[rajagopal]

Hi,

I have a lenovo U460 laptop running Windows 7 Home premium 64 bit. My computer seems to have picked up an issue recently - It hangs right after boot and powers off abruptly after few minutes. There are a bunch of startup programs that are trying to be started during this time and it hangs in the middle. I have tried the following options without any success - 

 

1. Ran chkdsk from the command prompt in safe mode and also before the boot, by scheduling the disk check - No errors

2. Ran ESET online scanner,it detected a bunch of threats and removed those.

3. Ran Adwcleaner in clean mode.

4. Tried repair computer from the boot options screen.

5. Updated the SpywareBlaster protection for Internet explorer, Chrome and firefox.

6. Ran windows memory diagnostics - Did not detect any problem with the memory.

 

Few more points to note - 

 

1. Malwarebytes antimalware won't start and I used malwarebytes chameleon tool to try and start malwarebytes tool without any success.

2. Sometimes booting on "safemode with networking"  mode also results in the computer freezing. But freezing happens 100% of the times when I boot on normal mode.

3. I tried removing skype from the startup programs list ( from Windows->search->msconfig) but still skype starts on boot.

4. From the repair computer when I tried to start a system scan from the command prompt, I was not able to start it.

 

Any help to resolve my problem is much appreciated. 

[Advertisements]

Hello ragagopal,

Here are some instructions to help you access the Recovery Environment to run a scan.

There are two options shown below. For the first, you will only need a flash drive or some such, for the second, you will need both a flash drive and a Windows Installation Disk..

If you are unable to access the Recovery Environment through the first option and have a Windows Installation disc for that machine then option two will be a good one to try.

Now

Please download Farbar Recovery Scan Tool and save it to a flash drive.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
 
Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Use the arrow keys to select the Repair your computer menu item.
• Select English as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.

 To enter System Recovery Options by using Windows installation disc:

• Insert the installation disc.
• Restart your computer.
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
• Click Repair your computer.
• Choose your language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt

• Select Command Prompt
• In the command window type in notepad and press Enter.
• The notepad opens. Under File menu select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\frst.exe (for x64 bit version type e:\frst64)  and press Enter
  Note: Replace letter e with the drive letter of your flash drive.
• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will create a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

 

 

[emeraldnzl]

Hello ragagopal,

Here are some instructions to help you access the Recovery Environment to run a scan.

There are two options shown below. For the first, you will only need a flash drive or some such, for the second, you will need both a flash drive and a Windows Installation Disk..

If you are unable to access the Recovery Environment through the first option and have a Windows Installation disc for that machine then option two will be a good one to try.

Now

Please download Farbar Recovery Scan Tool and save it to a flash drive.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
 
Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Use the arrow keys to select the Repair your computer menu item.
• Select English as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.

 To enter System Recovery Options by using Windows installation disc:

• Insert the installation disc.
• Restart your computer.
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
• Click Repair your computer.
• Choose your language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt

• Select Command Prompt
• In the command window type in notepad and press Enter.
• The notepad opens. Under File menu select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\frst.exe (for x64 bit version type e:\frst64)  and press Enter
  Note: Replace letter e with the drive letter of your flash drive.
• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will create a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

 

 

[rajagopal]

Hi Emeraldnzl,

 

Thank you very much for your instructions. Please see below for the Farbar recovery scan logs - 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:26-08-2015

Ran by SYSTEM on MININT-GA2D0E9 (26-08-2015 21:01:33)

Running from f:\

Platform: Windows 7 Home Premium (X64) Language: English (United States)

Internet Explorer Version 11

Boot Mode: Recovery

 

Default: ControlSet001

ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

 

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Registry (Whitelisted) ===========================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10144288 2010-04-05] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [908320 2010-04-05] (Realtek Semiconductor)

HKLM\...\Run: [TpShocks] => C:\Windows\System32\TpShocks.exe [231264 2009-09-02] (Lenovo.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2104104 2010-03-18] (Synaptics Incorporated)

HKLM\...\Run: [PSQLLauncher] => C:\Program Files\Lenovo\LenovoSecuritySolution FP\launcher.exe [84744 2010-03-29] (UPEK Inc.)

HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4448704 2010-03-11] (Lenovo(beijing) Limited)

HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [7056832 2010-03-11] (Lenovo (Beijing) Limited)

HKLM\...\Run: [ISW] => C:\Program Files\CheckPoint\ZAForceField\ForceField.exe [1127592 2012-07-14] (Check Point Software Technologies)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)

HKLM\...\Run: [HPRAService] => C:\Program Files\RA2HP\HPRAService.exe [126464 2010-04-01] (Hewlett-Packard Company)

HKLM\...\Run: [acevents] => C:\Program Files\ActivIdentity\ActivClient\acevents.exe [196648 2009-06-03] (ActivIdentity)

HKLM\...\Run: [accrdsub] => C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe [483880 2009-06-03] (ActivIdentity)

HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284696 2009-12-23] (Intel Corporation)

HKLM-x32\...\Run: [YouCam Mirror Tray icon] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [167008 2009-11-11] (CyberLink Corp.)

HKLM-x32\...\Run: [JunosPulse] => c:\Program Files (x86)\Common Files\Juniper Networks\JamUI\Pulse.exe [2522672 2014-04-09] (Juniper Networks, Inc.)

HKLM-x32\...\Run: [UCam_Menu] => C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [3508624 2012-02-03] (Samsung Electronics Co., Ltd.)

HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331_STI.EXE [536576 2010-01-15] (Vimicro)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

Winlogon\Notify\psfus: C:\Program Files\Lenovo\LenovoSecuritySolution FP\psqlpwd.dll (UPEK Inc.)

HKU\Rajagopal Kumar\...\Run: [FileHippo.com] => C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [306688 2012-03-25] (FileHippo.com)

HKU\Rajagopal Kumar\...\Run: [Google Update] => C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2014-10-26] (Google Inc.)

HKU\Rajagopal Kumar\...\Run: [KiesPDLR] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [21416 2012-02-29] ()

HKU\Rajagopal Kumar\...\Run: [KiesHelper] => C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe [943504 2012-02-03] (Samsung)

HKU\Rajagopal Kumar\...\Run: [cdloader] => C:\Users\Rajagopal Kumar\AppData\Roaming\mjusbsp\cdloader2.exe [50592 2012-02-01] (magicJack L.P.)

HKU\Rajagopal Kumar\...\Run: [Lync] => C:\Program Files\Microsoft Office 15\root\office15\lync.exe [24055464 2015-07-14] (Microsoft Corporation)

Lsa: [Notification Packages] scecli C:\Program Files\Lenovo\LenovoSecuritySolution FP\psqlpwd.dll

Startup: C:\Users\Rajagopal Kumar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk [2012-09-03]

ShortcutTarget: ERUNT AutoBackup.lnk -> C:\Program Files (x86)\ERUNT\AUTOBACK.EXE ()

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

 

==================== Services (Whitelisted) ========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

S2 ac.sharedstore; C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe [277032 2009-06-03] (ActivIdentity)

S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2252504 2013-08-09] (Broadcom Corporation.)

S2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [873248 2010-02-17] (Broadcom Corporation.)

S2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2765496 2015-07-14] (Microsoft Corporation)

S2 IGRS; C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe [38152 2009-07-14] (Lenovo Group Limited)

S2 IswSvc; C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe [827560 2012-07-14] (Check Point Software Technologies)

S3 Lenovo ReadyComm AppSvc; C:\Program Files\Lenovo\ReadyComm\AppSvc.exe [414984 2009-07-28] (Lenovo Group Limited)

S3 Lenovo ReadyComm ConnSvc; C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe [472328 2009-07-28] (Lenovo Group Limited)

S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.149\McCHSvc.exe [289256 2015-06-26] (McAfee, Inc.)

