Hi - thanks for reading my post.
My google chrome started acting funny recently (last few weeks) I ran malwarebytes and it did quarantine a number of 'trojan' files but the problem persists. After researching I came across the issue of multiple chrome 32* processes (high CPU usage) running even after chrome is shut down and I discovered that was happening on my machine. reinstalling didn't solve the problem.
Also - I had some adware my kids accidentally installed on my computer over a month ago that I thought I had removed but malwarebytes keeps finding them and saying they are quarantined but they keep showing up in the 'files detected'. Those file names are temp 2F88 and temp 696A
I have attached the logs below. Anything you could do to help would be very very much appreciated.
THANK YOU
===========
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by fabfour (administrator) on MGVCWLT098992 on 01-04-2015 23:14:43
Running from C:\Users\fabfour\Desktop
Loaded Profiles: fabfour (Available profiles: Teresa Smith & fabfour)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 9 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Symantec Corporation) C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
(Amazon.com) C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
(DameWare Development LLC) C:\Windows\dwrcs\DWRCS.EXE
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
( ) C:\Windows\System32\lxddcoms.exe
() C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Client Server Security Agent\Ntrtscan.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(Ulead Systems, Inc.) C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Client Server Security Agent\HostedAgent\svcGenericHost.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmListen.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
(Specops Software) C:\Windows\System32\SppClient.exe
() C:\Program Files (x86)\Lexmark 2500 Series\lxddmon.exe
(Lexmark) C:\Program Files (x86)\Lexmark 2500 Series\lxddamon.exe
(DameWare Development) C:\Windows\dwrcs\DWRCST.EXE
(Docudesk Corporation) C:\Program Files (x86)\Docudesk\deskPDF Studio X\deskPDFCreator.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
(Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Client Server Security Agent\PccNtMon.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe
(Amazon.com) C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
() C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Client Server Security Agent\HostedAgent\HostedAgent.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
(Symantec Corporation) C:\Program Files\Altiris\Altiris Agent\AeXAgentUIHost.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Symantec Corporation) C:\Program Files\Altiris\Altiris Agent\x86\AeXNSAgentHostSurrogate32.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmProxy.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTStackServer.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Message Center Plus\MCPLaunch.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PrivacyIconClient.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
(Microsoft Corporation) C:\Windows\System32\prevhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
(Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
(Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12480616 2012-04-17] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1158248 2012-03-09] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916112 2012-04-08] (Synaptics Incorporated)
HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [382528 2012-02-25] (Lenovo.)
HKLM\...\Run: [LENOVO.TPKNRRES] => C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [290160 2012-06-01] (Lenovo Group Limited)
HKLM\...\Run: [Specops Password Client] => C:\Windows\system32\SppClient.exe [896088 2011-06-17] (Specops Software)
HKLM\...\Run: [lxddmon.exe] => C:\Program Files (x86)\Lexmark 2500 Series\lxddmon.exe [291760 2007-02-12] ()
HKLM\...\Run: [lxddamon] => C:\Program Files (x86)\Lexmark 2500 Series\lxddamon.exe [20480 2007-02-05] (Lexmark)
HKLM\...\Run: [LXDDCATS] => rundll32 C:\Windows\system32\spool\DRIVERS\x64\3\LXDDtime.dll,RunDLLEntry
HKLM\...\Run: [DameWare MRC Agent] => C:\Windows\dwrcs\DWRCST.exe [295808 2011-02-25] (DameWare Development)
HKLM-x32\...\Run: [RotateImage] => C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-04-19] (Intel Corporation)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe [133400 2012-02-28] (Intel Corporation)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [507744 2011-12-20] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [PWMTRV] => rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [156000 2013-07-18] (Intel Corporation)
HKLM-x32\...\Run: [Lenovo Registration] => C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe [4351712 2011-07-13] (Lenovo, Inc.)
HKLM-x32\...\Run: [OfficeScanNT Monitor] => C:\Program Files (x86)\Trend Micro\Client Server Security Agent\pccntmon.exe [2853424 2014-03-18] (Trend Micro Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] => C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [267792 2013-01-17] (Research In Motion Limited)
HKLM-x32\...\Run: [Lenovo App Shop] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [156000 2013-07-18] (Intel Corporation)
HKLM-x32\...\Run: [FaxCenterServer] => C:\Program Files (x86)\Lexmark Fax Solutions\fm3032.exe [312240 2007-02-12] ()
HKLM-x32\...\Run: [VMM Mode Selection] => C:\Program Files\HTC\ModeSelection\VMMModeSelection.exe [83448 2013-05-02] ()
HKLM-x32\...\Run: [AmazonGSDownloaderTray] => C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe [326144 2009-10-23] (Amazon.com)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [bovobi] => C:\Users\fabfour\AppData\Local\bovobi\bovobi.exe [349744 2015-03-30] ()
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Symantec <====== ATTENTION
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKLM\...\Policies\Explorer\Run: [bovobi] => C:\Users\fabfour\AppData\Local\bovobi\bovobi.exe [349744 2015-03-30] ( ())
HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore: [DisableSR/DisableConfig] <===== ATTENTION
HKU\S-1-5-21-3170475204-2998451479-513436353-1003\...\Run: [deskPDF Creator] => C:\Program Files (x86)\Docudesk\deskPDF Studio X\deskPDFCreator.exe [2346664 2013-11-02] (Docudesk Corporation)
HKU\S-1-5-21-3170475204-2998451479-513436353-1003\...\Run: [HLBackupScheduler] => "C:\Program Files\Verizon Cloud\Verizon Cloud Service.exe"
HKU\S-1-5-21-3170475204-2998451479-513436353-1003\...\MountPoints2: {75e74f47-123b-11e2-a258-806e6f6e6963} - Q:\LenovoQDrive.exe
HKU\S-1-5-21-3170475204-2998451479-513436353-1003\...\MountPoints2: {b3a55b87-94bb-11e3-b338-e006e6badf2c} - D:\iLinker.exe
HKU\S-1-5-21-3170475204-2998451479-513436353-1003\...\MountPoints2: {e626bbf3-2423-11e3-9930-e006e6badf2c} - F:\setup.exe -a
HKU\S-1-5-18\...\Run: [Exetender] => "C:\Program Files (x86)\Free Ride Games\GPlayer.exe" /runonstartup
Lsa: [Notification Packages] scecli C:\Program Files\ThinkPad\Bluetooth Software\BtwProximityCP.dll C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\fabfour\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-3170475204-2998451479-513436353-1003\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/welcome/thinkpad
HKU\S-1-5-21-3170475204-2998451479-513436353-1003\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co...=LENP&bmod=LENP
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-s...p={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-s...p={searchTerms}
SearchScopes: HKU\S-1-5-21-3170475204-2998451479-513436353-1003 -> DefaultScope {978D1B70-5A61-4740-9CF5-57C8DB7EB841} URL = http://search.findwi...k={searchTerms}
