New advertising malware?

jhrowehl · Mar 4, 2015

Here's the first group of files. There are a total of 19.

jhrowehl · Mar 4, 2015

Second group...

jhrowehl · Mar 4, 2015

Third group...

jhrowehl · Mar 4, 2015

Fourth group...

Juliet · Mar 4, 2015

The only thng that was found as suspicious was RWAR3Monitor.exe (RoadWarrior 3 Monitor This file is not digitally signed.) and that was because it has an unsigned driver.
Rootkit scans we have run have not found anything.

Please download MBRCheck.exe to your Desktop. Run the application.

If no infection is found, it will produce a report on the desktop. Post that report in your next reply.

If an infection is found, you will be presented with the following dialog:

Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Type N and press Enter. A report will be produced on the desktop. Post that report in your next reply.

jhrowehl · Mar 4, 2015

Here's the MBRCheck log:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Professional
Windows Information: Service Pack 1 (build 7601), 64-bit
Base Board Manufacturer: Dell Inc.
BIOS Manufacturer: Dell Inc.
System Manufacturer: Dell Inc.
System Product Name: Precision M2800
Logical Drives Mask: 0x0100000c

Kernel Drivers (total 210):
0x03256000 \SystemRoot\system32\ntoskrnl.exe
0x0320D000 \SystemRoot\system32\hal.dll
0x00B97000 \SystemRoot\system32\kdcom.dll
0x00C6D000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x00CBC000 \SystemRoot\system32\PSHED.dll
0x00CD0000 \SystemRoot\system32\CLFS.SYS
0x00D2E000 \SystemRoot\system32\CI.dll
0x00E51000 \SystemRoot\system32\drivers\Wdf01000.sys
0x00F13000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x00F23000 \SystemRoot\system32\drivers\ACPI.sys
0x00F7A000 \SystemRoot\system32\drivers\WMILIB.SYS
0x00F83000 \SystemRoot\system32\drivers\msisadrv.sys
0x00F8D000 \SystemRoot\system32\drivers\pci.sys
0x00FC0000 \SystemRoot\system32\drivers\vdrvroot.sys
0x00FCD000 \SystemRoot\system32\DRIVERS\iusb3hcs.sys
0x00FD7000 \SystemRoot\System32\drivers\partmgr.sys
0x00FEC000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x00E00000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x00E0C000 \SystemRoot\system32\drivers\volmgr.sys
0x00C00000 \SystemRoot\System32\drivers\volmgrx.sys
0x00E21000 \SystemRoot\System32\drivers\mountmgr.sys
0x0100A000 \SystemRoot\system32\drivers\iaStorA.sys
0x012D3000 \SystemRoot\system32\drivers\storport.sys
0x01337000 \SystemRoot\system32\drivers\amdxata.sys
0x01342000 \SystemRoot\system32\drivers\fltmgr.sys
0x0138E000 \SystemRoot\system32\drivers\fileinfo.sys
0x013A2000 \SystemRoot\System32\Drivers\DLACDBHE.SYS
0x013A5000 \SystemRoot\System32\Drivers\DRVECDB.SYS
0x013C2000 \SystemRoot\System32\Drivers\PxHlpa64.sys
0x0144B000 \SystemRoot\System32\Drivers\Ntfs.sys
0x016AD000 \SystemRoot\System32\Drivers\msrpc.sys
0x0170B000 \SystemRoot\System32\Drivers\ksecdd.sys
0x01726000 \SystemRoot\System32\Drivers\cng.sys
0x01798000 \SystemRoot\System32\drivers\pcw.sys
0x017A9000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x0188D000 \SystemRoot\system32\drivers\ndis.sys
0x0197F000 \SystemRoot\system32\drivers\NETIO.SYS
0x01800000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x01A01000 \SystemRoot\System32\drivers\tcpip.sys
0x0182C000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x017B3000 \SystemRoot\system32\drivers\volsnap.sys
0x01875000 \SystemRoot\system32\DRIVERS\stdcfltn.sys
0x0187E000 \SystemRoot\System32\Drivers\spldr.sys
0x01600000 \SystemRoot\System32\drivers\rdyboost.sys
0x019DF000 \SystemRoot\system32\DRIVERS\SEDFilter.sys
0x0163A000 \SystemRoot\System32\Drivers\mup.sys
0x019F5000 \SystemRoot\system32\drivers\iaStorF.sys
0x0164C000 \SystemRoot\System32\drivers\hwpolicy.sys
0x01655000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x0168F000 \SystemRoot\system32\drivers\disk.sys
0x01400000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x01430000 \SystemRoot\system32\DRIVERS\CredFltL.sys
0x0143C000 \SystemRoot\system32\DRIVERS\avgrkx64.sys
0x01C39000 \SystemRoot\system32\DRIVERS\avgloga.sys
0x01C88000 \SystemRoot\system32\DRIVERS\avgmfx64.sys
0x01CAA000 \SystemRoot\system32\DRIVERS\avgidsha.sys
0x01CDE000 \SystemRoot\system32\DRIVERS\amdkmpfd.sys
0x04754000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x0477E000 \SystemRoot\System32\Drivers\Null.SYS
0x04787000 \SystemRoot\System32\Drivers\Beep.SYS
0x0478E000 \SystemRoot\System32\Drivers\DLARTL_E.SYS
0x04797000 \SystemRoot\System32\drivers\vga.sys
0x047A5000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x047CA000 \SystemRoot\System32\drivers\watchdog.sys
0x047DA000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x047E3000 \SystemRoot\system32\drivers\rdpencdd.sys
0x047EC000 \SystemRoot\system32\drivers\rdprefmp.sys
0x047F5000 \SystemRoot\System32\Drivers\Msfs.SYS
0x04400000 \SystemRoot\System32\Drivers\Npfs.SYS
0x04411000 \SystemRoot\system32\DRIVERS\tdx.sys
0x04433000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x01D03000 \SystemRoot\system32\DRIVERS\avgtdia.sys
0x01D49000 \SystemRoot\System32\DRIVERS\netbt.sys
0x04828000 \SystemRoot\system32\drivers\afd.sys
0x048B1000 \SystemRoot\system32\drivers\ws2ifsl.sys
0x048BC000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x048C5000 \SystemRoot\system32\DRIVERS\pacer.sys
0x048EB000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x04901000 \SystemRoot\system32\DRIVERS\netbios.sys
0x04910000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x0492B000 \SystemRoot\system32\DRIVERS\termdd.sys
0x0493F000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x04990000 \SystemRoot\system32\drivers\nsiproxy.sys
0x0499C000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x049A7000 \SystemRoot\System32\Drivers\ElbyCDIO.sys
0x049B3000 \SystemRoot\System32\drivers\discache.sys
0x04C4B000 \SystemRoot\system32\drivers\csc.sys
0x04CCE000 \SystemRoot\System32\Drivers\dfsc.sys
0x04CEC000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x04CFD000 \SystemRoot\system32\DRIVERS\avgldx64.sys
0x04D3D000 \SystemRoot\system32\DRIVERS\avgidsdrivera.sys
0x04D84000 \SystemRoot\system32\DRIVERS\avgdiska.sys
0x04DAD000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x04EED000 \SystemRoot\system32\DRIVERS\atikmpag.sys
0x0508C000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x05181000 \SystemRoot\System32\drivers\dxgmms1.sys
0x0F444000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x05400000 \SystemRoot\system32\DRIVERS\igdkmd64.sys
0x057B8000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x04E00000 \SystemRoot\system32\DRIVERS\iusb3xhc.sys
0x057DC000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x057DE000 \SystemRoot\system32\DRIVERS\TeeDriverx64.sys
0x05000000 \SystemRoot\system32\DRIVERS\e1d62x64.sys
0x101E7000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x04F8D000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x05DC0000 \SystemRoot\system32\DRIVERS\O2FJ2w7x64.sys
0x05A00000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
0x05A2F000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x0F400000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x05E9A000 \SystemRoot\system32\DRIVERS\Apfiltr.sys
0x05F2A000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x05F39000 \SystemRoot\system32\DRIVERS\parport.sys
0x05F56000 \SystemRoot\System32\Drivers\AnyDVD.sys
0x05F81000 \SystemRoot\system32\DRIVERS\ST_Accel.sys
0x05F97000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x05FAD000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x05FB6000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x05FBB000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x05E00000 \SystemRoot\system32\DRIVERS\usb3Hub.sys
0x05E37000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x05E4D000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x05E71000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x05FCB000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x05E7D000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x0F40F000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x051C7000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x05DF2000 \SystemRoot\system32\DRIVERS\rdpbus.sys
0x05E98000 \SystemRoot\system32\DRIVERS\swenum.sys
0x04C00000 \SystemRoot\system32\DRIVERS\ks.sys
0x0F430000 \SystemRoot\system32\drivers\POADrvr.sys
0x051E1000 \SystemRoot\system32\drivers\DellProf.sys
0x0F43A000 \SystemRoot\system32\drivers\DDDriver64Dcsa.sys
0x051EC000 \SystemRoot\system32\DRIVERS\iwdbus.sys
0x0507A000 \SystemRoot\system32\DRIVERS\TGBMPEnum.sys
0x04FE4000 \SystemRoot\system32\DRIVERS\umbus.sys
0x01D8E000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x04EC5000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x07957000 \SystemRoot\system32\DRIVERS\portcls.sys
0x07994000 \SystemRoot\system32\DRIVERS\drmk.sys
0x079B6000 \SystemRoot\system32\drivers\ksthunk.sys
0x07800000 \SystemRoot\system32\DRIVERS\iusb3hub.sys
0x07AFF000 \SystemRoot\system32\drivers\RTDVHD64.sys
0x07D32000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x07D4F000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x07D5D000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x07D76000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x07D7F000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x07D8D000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x07D9A000 \SystemRoot\System32\Drivers\usbvideo.sys
0x07DC8000 \SystemRoot\system32\DRIVERS\ibtusb.sys
0x07E49000 \SystemRoot\system32\DRIVERS\btmhsf.sys
0x07FA9000 \SystemRoot\System32\Drivers\BTHUSB.sys
0x07A00000 \SystemRoot\System32\Drivers\bthport.sys
0x07FC1000 \SystemRoot\System32\Drivers\cvusbdrv.sys
0x07FD2000 \SystemRoot\system32\DRIVERS\rfcomm.sys
0x07E00000 \SystemRoot\system32\DRIVERS\BthEnum.sys
0x07E10000 \SystemRoot\system32\DRIVERS\bthpan.sys
0x07A8C000 \SystemRoot\system32\DRIVERS\btmaux.sys
0x07E30000 \SystemRoot\System32\Drivers\crashdmp.sys
0x07E3E000 \SystemRoot\System32\Drivers\dump_diskdump.sys
0x04440000 \SystemRoot\System32\Drivers\dump_iaStorA.sys
0x07AB3000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x00040000 \SystemRoot\System32\win32k.sys
0x07AC6000 \SystemRoot\System32\drivers\Dxapi.sys
0x07AD2000 \SystemRoot\system32\DRIVERS\monitor.sys
0x00500000 \SystemRoot\System32\TSDDD.dll
0x00710000 \SystemRoot\System32\cdd.dll
0x0785F000 \SystemRoot\system32\drivers\luafv.sys
0x07AE0000 \SystemRoot\System32\Drivers\DRVEDDM.SYS
0x07E48000 \SystemRoot\System32\Drivers\DLADResE.SYS
0x07882000 \SystemRoot\System32\Drivers\DLAIFS_E.SYS
0x07AEE000 \SystemRoot\System32\Drivers\DLAOPIOE.SYS
0x07AF5000 \SystemRoot\System32\Drivers\DLAPoolE.SYS
0x078A5000 \SystemRoot\system32\drivers\WudfPf.sys
0x078BE000 \SystemRoot\System32\Drivers\DLABMFSE.SYS
0x078C8000 \SystemRoot\System32\Drivers\DLABOIOE.SYS
0x079BC000 \SystemRoot\System32\Drivers\DLAUDFAE.SYS
0x079DC000 \SystemRoot\System32\Drivers\DLAUDF_E.SYS
0x049C2000 \??\C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SboxDrv.sys
0x078D1000 \SystemRoot\system32\DRIVERS\WinUSB.sys
0x04709000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0x04EDA000 \SystemRoot\System32\DRIVERS\scfilter.sys
0x04FF6000 \SystemRoot\System32\Drivers\wbfcvusbdrv.sys
0x04DD3000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x04A01000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x04A54000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x04A67000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x04A7F000 \SystemRoot\system32\drivers\HTTP.sys
0x04B48000 \SystemRoot\system32\DRIVERS\bowser.sys
0x04B66000 \SystemRoot\System32\drivers\mpsdrv.sys
0x04B7E000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x04BAB000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x04800000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x0989F000 \SystemRoot\system32\drivers\peauth.sys
0x09945000 \SystemRoot\System32\Drivers\secdrv.SYS
0x09950000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x09981000 \??\C:\Windows\system32\Drivers\SSPORT.sys
0x09989000 \SystemRoot\System32\drivers\tcpipreg.sys
0x0999B000 \SystemRoot\SYSTEM32\DRIVERS\WibuKey64.sys
0x078EC000 \SystemRoot\System32\DRIVERS\srv2.sys
0x0A883000 \SystemRoot\System32\DRIVERS\srv.sys
0x0A91B000 \??\C:\Program Files (x86)\Invincea\Enterprise\X64\InvProtectDrv64.sys
0x0A92B000 \SystemRoot\System32\Drivers\fastfat.SYS
0x0B00A000 \SystemRoot\system32\drivers\mrxdav.sys
0x0B033000 \SystemRoot\system32\DRIVERS\Netwsw02.sys
0x0B392000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x0B39F000 \SystemRoot\system32\DRIVERS\vwifimp.sys
0x770F0000 \Windows\System32\ntdll.dll
0x47C70000 \Windows\System32\smss.exe
0xFF410000 \Windows\System32\apisetschema.dll