S2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)

S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)

S2 NitroReaderDriverReadSpool2; C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [204304 2012-04-11] (Nitro PDF Software)

S2 NSL; C:\Program Files (x86)\Norton Safe Web Lite\Engine\2.0.0.16\ccSvcHst.exe [138760 2011-08-10] (Symantec Corporation)

S3 PS_MDP; C:\Program Files (x86)\Lenovo\ReadyComm\PS_MDP.dll [276296 2009-07-16] (Lenovo Group Limited)

S2 ReadyComm.DirectRouter; C:\Program Files (x86)\Lenovo\ReadyComm\common\router.dll [103688 2009-07-14] (Lenovo Group Limited)

S2 UpekSrvc; C:\Program Files\Lenovo\LenovoSecuritySolution FP\upeksrvc.exe [72456 2010-03-29] (UPEK Inc.)

S3 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [2445880 2012-08-29] (Check Point Software Technologies LTD)

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)

 

===================== Drivers (Whitelisted) ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

S5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)

S3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [170712 2013-08-09] (Broadcom Corporation.)

S3 Bridge0; C:\Windows\System32\drivers\WDBridge.sys [79376 2009-07-16] (Lenovo)

S1 ccSet_NST; C:\Windows\system32\drivers\NSTx64\0200000.010\ccSetx64.sys [167048 2011-08-08] (Symantec Corporation)

S3 dgderdrv; C:\Windows\SysWOW64\drivers\dgderdrv.sys [20032 2011-08-22] (Devguru Co., Ltd)

S2 ISWKL; C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [33712 2012-07-14] (Check Point Software Technologies)

S1 jnprns; C:\Windows\System32\DRIVERS\jnprns.sys [506160 2014-03-13] (Juniper Networks)

S4 jnprTdi_803_44983; C:\windows\system32\Drivers\jnprTdi_803_44983.sys [108344 2014-04-09] (Juniper Networks, Inc.)

S3 jnprva; C:\Windows\System32\DRIVERS\jnprva.sys [30072 2014-03-13] (Juniper Networks, Inc.)

S3 JnprVaMgr; C:\Windows\System32\DRIVERS\jnprvamgr.sys [45352 2014-03-13] (Juniper Networks, Inc.)

S3 KeyScrambler; C:\Windows\System32\drivers\keyscrambler.sys [222904 2011-12-14] (QFX Software Corporation)

S3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)

S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)

S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [102600 2009-06-18] (McAfee, Inc.)

S1 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [307400 2009-06-18] (McAfee, Inc.)

S3 mferkdk; C:\Windows\System32\drivers\mferkdk.sys [40904 2009-06-18] (McAfee, Inc.)

S3 mfesmfk; C:\Windows\System32\drivers\mfesmfk.sys [49480 2009-06-18] (McAfee, Inc.)

S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)

S2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)

S3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2011-08-19] (The OpenVPN Project)

S3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [215040 2010-02-24] (Vimicro Corporation)

S1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [454232 2011-05-07] (Check Point Software Technologies LTD)

S3 wdmirror; C:\Windows\System32\DRIVERS\WDMirror.sys [11280 2009-07-16] (Lenovo)

S1 A2DDA; \??\C:\Users\Rajagopal Kumar\Desktop\EmsisoftEmergencyKit\Run\a2ddax64.sys [X]

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One Month Created files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-08-26 21:01 - 2015-08-26 21:01 - 00000000 ____D C:\FRST

2015-08-25 08:27 - 2015-08-10 17:20 - 25191936 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2015-08-25 08:27 - 2015-08-10 17:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2015-08-25 08:27 - 2015-08-10 16:33 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2015-08-25 08:27 - 2015-08-10 16:20 - 19871232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2015-08-25 02:13 - 2015-08-25 02:13 - 00000258 __RSH C:\ProgramData\ntuser.pol

2015-08-24 23:05 - 2015-08-24 23:05 - 00006645 _____ C:\AdwCleaner[S4].txt

2015-08-24 23:01 - 2015-08-24 23:01 - 00006688 _____ C:\AdwCleaner[R6].txt

2015-08-24 22:58 - 2015-08-24 22:58 - 00001090 _____ C:\Users\Public\Desktop\SpywareBlaster.lnk