SearchScopes: HKU\S-1-5-21-3170475204-2998451479-513436353-1003 -> {170EC34F-489A-4E92-A140-D9EF35576EDE} URL = http://search.yahoo....petb&type=10881
SearchScopes: HKU\S-1-5-21-3170475204-2998451479-513436353-1003 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.co...NP_enUS522US525
SearchScopes: HKU\S-1-5-21-3170475204-2998451479-513436353-1003 -> {978D1B70-5A61-4740-9CF5-57C8DB7EB841} URL = http://search.findwi...k={searchTerms}
SearchScopes: HKU\S-1-5-21-3170475204-2998451479-513436353-1003 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-s...p={searchTerms}
BHO: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1084\TmIEPlg.dll [2014-06-10] (Trend Micro Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2013-08-14] (Skype Technologies S.A.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation)
BHO: Symantec VIP Access Add-On -> {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} -> C:\Program Files (x86)\Symantec\VIP Access Client\64bit\VIPAddOnForIE64.dll [2012-04-19] (Symantec Corporation)
BHO-x32: &Yahoo! Toolbar Helper -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll [2013-11-19] (Yahoo! Inc.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-12-18] (Adobe Systems Incorporated)
BHO-x32: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1084\TmIEPlg32.dll [2014-06-10] (Trend Micro Inc.)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-25] (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2013-09-11] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2013-08-14] (Skype Technologies S.A.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation)
BHO-x32: Symantec VIP Access Add-On -> {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} -> C:\Program Files (x86)\Symantec\VIP Access Client\VIPAddOnForIE.dll [2012-04-19] (Symantec Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-25] (Oracle Corporation)
Toolbar: HKLM-x32 - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll [2013-11-19] (Yahoo! Inc.)
Toolbar: HKU\S-1-5-21-3170475204-2998451479-513436353-1003 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: HKLM-x32 {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files (x86)\Yahoo!\Common\Yinsthelper.dll
DPF: HKLM-x32 {6A060448-60F9-11D5-A6CD-0002B31F7455}
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2013-08-14] (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2013-08-14] (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2011-11-03] (Skype Technologies)
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1084\TmIEPlg.dll [2014-06-10] (Trend Micro Inc.)
Handler-x32: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1084\TmIEPlg32.dll [2014-06-10] (Trend Micro Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll [2013-09-13] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-10] (Microsoft Corporation)
FF Plugin: @Skype Technologies S.A..com/Skype Web Plugin -> C:\Program Files (x86)\SkypeWebPlugin\npSkypeWebPlugin64.dll [2013-12-04] (Skype)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll [2013-09-13] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-18] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-01-05] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-01-05] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-25] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-25] (Oracle Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-10] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 -> C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll [2013-04-25] ()
FF Plugin-x32: @Skype Technologies S.A..com/Skype Web Plugin -> C:\Program Files (x86)\SkypeWebPlugin\npSkypeWebPlugin.dll [2013-12-04] (Skype)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2013-02-15] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3170475204-2998451479-513436353-1003: intel.com/AppUp -> C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp.dll [2013-07-18] (Intel)
FF Plugin HKU\S-1-5-21-3170475204-2998451479-513436353-1003: intel.com/AppUpx64 -> C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp_x64.dll [2013-07-18] (Intel)
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-03-10]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-03-10]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\Symantec\VIP Access Client
FF Extension: Symantec VIP Access Add-On - C:\Program Files (x86)\Symantec\VIP Access Client [2012-10-09]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\Symantec\VIP Access Client
FF HKLM-x32\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1084\FirefoxExtension
FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1084\FirefoxExtension [2014-08-17]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\Symantec\VIP Access Client
Chrome:
=======
CHR Profile: C:\Users\fabfour\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\fabfour\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-09-06]
CHR Extension: (Google Drive) - C:\Users\fabfour\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-09-06]
CHR Extension: (YouTube) - C:\Users\fabfour\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-09-06]
CHR Extension: (Google Search) - C:\Users\fabfour\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-09-06]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\fabfour\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-07]
CHR Extension: (Google Wallet) - C:\Users\fabfour\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-06]
CHR Extension: (Gmail) - C:\Users\fabfour\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-09-06]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2013-08-14]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 AeXAgentSrvHost; C:\Program Files\Altiris\Altiris Agent\x86\AeXNSAgentHostSurrogate32.exe [317312 2012-10-01] (Symantec Corporation)
R2 AeXNSClient; C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe [2108800 2012-10-01] (Symantec Corporation)
S3 AltirisAgentProvider; C:\Program Files\Altiris\Altiris Agent\Agents\WMIProviderAgent\AltirisAgentProvider.exe [408448 2012-10-01] (Symantec Corporation)
R2 Amazon Download Agent; C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [401920 2009-10-23] (Amazon.com) [File not signed]
R3 BlackBerry Device Manager; C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [585728 2013-02-06] (Research In Motion Limited) [File not signed]
S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [320576 2012-05-15] (Lenovo.)
R2 dwmrcs; C:\Windows\dwrcs\DWRCS.EXE [693632 2011-02-25] (DameWare Development LLC)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [161560 2012-02-28] (Intel Corporation)
R2 LENOVO.TVTVCAM; C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [179568 2012-06-01] (Lenovo Group Limited)
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [133992 2011-07-12] (Lenovo Group Limited)
S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [272776 2014-10-16] ()
R2 lxdd_device; C:\Windows\system32\lxddcoms.exe [567216 2007-05-25] ( )
R2 lxdd_device; C:\Windows\SysWOW64\lxddcoms.exe [537520 2007-05-25] ( )
R2 MotoHelper; C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe [223088 2011-03-25] ()
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-02-26] ()
R2 ntrtscan; C:\Program Files (x86)\Trend Micro\Client Server Security Agent\ntrtscan.exe [1793424 2014-06-23] (Trend Micro Inc.)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1910640 2015-03-09] (Electronic Arts)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2013-10-17] () [File not signed]
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [24120 2014-02-21] ()
R2 svcGenericHost; C:\Program Files (x86)\Trend Micro\Client Server Security Agent\HostedAgent\svcGenericHost.exe [51760 2014-11-11] (Trend Micro Inc.)
S3 TMBMServer; C:\Program Files (x86)\Trend Micro\BM\TMBMSRV.exe [571928 2013-10-23] (Trend Micro Inc.)
