Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-11-2014
Ran by Owner (administrator) on ACER on 08-11-2014 18:08:39
Running from C:\Users\klt_c_000\Desktop
Loaded Profile: Owner (Available profiles: Owner)
Platform: Windows 8.1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Safe Mode (with Networking)
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\InputMethod\CHS\ChsIME.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(www.1HourSoftware.com) C:\Users\klt_c_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DimScreen.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [BtPreLoad] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtPreLoad.exe [64640 2012-11-09] ()
HKLM\...\Run: [SoftEther VPN Client UI Helper] => C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe [4308024 2013-10-10] (SoftEther Project at University of Tsukuba, Japan.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12558440 2014-01-06] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2226280 2014-01-06] (Realtek Semiconductor)
HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Dolby PCEE4\pcee4.exe [508256 2012-04-23] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [2994880 2012-08-15] (Symantec Corporation)
HKLM-x32\...\Run: [SSBkgdUpdate] => C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PaperPort PTD] => C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe [30248 2007-01-29] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [IndexSearch] => C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe [46632 2007-01-29] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PPort11reminder] => C:\Program Files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe [255528 2007-02-01] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [mcui_exe] => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2014817278-731190031-577545044-1002\...\Run: [uTorrent] => C:\Users\klt_c_000\Desktop\uTorrent (2).exe [1268816 2014-04-25] (BitTorrent Inc.)
HKU\S-1-5-21-2014817278-731190031-577545044-1002\...\Run: [Ajhworks] => C:\Users\klt_c_000\AppData\Local\Ajhworks\UPI_r.exe
HKU\S-1-5-21-2014817278-731190031-577545044-1002\...\Run: [Iwtwsoft] => regsvr32.exe C:\Users\klt_c_000\AppData\Local\Iwtwsoft\WkwNetM.dll <===== ATTENTION
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Hand Gesture Control.lnk
ShortcutTarget: Hand Gesture Control.lnk -> C:\Windows\Installer\{4B145183-E986-4585-ADDF-0C73DB575112}\NewShortcut2_B6E756492E054C52892B86CE7391EFC9.exe (Flexera Software LLC)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SoftEther VPN Client Manager Startup.lnk
ShortcutTarget: SoftEther VPN Client Manager Startup.lnk -> C:\Program Files\SoftEther VPN Client\vpncmgr_x64.exe (SoftEther Project at University of Tsukuba, Japan.)
Startup: C:\Users\klt_c_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DimScreen.exe (www.1HourSoftware.com)
Startup: C:\Users\klt_c_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Start Throttlestop.bat ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: proxy.singnet.com.sg:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://acer13.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acer13.msn.com
URLSearchHook: HKCU - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
URLSearchHook: HKCU - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
SearchScopes: HKLM - DefaultScope {9BC710FA-6863-4DBF-AFBC-9CDAC575ED35} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM - {9BC710FA-6863-4DBF-AFBC-9CDAC575ED35} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {9BC710FA-6863-4DBF-AFBC-9CDAC575ED35} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKCU - {9BC710FA-6863-4DBF-AFBC-9CDAC575ED35} URL = 
BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
BHO-x32: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
BHO-x32: Free Download Manager -> {CC59E0F9-7E43-44FA-9FAA-8377850BF205} -> C:\Program Files (x86)\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor [2013-05-18]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.com
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\pdf.dll ()
CHR Plugin: (McAfee SiteAdvisor) - C:\Users\klt_c_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.60.126.1_0\McChPlg.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
CHR Plugin: (McAfee SecurityCenter) - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL No File
CHR Profile: C:\Users\klt_c_000\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\klt_c_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-03-16]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\klt_c_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-24]
CHR Extension: (YouTube) - C:\Users\klt_c_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-03-16]
CHR Extension: (Adblock Plus) - C:\Users\klt_c_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-04-06]
CHR Extension: (Google Search) - C:\Users\klt_c_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-03-16]
CHR Extension: (SiteAdvisor) - C:\Users\klt_c_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2013-05-18]
CHR Extension: (Google Wallet) - C:\Users\klt_c_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Gmail) - C:\Users\klt_c_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-03-16]
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2014-10-09]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [231040 2012-11-09] (Qualcomm Atheros Commnucations)
S2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2449552 2012-10-09] (Acer Incorporated)
S3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-23] (Acer Incorporated)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation)
S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-14] (Microsoft Corporation)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S2 McAfee SiteAdvisor Service; c:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe [156904 2014-09-23] (McAfee, Inc.)