2015-08-24 22:58 - 2015-08-24 22:58 - 00000000 ____D C:\ProgramData\Licenses

2015-08-24 22:55 - 2015-08-24 22:55 - 00006628 _____ C:\AdwCleaner[R5].txt

2015-08-23 23:31 - 2015-08-23 23:31 - 02620595 _____ C:\Users\Rajagopal Kumar\Downloads\B26B.tmp

2015-08-23 20:26 - 2015-08-23 20:27 - 77789672 _____ C:\Users\Rajagopal Kumar\Downloads\Windows6.1-KB947821-v34-x64.msu.crdownload

2015-08-21 11:06 - 2015-08-21 11:06 - 00022011 _____ C:\Users\Rajagopal Kumar\Downloads\friend039s-wife-[bleep]ed-by-me-when-she-visit-my-house-620905.html

2015-08-18 19:42 - 2015-08-18 19:42 - 00025914 _____ C:\Users\Rajagopal Kumar\Downloads\sabudana-upma

2015-08-18 19:39 - 2015-08-18 19:47 - 00006843 _____ C:\Users\Rajagopal Kumar\Downloads\Unconfirmed 76468.crdownload

2015-08-17 18:08 - 2015-08-17 18:08 - 00013958 _____ C:\Users\Rajagopal Kumar\Downloads\registerform.php

2015-08-16 11:07 - 2015-08-16 11:07 - 00000233 _____ C:\Users\Rajagopal Kumar\Downloads\ads-iframe-display (3).php

2015-08-15 16:56 - 2015-08-15 16:57 - 00019081 _____ C:\Users\Rajagopal Kumar\Downloads\Chinese-masseuse-[bleep]s-customer-in-Manchester-hidden-c-822663.html

2015-08-15 16:56 - 2015-08-15 16:57 - 00004243 _____ C:\Users\Rajagopal Kumar\Downloads\sh.4c9a1c77.html

2015-08-15 16:54 - 2015-08-15 17:02 - 00008212 _____ C:\Users\Rajagopal Kumar\Downloads\7tUlZKGPU61.js

2015-08-15 16:54 - 2015-08-15 16:55 - 00014346 _____ C:\Users\Rajagopal Kumar\Downloads\video (1).php

2015-08-15 16:53 - 2015-08-15 16:54 - 00008872 _____ C:\Users\Rajagopal Kumar\Downloads\video.php

2015-08-12 22:41 - 2015-07-30 05:13 - 00124624 _____ (Microsoft Corporation) C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll

2015-08-12 22:41 - 2015-07-30 05:13 - 00103120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll

2015-08-11 23:18 - 2015-07-28 12:09 - 00017344 _____ (Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe

2015-08-11 23:18 - 2015-07-28 12:05 - 01116672 _____ (Microsoft Corporation) C:\Windows\System32\appraiser.dll

2015-08-11 23:18 - 2015-07-28 12:05 - 00774656 _____ (Microsoft Corporation) C:\Windows\System32\invagent.dll

2015-08-11 23:18 - 2015-07-28 12:05 - 00743424 _____ (Microsoft Corporation) C:\Windows\System32\generaltel.dll

2015-08-11 23:18 - 2015-07-28 12:05 - 00437760 _____ (Microsoft Corporation) C:\Windows\System32\devinv.dll

2015-08-11 23:18 - 2015-07-28 12:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll

2015-08-11 23:18 - 2015-07-28 12:05 - 00069120 _____ (Microsoft Corporation) C:\Windows\System32\acmigration.dll

2015-08-11 23:18 - 2015-07-28 11:55 - 01148416 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll

2015-08-11 23:18 - 2015-07-15 10:15 - 05568960 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe

2015-08-11 23:18 - 2015-07-15 10:15 - 00155584 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys

2015-08-11 23:18 - 2015-07-15 10:15 - 00095680 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys

2015-08-11 23:18 - 2015-07-15 10:15 - 00094656 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\mountmgr.sys

2015-08-11 23:18 - 2015-07-15 10:12 - 01730496 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll

2015-08-11 23:18 - 2015-07-15 10:11 - 00362496 _____ (Microsoft Corporation) C:\Windows\System32\wow64win.dll

2015-08-11 23:18 - 2015-07-15 10:11 - 00243712 _____ (Microsoft Corporation) C:\Windows\System32\wow64.dll

2015-08-11 23:18 - 2015-07-15 10:11 - 00215040 _____ (Microsoft Corporation) C:\Windows\System32\winsrv.dll

2015-08-11 23:18 - 2015-07-15 10:11 - 00210944 _____ (Microsoft Corporation) C:\Windows\System32\wdigest.dll

2015-08-11 23:18 - 2015-07-15 10:11 - 00013312 _____ (Microsoft Corporation) C:\Windows\System32\wow64cpu.dll

2015-08-11 23:18 - 2015-07-15 10:10 - 01743360 _____ (Microsoft Corporation) C:\Windows\System32\sysmain.dll

2015-08-11 23:18 - 2015-07-15 10:10 - 01461760 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll

2015-08-11 23:18 - 2015-07-15 10:10 - 01216512 _____ (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll

2015-08-11 23:18 - 2015-07-15 10:10 - 01163264 _____ (Microsoft Corporation) C:\Windows\System32\kernel32.dll

2015-08-11 23:18 - 2015-07-15 10:10 - 00729088 _____ (Microsoft Corporation) C:\Windows\System32\kerberos.dll

2015-08-11 23:18 - 2015-07-15 10:10 - 00503808 _____ (Microsoft Corporation) C:\Windows\System32\srcore.dll

2015-08-11 23:18 - 2015-07-15 10:10 - 00424960 _____ (Microsoft Corporation) C:\Windows\System32\KernelBase.dll

2015-08-11 23:18 - 2015-07-15 10:10 - 00342016 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll

2015-08-11 23:18 - 2015-07-15 10:10 - 00315392 _____ (Microsoft Corporation) C:\Windows\System32\msv1_0.dll

2015-08-11 23:18 - 2015-07-15 10:10 - 00309760 _____ (Microsoft Corporation) C:\Windows\System32\ncrypt.dll

2015-08-11 23:18 - 2015-07-15 10:10 - 00296960 _____ (Microsoft Corporation) C:\Windows\System32\rstrui.exe

2015-08-11 23:18 - 2015-07-15 10:10 - 00136192 _____ (Microsoft Corporation) C:\Windows\System32\sspicli.dll

2015-08-11 23:18 - 2015-07-15 10:10 - 00112640 _____ (Microsoft Corporation) C:\Windows\System32\smss.exe

2015-08-11 23:18 - 2015-07-15 10:10 - 00086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll

2015-08-11 23:18 - 2015-07-15 10:10 - 00050176 _____ (Microsoft Corporation) C:\Windows\System32\srclient.dll

2015-08-11 23:18 - 2015-07-15 10:10 - 00044032 _____ (Microsoft Corporation) C:\Windows\System32\cryptbase.dll

2015-08-11 23:18 - 2015-07-15 10:10 - 00043520 _____ (Microsoft Corporation) C:\Windows\System32\csrsrv.dll

2015-08-11 23:18 - 2015-07-15 10:10 - 00031232 _____ (Microsoft Corporation) C:\Windows\System32\lsass.exe

2015-08-11 23:18 - 2015-07-15 10:10 - 00029184 _____ (Microsoft Corporation) C:\Windows\System32\sspisrv.dll

2015-08-11 23:18 - 2015-07-15 10:10 - 00028160 _____ (Microsoft Corporation) C:\Windows\System32\secur32.dll

2015-08-11 23:18 - 2015-07-15 10:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll

2015-08-11 23:18 - 2015-07-15 10:10 - 00016384 _____ (Microsoft Corporation) C:\Windows\System32\ntvdm64.dll