R2 tmlisten; C:\Program Files (x86)\Trend Micro\Client Server Security Agent\tmlisten.exe [1998080 2014-07-24] (Trend Micro Inc.)
R3 TmProxy; C:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmProxy.exe [927768 2013-10-14] (Trend Micro Inc.)
R2 UleadBurningHelper; C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [61440 2008-01-10] (Ulead Systems, Inc.) [File not signed]
R2 VIPAppService; C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe [84080 2012-04-19] (Symantec Corporation)
S4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-02-26] (Intel® Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [163368 2012-03-31] (Broadcom Corporation.)
R3 DwMirror; C:\Windows\System32\DRIVERS\DamewareMini.sys [5632 2008-03-14] (DameWare Development, LLC)
R1 dwvkbd; C:\Windows\System32\DRIVERS\dwvkbd64.sys [30720 2008-03-12] (DameWare)
S3 HtcVCom32; C:\Windows\System32\DRIVERS\HtcVComV64.sys [121800 2010-03-09] (QUALCOMM Incorporated)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [78336 2013-01-03] (Research In Motion Limited)
S3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44544 2012-12-10] (Research in Motion Ltd)
S3 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [85376 2013-08-29] (Trend Micro Inc.)
R1 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [175528 2013-09-02] (Trend Micro Inc.)
S3 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [65336 2013-08-29] (Trend Micro Inc.)
R2 TmFilter; C:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmXPFlt.sys [344864 2013-08-14] (Trend Micro Inc.)
R2 TmPreFilter; C:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmPreFlt.sys [42272 2013-08-14] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [109080 2013-01-09] (Trend Micro Inc.)
R3 TVTI2C; C:\Windows\System32\DRIVERS\Tvti2c.sys [40248 2011-05-29] (Lenovo Information Product(ShenZhen China) Inc.)
R3 tvtvcamd; C:\Windows\System32\DRIVERS\tvtvcamd.sys [27432 2011-12-07] (ThinkVantage Communications Utility)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
R2 VSApiNt; C:\Program Files (x86)\Trend Micro\Client Server Security Agent\VSApiNt.sys [2260768 2013-08-14] (Trend Micro Inc.)
S2 smihlp2; \??\C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [X]
U3 tmpfw; No ImagePath
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-01 23:11 - 2015-04-01 23:12 - 00043568 _____ () C:\Users\fabfour\Desktop\Addition.txt
2015-04-01 23:02 - 2015-04-01 23:03 - 00043570 _____ () C:\Users\fabfour\Downloads\Addition.txt
2015-04-01 23:01 - 2015-04-01 23:14 - 00032501 _____ () C:\Users\fabfour\Desktop\FRST.txt
2015-04-01 23:01 - 2015-04-01 23:14 - 00000000 ____D () C:\FRST
2015-04-01 23:01 - 2015-04-01 23:01 - 02095616 _____ (Farbar) C:\Users\fabfour\Desktop\FRST64.exe
2015-04-01 21:12 - 2015-04-01 21:12 - 00008572 _____ () C:\Users\Teresa.Smith\HELP_DECRYPT.HTML
2015-04-01 21:12 - 2015-04-01 21:12 - 00008572 _____ () C:\Users\Teresa.Smith\Documents\HELP_DECRYPT.HTML
2015-04-01 21:12 - 2015-04-01 21:12 - 00008572 _____ () C:\Users\Teresa.Smith\AppData\Roaming\HELP_DECRYPT.HTML
2015-04-01 21:12 - 2015-04-01 21:12 - 00008572 _____ () C:\Users\Teresa.Smith\AppData\Local\HELP_DECRYPT.HTML
2015-04-01 21:12 - 2015-04-01 21:12 - 00008572 _____ () C:\Users\Teresa.Smith\AppData\HELP_DECRYPT.HTML
2015-04-01 21:12 - 2015-04-01 21:12 - 00008572 _____ () C:\Users\Teresa Smith\HELP_DECRYPT.HTML
2015-04-01 21:12 - 2015-04-01 21:12 - 00008572 _____ () C:\Users\Teresa Smith\AppData\Roaming\HELP_DECRYPT.HTML
2015-04-01 21:12 - 2015-04-01 21:12 - 00008572 _____ () C:\Users\Teresa Smith\AppData\Local\HELP_DECRYPT.HTML
2015-04-01 21:12 - 2015-04-01 21:12 - 00008572 _____ () C:\Users\Teresa Smith\AppData\HELP_DECRYPT.HTML
2015-04-01 21:12 - 2015-04-01 21:12 - 00008572 _____ () C:\Users\mic\HELP_DECRYPT.HTML
2015-04-01 21:12 - 2015-04-01 21:12 - 00008572 _____ () C:\Users\mic\AppData\Roaming\HELP_DECRYPT.HTML
2015-04-01 21:12 - 2015-04-01 21:12 - 00008572 _____ () C:\Users\mic\AppData\Local\HELP_DECRYPT.HTML
2015-04-01 21:12 - 2015-04-01 21:12 - 00008572 _____ () C:\Users\mic\AppData\HELP_DECRYPT.HTML
2015-04-01 21:12 - 2015-04-01 21:12 - 00008572 _____ () C:\Users\HELP_DECRYPT.HTML
2015-04-01 21:12 - 2015-04-01 21:12 - 00008572 _____ () C:\Users\fabfour\HELP_DECRYPT.HTML
2015-04-01 21:12 - 2015-04-01 21:12 - 00004226 _____ () C:\Users\Teresa.Smith\HELP_DECRYPT.TXT
2015-04-01 21:12 - 2015-04-01 21:12 - 00004226 _____ () C:\Users\Teresa.Smith\Documents\HELP_DECRYPT.TXT
2015-04-01 21:12 - 2015-04-01 21:12 - 00004226 _____ () C:\Users\Teresa.Smith\AppData\Roaming\HELP_DECRYPT.TXT
2015-04-01 21:12 - 2015-04-01 21:12 - 00004226 _____ () C:\Users\Teresa.Smith\AppData\Local\HELP_DECRYPT.TXT
2015-04-01 21:12 - 2015-04-01 21:12 - 00004226 _____ () C:\Users\Teresa.Smith\AppData\HELP_DECRYPT.TXT
2015-04-01 21:12 - 2015-04-01 21:12 - 00004226 _____ () C:\Users\Teresa Smith\HELP_DECRYPT.TXT
2015-04-01 21:12 - 2015-04-01 21:12 - 00004226 _____ () C:\Users\Teresa Smith\AppData\Roaming\HELP_DECRYPT.TXT
2015-04-01 21:12 - 2015-04-01 21:12 - 00004226 _____ () C:\Users\Teresa Smith\AppData\Local\HELP_DECRYPT.TXT
2015-04-01 21:12 - 2015-04-01 21:12 - 00004226 _____ () C:\Users\Teresa Smith\AppData\HELP_DECRYPT.TXT
2015-04-01 21:12 - 2015-04-01 21:12 - 00004226 _____ () C:\Users\mic\HELP_DECRYPT.TXT
2015-04-01 21:12 - 2015-04-01 21:12 - 00004226 _____ () C:\Users\mic\AppData\Roaming\HELP_DECRYPT.TXT
2015-04-01 21:12 - 2015-04-01 21:12 - 00004226 _____ () C:\Users\mic\AppData\Local\HELP_DECRYPT.TXT
2015-04-01 21:12 - 2015-04-01 21:12 - 00004226 _____ () C:\Users\mic\AppData\HELP_DECRYPT.TXT
2015-04-01 21:12 - 2015-04-01 21:12 - 00004226 _____ () C:\Users\HELP_DECRYPT.TXT
2015-04-01 21:12 - 2015-04-01 21:12 - 00004226 _____ () C:\Users\fabfour\HELP_DECRYPT.TXT
2015-04-01 21:12 - 2015-04-01 21:12 - 00000276 _____ () C:\Users\Teresa.Smith\HELP_DECRYPT.URL
2015-04-01 21:12 - 2015-04-01 21:12 - 00000276 _____ () C:\Users\Teresa.Smith\Documents\HELP_DECRYPT.URL