Processes (total 182):
0 System Idle Process
4 System
380 C:\Windows\System32\smss.exe
516 C:\PROGRA~2\AVG\AVG2015\avgrsa.exe
588 C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe
620 csrss.exe
1088 C:\Windows\System32\wininit.exe
1124 csrss.exe
1160 C:\Windows\System32\services.exe
1168 C:\Windows\System32\lsass.exe
1176 C:\Windows\System32\lsm.exe
1260 C:\Windows\System32\winlogon.exe
1320 C:\Windows\System32\svchost.exe
1428 C:\Windows\System32\svchost.exe
1500 C:\Program Files\Dell\Dell Data Protection\Security Tools\Authentication\Bin\DpHostW.exe
1556 C:\Windows\System32\atiesrxx.exe
1596 C:\Windows\System32\svchost.exe
1636 C:\Windows\System32\svchost.exe
1676 C:\Windows\System32\svchost.exe
1708 C:\Windows\System32\svchost.exe
1768 DpCardEngine.exe
1868 C:\Windows\System32\svchost.exe
1988 C:\Windows\System32\igfxCUIService.exe
2036 C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SboxSvc.exe
1704 C:\Windows\System32\atieclxx.exe
2088 C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
2148 C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
2160 C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
2216 WUDFHost.exe
2372 WUDFHost.exe
2496 C:\Windows\System32\svchost.exe
2728 C:\Windows\System32\spoolsv.exe
2772 C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
2804 C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
2896 C:\Windows\System32\svchost.exe
2996 C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
3024 C:\Program Files\DellTPad\HidMonitorSvc.exe
3044 C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe
3068 C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
2260 C:\Program Files (x86)\Bonjour\mDNSResponder.exe
2452 C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.Loader.exe
3152 C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\Emc.Captiva.WebCaptureService.exe
3316 C:\Program Files\Intel\WiFi\bin\EvtEng.exe
3432 C:\Windows\System32\svchost.exe
3516 C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
3716 C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
3732 C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
3708 C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe
3172 C:\Windows\System32\IPROSetMonitor.exe
2316 C:\Program Files (x86)\Invincea\Enterprise\X64\InvProtectSvc64.exe
3988 C:\Program Files (x86)\Common Files\microsoft shared\VS7Debug\mdm.exe
2364 C:\Program Files (x86)\NetSetMan\nsmservice.exe
2356 C:\Program Files (x86)\Visioneer\OneTouch 4.0\OtService.exe
4104 C:\Program Files (x86)\Nuance\PDF Professional 7\PDFProFiltSrv.exe
4140 C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
4188 C:\Program Files\Dell\PPO\poaService.exe
4216 C:\Program Files\Dell\PPO\poaSmSrv.exe
4248 C:\Program Files\Dell\PPO\poaTaServ.exe
4272 C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
4296 C:\Program Files\Visioneer\RWAR3\RWAR3HV_0002_0.EXE
4348 C:\Program Files\Visioneer\RWAR3\RWAR3Monitor.exe
4404 C:\Windows\System32\svchost.exe
4460 C:\Windows\SysWOW64\TgbStarter.exe
4508 C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe
4564 C:\Program Files (x86)\Windows Network Accelerater\v3\winvxm.exe
4660 C:\Windows\System32\SearchIndexer.exe
4768 unsecapp.exe
4808 C:\Program Files (x86)\YouTube-Downloader\A4\youtubeserv.exe
4816 WmiPrvSE.exe
4852 unsecapp.exe
5000 C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
5048 C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.exe
5124 WmiPrvSE.exe
5296 C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.MgmtServer.exe
5444 C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe
6000 C:\Windows\System32\svchost.exe
6632 C:\Windows\System32\taskhost.exe
6640 C:\Program Files\DellTPad\Apoint.exe
6776 C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
6816 C:\Windows\System32\dwm.exe
6932 C:\Windows\explorer.exe
7028 C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\Emc.Captiva.WebToolkitHost.exe
4936 C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe
6216 C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe
4740 C:\Windows\System32\igfxHK.exe
6444 C:\Windows\System32\igfxTray.exe
6460 C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
6492 C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
6408 C:\Program Files\Realtek\Audio\HDA\WavesSvc64.exe
6524 C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
6352 C:\Program Files\Dell\PPO\DellPoaEvents.exe
6684 C:\Windows\System32\rundll32.exe
7132 C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
6112 C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.SystrayApp.exe
6184 C:\Program Files (x86)\Invincea\Enterprise\X64\InvProtect64.exe
6656 C:\Windows\System32\rundll32.exe
6356 C:\Program Files\BOINC\boinctray.exe
7188 C:\Program Files\BOINC\boincmgr.exe
7252 C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
7316 C:\Program Files\Windows Sidebar\sidebar.exe
7456 C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe
7476 C:\Program Files (x86)\WIBUKEY\Server\WkSvMgr.exe
7512 C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
7544 C:\Program Files (x86)\OpenOffice 4\program\soffice.bin
7660 C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
7704 C:\Windows\System32\igfxEM.exe
7756 C:\Program Files\DellTPad\ApMsgFwd.exe
7860 C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe
7936 C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe
8020 C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe
8140 C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
7184 C:\Program Files (x86)\Nuance\PDF Professional 7\PdfPro7Hook.exe
7304 C:\Program Files (x86)\AVG\AVG2015\avgui.exe
7328 C:\Program Files\DellTPad\hidfind.exe
7344 C:\Program Files\DellTPad\ApntEx.exe
7392 C:\Windows\System32\conhost.exe
7496 C:\Program Files (x86)\Canon Electronics\P215II\TouchDR.exe
3240 C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
7748 C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
7592 C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
7812 C:\Windows\System32\wbem\unsecapp.exe
7784 C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
7712 C:\Program Files (x86)\NetSetMan\netsetman.exe
7600 C:\Windows\SysWOW64\ctfmon.exe
8572 C:\Program Files\BOINC\boinc.exe
8584 C:\Windows\System32\conhost.exe
8928 C:\Program Files (x86)\SlySoft\AnyDVD\ADvdDiscHlp64.exe
8940 C:\Windows\System32\conhost.exe
9016 C:\Program Files\Windows Media Player\wmpnetwk.exe
9212 C:\Windows\System32\svchost.exe
9700 C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SboxSvc.exe
9748 C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SandboxRpcSs.exe
9848 C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SandboxDcomLaunch.exe
10164 C:\ProgramData\Invincea\Enterprise\Bin\x64\InvProtectAgent64.exe
236 C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
10532 C:\Program Files\Dell\Dell Foundation Services\DFSSvc.exe
10648 C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
10900 C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
10980 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
11136 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
4728 C:\Windows\System32\drivers\o2flash.exe
8060 C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe
9000 C:\Windows\System32\wuauclt.exe
6376 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
6380 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
9380 C:\Program Files (x86)\Dell Backup and Recovery\Components\DBRUpdate\DBRUpd.exe
7776 C:\Program Files (x86)\Dell Backup and Recovery\Toaster.exe
6472 WmiPrvSE.exe
6252 C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBRCrawler.exe
5256 C:\Windows\System32\conhost.exe
10896 C:\Windows\System32\taskmgr.exe
9880 C:\Windows\System32\wlanext.exe
10288 C:\Windows\System32\conhost.exe
19260 C:\Windows\splwow64.exe
19672 C:\Program Files (x86)\Mozilla Firefox\firefox.exe
18964 C:\Windows\System32\audiodg.exe
20284 C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
20472 C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
20744 C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
27832 C:\ProgramData\BOINC\projects\asteroidsathome.net_boinc\period_search_10210_windows_x86_64__sse2.exe
27072 C:\ProgramData\BOINC\projects\asteroidsathome.net_boinc\period_search_10210_windows_x86_64__sse2.exe
28096 C:\ProgramData\BOINC\projects\www.enigmaathome.net\wrapper_5.32_windows_intelx86.exe
28608 C:\ProgramData\BOINC\projects\www.enigmaathome.net\wrapper_5.32_windows_intelx86.exe
26816 C:\ProgramData\BOINC\projects\milkyway.cs.rpi.edu_milkyway\milkyway_separation__modified_fit_1.36_windows_x86_64.exe
28020 C:\ProgramData\BOINC\projects\asteroidsathome.net_boinc\period_search_10210_windows_x86_64__sse2.exe
27744 C:\ProgramData\BOINC\projects\www.enigmaathome.net\wrapper_5.32_windows_intelx86.exe
28260 C:\ProgramData\BOINC\projects\www.enigmaathome.net\wrapper_5.32_windows_intelx86.exe
28512 C:\Windows\System32\conhost.exe
23464 C:\ProgramData\BOINC\slots\7\enigma_0.76.exe
28540 C:\ProgramData\BOINC\slots\0\enigma_0.76.exe
27140 C:\Windows\System32\conhost.exe
27008 C:\Windows\System32\conhost.exe
26752 C:\ProgramData\BOINC\slots\2\enigma_0.76.exe
27788 C:\ProgramData\BOINC\slots\8\enigma_0.76.exe
28328 C:\Windows\System32\conhost.exe
28312 C:\Windows\System32\conhost.exe
28032 C:\totalcmd\TOTALCMD.EXE
29676 dllhost.exe
29048 dllhost.exe
29384 C:\Users\Henry\Desktop\MBRCheck.exe
25104 C:\Windows\System32\conhost.exe
27508 C:\Windows\System32\dllhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`f1600000 (NTFS)
\\.\Y: --> \\.\PhysicalDrive0 at offset 0x00000000`02800000 (NTFS)

