for RESET BROWSER SETTINGS
  • Click on it and it will set Chome back to defaults








  • Open Firefox
  • Click on Help > Troubleshooting Information > Reset Firefox to its default state
 
:bigthumb:

Again I will leave this thread open for about 3 days for you, lets hope this pest is gone
 
Morning

Lets try something else, you will need to run the 64 bit version of this program.



Download and Run SystemLook


Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
64 Bit Version



  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    Code: 
    :folderfind
Total Ad Performance
:filefind
Total Ad Performance
:regfind
Total Ad Performance
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
 
If SystemLook does not find it than it maybe spelled wrong, run it again with this

TotalAdPerformance
 
Status
Not open for further replies.
Back
Top