2015-04-01 21:12 - 2015-04-01 21:12 - 00000276 _____ () C:\Users\Teresa.Smith\AppData\Roaming\HELP_DECRYPT.URL
2015-04-01 21:12 - 2015-04-01 21:12 - 00000276 _____ () C:\Users\Teresa.Smith\AppData\Local\HELP_DECRYPT.URL
2015-04-01 21:12 - 2015-04-01 21:12 - 00000276 _____ () C:\Users\Teresa.Smith\AppData\HELP_DECRYPT.URL
2015-04-01 21:12 - 2015-04-01 21:12 - 00000276 _____ () C:\Users\Teresa Smith\HELP_DECRYPT.URL
2015-04-01 21:12 - 2015-04-01 21:12 - 00000276 _____ () C:\Users\Teresa Smith\AppData\Roaming\HELP_DECRYPT.URL
2015-04-01 21:12 - 2015-04-01 21:12 - 00000276 _____ () C:\Users\Teresa Smith\AppData\Local\HELP_DECRYPT.URL
2015-04-01 21:12 - 2015-04-01 21:12 - 00000276 _____ () C:\Users\Teresa Smith\AppData\HELP_DECRYPT.URL
2015-04-01 21:12 - 2015-04-01 21:12 - 00000276 _____ () C:\Users\mic\HELP_DECRYPT.URL
2015-04-01 21:12 - 2015-04-01 21:12 - 00000276 _____ () C:\Users\mic\AppData\Roaming\HELP_DECRYPT.URL
2015-04-01 21:12 - 2015-04-01 21:12 - 00000276 _____ () C:\Users\mic\AppData\Local\HELP_DECRYPT.URL
2015-04-01 21:12 - 2015-04-01 21:12 - 00000276 _____ () C:\Users\mic\AppData\HELP_DECRYPT.URL
2015-04-01 21:12 - 2015-04-01 21:12 - 00000276 _____ () C:\Users\HELP_DECRYPT.URL
2015-04-01 21:12 - 2015-04-01 21:12 - 00000276 _____ () C:\Users\fabfour\HELP_DECRYPT.URL
2015-04-01 19:35 - 2015-04-01 21:01 - 00008572 _____ () C:\Users\fabfour\Documents\HELP_DECRYPT.HTML
2015-04-01 19:35 - 2015-04-01 21:01 - 00004226 _____ () C:\Users\fabfour\Documents\HELP_DECRYPT.TXT
2015-04-01 19:35 - 2015-04-01 21:01 - 00000276 _____ () C:\Users\fabfour\Documents\HELP_DECRYPT.URL
2015-04-01 19:29 - 2015-04-01 19:29 - 00008572 _____ () C:\Users\fabfour\AppData\Roaming\HELP_DECRYPT.HTML
2015-04-01 19:29 - 2015-04-01 19:29 - 00008572 _____ () C:\Users\fabfour\AppData\Local\HELP_DECRYPT.HTML
2015-04-01 19:29 - 2015-04-01 19:29 - 00008572 _____ () C:\Users\fabfour\AppData\HELP_DECRYPT.HTML
2015-04-01 19:29 - 2015-04-01 19:29 - 00004226 _____ () C:\Users\fabfour\AppData\Roaming\HELP_DECRYPT.TXT
2015-04-01 19:29 - 2015-04-01 19:29 - 00004226 _____ () C:\Users\fabfour\AppData\Local\HELP_DECRYPT.TXT
2015-04-01 19:29 - 2015-04-01 19:29 - 00004226 _____ () C:\Users\fabfour\AppData\HELP_DECRYPT.TXT
2015-04-01 19:29 - 2015-04-01 19:29 - 00000276 _____ () C:\Users\fabfour\AppData\Roaming\HELP_DECRYPT.URL
2015-04-01 19:29 - 2015-04-01 19:29 - 00000276 _____ () C:\Users\fabfour\AppData\Local\HELP_DECRYPT.URL
2015-04-01 19:29 - 2015-04-01 19:29 - 00000276 _____ () C:\Users\fabfour\AppData\HELP_DECRYPT.URL
2015-04-01 19:28 - 2015-04-01 19:28 - 00008572 _____ () C:\ProgramData\HELP_DECRYPT.HTML
2015-04-01 19:28 - 2015-04-01 19:28 - 00004226 _____ () C:\ProgramData\HELP_DECRYPT.TXT
2015-04-01 19:28 - 2015-04-01 19:28 - 00000276 _____ () C:\ProgramData\HELP_DECRYPT.URL
2015-03-31 23:34 - 2015-03-31 23:34 - 00057328 _____ () C:\Users\fabfour\Downloads\UnbilledMessaging (3).xls
2015-03-31 23:33 - 2015-03-31 23:33 - 00057328 _____ () C:\Users\fabfour\Downloads\UnbilledMessaging (2).xls
2015-03-31 20:33 - 2015-03-31 20:33 - 00053792 _____ () C:\Users\fabfour\Downloads\UnbilledMessaging (1).xls
2015-03-31 10:51 - 2015-04-01 19:25 - 00000708 _____ () C:\Users\fabfour\AppData\Roaming\template.css
2015-03-31 10:51 - 2015-03-31 18:01 - 00000108 _____ () C:\Users\fabfour\AppData\Roaming\template.log
2015-03-31 10:51 - 2015-03-31 10:51 - 00226824 _____ () C:\Users\fabfour\AppData\Roaming\f601cd04c233e6d.xml
2015-03-31 10:51 - 2015-03-31 10:51 - 00092168 _____ () C:\Users\fabfour\AppData\Roaming\1e207c0b6b8f382.xml
2015-03-31 00:58 - 2015-03-31 00:58 - 00002848 _____ () C:\Users\fabfour\Downloads\UnbilledVoice.xls
2015-03-31 00:09 - 2015-03-31 00:09 - 00050384 _____ () C:\Users\fabfour\Downloads\UnbilledMessaging.xls
2015-03-30 21:41 - 2015-03-30 21:41 - 00009872 _____ () C:\Users\fabfour\Downloads\ASAP Invoice.zip
2015-03-30 21:07 - 2015-03-30 21:10 - 00000000 ____D () C:\Users\fabfour\AppData\Local\bovobi
2015-03-28 23:53 - 2015-03-28 23:53 - 00195360 _____ () C:\Users\fabfour\Downloads\Child-Support-Guidelines-2014.xls
2015-03-28 01:30 - 2015-03-28 10:44 - 00033344 _____ () C:\Users\fabfour\Downloads\download (12).CSV
2015-03-28 01:22 - 2015-03-28 01:22 - 00085440 _____ () C:\Users\fabfour\Downloads\download (11).CSV
2015-03-28 01:21 - 2015-03-28 01:21 - 00047872 _____ () C:\Users\fabfour\Downloads\download (10).CSV
2015-03-28 01:19 - 2015-04-01 19:35 - 00000000 ____D () C:\Users\fabfour\Documents\work info
2015-03-13 03:04 - 2015-02-20 00:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-13 03:04 - 2015-02-20 00:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-13 03:04 - 2015-02-20 00:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-13 03:04 - 2015-02-20 00:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-13 03:04 - 2015-02-20 00:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-03-13 03:04 - 2015-02-20 00:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-13 03:04 - 2015-02-20 00:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-03-13 03:04 - 2015-02-20 00:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-03-13 03:04 - 2015-02-19 23:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-13 03:04 - 2015-02-19 23:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-13 03:03 - 2015-02-02 23:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-13 03:03 - 2015-02-02 23:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-03-13 03:03 - 2015-02-02 23:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-03-13 03:03 - 2015-02-02 23:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-03-13 03:03 - 2015-02-02 23:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-03-13 03:03 - 2015-02-02 23:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-03-13 03:03 - 2015-02-02 23:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-03-13 03:03 - 2015-02-02 23:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-03-13 03:03 - 2015-02-02 23:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-03-13 