S2 MfeASUM; C:\Program Files\McAfee\AppStats\MfeASUM.exe [335216 2013-08-08] (McAfee, Inc.)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-03-06] (Microsoft Corporation)
S3 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [3943104 2012-08-15] (Symantec Corporation)
S3 PGService; C:\Program Files (x86)\PointGrab\Hand Gesture Control\PGService.exe [53616 2012-08-22] (PointGrab LTD)
S3 SEVPNCLIENT; C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe [4308024 2013-10-10] (SoftEther Project at University of Tsukuba, Japan.)
S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation)
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-05] (Microsoft Corporation)
S1 ccSet_NARA; C:\Windows\system32\drivers\NARAx64\0401000.00E\ccSetx64.sys [168608 2012-05-26] (Symantec Corporation)
S3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)
S1 MfeASKM; C:\Program Files\McAfee\AppStats\MfeASKM.sys [31408 2013-08-08] (McAfee, Inc.)
S3 Neo_VPN; C:\Windows\system32\DRIVERS\Neo_VPN.sys [28768 2013-10-10] (SoftEther Project at University of Tsukuba, Japan.)
S2 RtkIOAC60; C:\Windows\system32\DRIVERS\RtkIOAC60.sys [38504 2012-04-16] (Windows (R) Codename Longhorn DDK provider)
S3 ssudserd; C:\Windows\system32\DRIVERS\ssudserd.sys [206080 2014-01-22] (DEVGURU Co., LTD.(www.devguru.co.kr))
S3 taphss6; C:\Windows\system32\DRIVERS\taphss6.sys [42184 2013-04-25] (Anchorfree Inc.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
S3 WinRing0_1_2_0; C:\Users\klt_c_000\Desktop\ThrottleStop_500\WinRing0x64.sys [14544 2013-03-16] (OpenLibSys.org)
S3 BTATH_LWFLT; \SystemRoot\system32\DRIVERS\btath_lwflt.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-09 08:55 - 2014-11-09 08:55 - 00000000 _____ () C:\Recovery.txt
2014-11-08 17:10 - 2014-11-08 17:55 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-11-08 17:10 - 2014-11-08 17:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-11-08 17:10 - 2014-11-08 17:10 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-11-08 17:10 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-11-08 17:10 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-11-08 17:10 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-11-08 16:43 - 2014-11-08 16:43 - 05593178 _____ (Swearware) C:\Users\klt_c_000\Desktop\ComboFix.exe
2014-11-08 16:40 - 2014-11-08 16:40 - 00036141 _____ () C:\Users\klt_c_000\Desktop\Addition.txt
2014-11-08 16:39 - 2014-11-08 18:08 - 00000000 _____ () C:\Users\klt_c_000\Desktop\FRST.txt
2014-11-08 16:37 - 2014-11-08 18:08 - 00000000 ____D () C:\FRST
2014-11-08 16:37 - 2014-11-08 16:37 - 02115072 _____ (Farbar) C:\Users\klt_c_000\Desktop\FRST64.exe
2014-11-08 16:04 - 2014-11-08 16:04 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-11-08 15:53 - 2014-11-08 16:52 - 00002572 _____ () C:\Users\klt_c_000\Desktop\Rkill.txt
2014-11-08 15:53 - 2014-11-08 15:49 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\klt_c_000\Desktop\mbam-setup-2.0.3.1025.exe
2014-11-08 15:53 - 2014-11-08 15:47 - 01944824 _____ (Bleeping Computer, LLC) C:\Users\klt_c_000\Desktop\rkill.exe
2014-11-08 15:08 - 2014-11-08 15:09 - 00000000 ____D () C:\Users\klt_c_000\AppData\Local\Iwtwsoft
2014-11-08 15:08 - 2014-11-08 15:08 - 00009692 _____ () C:\Users\klt_c_000\AppData\Roaming\brutedb.bin
2014-11-07 12:29 - 2014-11-07 12:31 - 06550801 ____H () C:\Users\klt_c_000\Downloads\GQ-445-HD.part5.rar
2014-11-07 12:28 - 2014-11-07 13:12 - 264241152 ____H () C:\Users\klt_c_000\Downloads\GQ-445-HD.part3.rar
2014-11-07 12:28 - 2014-11-07 13:05 - 264241152 ____H () C:\Users\klt_c_000\Downloads\GQ-445-HD.part4.rar
2014-11-07 12:27 - 2014-11-07 13:01 - 264241152 ____H () C:\Users\klt_c_000\Downloads\GQ-445-HD.part2.rar
2014-11-07 12:26 - 2014-11-07 13:06 - 264241152 ____H () C:\Users\klt_c_000\Downloads\GQ-445-HD.part1.rar
2014-10-28 23:56 - 2014-10-29 00:00 - 10307702 _____ () C:\Users\klt_c_000\Downloads\DraStic r2.2.1.2a By Adromulator (1).apk
2014-10-28 23:46 - 2014-10-28 23:46 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2014-10-25 23:55 - 2014-10-25 23:55 - 00473636 _____ () C:\Users\klt_c_000\Desktop\wedding.htm
2014-10-24 21:28 - 2013-01-30 02:10 - 689419256 _____ () C:\Users\klt_c_000\Desktop\02070006.AVI
2014-10-22 16:49 - 2014-10-22 16:49 - 232482959 ____H () C:\Users\klt_c_000\Downloads\dOglgw9MeeXnw5LgPoV1pyBR3-adultddl.ws.wmv