PhysicalDrive0 Model Number: ST1000LM014-1EJ164, Rev: DEMA

Size Device Name MBR Status
--------------------------------------------
931 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected
SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979

Done!

Juliet · Mar 4, 2015

The only thing that looked suspicious to me was

https://www.virustotal.com/en/file/...e45da57e15d81fbc5932f4b11c5bb951d05/analysis/
enigma_5.32_windows_intelx86.exe This file is not digitally signed. No suspicious behavior reported so far.
Bkav HW32.Laneul.kwqw <--detected by an unknown antivirus

that all looks fine with a non infected MBR now. If something had been found we would see
Unknown MBR code or MBR Code Faked!

We have run other rootkit and trojan scans that are clear.

I think we'll have to wait this one out for a while and see if anything should pop up or start showing alerts cause, I can't find anything.

jhrowehl · Mar 6, 2015

Juliet said:
The only thing that looked suspicious to me was

https://www.virustotal.com/en/file/...e45da57e15d81fbc5932f4b11c5bb951d05/analysis/
enigma_5.32_windows_intelx86.exe This file is not digitally signed. No suspicious behavior reported so far.
Bkav HW32.Laneul.kwqw <--detected by an unknown antivirus

that all looks fine with a non infected MBR now. If something had been found we would see
Unknown MBR code or MBR Code Faked!

We have run other rootkit and trojan scans that are clear.

I think we'll have to wait this one out for a while and see if anything should pop up or start showing alerts cause, I can't find anything.

The Enigma_5.32 file is known safe, I have it running on several computers. It's part of the BOINC (Berkley Open Infrastructure for Network Computing) science projects. This particular one is crunching one of the last 3 unbroken German Enigma code messages from World War II.

And I'm almost thinking that I might have seen something useful, I just need to verify if I'm correct. I upgraded an installed program, and in the process it's upgrade link (Known safe website) opened my 'default' browser, Internet Explorer. Keep in mind that for the past 4 months, I've set Firefox as my default browser about 200 or 300 times, each time I boot my laptop and open Firefox. And, I have told Internet Explorer *not* to set as default, probably 10 to 150 times so far.

Anyway, while performing the upgrade, with IE open for about 30 minutes, I had no rogue processes. However, when I opened Firefox to check my email, I had the rogue processes within just a couple of minutes. So... did I actually see something, or did I mis-interpret what I was seeing?

I also need to figure out the differences between my choices of Internet Explorer. I have 3 options available; 1- the standard Internet Explorer, 2- Internet Explorer (No Add-ons) [yes, that's the selection under All Programs, Accessories, System Tools], and 3- Dell Protected Workspace, which uses Internet Explorer. I'm almost thinking that the IE session that was opened was under Dell Protected Workspace, because, if I remember correctly, the window had a green border. The green border is the Dell PWS visual indicator.

I'll have to experiment for a bit, and hopefully I can come up with something that might help explain what's going on.

Also, just for grins and giggles, I was thinking about making a list of all Iexplore.exe files on my system, with file size and file date, and checking to see if any of them match known file forgeries.

jhrowehl · Mar 6, 2015

This may help.....

Juliet · Mar 6, 2015

Dell Protected Workspace. I am not familiar with this, to me it suggest an added secure browser.
I know people use IE 'No Add-ons' to troubleshoot, and had thought of using it to see if that was what was causing issues here but, no malicious Add-ons were found.

Also, from what you've posted about changes for default browser not holding, might be related to security settings such as SpyBot Teatimer but, settings in other security tools can do the same.
~~~~~~~~~~~~~~
Let's try to make system changes to make Firefox your default browser.

Click on the Windows logo to open the Start menu, then select Control Panel. The Control Panel window will open.
Click on the link labeled Programs. The Programs panel will open.

Click on the link labeled Set your default programs. The Set your default programs panel will open.

In the Programs list on the left side of the window, click Firefox.
In the right side of the window, click Set this program as default.

~~~~~~

From the screen capture it shows using Flash from a temp directorey and we can take care of that now.

Please Run TFC by OldTimer to clear temporary files:
TFC by OldTimer and save it to your desktop.

Close any open programs and Internet browsers.
Double click TFC.exe to run it on XP (for Vista and Windows 7 right click and choose "Run as administrator") and once it opens click on the Start button on the lower left of the program to allow it to begin cleaning.
Please be patient as clearing out temp files may take a while.
Once it completes you may be prompted to restart your computer, please do so.
Once it's finished you may delete TFC.exe from your desktop or save it for later use for the cleaning of temporary files.

~~~~~
We need to check which version of Flash player your using and make sure it's up to date.

Please run this security check for my review.

Download Security Check by screen317 from here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

jhrowehl · Mar 7, 2015

Juliet said:
Dell Protected Workspace. I am not familiar with this, to me it suggest an added secure browser.
I know people use IE 'No Add-ons' to troubleshoot, and had thought of using it to see if that was what was causing issues here but, no malicious Add-ons were found.

That's supposed to be an additional security layer from Dell. I'm aware that it's there, but I don't use it (that I'm aware of). It's one of those 'new' things that I haven't had the time to play with yet and find out what it really does.

I hit control panel and set Firefox as my default browser, and removed access to IE. I attached the report from Security check, and will run TFC after I post this.

I also have a question... are you familiar with VXMClient? The AVG detection that I posted earlier was the result of VXMClient. It pops up obviously false update prompts, such as 'Flash Player Plugs is out of date', and not Adobe Flash Player. Or, 'Your Internet Browser is out of date - click to download the updated browser'. Never mentions IE or Firefox, just your 'browser'. Those type of update prompts are huge red flags, along with alarm bells, warning lights, the whole shootin' match. I kill the processes without clicking the box.

Searching the internet, I find articles saying that VXMClient is malware, but not the typical virus or trojan type. It's browser related, and hides itself fairly well.

Juliet · Mar 7, 2015

are you familiar with VXMClient

No

Please run the Farbar Recovery Scan Tool.
Enter vxmclient in the Search Box.

click the Search Registry button, post the content of the Search.txt file in your next reply.

jhrowehl · Mar 7, 2015

Juliet said:
No

Please run the Farbar Recovery Scan Tool.
Enter vxmclient in the Search Box.

click the Search Registry button, post the content of the Search.txt file in your next reply.

Ok, will do. And, just for info, when I launched Firefox to log on here, it asked me if I wanted to set it as my default browser.

Again.

Juliet · Mar 7, 2015

It's late here and I have a 5 year old to get ready for bed, I'll be back in the morning.

Juliet · Mar 7, 2015

Also, let's make sure nothing is coming in through your router.

Router Power Cycle

Switch your computer off.
Turn your router/modem off.
Unplug your router/modem and all cables from the wall.
Wait 60 seconds.
Plug your router/modem back in and turn on.
Switch your computer on.
Check for issues.

[font=helvetica, arial, sans-serif]------------------------------------[/font]

Router Reset

Please read: Malware Silently Alters Wireless Router Settings
Consult Router Passwords to find out what default username and password for your brand of router and make a note of that for future reference. Alternatively, your may find the username/password written on the base of your router. If neither options are applicable, please contact the manufacturer of your router.

Reset Router to Factory Default Settings:

Typically a reset can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled "reset" located on the back of the router.
Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 30 seconds)
In order to get to the router's server, type http:\\192.168.1.1 in the address bar and click Enter. You should see the log in window.
Fill in the password you have already found and you will get the configuration page.
Configure the router to allow you to connect to your ISP server. In some routers it is done by a setup wizard.
If you do not have a setup wizard you have to fill in the log in password your ISP has initially given to you. You can also call your ISP if you don't have your initial password.
Don't forget to change the routers default password and set a stronger, more complex password. Note down the password and keep it somewhere for future reference.
~~~~

Please make sure of the following settings on your computer:

Click Start, Control panel, then double-click Network and Sharing Center.
In the left window select Manage Network Connection.
In the right window right-click Local Area Connection and select Properties .
Internet Protocol Version 6 (IP6v) should be checked. Double-click on it. Make sure of the following settings:
The option Obtain an IP address automatically should be checked.
The option Obtain DNS server address automatically should be checked.
Click OK.
Internet Protocol Version 4 (IP4v) should be checked. Double-click on it.
The option Obtain an IP address automatically should be checked.
The option Obtain DNS server address automatically should be checked.
Click OK twice.
If you need to change any of these settings you will need to reboot your computer.

~~~~~~~~~~~~~~~~~~~~~~~~

I need you to make a batch file.

Open a new Notepad session

Click the Start button, click Run
In the run box type notepad
Click OK
In the notepad, Click "Format" and be certain that Word Wrap is not checked.
Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

Code:

@Echo on
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

In the notepad

Click File, Save as..., and set the Save in to your Desktop
In the filename box, type (including quotation marks) as the filename:
"flush.bat"
Click Save

You should now have a file on your desktop with an icon like this

Double click on flush.bat & allow it to run. A small black screen may briefly flash on and off, that normal.

jhrowehl · Mar 7, 2015

Firefox just asked me if I wanted to set it as my default browser... again. I set it as my default browser 4 or 5 times a day now.

I also had an AVG detection this morning... see capture16.jpg. It's running from a temporary file, but, I ran TFC last night, so there should be no temporary files.

I tried something last night, I downloaded a free version of SpyHunter and ran it. The free version is the teaser, it won't remove any threats until you buy the paid version. But it's results were interesting. Check the other 4 screen captures, and pay particular attention to capture21. We had FRST remove Reimage Repair twice, but SpyHunter found 48 instances of Reimage Repair leftovers.

Spybot does not find any of the reimage traces, and misses the adware programs.

Here's the FRST log file:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-03-2015 01
Ran by Henry (administrator) on ELSERVICE13 on 06-03-2015 21:51:04
Running from C:\Users\Henry\Desktop
Loaded Profiles: Henry (Available profiles: Henry)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe
(DigitalPersona, Inc.) C:\Program Files\Dell\Dell Data Protection\Security Tools\Authentication\Bin\DpHostW.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(DigitalPersona, Inc.) C:\Program Files\Dell\Dell Data Protection\Security Tools\Authentication\Bin\DpCardEngine.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Invincea, Inc.) C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SboxSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Broadcom Corporation) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
(Broadcom Corporation) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\HidMonitorSvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
() C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.Loader.exe
(EMC Corporation) C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\Emc.Captiva.WebCaptureService.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Invincea, Inc.) C:\Program Files (x86)\Invincea\Enterprise\X64\InvProtectSvc64.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7Debug\mdm.exe
(Ilja Herlein) C:\Program Files (x86)\NetSetMan\nsmservice.exe
(Visioneer Inc.) C:\Program Files (x86)\Visioneer\OneTouch 4.0\OtService.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PDF Professional 7\PDFProFiltSrv.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
(Dell Inc.) C:\Program Files\Dell\PPO\poaService.exe
(Dell Inc.) C:\Program Files\Dell\PPO\poaSmSrv.exe
(Dell Inc.) C:\Program Files\Dell\PPO\poaTaServ.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Dell Inc.) C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe
(TheGreenBow) C:\Windows\SysWOW64\TgbStarter.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe
(MicroStudio) C:\Program Files (x86)\Windows Network Accelerater\v3\winvxm.exe
(Microsoftware) C:\Program Files (x86)\YouTube-Downloader\A4\youtubeserv.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Dell Inc.) C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.exe
(Dell, Inc.) C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.MgmtServer.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(EMC Corporation) C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\Emc.Captiva.WebToolkitHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Waves Audio Ltd.) C:\Program Files\Realtek\Audio\HDA\WavesSvc64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Dell Inc.) C:\Program Files\Dell\PPO\DellPoaEvents.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
() C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.SystrayApp.exe
(Invincea, Inc.) C:\Program Files (x86)\Invincea\Enterprise\X64\InvProtect64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Space Sciences Laboratory) C:\Program Files\BOINC\boinctray.exe
(Space Sciences Laboratory) C:\Program Files\BOINC\boincmgr.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe
(WIBU-SYSTEMS AG) C:\Program Files (x86)\WIBUKEY\Server\WkSvMgr.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(SlySoft, Inc.) C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.bin
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PDF Professional 7\PdfPro7Hook.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe
(Canon Electronics Inc.) C:\Program Files (x86)\Canon Electronics\P215II\TouchDR.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Ilja Herlein) C:\Program Files (x86)\NetSetMan\netsetman.exe
(Space Sciences Laboratory) C:\Program Files\BOINC\boinc.exe
() C:\Program Files (x86)\SlySoft\AnyDVD\ADvdDiscHlp64.exe
(Invincea, Inc.) C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SboxSvc.exe
(Invincea, Inc.) C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SandboxRpcSs.exe
(Invincea, Inc.) C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SandboxDcomLaunch.exe
(Invincea, Inc.) C:\ProgramData\Invincea\Enterprise\Bin\x64\InvProtectAgent64.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Dell) C:\Program Files\Dell\Dell Foundation Services\DFSSvc.exe
(Dell Products, LP.) C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(BayHubTech/O2Micro International) C:\Windows\System32\drivers\o2flash.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell Backup and Recovery\Components\DBRUpdate\DBRUpd.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell Backup and Recovery\Toaster.exe
(Microsoft Corporation) C:\Windows\winsxs\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_6.1.7601.17514_none_78dd6e4cd6655603\WmiPrvSE.exe
() C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBRCrawler.exe
() C:\ProgramData\BOINC\projects\milkyway.cs.rpi.edu_milkyway\milkyway_nbody_1.48_windows_x86_64__mt.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [727896 2014-03-13] (Alps Electric Co., Ltd.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7510232 2014-01-17] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1374936 2014-01-13] (Realtek Semiconductor)
HKLM\...\Run: [WavesSvc] => C:\Program Files\Realtek\Audio\HDA\WavesSvc64.exe [285272 2013-12-30] (Waves Audio Ltd.)
HKLM\...\Run: [RtHDVBg_PushButton] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1374936 2014-01-13] (Realtek Semiconductor)
HKLM\...\Run: [DellPoaEvents] => C:\Program Files\Dell\PPO\DellPoaEvents.exe [396496 2014-08-15] (Dell Inc.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2014-05-28] (Intel Corporation)
HKLM\...\Run: [IntelPROSet] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [4876528 2014-05-29] (Intel(R) Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [558496 2014-02-27] (Adobe Systems Incorporated)
HKLM\...\Run: [CSFTrayApp] => C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.SystrayApp.exe [232288 2014-09-11] ()
HKLM\...\Run: [InvProtect] => C:\Program Files (x86)\Invincea\Enterprise\X64\InvProtect64.exe [6779592 2015-02-12] (Invincea, Inc.)
HKLM\...\Run: [CANON P-215II SVC] => rundll32.exe P215IISvc.dll,EntryPointUserMessage
HKLM\...\Run: [boinctray] => C:\Program Files\BOINC\boinctray.exe [67056 2014-12-11] (Space Sciences Laboratory)
HKLM\...\Run: [boincmgr] => C:\Program Files\BOINC\boincmgr.exe [9639920 2014-12-11] (Space Sciences Laboratory)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-04-10] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767200 2014-04-02] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe [3498728 2014-12-03] (Adobe Systems Inc.)
HKLM-x32\...\Run: [WD Quick View] => C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe [5564784 2015-02-12] (Western Digital Technologies, Inc.)
HKLM-x32\...\Run: [NetSetMan] => C:\Program Files (x86)\NetSetMan\netsetman.exe [6699176 2015-03-02] (Ilja Herlein)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [PaperPort PTD] => C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe [36168 2013-04-19] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [IndexSearch] => C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe [18248 2013-04-19] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDF7 Registry Controller] => C:\Program Files (x86)\Nuance\PDF Professional 7\RegistryController.exe [141160 2012-02-17] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDFProHook] => C:\Program Files (x86)\Nuance\PDF Professional 7\pdfpro7hook.exe [641384 2012-02-17] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [OmniPage Preload] => C:\Program Files (x86)\Nuance\OmniPage18\OmniPage18.exe [1893224 2012-02-23] (TODO: <Company name>)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3667472 2014-12-18] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [P-215II CaptureOnTouch] => C:\Program Files (x86)\Canon Electronics\P215II\TouchDR.exe [2251056 2014-03-30] (Canon Electronics Inc.)
HKLM-x32\...\Run: [PDVDDXSrv] => C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe [140520 2010-01-07] (CyberLink Corp.)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-1310488628-551009281-1505269296-1000\...\Run: [HydraVisionDesktopManager] => C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [389120 2014-04-02] (AMD)
HKU\S-1-5-21-1310488628-551009281-1505269296-1000\...\Run: [AnyDVD] => C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVD.exe [109480 2015-02-19] (SlySoft, Inc.)
HKU\S-1-5-21-1310488628-551009281-1505269296-1000\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2015-01-28] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-21-1310488628-551009281-1505269296-1000\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-1310488628-551009281-1505269296-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-1310488628-551009281-1505269296-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\boinc.scr [1120752 2014-12-11] (Space Sciences Laboratory)
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Network Server.lnk
ShortcutTarget: Network Server.lnk -> C:\Program Files (x86)\WIBUKEY\Server\WkSvMgr.exe (WIBU-SYSTEMS AG)
Startup: C:\Users\Henry\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice 4.1.1.lnk
ShortcutTarget: OpenOffice 4.1.1.lnk -> C:\Program Files (x86)\OpenOffice 4\program\quickstart.exe ()
ShellIconOverlayIdentifiers: [DBARFileBackuped] -> {831cebdd-6baf-4432-be76-9e0989c14aef} => C:\Windows\system32\mscoree.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [DBARFileNotBackuped] -> {275e4fd7-21ef-45cf-a836-832e5d2cc1b3} => C:\Windows\system32\mscoree.dll (Microsoft Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1310488628-551009281-1505269296-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1310488628-551009281-1505269296-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1310488628-551009281-1505269296-1000\Software\Microsoft\Internet Explorer\Main,Start Page = www.excite.com
BHO: Invincea Web Redirector -> {1C52FA7C-51B7-4621-9D5A-11101BA13134} -> C:\Program Files (x86)\Invincea\Enterprise\X64\InvRedirHostIE64.dll (Invincea, Inc.)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Invincea Web Redirector -> {1C52FA7C-51B7-4621-9D5A-11101BA13134} -> C:\Program Files (x86)\Invincea\Enterprise\InvRedirHostIE.dll (Invincea, Inc.)
BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\PlusIEContextMenu.dll (Zeon Corporation)
BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: ZeonIEEventHelper Class -> {DA986D7D-CCAF-47B2-84FE-BFA1549BEBF9} -> C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - DocuCom PDF - {E3286BF1-E654-42FF-B4A6-5E111731DF6B} - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)
Handler-x32: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\pkmcdo.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 208.67.222.222 208.67.222.220 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Henry\AppData\Roaming\Mozilla\Firefox\Profiles\zle9j8xn.default-1419567438668
FF Homepage: www.excite.com
FF NetworkProxy: "no_proxies_on", "localhost; 127.0.0.1"
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin-x32: digitalpersona.com/ChromeDPAgent -> C:\Program Files (x86)\Dell\Dell Data Protection\Security Tools Authentication\Bin\BrowserExt\components\npChromeDPAgent.dll (DigitalPersona, Inc.)
FF Plugin-x32: ZEON/PDF,version=2.0 -> C:\Program Files (x86)\Nuance\PDF Professional 7\bin\nppdf.dll (Zeon Corporation)
FF Extension: Flash Video Downloader - YouTube HD Download [4K] - C:\Users\Henry\AppData\Roaming\Mozilla\Firefox\Profiles\zle9j8xn.default-1419567438668\Extensions\artur.dubovoy@gmail.com [2015-03-06]
FF Extension: Garmin Communicator - C:\Users\Henry\AppData\Roaming\Mozilla\Firefox\Profiles\zle9j8xn.default-1419567438668\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2014-12-26]
FF Extension: QuickJava - C:\Users\Henry\AppData\Roaming\Mozilla\Firefox\Profiles\zle9j8xn.default-1419567438668\Extensions\{E6C1199F-E687-42da-8C24-E7770CC3AE66}.xpi [2014-12-26]
FF Extension: Invincea Web Redirector - C:\Program Files (x86)\Mozilla Firefox\distribution\bundles\webredirector@invincea.com [2015-03-05]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2014-11-01]
FF HKLM-x32\...\Firefox\Extensions: [dpmaxz_ng@jetpack] - C:\Program Files (x86)\Dell\Dell Data Protection\Security Tools Authentication\Bin\BrowserExt\dpchrome
FF Extension: Dell Data Protection | Security Tools - C:\Program Files (x86)\Dell\Dell Data Protection\Security Tools Authentication\Bin\BrowserExt\dpchrome [2014-11-01]
FF Extension: PDF Converter 7.1 - C:\Program Files (x86)\Nuance\PDF Professional 7\FireFox [2014-11-09]

Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2014-12-03]
CHR HKLM-x32\...\Chrome\Extension: [ncffjdbbodifgldkcbhmiiljfcnbgjab] - C:\Program Files (x86)\Dell\Dell Data Protection\Security Tools Authentication\Bin\BrowserExt\dpchrome.crx [2014-03-17]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ApHidMonitorService; C:\Program Files\DellTPad\HidMonitorSvc.exe [87384 2014-03-27] (Alps Electric Co., Ltd.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3432976 2014-12-18] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [298080 2014-12-18] (AVG Technologies CZ, s.r.o.)
R2 Dell Foundation Services; C:\Program Files\Dell\Dell Foundation Services\DFSSvc.exe [73072 2014-11-10] (Dell)
R2 DellMgmtAgent; C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.exe [255328 2014-09-11] (Dell Inc.)
R2 DellMgmtLoader; C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.Loader.exe [26464 2014-09-11] ()
R2 DellMgmtServer; C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.MgmtServer.exe [33632 2014-09-11] (Dell, Inc.)
R2 DpHost; C:\Program Files\Dell\Dell Data Protection\Security Tools\Authentication\Bin\DpHostW.exe [472912 2014-03-19] (DigitalPersona, Inc.)
R2 Emc.Captiva.WebCaptureService; C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\Emc.Captiva.WebCaptureService.exe [46400 2013-03-25] (EMC Corporation)
R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [517464 2015-01-28] (Garmin Ltd or its subsidiaries)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [16232 2014-05-28] (Intel Corporation)
R2 iBtSiva; C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe [121288 2014-06-06] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [315376 2014-05-06] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887232 2014-01-31] (Intel(R) Corporation)
R2 InvProtectSvc; C:\Program Files (x86)\Invincea\Enterprise\X64\InvProtectSvc64.exe [2150088 2015-02-12] (Invincea, Inc.)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-02-28] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [154584 2014-04-29] (Intel Corporation)
R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7Debug\mdm.exe [335872 2003-03-19] (Microsoft Corporation) [File not signed]
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2014-05-29] ()
R2 nsmService; C:\Program Files (x86)\NetSetMan\nsmservice.exe [1278632 2015-02-06] (Ilja Herlein)
R2 O2FLASH; C:\Windows\system32\DRIVERS\o2flash.exe [65536 2014-03-07] (BayHubTech/O2Micro International)
R2 OneTouch 4.0 Monitor; C:\Program Files (x86)\Visioneer\OneTouch 4.0\OtService.exe [232448 2014-09-30] (Visioneer Inc.) [File not signed]
R2 PDFProFiltSrv; C:\Program Files (x86)\Nuance\PDF Professional 7\PDFProFiltSrv.exe [135016 2012-02-17] (Nuance Communications, Inc.)
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [77640 2013-04-19] (Nuance Communications, Inc.)
R2 poaService; C:\Program Files\Dell\PPO\poaService.exe [721104 2014-08-15] (Dell Inc.)
R2 PoaSMSrv; C:\Program Files\Dell\PPO\poaSmSrv.exe [312016 2014-08-15] (Dell Inc.)
R2 poaTaServ; C:\Program Files\Dell\PPO\poaTaServ.exe [645328 2014-08-16] (Dell Inc.)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [289496 2013-12-06] (Realtek Semiconductor)
R2 SboxSvc; C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SboxSvc.exe [174792 2015-02-12] (Invincea, Inc.)
R2 SftService; C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe [1921768 2014-07-02] (SoftThinks SAS)
S3 stllssvr; C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe [69632 2007-07-11] (MicroVision Development, Inc.) [File not signed]
R2 SupportAssistAgent; C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe [19288 2015-03-04] (Dell Inc.)
R2 TgbIke Starter; C:\Windows\SysWOW64\TgbStarter.exe [239280 2012-03-21] (TheGreenBow)
R2 WDBackup; C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe [1042808 2015-02-12] (Western Digital Technologies, Inc.)
R2 WDDriveService; C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [302968 2015-02-12] (Western Digital Technologies, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2014-10-26] (Microsoft Corporation)
R2 WindowsVNT_R3; C:\Program Files (x86)\Windows Network Accelerater\v3\winvxm.exe [2973600 2014-10-20] (MicroStudio) [File not signed]
R2 YouTubeDownload_A4; C:\Program Files (x86)\YouTube-Downloader\A4\youtubeserv.exe [2971736 2015-03-03] (Microsoftware)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3816176 2014-05-29] (Intel® Corporation)
S3 Dell.CommandPowerManager.Service; C:\Windows\SysWOW64\dllhost.exe /Processid:{B72A21F9-6C42-44BF-BEBD-DD11EDF0E075}

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [36608 2013-12-13] (Advanced Micro Devices, Inc.)
R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [150440 2014-12-23] (SlySoft, Inc.)
R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [150440 2014-12-23] (SlySoft, Inc.)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [260888 2014-12-08] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [203544 2014-11-18] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [313624 2014-07-18] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [124184 2014-10-05] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [274200 2014-10-10] (AVG Technologies CZ, s.r.o.)
R3 btmaux; C:\Windows\System32\DRIVERS\btmaux.sys [140600 2014-03-26] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\System32\DRIVERS\btmhsf.sys [1423160 2014-04-18] (Motorola Solutions, Inc.)
R0 CredFltL; C:\Windows\System32\DRIVERS\CredFltL.sys [37120 2014-09-11] ()
S3 DDDriver; C:\Windows\System32\drivers\DDDriver64Dcsa.sys [23760 2014-08-13] (Dell Computer Corporation)
S3 DellProf; C:\Windows\System32\drivers\DellProf.sys [23312 2014-08-13] (Dell Computer Corporation)
R2 DLABMFSE; C:\Windows\System32\Drivers\DLABMFSE.SYS [46448 2007-07-23] (Roxio)
R2 DLABOIOE; C:\Windows\System32\Drivers\DLABOIOE.SYS [42352 2007-07-23] (Roxio)
R0 DLACDBHE; C:\Windows\System32\Drivers\DLACDBHE.SYS [17776 2007-07-23] (Roxio)
R2 DLADResE; C:\Windows\System32\Drivers\DLADResE.SYS [9968 2007-07-23] (Roxio)
R2 DLAIFS_E; C:\Windows\System32\Drivers\DLAIFS_E.SYS [146672 2007-07-23] (Roxio)
R2 DLAOPIOE; C:\Windows\System32\Drivers\DLAOPIOE.SYS [35056 2007-07-23] (Roxio)
R2 DLAPoolE; C:\Windows\System32\Drivers\DLAPoolE.SYS [19824 2007-07-23] (Roxio)
R1 DLARTL_E; C:\Windows\System32\Drivers\DLARTL_E.SYS [41072 2007-07-23] (Roxio)
R2 DLAUDFAE; C:\Windows\System32\Drivers\DLAUDFAE.SYS [135152 2007-07-23] (Roxio)
R2 DLAUDF_E; C:\Windows\System32\Drivers\DLAUDF_E.SYS [144112 2007-07-23] (Roxio)
R0 DRVECDB; C:\Windows\System32\Drivers\DRVECDB.SYS [124112 2007-07-23] (Sonic Solutions)
R2 DRVEDDM; C:\Windows\System32\Drivers\DRVEDDM.SYS [63984 2007-07-23] (Roxio)
R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [489752 2014-06-12] (Intel Corporation)
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [28008 2014-05-02] (Intel Corporation)
R3 ibtusb; C:\Windows\System32\DRIVERS\ibtusb.sys [199624 2014-06-06] (Intel Corporation)
R3 IntcAzAudAddService; C:\Windows\System32\drivers\RTDVHD64.sys [2310488 2014-02-13] (Realtek Semiconductor Corp.)
R3 InvProtectDrv; C:\Program Files (x86)\Invincea\Enterprise\X64\InvProtectDrv64.sys [52232 2015-02-12] (Invincea, Inc.)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [118272 2014-04-29] (Intel Corporation)
R3 NETwNs64; C:\Windows\System32\DRIVERS\Netwsw02.sys [3442144 2014-06-18] (Intel Corporation)
R3 O2FJ2RDR; C:\Windows\System32\DRIVERS\O2FJ2w7x64.sys [210592 2014-05-14] (BayHubTech/O2Micro )
R3 POADrvr; C:\Windows\System32\drivers\POADrvr.sys [21264 2014-08-15] (Dell Computer Corporation)
R3 SboxDrv; C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SboxDrv.sys [183816 2015-02-12] (Invincea, Inc.)
R0 SEDFilter; C:\Windows\System32\DRIVERS\SEDFilter.sys [61184 2014-09-11] (Dell Inc.)
R3 ST_ACCEL; C:\Windows\System32\DRIVERS\ST_Accel.sys [75976 2013-08-06] (STMicroelectronics)
R3 TGBMPEnum; C:\Windows\System32\DRIVERS\TGBMPEnum.sys [40624 2012-03-21] (TheGreenBow)
S3 TGBVPNVirtM; C:\Windows\System32\DRIVERS\TGBVPNVirtM.sys [140976 2012-03-21] (TheGreenBow)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [35064 2015-02-26] ()
R3 usb3Hub; C:\Windows\System32\DRIVERS\usb3Hub.sys [204184 2014-03-04] (Windows (R) Win 7 DDK provider)
S3 usbscan; C:\Windows\SysWOW64\DRIVERS\usbscan.sys [35840 2009-07-14] (Microsoft Corporation) [File not signed]
R3 wbfcvusbdrv; C:\Windows\System32\Drivers\wbfcvusbdrv.sys [17632 2014-08-02] ()
R2 WIBUKEY; C:\Windows\System32\DRIVERS\WibuKey64.sys [107008 2006-11-22] (WIBU-SYSTEMS AG)
S3 Wibukey2_64; C:\Windows\System32\drivers\wibukey2_64.sys [16896 2006-11-09] (WIBU-SYSTEMS AG)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]
S3 cpuz134; \??\C:\Users\Henry\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-06 21:51 - 2015-03-06 21:51 - 00033754 _____ () C:\Users\Henry\Desktop\FRST.txt
2015-03-06 21:50 - 2015-03-06 21:51 - 00000000 ____D () C:\FRST
2015-03-06 21:50 - 2015-03-06 21:50 - 02092544 _____ (Farbar) C:\Users\Henry\Desktop\FRST64.exe
2015-03-06 19:48 - 2015-03-06 19:48 - 00448512 _____ (OldTimer Tools) C:\Users\Henry\Desktop\TFC.exe
2015-03-06 19:14 - 2015-03-06 19:14 - 00000802 _____ () C:\Users\Henry\Desktop\checkup.txt
2015-03-06 19:04 - 2015-03-06 19:04 - 00852604 _____ () C:\Users\Henry\Desktop\SecurityCheck.exe
2015-03-05 21:45 - 2015-03-05 21:45 - 00001850 _____ () C:\Users\Public\Desktop\Garmin Express.lnk
2015-03-05 21:44 - 2015-03-05 21:44 - 00003556 _____ () C:\Windows\System32\Tasks\GarminUpdaterTask
2015-03-05 17:59 - 2015-03-05 17:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-05 14:18 - 2015-03-05 14:48 - 00000000 ____D () C:\ProgramData\SupportAssistAgent
2015-03-05 14:18 - 2015-03-05 14:18 - 00003598 _____ () C:\Windows\System32\Tasks\Dell SupportAssistAgent AutoUpdate
2015-03-05 06:09 - 2015-03-05 06:09 - 00001939 _____ () C:\Users\Henry\Desktop\OBD-PCLink.lnk
2015-03-04 17:48 - 2015-03-04 17:48 - 18058685 _____ (Innova Electronics ) C:\Users\Henry\Downloads\OBD_PCLink_V1.33.exe
2015-03-04 17:41 - 2015-03-04 17:41 - 00000000 ____D () C:\Users\Henry\AppData\Roaming\Innova
2015-03-04 17:41 - 2015-03-04 17:41 - 00000000 ____D () C:\Innova
2015-03-04 17:40 - 2015-03-04 17:40 - 00001965 _____ () C:\Users\Public\Desktop\Innova OBD PC-Link.lnk
2015-03-04 17:40 - 2015-03-04 17:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Innova Electronics
2015-03-04 17:40 - 2015-03-04 17:40 - 00000000 ____D () C:\Program Files (x86)\Innova OBD PC-Link