2015-08-11 23:18 - 2015-07-15 10:10 - 00011264 _____ (Microsoft Corporation) C:\Windows\System32\msmmsp.dll

2015-08-11 23:18 - 2015-07-15 10:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\System32\conhost.exe

2015-08-11 23:18 - 2015-07-15 10:09 - 00064000 _____ (Microsoft Corporation) C:\Windows\System32\auditpol.exe

2015-08-11 23:18 - 2015-07-15 10:05 - 00146432 _____ (Microsoft Corporation) C:\Windows\System32\msaudite.dll

2015-08-11 23:18 - 2015-07-15 10:05 - 00060416 _____ (Microsoft Corporation) C:\Windows\System32\msobjs.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00686080 _____ (Microsoft Corporation) C:\Windows\System32\adtschema.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00006656 _____ (Microsoft Corporation) C:\Windows\System32\apisetschema.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00006144 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00005120 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 10:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:59 - 03989952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2015-08-11 23:18 - 2015-07-15 09:59 - 03934656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2015-08-11 23:18 - 2015-07-15 09:56 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2015-08-11 23:18 - 2015-07-15 09:55 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2015-08-11 23:18 - 2015-07-15 09:55 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2015-08-11 23:18 - 2015-07-15 09:55 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2015-08-11 23:18 - 2015-07-15 09:55 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll

2015-08-11 23:18 - 2015-07-15 09:55 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2015-08-11 23:18 - 2015-07-15 09:54 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2015-08-11 23:18 - 2015-07-15 09:54 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2015-08-11 23:18 - 2015-07-15 09:54 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2015-08-11 23:18 - 2015-07-15 09:54 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll

2015-08-11 23:18 - 2015-07-15 09:54 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2015-08-11 23:18 - 2015-07-15 09:54 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2015-08-11 23:18 - 2015-07-15 09:54 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2015-08-11 23:18 - 2015-07-15 09:53 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2015-08-11 23:18 - 2015-07-15 09:53 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

2015-08-11 23:18 - 2015-07-15 09:53 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2015-08-11 23:18 - 2015-07-15 09:53 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2015-08-11 23:18 - 2015-07-15 09:53 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe

2015-08-11 23:18 - 2015-07-15 09:53 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2015-08-11 23:18 - 2015-07-15 09:49 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll

2015-08-11 23:18 - 2015-07-15 09:48 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 09:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 08:46 - 00290816 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb10.sys

2015-08-11 23:18 - 2015-07-15 08:46 - 00159232 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb.sys

2015-08-11 23:18 - 2015-07-15 08:46 - 00129024 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb20.sys

2015-08-11 23:18 - 2015-07-15 08:37 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2015-08-11 23:18 - 2015-07-15 08:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2015-08-11 23:18 - 2015-07-15 08:34 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 08:34 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 08:34 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll

2015-08-11 23:18 - 2015-07-15 08:34 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll

2015-08-11 23:15 - 2015-07-14 19:19 - 00052736 _____ (Microsoft Corporation) C:\Windows\System32\basesrv.dll

2015-08-11 23:14 - 2015-07-20 16:39 - 00389840 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll

2015-08-11 23:14 - 2015-07-20 16:12 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2015-08-11 23:14 - 2015-07-16 12:54 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll

2015-08-11 23:14 - 2015-07-16 12:37 - 00066560 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll

2015-08-11 23:14 - 2015-07-16 12:36 - 00584192 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll

2015-08-11 23:14 - 2015-07-16 12:36 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll

2015-08-11 23:14 - 2015-07-16 12:35 - 02885632 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2015-08-11 23:14 - 2015-07-16 12:27 - 00054784 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2015-08-11 23:14 - 2015-07-16 12:26 - 00034304 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll

2015-08-11 23:14 - 2015-07-16 12:23 - 00615936 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll

2015-08-11 23:14 - 2015-07-16 12:21 - 00144384 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe

2015-08-11 23:14 - 2015-07-16 12:21 - 00114688 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe

2015-08-11 23:14 - 2015-07-16 12:12 - 00968704 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe

2015-08-11 23:14 - 2015-07-16 12:08 - 00490496 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll

2015-08-11 23:14 - 2015-07-16 12:00 - 00077824 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll

2015-08-11 23:14 - 2015-07-16 11:51 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2015-08-11 23:14 - 2015-07-16 11:51 - 00316928 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll

2015-08-11 23:14 - 2015-07-16 11:51 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2015-08-11 23:14 - 2015-07-16 11:50 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec

2015-08-11 23:14 - 2015-07-16 11:50 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2015-08-11 23:14 - 2015-07-16 11:49 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2015-08-11 23:14 - 2015-07-16 11:45 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2015-08-11 23:14 - 2015-07-16 11:43 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2015-08-11 23:14 - 2015-07-16 11:43 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2015-08-11 23:14 - 2015-07-16 11:41 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2015-08-11 23:14 - 2015-07-16 11:39 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2015-08-11 23:14 - 2015-07-16 11:39 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2015-08-11 23:14 - 2015-07-16 11:38 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2015-08-11 23:14 - 2015-07-16 11:36 - 00801280 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll

2015-08-11 23:14 - 2015-07-16 11:35 - 00720384 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe

2015-08-11 23:14 - 2015-07-16 11:32 - 02125824 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl

2015-08-11 23:14 - 2015-07-16 11:29 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2015-08-11 23:14 - 2015-07-16 11:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2015-08-11 23:14 - 2015-07-16 11:20 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2015-08-11 23:14 - 2015-07-16 11:19 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2015-08-11 23:14 - 2015-07-16 11:17 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2015-08-11 23:14 - 2015-07-16 11:12 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2015-08-11 23:14 - 2015-07-16 11:10 - 12856832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2015-08-11 23:14 - 2015-07-16 11:06 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2015-08-11 23:14 - 2015-07-16 11:06 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2015-08-11 23:14 - 2015-07-16 11:05 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2015-08-11 23:14 - 2015-07-16 11:01 - 01545728 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2015-08-11 23:14 - 2015-07-16 10:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll

2015-08-11 23:14 - 2015-07-16 10:42 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2015-08-11 23:14 - 2015-07-16 10:38 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2015-08-11 23:14 - 2015-07-16 10:37 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2015-08-11 23:13 - 2015-07-16 12:36 - 00417792 _____ (Microsoft Corporation) C:\Windows\System32\html.iec

2015-08-11 23:13 - 2015-07-16 12:35 - 00088064 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll

2015-08-11 23:13 - 2015-07-16 12:26 - 05923328 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2015-08-11 23:13 - 2015-07-16 12:21 - 00816640 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll

2015-08-11 23:13 - 2015-07-16 12:21 - 00814080 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll

2015-08-11 23:13 - 2015-07-16 11:55 - 00199680 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll

2015-08-11 23:13 - 2015-07-16 11:54 - 00092160 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll

2015-08-11 23:13 - 2015-07-16 11:34 - 14451200 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2015-08-11 23:13 - 2015-07-16 11:33 - 01359360 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll

2015-08-11 23:13 - 2015-07-16 11:12 - 02427904 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll

2015-08-11 23:09 - 2015-07-30 10:06 - 02565120 _____ (Microsoft Corporation) C:\Windows\System32\d3d10warp.dll

2015-08-11 23:09 - 2015-07-30 10:06 - 01648128 _____ (Microsoft Corporation) C:\Windows\System32\DWrite.dll

2015-08-11 23:09 - 2015-07-30 10:06 - 01180160 _____ (Microsoft Corporation) C:\Windows\System32\FntCache.dll

2015-08-11 23:09 - 2015-07-30 10:06 - 00100864 _____ (Microsoft Corporation) C:\Windows\System32\fontsub.dll

2015-08-11 23:09 - 2015-07-30 10:06 - 00046080 _____ (Adobe Systems) C:\Windows\System32\atmlib.dll