03:03 - 2015-02-02 23:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-03-13 03:03 - 2015-02-02 23:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-03-13 03:03 - 2015-02-02 23:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-03-13 03:03 - 2015-02-02 23:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-03-13 03:03 - 2015-02-02 23:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-03-13 03:03 - 2015-02-02 23:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-03-13 03:03 - 2015-02-02 23:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-03-13 03:03 - 2015-02-02 23:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-03-13 03:03 - 2015-02-02 23:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-03-13 03:03 - 2015-02-02 23:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-03-13 03:03 - 2015-02-02 23:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-03-13 03:03 - 2015-02-02 23:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-03-13 03:03 - 2015-02-02 23:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-03-13 03:03 - 2015-02-02 23:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-03-13 03:03 - 2015-02-02 23:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-03-13 03:03 - 2015-02-02 23:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-03-13 03:03 - 2015-02-02 23:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-03-13 03:03 - 2015-02-02 23:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-03-13 03:03 - 2015-02-02 23:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-03-13 03:03 - 2015-02-02 23:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-03-13 03:03 - 2015-02-02 23:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-03-13 03:03 - 2015-02-02 23:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-03-13 03:03 - 2015-02-02 23:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-03-13 03:03 - 2015-02-02 23:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-03-13 03:03 - 2015-02-02 23:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-03-13 03:03 - 2015-02-02 23:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-03-13 03:03 - 2015-02-02 23:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-03-13 03:03 - 2015-02-02 23:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-03-13 03:03 - 2015-02-02 23:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-03-13 03:03 - 2015-02-02 23:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-03-13 03:03 - 2015-02-02 23:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-03-13 03:03 - 2015-02-02 23:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-13 03:03 - 2015-02-02 23:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-03-13 03:03 - 2015-02-02 23:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-03-13 03:03 - 2015-02-02 23:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-03-13 03:03 - 2015-02-02 23:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-13 03:03 - 2015-02-02 23:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-03-13 03:03 - 2015-02-02 23:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-03-13 03:03 - 2015-02-02 23:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-03-13 03:03 - 2015-02-02 23:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-03-13 03:03 - 2015-02-02 23:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-03-13 03:03 - 2015-02-02 23:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-03-13 03:03 - 2015-02-02 23:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-03-13 03:03 - 2015-02-02 23:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-03-13 03:03 - 2015-02-02 23:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-03-13 03:03 - 2015-02-02 23:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-03-13 03:03 - 2015-02-02 23:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-03-13 03:03 - 2015-02-02 23:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-03-13 03:03 - 2015-02-02 23:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-03-13 03:03 - 2015-02-02 23:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-03-13 03:03 - 2015-02-02 23:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-03-13 03:03 - 2015-02-02 23:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-03-13 03:03 - 2015-02-02 23:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-03-13 03:03 - 2015-02-02 23:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-03-13 03:03 - 2015-02-02 23:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-03-13 03:03 - 2015-02-02 22:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-03-13 03:03 - 2015-01-30 23:48 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-03-13 03:03 - 2015-01-30 23:48 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-03-13 03:03 - 2015-01-30 19:56 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-03-13 03:03 - 2014-10-31 18:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-03-13 03:01 - 2015-03-06 01:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-03-13 03:01 - 2015-03-06 01:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-03-13 03:01 - 2015-03-06 01:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-03-13 03:01 - 2015-03-06 01:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-03-13 03:01 - 2015-03-06 01:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-13 03:01 - 2015-03-06 01:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-03-13 03:01 - 2015-03-06 01:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-03-13 03:01 - 2015-03-06 01:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-03-13 03:01 - 2015-03-06 01:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-03-13 03:01 - 2015-03-06 01:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-03-13 03:01 - 2015-03-06 01:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-03-13 03:01 - 2015-03-06 01:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-03-13 03:01 - 2015-03-06 01:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-03-13 03:01 - 2015-03-06 01:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-03-13 03:01 - 2015-03-06 01:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-03-13 03:01 - 2015-03-06 01:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-03-13 03:01 - 2015-03-06 01:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-03-13 03:01 - 2015-03-06 01:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-03-13 03:01 - 2015-03-06 01:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-03-13 03:01 - 2015-03-06 01:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-03-13 03:01 - 2015-03-06 01:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-03-13 03:01 - 2015-03-06 01:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-03-13 03:01 - 2015-03-06 01:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-03-13 03:01 - 2015-03-06 01:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-03-13 03:01 - 2015-03-06 01:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-03-13 03:01 - 2015-03-06 01:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-03-13 03:01 - 2015-03-06 01:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-03-13 03:01 - 2015-03-06 01:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-03-13 03:01 - 2015-03-06 01:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-03-13 03:01 - 2015-03-06 01:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-03-13 03:01 - 2015-03-06 01:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-03-13 03:01 - 2015-02-13 01:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-13 03:01 - 2015-02-13 01:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-13 03:01 - 2015-02-02 23:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-13 03:01 - 2015-02-02 23:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-03-13 03:01 - 2015-01-30 19:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-13 03:00 - 2015-02-25 23:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-13 03:00 - 2015-02-21 15:17 - 17882624 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-13 03:00 - 2015-02-21 15:07 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-03-13 03:00 - 2015-02-21 15:02 - 10931200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-13 03:00 - 2015-02-21 15:00 - 02339840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-03-13 03:00 - 2015-02-21 14:54 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-13 03:00 - 2015-02-21 14:54 - 01388032 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-13 03:00 - 2015-02-21 14:53 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-13 03:00 - 2015-02-21 14:52 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-03-13 03:00 - 2015-02-21 14:52 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-03-13 03:00 - 2015-02-21 14:52 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-03-13 03:00 - 2015-02-21 14:51 - 02157568 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-13 03:00 - 2015-02-21 14:51 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-03-13 03:00 - 2015-02-21 14:51 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-13 03:00 - 2015-02-21 14:51 - 00598528 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-13 03:00 - 2015-02-21 14:51 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-03-13 03:00 - 2015-02-21 14:51 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-13 03:00 - 2015-02-21 14:51 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-03-13 03:00 - 2015-02-21 14:51 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-03-13 03:00 - 2015-02-21 14:50 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-03-13 03:00 - 2015-02-21 14:50 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-03-13 03:00 - 2015-02-21 14:50 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-13 03:00 - 2015-02-21 14:50 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-03-13 03:00 - 2015-02-21 13:37 - 12375040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-03-13 03:00 - 2015-02-21 13:34 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-03-13 03:00 - 2015-02-21 13:29 - 09747968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-03-13 03:00 - 2015-02-21 13:28 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-03-13 03:00 - 2015-02-21 13:22 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-03-13 03:00 - 2015-02-21 13:21 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-03-13 03:00 - 2015-02-21 13:21 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-03-13 03:00 - 2015-02-21 13:20 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2015-03-13 03:00 - 2015-02-21 13:20 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-03-13 03:00 - 2015-02-21 13:19 - 01803264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-03-13 03:00 - 2015-02-21 13:19 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-03-13 03:00 - 2015-02-21 13:19 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-03-13 03:00 - 2015-02-21 13:19 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-03-13 03:00 - 2015-02-21 13:19 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-03-13 03:00 - 2015-02-21 13:18 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-03-13 03:00 - 2015-02-21 13:18 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-03-13 03:00 - 2015-02-21 13:18 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-03-13 03:00 - 2015-02-21 13:18 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-03-13 03:00 - 2015-02-21 13:18 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2015-03-13 03:00 - 2015-02-21 13:18 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2015-03-13 03:00 - 2015-02-21 13:18 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2015-03-13 03:00 - 2015-02-21 13:17 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-03-13 03:00 - 2015-02-03 23:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-13 03:00 - 2015-02-03 22:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-03-13 03:00 - 2015-02-02 23:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-13 03:00 - 2015-02-02 23:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-13 03:00 - 2015-01-16 22:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-13 03:00 - 2015-01-16 22:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-03-11 23:28 - 2015-03-11 23:28 - 00089024 _____ () C:\Users\fabfour\Downloads\Hoshin_Policy_Deployment_Templates.xlsx