2015-03-04 17:39 - 2015-03-04 17:39 - 00000000 ____D () C:\Program Files\Microsoft Synchronization Services
2015-03-04 17:39 - 2015-03-04 17:39 - 00000000 ____D () C:\Program Files\Microsoft SQL Server Compact Edition
2015-03-04 17:39 - 2015-03-04 17:39 - 00000000 ____D () C:\Program Files (x86)\Microsoft Synchronization Services
2015-03-04 17:38 - 2015-03-04 17:38 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2015-03-04 17:37 - 2015-03-04 17:38 - 208015834 _____ (Innova Electronics ) C:\Users\Henry\Downloads\Innova_V02.03.07_PCLink.exe
2015-03-04 17:23 - 2015-03-04 17:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OBD-PCLink
2015-03-04 17:23 - 2015-03-04 17:23 - 00000000 ____D () C:\Program Files (x86)\OBD-PCLink
2015-03-04 17:16 - 2015-03-04 17:16 - 00000000 ____D () C:\Users\Henry\AppData\Local\Innova_Electronics_Corp
2015-03-04 17:13 - 2015-03-04 17:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RepairSolutions
2015-03-04 17:13 - 2015-03-04 17:13 - 00000000 ____D () C:\Program Files (x86)\RepairSolutions
2015-03-03 21:26 - 2015-03-03 21:26 - 00023134 _____ () C:\Users\Henry\Desktop\MBRCheck_03.03.15_21.26.03.txt
2015-03-03 21:24 - 2015-03-03 21:24 - 00080384 _____ () C:\Users\Henry\Desktop\MBRCheck.exe
2015-03-02 22:43 - 2015-03-02 22:43 - 00441583 _____ () C:\Users\Henry\Desktop\gmer.txt
2015-03-02 21:17 - 2015-03-02 21:17 - 00380416 _____ () C:\Users\Henry\Desktop\3x39kz7u.exe
2015-03-02 17:42 - 2015-03-02 17:47 - 00001376 _____ () C:\Users\Henry\Desktop\Kill Iexplore.lnk
2015-03-02 17:23 - 2015-03-05 06:13 - 00000585 _____ () C:\Windows\pixcache.ini
2015-03-01 21:52 - 2015-03-01 21:52 - 00001951 _____ () C:\DelFix.txt
2015-02-28 20:58 - 2015-02-28 22:16 - 00000530 _____ () C:\Windows\DtcInstall.log
2015-02-28 18:21 - 2015-02-28 18:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2015-02-28 18:21 - 2015-02-28 18:21 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com
2015-02-27 14:17 - 2015-03-06 14:22 - 00003484 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask
2015-02-27 08:43 - 2015-03-01 21:52 - 00000000 ____D () C:\Program Files (x86)\Trend Micro
2015-02-27 08:43 - 2015-02-27 08:43 - 00000000 ____D () C:\Users\Henry\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
2015-02-27 08:32 - 2015-02-27 08:32 - 00000000 ____D () C:\Program Files\Western Digital
2015-02-26 21:15 - 2015-02-26 21:15 - 00000000 ____D () C:\ProgramData\Emsisoft
2015-02-26 18:20 - 2015-02-26 22:30 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2015-02-26 18:03 - 2015-02-26 18:03 - 00035064 _____ () C:\Windows\system32\Drivers\TrueSight.sys
2015-02-26 18:03 - 2015-02-26 18:03 - 00000000 ____D () C:\ProgramData\RogueKiller
2015-02-26 17:52 - 2015-03-03 13:02 - 00000000 ____D () C:\ProgramData\Optimizer
2015-02-26 14:32 - 2015-01-08 18:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls
2015-02-26 14:32 - 2015-01-08 18:43 - 00419936 _____ () C:\Windows\system32\locale.nls
2015-02-26 11:31 - 2015-02-26 11:43 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-02-25 22:44 - 2015-02-25 22:44 - 00001115 _____ () C:\Users\Public\Desktop\WD My Cloud.lnk
2015-02-25 22:44 - 2015-02-25 22:44 - 00000000 ____D () C:\Users\Henry\AppData\Roaming\com.wd.WDMyCloud
2015-02-25 08:57 - 2015-02-25 09:11 - 00000000 ____D () C:\Windows\erdnt
2015-02-22 14:17 - 2015-02-22 14:17 - 00000000 ____D () C:\Users\Henry\AppData\Roaming\PCDr
2015-02-22 14:17 - 2015-02-22 14:17 - 00000000 ____D () C:\ProgramData\PCDr
2015-02-21 11:06 - 2015-02-21 11:06 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-ELSERVICE13-Windows-7-Professional-(64-bit).dat
2015-02-20 18:26 - 2015-02-26 17:52 - 00000560 __RSH () C:\ProgramData\ntuser.pol
2015-02-16 16:26 - 2015-01-08 22:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-02-16 16:26 - 2015-01-08 22:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-02-16 16:26 - 2015-01-08 22:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-02-16 16:26 - 2015-01-08 21:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-02-15 14:01 - 2015-03-03 13:03 - 00000000 ____D () C:\Program Files (x86)\YouTube-Downloader
2015-02-12 21:42 - 2015-01-22 23:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-02-12 21:42 - 2015-01-22 23:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-12 21:42 - 2015-01-22 22:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-02-12 21:42 - 2015-01-22 22:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-11 11:05 - 2015-02-11 11:05 - 00003224 _____ () C:\Windows\System32\Tasks\SystemToolsDailyTest
2015-02-11 11:04 - 2015-02-11 11:04 - 00000000 ____D () C:\Program Files\Dell Support Center
2015-02-10 16:42 - 2015-01-14 00:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-10 16:42 - 2015-01-14 00:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-10 16:42 - 2015-01-11 22:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-10 16:42 - 2015-01-11 22:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-10 16:42 - 2015-01-11 22:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-02-10 16:42 - 2015-01-11 21:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-10 16:42 - 2015-01-11 21:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-10 16:42 - 2015-01-11 21:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-10 16:42 - 2015-01-11 21:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-02-10 16:42 - 2015-01-11 21:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-10 16:42 - 2015-01-11 21:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-10 16:42 - 2015-01-11 21:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-10 16:42 - 2015-01-11 21:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-10 16:42 - 2015-01-11 21:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-10 16:42 - 2015-01-11 21:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-02-10 16:42 - 2015-01-11 21:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-10 16:42 - 2015-01-11 21:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-02-10 16:42 - 2015-01-11 21:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-10 16:42 - 2015-01-11 21:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-10 16:42 - 2015-01-11 21:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-02-10 16:42 - 2015-01-11 21:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-10 16:42 - 2015-01-11 21:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-10 16:42 - 2015-01-11 21:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-10 16:42 - 2015-01-11 21:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-02-10 16:42 - 2015-01-11 21:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-02-10 16:42 - 2015-01-11 21:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-10 16:42 - 2015-01-11 21:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-10 16:42 - 2015-01-11 21:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-10 16:42 - 2015-01-11 21:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-10 16:42 - 2015-01-11 20:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-02-10 16:42 - 2015-01-11 20:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-10 16:42 - 2015-01-11 20:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-10 16:42 - 2015-01-11 20:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-10 16:42 - 2015-01-11 20:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-10 16:42 - 2015-01-11 20:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-10 16:42 - 2015-01-11 20:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-02-10 16:42 - 2015-01-11 20:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-10 16:42 - 2015-01-11 20:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-10 16:42 - 2015-01-11 20:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-10 16:42 - 2015-01-11 20:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-02-10 16:42 - 2015-01-11 20:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-10 16:42 - 2015-01-11 20:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-10 16:42 - 2015-01-11 20:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-10 16:42 - 2015-01-11 20:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-10 16:42 - 2015-01-11 20:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-10 16:42 - 2015-01-11 20:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-02-10 16:42 - 2015-01-11 20:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-10 16:42 - 2015-01-11 20:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-10 16:42 - 2015-01-11 20:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-10 16:42 - 2015-01-11 20:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-10 16:42 - 2015-01-11 19:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-10 16:42 - 2015-01-11 19:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-10 16:42 - 2015-01-10 01:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-02-10 16:42 - 2015-01-10 01:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-10 16:42 - 2015-01-10 01:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-02-10 16:42 - 2015-01-10 01:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-02-10 16:42 - 2015-01-10 01:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-02-10 16:42 - 2015-01-10 01:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-02-10 16:42 - 2015-01-10 01:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-02-10 16:42 - 2015-01-10 01:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-02-10 16:42 - 2015-01-10 01:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-02-10 16:42 - 2015-01-10 01:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-10 16:42 - 2015-01-10 01:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-02-10 16:42 - 2015-01-10 01:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-02-10 16:42 - 2015-01-10 01:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-02-10 16:42 - 2015-01-10 01:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-02-10 16:41 - 2015-02-16 16:55 - 00025260 _____ () C:\Windows\system32\ScanResults.xml
2015-02-10 16:41 - 2015-01-15 03:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-10 16:41 - 2015-01-15 03:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-10 16:41 - 2015-01-15 03:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-10 16:41 - 2015-01-15 03:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-10 16:41 - 2015-01-15 03:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-10 16:41 - 2015-01-15 03:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-10 16:41 - 2015-01-15 03:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-10 16:41 - 2015-01-15 03:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-10 16:41 - 2015-01-15 03:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-10 16:41 - 2015-01-15 03:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-10 16:41 - 2015-01-15 03:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-10 16:41 - 2015-01-15 02:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-02-10 16:41 - 2015-01-15 02:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-02-10 16:41 - 2015-01-15 02:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-02-10 16:41 - 2015-01-15 02:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-10 16:41 - 2015-01-15 02:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-02-10 16:41 - 2015-01-15 02:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-10 16:41 - 2015-01-14 23:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-10 16:41 - 2015-01-14 01:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-10 16:41 - 2015-01-14 01:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-02-10 16:41 - 2015-01-14 01:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-02-10 16:41 - 2015-01-14 01:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-02-10 16:41 - 2015-01-14 00:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-10 16:41 - 2015-01-14 00:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-10 16:41 - 2015-01-14 00:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-10 16:41 - 2015-01-12 22:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-10 16:41 - 2015-01-12 21:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-10 16:41 - 2014-12-12 00:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-10 16:41 - 2014-12-12 00:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-02-10 16:41 - 2014-12-07 22:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-10 16:41 - 2014-12-07 21:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-10 16:41 - 2014-11-25 22:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-10 16:41 - 2014-11-25 22:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-10 16:41 - 2014-07-06 21:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-02-10 16:41 - 2014-07-06 21:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-02-10 16:41 - 2014-07-06 20:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-02-10 16:41 - 2014-07-06 20:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-02-10 16:40 - 2015-01-08 21:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-10 16:34 - 2015-02-16 16:48 - 00000464 _____ () C:\Windows\system32\ScannerSettings