2014-10-15 20:37 - 2014-09-28 06:25 - 04183040 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2014-10-15 20:37 - 2014-09-13 14:29 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\system32\packager.dll
2014-10-15 20:37 - 2014-09-13 13:49 - 00068608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\packager.dll
2014-10-15 20:36 - 2014-09-26 06:50 - 13619200 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-10-15 20:36 - 2014-09-26 06:46 - 00243200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-10-15 20:36 - 2014-09-26 06:46 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-10-15 20:36 - 2014-09-26 06:43 - 11807232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-10-15 20:36 - 2014-09-26 06:32 - 02017280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-10-15 20:36 - 2014-09-26 06:31 - 02108416 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-10-15 20:36 - 2014-09-19 10:25 - 23631360 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-10-15 20:36 - 2014-09-19 09:44 - 17484800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-10-15 20:36 - 2014-09-19 09:41 - 02796032 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-10-15 20:36 - 2014-09-19 09:40 - 00547328 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-10-15 20:36 - 2014-09-19 09:38 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-10-15 20:36 - 2014-09-19 09:36 - 05829632 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-10-15 20:36 - 2014-09-19 09:25 - 04201472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-10-15 20:36 - 2014-09-19 09:25 - 00758272 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2014-10-15 20:36 - 2014-09-19 09:02 - 00454656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-10-15 20:36 - 2014-09-19 09:00 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-10-15 20:36 - 2014-09-19 08:59 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-10-15 20:36 - 2014-09-19 08:58 - 00289280 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-10-15 20:36 - 2014-09-19 08:55 - 02187264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-10-15 20:36 - 2014-09-19 08:42 - 00731136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-10-15 20:36 - 2014-09-19 08:42 - 00710656 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-10-15 20:36 - 2014-09-19 08:42 - 00363008 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-10-15 20:36 - 2014-09-19 08:33 - 02309632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-10-15 20:36 - 2014-09-19 08:20 - 00607744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-10-15 20:36 - 2014-09-19 08:20 - 00315904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-10-15 20:36 - 2014-09-19 08:14 - 01447936 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-10-15 20:36 - 2014-09-19 07:59 - 01810944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-10-15 20:36 - 2014-09-19 07:59 - 00775168 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-10-15 20:36 - 2014-09-19 07:53 - 01190400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-10-15 20:36 - 2014-09-19 07:52 - 00678400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-10-15 20:35 - 2014-09-04 08:10 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbici.dll
2014-10-15 20:35 - 2014-09-04 07:57 - 00921600 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-10-15 20:35 - 2014-09-04 07:49 - 00626688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2014-10-15 20:34 - 2014-09-08 11:15 - 00054752 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2014-10-15 20:34 - 2014-09-08 09:46 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2014-10-15 20:34 - 2014-09-08 09:46 - 00050688 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2014-10-15 20:34 - 2014-09-08 08:08 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2014-10-15 20:34 - 2014-09-08 08:07 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2014-10-15 20:34 - 2014-09-08 08:05 - 03448320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2014-10-15 20:34 - 2014-09-08 08:04 - 00388608 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2014-10-15 20:34 - 2014-09-08 08:04 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2014-10-15 20:34 - 2014-09-08 08:03 - 01702400 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2014-10-15 20:34 - 2014-09-08 08:03 - 00839680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2014-10-15 20:34 - 2014-09-08 07:59 - 00123904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2014-10-15 20:34 - 2014-09-08 07:59 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2014-10-15 20:34 - 2014-09-08 07:56 - 00672256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2014-10-15 20:34 - 2014-09-08 07:56 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2014-10-15 20:34 - 2014-09-04 08:12 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll
2014-10-15 20:34 - 2014-09-04 08:01 - 00514048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll
2014-10-15 20:34 - 2014-08-16 12:08 - 21195616 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2014-10-15 20:34 - 2014-08-16 12:01 - 01710184 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2014-10-15 20:34 - 2014-08-16 11:58 - 01112512 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2014-10-15 20:34 - 2014-08-16 11:57 - 02498880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2014-10-15 20:34 - 2014-08-16 11:16 - 18722600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2014-10-15 20:34 - 2014-08-16 08:23 - 01106432 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchFolder.dll
2014-10-15 20:34 - 2014-08-16 08:18 - 04758528 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncEngine.dll
2014-10-15 20:34 - 2014-08-16 08:17 - 08757760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2014-10-15 20:34 - 2014-08-16 08:13 - 06649344 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2014-10-15 20:34 - 2014-08-16 08:13 - 05902848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2014-10-15 20:34 - 2014-08-16 08:08 - 05777408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2014-10-15 20:33 - 2014-10-10 06:16 - 00678400 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-10-15 20:33 - 2014-10-09 06:09 - 00275968 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2014-10-15 20:33 - 2014-09-19 09:24 - 00527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-10-15 20:33 - 2014-09-13 14:02 - 02779648 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2014-10-15 20:33 - 2014-09-13 13:30 - 03117568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2014-10-15 20:33 - 2014-08-29 09:58 - 00109568 _____ (Microsoft Corporation) C:\WINDOWS\system32\appinfo.dll
2014-10-15 20:33 - 2014-08-29 07:56 - 02646016 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2014-10-15 20:33 - 2014-08-29 07:47 - 02321920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2014-10-15 20:33 - 2014-08-16 12:08 - 01507648 _____ (Microsoft Corporation) C:\WINDOWS\system32\propsys.dll
2014-10-15 20:33 - 2014-08-16 11:57 - 00428864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS
2014-10-15 20:33 - 2014-08-16 11:16 - 01205976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\propsys.dll
2014-10-15 20:33 - 2014-08-16 11:03 - 01467384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2014-10-15 20:33 - 2014-08-16 09:31 - 00838144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2014-10-15 20:33 - 2014-08-16 09:04 - 00359424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wldap32.dll
2014-10-15 20:33 - 2014-08-16 08:58 - 00287744 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemEventsBrokerServer.dll
2014-10-15 20:33 - 2014-08-16 08:53 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\httpprxm.dll
2014-10-15 20:33 - 2014-08-16 08:46 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProximityService.dll
2014-10-15 20:33 - 2014-08-16 08:45 - 00267776 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2014-10-15 20:33 - 2014-08-16 08:43 - 00321024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Wldap32.dll
2014-10-15 20:33 - 2014-08-16 08:43 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\adhsvc.dll
2014-10-15 20:33 - 2014-08-16 08:31 - 00914432 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll
2014-10-15 20:33 - 2014-08-16 08:31 - 00286208 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcsvDevice.dll
2014-10-15 20:33 - 2014-08-16 08:29 - 00249344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-15 20:33 - 2014-08-16 08:22 - 00717824 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveTelemetry.dll
2014-10-15 20:33 - 2014-08-16 08:22 - 00286208 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveShell.dll
2014-10-15 20:33 - 2014-08-16 08:19 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-15 20:33 - 2014-08-16 08:14 - 00265216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SkyDriveShell.dll