2015-03-07 13:05 - 2015-03-07 13:06 - 152428336 _____ (Apple Inc.) C:\Users\fabfour\Downloads\itunes6464setup.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-01 23:06 - 2009-07-14 00:45 - 00034208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-01 23:06 - 2009-07-14 00:45 - 00034208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-01 22:54 - 2013-04-01 00:11 - 00160332 _____ () C:\Windows\setupact.log
2015-04-01 22:50 - 2009-07-14 01:13 - 00988884 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-01 22:44 - 2013-09-19 23:46 - 00000000 ____D () C:\Program Files\Lx_cats
2015-04-01 22:44 - 2013-04-03 12:36 - 00103142 _____ () C:\Windows\PFRO.log
2015-04-01 22:44 - 2012-10-09 14:16 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-01 22:44 - 2009-07-14 01:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-01 22:43 - 2012-10-09 14:16 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-01 22:09 - 2014-06-12 16:45 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-01 21:29 - 2014-03-29 16:13 - 00004391 _____ () C:\Windows\TMFilter.log
2015-04-01 21:12 - 2013-09-06 03:20 - 00000000 ____D () C:\Users\fabfour
2015-04-01 21:12 - 2013-05-09 22:44 - 00000000 ____D () C:\Users\Teresa.Smith\AppData\Roaming\Research In Motion
2015-04-01 21:12 - 2013-05-09 22:44 - 00000000 ____D () C:\Users\Teresa.Smith\AppData\Local\Research In Motion
2015-04-01 21:12 - 2013-04-01 12:54 - 00000000 ____D () C:\Users\Teresa.Smith\Corel
2015-04-01 21:12 - 2013-04-01 12:54 - 00000000 ____D () C:\Users\Teresa.Smith\AppData\Roaming\Corel
2015-04-01 21:12 - 2013-02-27 22:56 - 00000000 ____D () C:\Users\Teresa.Smith\AppData\Local\Roblox
2015-04-01 21:12 - 2013-02-26 19:04 - 00000000 ____D () C:\Users\Teresa.Smith\AppData\Roaming\Skype
2015-04-01 21:12 - 2013-02-26 18:59 - 00000000 ____D () C:\Users\Teresa.Smith\AppData\Roaming\Apple Computer
2015-04-01 21:12 - 2013-02-26 18:59 - 00000000 ____D () C:\Users\Teresa.Smith\AppData\Local\Apple Computer
2015-04-01 21:12 - 2013-02-26 18:52 - 00000000 ____D () C:\Users\Teresa.Smith\AppData\Local\Google
2015-04-01 21:12 - 2013-02-26 18:42 - 00000000 ____D () C:\Users\Teresa.Smith\AppData\Roaming\FileOpen
2015-04-01 21:12 - 2013-02-26 18:07 - 00000000 ___SD () C:\Users\Teresa.Smith\Documents\My Data Sources
2015-04-01 21:12 - 2013-02-26 18:06 - 00000000 ____D () C:\Users\Teresa.Smith\Documents\eFax Messenger 4.4
2015-04-01 21:12 - 2013-02-26 18:02 - 00000000 ____D () C:\Users\mic\AppData\Roaming\FileOpen
2015-04-01 21:12 - 2013-02-26 17:39 - 00000000 ____D () C:\Users\mic\AppData\Roaming\LSC
2015-04-01 21:12 - 2013-02-26 17:29 - 00000000 ____D () C:\Users\mic
2015-04-01 21:12 - 2013-02-22 14:18 - 00000000 ____D () C:\Users\Teresa.Smith\AppData\Roaming\LSC
2015-04-01 21:12 - 2013-02-22 14:18 - 00000000 ____D () C:\Users\Teresa.Smith\AppData\Roaming\Adobe
2015-04-01 21:12 - 2013-02-22 14:11 - 00000000 ____D () C:\Users\Teresa.Smith\AppData\Roaming\Nitro PDF
2015-04-01 21:12 - 2013-02-22 14:08 - 00000000 ____D () C:\Users\Teresa.Smith
2015-04-01 21:12 - 2013-02-07 12:38 - 00000000 ____D () C:\Users\Teresa Smith\AppData\Roaming\LSC
2015-04-01 21:12 - 2013-02-07 12:31 - 00000000 ____D () C:\Users\Teresa Smith\AppData\Local\Google
2015-04-01 21:12 - 2013-02-07 12:28 - 00000000 ____D () C:\Users\Teresa Smith
2015-04-01 20:52 - 2014-08-12 15:46 - 00028896 _____ () C:\Users\fabfour\Downloads\noname (2).eml
2015-04-01 20:51 - 2014-08-07 16:00 - 00028896 _____ () C:\Users\fabfour\Downloads\noname (1).eml
2015-04-01 20:51 - 2014-08-07 15:48 - 00028896 _____ () C:\Users\fabfour\Downloads\noname.eml
2015-04-01 19:35 - 2014-08-20 00:03 - 00000000 ____D () C:\Users\fabfour\Documents\Landon Video
2015-04-01 19:35 - 2014-05-23 11:35 - 00000000 ____D () C:\Users\fabfour\Documents\RESUME
2015-04-01 19:35 - 2014-02-03 03:12 - 00000000 ___SD () C:\Users\fabfour\Documents\My Data Sources
2015-04-01 19:35 - 2014-01-18 04:51 - 00000000 ____D () C:\Users\fabfour\Documents\Optimizer Pro
2015-04-01 19:35 - 2013-11-06 16:48 - 00000000 ____D () C:\Users\fabfour\Documents\Tegile
2015-04-01 19:35 - 2013-11-01 22:39 - 00000000 ____D () C:\Users\fabfour\Documents\Projects
2015-04-01 19:35 - 2013-09-09 11:02 - 00000000 ____D () C:\Users\fabfour\Documents\Orders
2015-04-01 19:34 - 2014-06-07 14:06 - 00000000 ____D () C:\Users\fabfour\Documents\HTC
2015-04-01 19:34 - 2013-09-13 20:51 - 00000000 ____D () C:\Users\fabfour\Documents\Important Docs
2015-04-01 19:33 - 2014-05-22 02:20 - 00000000 ____D () C:\Users\fabfour\Documents\from usb
2015-04-01 19:29 - 2015-01-26 23:13 - 00000000 ____D () C:\Users\fabfour\Desktop\MEMA (@MassEMA) Twitter_files
2015-04-01 19:29 - 2014-12-21 13:55 - 00000000 ____D () C:\Users\fabfour\Desktop\returns
2015-04-01 19:29 - 2014-12-14 23:14 - 00000000 ____D () C:\Users\fabfour\AppData\Local\MetaGeek,_LLC
2015-04-01 19:29 - 2014-12-12 22:21 - 00000000 ____D () C:\Users\fabfour\AppData\Roaming\Verizon
2015-04-01 19:29 - 2014-09-13 16:58 - 00000000 ____D () C:\Users\fabfour\AppData\Local\Origin
2015-04-01 19:29 - 2014-06-13 12:45 - 00000000 ____D () C:\Users\fabfour\Documents\contracting info
2015-04-01 19:29 - 2014-06-07 14:22 - 00000000 ____D () C:\Users\fabfour\AppData\Roaming\MyPhoneExplorer
2015-04-01 19:29 - 2014-06-07 14:08 - 00000000 ____D () C:\Users\fabfour\AppData\Roaming\HTC
2015-04-01 19:29 - 2014-06-07 14:04 - 00000000 ____D () C:\Users\fabfour\AppData\Local\Backup Assistant Plus
2015-04-01 19:29 - 2014-05-19 16:46 - 00000000 ____D () C:\Users\fabfour\AppData\Roaming\PhotoScape