2015-02-07 09:20 - 2015-02-07 09:20 - 00000000 ____D () C:\Users\Henry\AppData\Local\GARMIN_Corp

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-06 21:50 - 2014-11-02 11:06 - 00000000 ____D () C:\ProgramData\BOINC
2015-03-06 21:28 - 2014-10-26 16:38 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-06 21:20 - 2014-11-15 13:03 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-06 20:57 - 2014-10-26 17:06 - 00047539 _____ () C:\Windows\SysWOW64\Gms.log
2015-03-06 20:02 - 2014-10-26 17:08 - 00000000 ____D () C:\Program Files (x86)\Dell Backup and Recovery
2015-03-06 20:00 - 2009-07-13 23:45 - 00021312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-06 20:00 - 2009-07-13 23:45 - 00021312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-06 19:59 - 2009-07-14 00:13 - 00798530 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-06 19:58 - 2014-10-26 16:38 - 01665956 _____ () C:\Windows\WindowsUpdate.log
2015-03-06 19:56 - 2014-11-29 16:32 - 00008192 _____ () C:\Windows\SysWOW64\WDPABKP.dat
2015-03-06 19:56 - 2014-11-15 13:03 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-06 19:56 - 2014-11-01 11:51 - 00131072 ___SH () C:\CredSED.dat
2015-03-06 19:54 - 2015-01-11 15:06 - 00007972 _____ () C:\Windows\setupact.log
2015-03-06 19:54 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-06 17:43 - 2014-11-02 00:09 - 00000000 ____D () C:\ProgramData\MFAData
2015-03-06 06:04 - 2014-11-02 12:58 - 00000000 ____D () C:\Program Files (x86)\NetSetMan
2015-03-05 21:45 - 2014-11-03 20:35 - 00000000 ____D () C:\ProgramData\Garmin
2015-03-05 21:45 - 2014-11-03 20:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
2015-03-05 21:45 - 2014-11-03 20:33 - 00000000 ____D () C:\Program Files (x86)\Garmin
2015-03-05 21:44 - 2014-10-26 16:47 - 00000000 ____D () C:\ProgramData\Package Cache
2015-03-05 16:33 - 2014-11-02 12:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NetSetMan Pro
2015-03-05 14:18 - 2014-10-26 17:05 - 00000000 ____D () C:\Program Files (x86)\Dell
2015-03-05 06:55 - 2014-11-01 20:20 - 00000000 ____D () C:\Users\Henry\AppData\Roaming\.oit
2015-03-05 06:01 - 2014-11-04 06:34 - 00007636 _____ () C:\Users\Henry\AppData\Local\Resmon.ResmonCfg
2015-03-05 05:55 - 2009-07-13 23:45 - 00317552 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-04 17:49 - 2014-11-02 11:05 - 00000000 ____D () C:\Windows\Downloaded Installations
2015-03-04 17:41 - 2014-11-01 10:33 - 00079072 _____ () C:\Users\Henry\AppData\Local\GDIPFONTCACHEV1.DAT
2015-03-04 06:56 - 2014-11-01 13:31 - 00000000 ____D () C:\Users\Henry\Documents\AGFM
2015-03-04 06:54 - 2014-11-17 06:00 - 00000000 ____D () C:\Program Files (x86)\Xerox
2015-03-04 06:54 - 2014-11-03 16:33 - 00000072 _____ () C:\Users\Public\LMDebug.log
2015-03-03 22:11 - 2014-11-01 19:58 - 00000000 ____D () C:\Program Files\Common Files\Visioneer
2015-03-03 21:35 - 2014-11-11 17:49 - 00000000 ____D () C:\Program Files (x86)\Visioneer
2015-03-03 21:35 - 2014-11-01 19:58 - 00000000 ____D () C:\Windows\Twain_64
2015-03-03 16:39 - 2014-11-09 01:18 - 00001386 _____ () C:\Users\Henry\Desktop\Lock Computer.lnk
2015-03-03 09:17 - 2009-07-14 00:08 - 00032656 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-03-02 17:29 - 2014-11-18 17:09 - 00000184 _____ () C:\Windows\setscan.ini
2015-03-01 09:47 - 2014-11-05 20:40 - 00074240 _____ () C:\Users\Henry\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-03-01 09:32 - 2014-11-01 15:59 - 00000000 ____D () C:\Users\Henry\Documents\D
2015-02-28 22:17 - 2015-01-14 16:53 - 00006478 _____ () C:\Windows\PFRO.log
2015-02-28 22:16 - 2014-10-26 18:32 - 00000000 ____D () C:\Windows\CSC
2015-02-28 22:13 - 2009-07-13 21:34 - 00000439 _____ () C:\Windows\win.ini
2015-02-28 22:06 - 2011-02-10 09:33 - 00798530 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-02-28 20:57 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\registration
2015-02-28 18:17 - 2014-11-11 21:48 - 00000818 __RSH () C:\Users\Henry\ntuser.pol
2015-02-28 18:17 - 2014-11-01 10:31 - 00000000 ____D () C:\Users\Henry
2015-02-27 08:33 - 2015-01-14 16:49 - 00020844 _____ () C:\Windows\DPINST.LOG
2015-02-27 08:32 - 2014-11-04 22:39 - 00000000 ____D () C:\Program Files\Common Files\Western Digital
2015-02-27 08:32 - 2014-11-01 13:24 - 00000000 ____D () C:\Program Files (x86)\Western Digital
2015-02-27 08:32 - 2014-11-01 12:46 - 00000000 ____D () C:\ProgramData\Western Digital
2015-02-26 17:52 - 2009-07-13 22:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2015-02-26 14:34 - 2014-11-01 12:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-26 11:31 - 2015-01-03 09:26 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-26 11:29 - 2015-01-03 09:26 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-26 11:07 - 2014-11-02 00:12 - 00000000 ____D () C:\ProgramData\AVG2015
2015-02-26 10:35 - 2014-11-02 00:27 - 00000227 _____ () C:\Users\Henry\AppData\Roaming\RmUserCfg.ini
2015-02-26 10:30 - 2014-11-02 00:27 - 00000048 _____ () C:\Users\Henry\AppData\Roaming\IpAndPort.fig
2015-02-25 23:06 - 2014-11-01 19:32 - 00000000 ____D () C:\Users\Henry\Documents\MyCloud
2015-02-25 22:44 - 2014-11-01 13:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Western Digital
2015-02-25 09:10 - 2009-07-13 21:34 - 00000215 _____ () C:\Windows\system.ini
2015-02-23 16:39 - 2014-12-31 10:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla FireFox Update
2015-02-20 18:26 - 2014-10-26 17:07 - 00001974 _____ () C:\Users\Public\Desktop\Protected Workspace.lnk
2015-02-20 18:26 - 2014-10-26 17:07 - 00000000 ____D () C:\Program Files (x86)\Invincea
2015-02-20 13:08 - 2014-11-14 22:26 - 00001063 _____ () C:\Users\Public\Desktop\AnyDVD.lnk
2015-02-19 21:31 - 2014-11-01 12:58 - 00000000 ____D () C:\Users\Henry\Documents\Garmin Data
2015-02-18 07:42 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\rescache
2015-02-16 16:28 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\tracing
2015-02-13 21:01 - 2014-11-01 19:09 - 00000000 ____D () C:\Users\Henry\Documents\Garmin
2015-02-13 20:50 - 2014-11-03 20:32 - 00000000 ____D () C:\Users\Henry\AppData\Roaming\GARMIN
2015-02-13 20:38 - 2014-11-03 20:35 - 00000000 ____D () C:\Users\Henry\AppData\Local\Garmin
2015-02-12 17:16 - 2014-11-01 13:28 - 00000000 ____D () C:\Users\Henry\AppData\Local\CrashDumps
2015-02-12 17:16 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-02-12 16:46 - 2014-11-01 11:00 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-12 16:41 - 2014-11-01 11:00 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-11 11:04 - 2014-10-26 16:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2015-02-11 11:04 - 2014-10-26 16:40 - 00000000 ____D () C:\Program Files\Dell
2015-02-09 21:22 - 2014-11-01 19:10 - 00000000 ____D () C:\Users\Henry\Documents\Humor
2015-02-09 05:38 - 2014-11-17 06:06 - 00000576 _____ () C:\wifi-debug.xml
2015-02-07 12:17 - 2014-11-01 20:09 - 00000000 ____D () C:\Users\Henry\Documents\Product Manuals
2015-02-05 16:21 - 2014-11-05 18:33 - 00000000 ____D () C:\Users\Henry\AppData\Local\Deployment
2015-02-05 12:28 - 2014-10-26 16:38 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-05 12:28 - 2014-10-26 16:38 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-05 12:28 - 2014-10-26 16:38 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-04 22:15 - 2014-11-15 13:03 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-04 22:15 - 2014-11-15 13:03 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-04 09:27 - 2014-12-26 13:11 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-02-04 09:27 - 2014-12-04 22:11 - 00000000 ____D () C:\ProgramData\Windows VXM
2015-02-04 09:27 - 2014-11-08 17:45 - 00000000 ____D () C:\ProgramData\Ulead Systems
2015-02-04 09:27 - 2014-11-03 20:39 - 00000000 ____D () C:\Users\Henry\AppData\Roaming\IrfanView
2015-02-04 09:27 - 2014-11-01 15:06 - 00000000 ____D () C:\Users\Henry\AppData\Roaming\GHISLER
2015-02-04 09:27 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\AppCompat
2015-02-04 09:26 - 2010-11-21 02:16 - 00000000 ___RD () C:\Users\Public\Recorded TV

==================== Files in the root of some directories =======

2014-12-25 11:45 - 2015-01-19 21:59 - 0000263 _____ () C:\Users\Henry\AppData\Roaming\Binary Clock_Settings.ini
2014-11-02 00:27 - 2015-02-26 10:30 - 0000048 _____ () C:\Users\Henry\AppData\Roaming\IpAndPort.fig
2014-11-02 00:27 - 2015-02-26 10:35 - 0000227 _____ () C:\Users\Henry\AppData\Roaming\RmUserCfg.ini
2014-11-05 20:40 - 2015-03-01 09:47 - 0074240 _____ () C:\Users\Henry\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-11-01 17:45 - 2014-11-01 17:45 - 0000093 _____ () C:\Users\Henry\AppData\Local\fusioncache.dat
2014-11-04 06:34 - 2015-03-05 06:01 - 0007636 _____ () C:\Users\Henry\AppData\Local\Resmon.ResmonCfg
2014-11-12 21:31 - 2014-11-12 21:31 - 0000040 ___SH () C:\ProgramData\.zreglib

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-03-05 07:25

==================== End Of Log ============================

jhrowehl · Mar 7, 2015

I ran SpyBot, and all checks came up clean. Then I ran MalwareBytes... here's it's log:

<?xml version="1.0" encoding="UTF-16" ?>
<mbam-log>
<header>
<date>2015/03/07 10:10:21 -0500</date>
<logfile>mbam-log-2015-03-07 (10-10-20).xml</logfile>
<isadmin>no</isadmin>
</header>
<engine>
<version>2.00.4.1028</version>
<malware-database>v2015.03.07.03</malware-database>
<rootkit-database>v2015.02.25.01</rootkit-database>
<license>free</license>
<file-protection>disabled</file-protection>
<web-protection>disabled</web-protection>
<self-protection>disabled</self-protection>
</engine>
<system>
<osversion>Windows 7 Service Pack 1</osversion>
<arch>x64</arch>
<username>Henry</username>
<filesys>NTFS</filesys>
</system>
<summary>
<type>threat</type>
<result>completed</result>
<objects>378711</objects>
<time>460</time>
<processes>1</processes>
<modules>0</modules>
<keys>1</keys>
<values>0</values>
<datas>0</datas>
<folders>2</folders>
<files>5</files>
<sectors>0</sectors>
</summary>
<options>
<memory>enabled</memory>
<startup>enabled</startup>
<filesystem>enabled</filesystem>
<archives>disabled</archives>
<rootkits>enabled</rootkits>
<deeprootkit>disabled</deeprootkit>
<heuristics>enabled</heuristics>
<pup>enabled</pup>
<pum>enabled</pum>
</options>
<items>
<process><path>C:\Program Files (x86)\Windows Network Accelerater\v3\winvxm.exe</path><vendor>PUP.Optional.VXMClient.A</vendor><action>delete-on-reboot</action><pid>4644</pid><hash>1d9244fe9bef87af1b9d653d6d96b749</hash></process>
<key><path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WindowsVNT_R3</path><vendor>PUP.Optional.VXMClient.A</vendor><action>success</action><hash>1d9244fe9bef87af1b9d653d6d96b749</hash></key>
<folder><path>C:\Program Files (x86)\Windows Network Accelerater\v3</path><vendor>PUP.Optional.VXMClient.A</vendor><action>delete-on-reboot</action><hash>713e58ea375353e313238b1760a3649c</hash></folder>
<folder><path>C:\Program Files (x86)\Windows Network Accelerater\v3\config</path><vendor>PUP.Optional.VXMClient.A</vendor><action>success</action><hash>713e58ea375353e313238b1760a3649c</hash></folder>
<file><path>C:\Program Files (x86)\Windows Network Accelerater\v3\winvxm.exe</path><vendor>PUP.Optional.VXMClient.A</vendor><action>delete-on-reboot</action><hash>1d9244fe9bef87af1b9d653d6d96b749</hash></file>
<file><path>C:\Program Files (x86)\Windows Network Accelerater\v3\systeinfo.vpx</path><vendor>PUP.Optional.VXMClient.A</vendor><action>success</action><hash>713e58ea375353e313238b1760a3649c</hash></file>
<file><path>C:\Program Files (x86)\Windows Network Accelerater\v3\vxmclient.ex1</path><vendor>PUP.Optional.VXMClient.A</vendor><action>success</action><hash>713e58ea375353e313238b1760a3649c</hash></file>
<file><path>C:\Program Files (x86)\Windows Network Accelerater\v3\vxmclient.exe</path><vendor>PUP.Optional.VXMClient.A</vendor><action>success</action><hash>713e58ea375353e313238b1760a3649c</hash></file>
<file><path>C:\Program Files (x86)\Windows Network Accelerater\v3\config\systeinfo.vpx</path><vendor>PUP.Optional.VXMClient.A</vendor><action>success</action><hash>713e58ea375353e313238b1760a3649c</hash></file>
</items>
</mbam-log>

Juliet · Mar 7, 2015

We generally ask people to uninstall/delete - Enigma Software Group\SpyHunter
because of bogus claims of what it says it finds, that program has dubious history.