2014-10-15 20:33 - 2014-08-16 08:13 - 00840192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchFolder.dll
2014-10-15 20:33 - 2014-08-16 08:11 - 00920064 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2014-10-15 20:33 - 2014-08-16 08:10 - 01120768 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDrive.exe
2014-10-15 20:33 - 2014-08-16 08:07 - 00756224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2014-10-15 20:33 - 2014-08-01 07:22 - 00388729 _____ () C:\WINDOWS\system32\ApnDatabase.xml

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-08 17:56 - 2013-08-22 22:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-11-08 17:55 - 2013-03-16 23:24 - 00000912 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-08 17:17 - 2013-09-25 22:54 - 00000000 ____D () C:\Users\klt_c_000\AppData\Roaming\uTorrent
2014-11-08 16:53 - 2013-03-16 13:09 - 00003594 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2014817278-731190031-577545044-1002
2014-11-08 16:36 - 2014-04-22 21:36 - 00000000 ____D () C:\Users\klt_c_000\Desktop\New folder
2014-11-08 16:34 - 2013-09-30 11:55 - 00030788 _____ () C:\WINDOWS\PFRO.log
2014-11-08 16:33 - 2013-08-22 23:36 - 00000000 ____D () C:\WINDOWS\Vss
2014-11-08 16:02 - 2013-09-30 12:04 - 00863592 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-11-08 15:55 - 2013-10-20 02:56 - 01752232 _____ () C:\WINDOWS\WindowsUpdate.log
2014-11-08 15:52 - 2013-08-22 22:46 - 00297414 _____ () C:\WINDOWS\setupact.log
2014-11-08 15:31 - 2013-03-16 23:24 - 00000916 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-08 15:30 - 2013-03-28 05:01 - 00000000 ____D () C:\Users\klt_c_000\AppData\Local\clear.fi
2014-11-08 15:20 - 2014-02-14 23:40 - 00003910 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{DE1A8D6A-D88A-4CEC-B6DC-1260C57AF5BE}
2014-11-08 15:18 - 2013-08-22 23:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-11-08 15:11 - 2013-03-16 13:50 - 34589560 ____H () C:\Users\klt_c_000\Documents\PP11Thumbs.ptn
2014-11-08 15:09 - 2014-10-06 23:28 - 00025497 ____H () C:\Users\klt_c_000\Documents\PP11Thumbs.ptn2
2014-11-08 14:11 - 2012-07-26 15:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-11-07 15:36 - 2013-08-22 21:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2014-11-07 04:24 - 2013-03-16 16:38 - 00010380 ____H () C:\Users\klt_c_000\Documents\maxdesk.ini2
2014-11-06 04:02 - 2013-10-20 02:40 - 00000000 ____D () C:\Users\klt_c_000
2014-11-05 20:50 - 2013-08-22 23:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-11-03 12:23 - 2013-03-16 13:02 - 00000000 ____D () C:\Users\klt_c_000\AppData\Local\VirtualStore
2014-10-30 19:25 - 2014-07-04 21:16 - 00275080 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2014-10-29 04:33 - 2013-03-16 23:27 - 00002207 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-10-20 22:35 - 2012-07-26 16:12 - 00000000 ____D () C:\WINDOWS\LiveKernelReports
2014-10-20 18:26 - 2013-03-16 23:24 - 00003888 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2014-10-20 18:26 - 2013-03-16 23:24 - 00003652 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2014-10-19 22:23 - 2013-10-10 20:32 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-10-19 22:20 - 2013-03-18 15:26 - 103265616 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-10-19 00:23 - 2013-04-13 14:40 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-10-16 20:15 - 2013-08-22 23:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-10-16 10:53 - 2013-10-20 03:05 - 00000000 ___RD () C:\Users\klt_c_000\SkyDrive
2014-10-16 10:52 - 2013-08-22 22:44 - 00337840 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-10-16 04:29 - 2014-07-10 16:08 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-10-16 04:29 - 2013-08-22 23:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-10-16 04:29 - 2013-08-22 23:36 - 00000000 ____D () C:\WINDOWS\WinStore
2014-10-16 04:29 - 2013-08-22 23:36 - 00000000 ____D () C:\WINDOWS\MediaViewer
2014-10-16 04:29 - 2013-08-22 23:36 - 00000000 ____D () C:\WINDOWS\FileManager
2014-10-16 04:29 - 2013-08-22 23:36 - 00000000 ____D () C:\WINDOWS\Camera
2014-10-09 19:13 - 2013-05-18 15:36 - 00000000 ____D () C:\Program Files (x86)\McAfee

Some content of TEMP:
====================
C:\Users\klt_c_000\AppData\Local\Temp\bitool.dll
C:\Users\klt_c_000\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-08 13:51

==================== End Of Log ============================