2015-04-01 19:29 - 2014-05-19 01:34 - 00000000 ____D () C:\Users\fabfour\Desktop\UE
2015-04-01 19:29 - 2014-03-23 02:32 - 00000000 ____D () C:\Users\fabfour\Documents\bmm
2015-04-01 19:29 - 2014-03-12 10:43 - 00000000 ____D () C:\Users\fabfour\Desktop\things to do in mass
2015-04-01 19:29 - 2014-01-26 20:19 - 00000000 ____D () C:\Users\fabfour\Desktop\Landon
2015-04-01 19:29 - 2014-01-12 04:04 - 00000000 ____D () C:\Users\fabfour\AppData\Local\Big Fish
2015-04-01 19:29 - 2014-01-07 20:08 - 00000000 ____D () C:\Users\fabfour\Desktop\avery
2015-04-01 19:29 - 2013-11-15 02:51 - 00000000 ____D () C:\Users\fabfour\AppData\Roaming\deskPDF Editor
2015-04-01 19:29 - 2013-09-20 08:28 - 00000000 ____D () C:\Users\fabfour\AppData\Roaming\FaxCtr
2015-04-01 19:29 - 2013-09-17 19:53 - 00000000 ____D () C:\Users\fabfour\AppData\Local\Apple Computer
2015-04-01 19:29 - 2013-09-17 01:24 - 00000000 ____D () C:\Users\fabfour\AppData\Local\Evernote
2015-04-01 19:29 - 2013-09-09 12:54 - 00000000 ____D () C:\Users\fabfour\AppData\Roaming\FileOpen
2015-04-01 19:29 - 2013-09-06 03:59 - 00000000 ____D () C:\Users\fabfour\AppData\Local\Google
2015-04-01 19:29 - 2013-09-06 03:30 - 00000000 ____D () C:\Users\fabfour\AppData\Roaming\Adobe
2015-04-01 19:29 - 2013-09-06 03:22 - 00000000 ____D () C:\Users\fabfour\AppData\Roaming\Nitro PDF
2015-04-01 19:29 - 2011-02-24 13:03 - 00000000 ____D () C:\SWTOOLS
2015-04-01 19:28 - 2015-02-08 02:48 - 00000000 ___SD () C:\ComboFix
2015-04-01 19:28 - 2015-01-18 04:53 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-04-01 19:28 - 2014-09-13 16:57 - 00000000 ____D () C:\ProgramData\Origin
2015-04-01 19:28 - 2014-07-31 21:10 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2015-04-01 19:28 - 2013-09-27 22:42 - 00000000 ____D () C:\lexmark
2015-04-01 19:28 - 2013-09-19 23:42 - 00000000 ____D () C:\ProgramData\FaxCtr
2015-04-01 19:28 - 2013-02-26 19:03 - 00000000 ____D () C:\ProgramData\Skype
2015-04-01 19:28 - 2012-10-09 14:15 - 01470908 _____ () C:\Windows\WindowsUpdate.log
2015-04-01 19:28 - 2012-10-09 14:12 - 00000000 ____D () C:\ProgramData\Corel
2015-04-01 19:28 - 2012-10-09 14:05 - 00000000 ____D () C:\ProgramData\Intel
2015-04-01 19:28 - 2012-10-09 13:53 - 00000000 ____D () C:\mfg
2015-04-01 19:28 - 2012-10-09 13:52 - 00000000 ____D () C:\ProgramData\Lenovo
2015-03-30 21:16 - 2013-09-15 19:19 - 00000000 ____D () C:\Users\fabfour\AppData\Local\CrashDumps
2015-03-13 19:21 - 2009-07-14 01:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-03-13 19:21 - 2009-07-14 00:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-03-13 11:09 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\rescache
2015-03-13 03:36 - 2009-07-14 00:45 - 00393992 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-13 03:35 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-13 03:35 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-03-09 17:52 - 2014-09-13 16:57 - 00000000 ____D () C:\Program Files (x86)\Origin
==================== Files in the root of some directories =======
2015-03-31 10:51 - 2015-03-31 10:51 - 0092168 _____ () C:\Users\fabfour\AppData\Roaming\1e207c0b6b8f382.xml
2015-03-31 10:51 - 2015-03-31 10:51 - 0226824 _____ () C:\Users\fabfour\AppData\Roaming\f601cd04c233e6d.xml
2015-04-01 19:29 - 2015-04-01 19:29 - 0008572 _____ () C:\Users\fabfour\AppData\Roaming\HELP_DECRYPT.HTML
2015-04-01 19:29 - 2015-04-01 19:29 - 0045441 _____ () C:\Users\fabfour\AppData\Roaming\HELP_DECRYPT.PNG
2015-04-01 19:29 - 2015-04-01 19:29 - 0004226 _____ () C:\Users\fabfour\AppData\Roaming\HELP_DECRYPT.TXT
2015-04-01 19:29 - 2015-04-01 19:29 - 0000276 _____ () C:\Users\fabfour\AppData\Roaming\HELP_DECRYPT.URL
2013-09-06 04:12 - 2013-09-06 04:12 - 0000868 _____ () C:\Users\fabfour\AppData\Roaming\Rim.Desktop.HttpServerSetup.log
2015-03-31 10:51 - 2015-04-01 19:25 - 0000708 _____ () C:\Users\fabfour\AppData\Roaming\template.css
2015-03-31 10:51 - 2015-03-31 18:01 - 0000108 _____ () C:\Users\fabfour\AppData\Roaming\template.log
2015-04-01 19:29 - 2015-04-01 19:29 - 0008572 _____ () C:\Users\fabfour\AppData\Local\HELP_DECRYPT.HTML
2015-04-01 19:29 - 2015-04-01 19:29 - 0045441 _____ () C:\Users\fabfour\AppData\Local\HELP_DECRYPT.PNG
2015-04-01 19:29 - 2015-04-01 19:29 - 0004226 _____ () C:\Users\fabfour\AppData\Local\HELP_DECRYPT.TXT
2015-04-01 19:29 - 2015-04-01 19:29 - 0000276 _____ () C:\Users\fabfour\AppData\Local\HELP_DECRYPT.URL
2015-04-01 19:28 - 2015-04-01 19:28 - 0008572 _____ () C:\ProgramData\HELP_DECRYPT.HTML
2015-04-01 19:28 - 2015-04-01 19:28 - 0045441 _____ () C:\ProgramData\HELP_DECRYPT.PNG
2015-04-01 19:28 - 2015-04-01 19:28 - 0004226 _____ () C:\ProgramData\HELP_DECRYPT.TXT
2015-04-01 19:28 - 2015-04-01 19:28 - 0000276 _____ () C:\ProgramData\HELP_DECRYPT.URL
2013-04-01 12:54 - 2013-04-01 12:54 - 0000952 ___SH () C:\ProgramData\KGyGaAvL.sys
Some content of TEMP:
====================
C:\Users\fabfour\AppData\Local\Temp\APNSetup.exe
C:\Users\fabfour\AppData\Local\Temp\bstrapInstall.exe
C:\Users\fabfour\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
C:\Users\fabfour\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\fabfour\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\fabfour\AppData\Local\Temp\MotoHelper_2.0.49_Driver_5.0.0.exe
C:\Users\Teresa Smith\AppData\Local\Temp\ose00000.exe
C:\Users\Teresa.Smith\AppData\Local\Temp\install_flashplayer11x32ax_aih.exe
Some zero byte size files/folders:
==========================
C:\Windows\SWREG.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-03-25 00:35
==================== End Of Log ============================
Attached Files
-
Addition.txt 42.55KB
295 downloads
-
FRST.txt 72.79KB
215 downloads
I am not having a good april fools day. Some of the files in my fixlist may say they weren't found. I was just coming here to repost that I had discovered the help_decrypt files. I deleted a few then realized I likely had an enormous problem when they were in all of my folders. 
Sign In
Create Account