~~~~

Please run the Farbar Recovery Scan Tool.
Enter vxmclient in the Search Box.

click the Search Registry button, post the content of the Search.txt file in your next reply.

~~~~

Please go to one of the below sites to scan the following files:
Virus Total (Recommended)
jotti.org
VirScan
click on Browse, and upload the following file for analysis:

C:\Program Files (x86)\Windows Network Accelerater\v3\winvxm.exe

Then click Submit. Allow the file to be scanned, and then please copy and paste the results link (for Virus Total) here for me to see.
If it says already scanned -- click "reanalyze now"
Please post the results in your next reply.

Please also have this file scanned

C:\Program Files (x86)\YouTube-Downloader\A4\youtubeserv.exe

~~~~

Did you allow that last MBAM scan to delete/quarantine what it found?

Let me have you do a clean removal and reinstall of MBAM

Please uninstall your current version of MBAM and reinstall the latest version. MBAM Clean Removal Process 2x

Then restart the computer again.
**
Next, Please open Malwarebytes Anti-Malware and from the Dashboard please Check for Updates by clicking the Update Now... link
Open up Malwarebytes > Settings > Detection and Protection > Enable Scan for rootkits, Under Non Malware Protection set both PUP and PUM to Treat detections as malware.
Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button. Remove any threats found
Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.

~~~~

Panda Cloud Cleaner

Panda Cloud Cleaner

Please download Panda Cloud Cleaner and save the file to your Desktop.
Temporarily disable your anti-virus software. For instructions, please refer to the following link.
Right-Click PandaCloudCleaner.exe and select
Run as administrator to run the programme.
Click Next, followed by Next, followed by Finished.
Click Accept and Scan.
Allow Updates to download, and the scan to commence.
Upon completion, allow the results to be sent to the Cloud.
On the Scan finished screen, click

. Do NOT click Clean.
Re-enable your anti-virus software.
Press the Windows Key

+ r on your keyboard at the same time. Type C:\Program Files (x86)\Panda Security\Panda Cloud Cleaner\PCloudCleaner.log and click OK.
A log (PCloudCleaner.log) will open. Copy the contents of the log and paste in your next reply.

Panda Cloud Cleaner tutorial

Please post
Files to be scanned
files from FRST scan
PCloudCleaner.log

jhrowehl · Mar 7, 2015

Juliet said:
We generally ask people to uninstall/delete - Enigma Software Group\SpyHunter
because of bogus claims of what it says it finds, that program has dubious history.

~~~~

Please run the Farbar Recovery Scan Tool.
Enter vxmclient in the Search Box.

click the Search Registry button, post the content of the Search.txt file in your next reply.

Did that last night, do you need it again?

Juliet said:
Did you allow that last MBAM scan to delete/quarantine what it found?

Yes, I did. But I still have the problem.

I'll see if the file scan has any results... those files should have been quarantined by MalwareBytes.

Juliet · Mar 7, 2015

Please run the Farbar Recovery Scan Tool.
Enter vxmclient in the Search Box.

click the Search Registry button, post the content of the Search.txt file in your next reply.
Did that last night, do you need it again?

~~~

If you did I'm not finding it posted?

Did you run the Panda Cloud Cleaner?

New advertising malware?

New member

Attachments

New member

Attachments

New member

Attachments

New member

Attachments

Security Expert-emeritus

New member

Security Expert-emeritus

New member

New member

Attachments

Security Expert-emeritus

New member

Attachments

Security Expert-emeritus

New member

Security Expert-emeritus

Security Expert-emeritus

New member

Attachments

New member

Security Expert-emeritus

New member

Security Expert-emeritus