2015-08-11 23:09 - 2015-07-30 10:06 - 00041984 _____ (Microsoft Corporation) C:\Windows\System32\lpk.dll

2015-08-11 23:09 - 2015-07-30 10:06 - 00014336 _____ (Microsoft Corporation) C:\Windows\System32\dciman32.dll

2015-08-11 23:09 - 2015-07-30 09:57 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll

2015-08-11 23:09 - 2015-07-30 09:57 - 01251328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2015-08-11 23:09 - 2015-07-30 09:57 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll

2015-08-11 23:09 - 2015-07-30 09:57 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll

2015-08-11 23:09 - 2015-07-30 09:57 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll

2015-08-11 23:09 - 2015-07-30 09:55 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll

2015-08-11 23:09 - 2015-07-30 08:56 - 03208192 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys

2015-08-11 23:09 - 2015-07-30 08:52 - 00372736 _____ (Adobe Systems Incorporated) C:\Windows\System32\atmfd.dll

2015-08-11 23:09 - 2015-07-30 08:49 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll

2015-08-11 23:09 - 2015-07-20 10:12 - 03154944 _____ (Microsoft Corporation) C:\Windows\System32\wucltux.dll

2015-08-11 23:09 - 2015-07-20 10:12 - 02606080 _____ (Microsoft Corporation) C:\Windows\System32\wuaueng.dll

2015-08-11 23:09 - 2015-07-16 11:12 - 04922368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2015-08-11 23:09 - 2015-07-16 11:12 - 00269824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll

2015-08-11 23:09 - 2015-07-16 11:12 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll

2015-08-11 23:09 - 2015-07-16 11:11 - 05779456 _____ (Microsoft Corporation) C:\Windows\System32\mstscax.dll

2015-08-11 23:09 - 2015-07-16 11:11 - 00322560 _____ (Microsoft Corporation) C:\Windows\System32\aaclient.dll

2015-08-11 23:09 - 2015-07-16 11:11 - 00044032 _____ (Microsoft Corporation) C:\Windows\System32\tsgqec.dll

2015-08-11 23:09 - 2015-07-14 19:19 - 02004992 _____ (Microsoft Corporation) C:\Windows\System32\msxml6.dll

2015-08-11 23:09 - 2015-07-14 19:19 - 01887232 _____ (Microsoft Corporation) C:\Windows\System32\msxml3.dll

2015-08-11 23:09 - 2015-07-14 19:14 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\msxml6r.dll

2015-08-11 23:09 - 2015-07-14 19:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\msxml3r.dll

2015-08-11 23:09 - 2015-07-14 18:55 - 01390592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2015-08-11 23:09 - 2015-07-14 18:55 - 01241088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2015-08-11 23:09 - 2015-07-14 18:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll

2015-08-11 23:09 - 2015-07-14 18:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2015-08-11 23:09 - 2015-07-10 09:51 - 14177280 _____ (Microsoft Corporation) C:\Windows\System32\shell32.dll

2015-08-11 23:09 - 2015-07-10 09:34 - 12875776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2015-08-11 23:09 - 2015-07-09 09:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\System32\notepad.exe

2015-08-11 23:09 - 2015-07-09 09:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\notepad.exe

2015-08-11 23:09 - 2015-07-09 09:42 - 00179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe

2015-08-11 23:09 - 2015-07-01 12:49 - 00260096 _____ (Microsoft Corporation) C:\Windows\System32\WebClnt.dll

2015-08-11 23:09 - 2015-07-01 12:48 - 00102912 _____ (Microsoft Corporation) C:\Windows\System32\davclnt.dll

2015-08-11 23:09 - 2015-07-01 12:30 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll

2015-08-11 23:09 - 2015-07-01 12:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll

2015-08-11 23:08 - 2015-07-20 10:12 - 00696320 _____ (Microsoft Corporation) C:\Windows\System32\wuapi.dll

2015-08-11 23:08 - 2015-07-20 10:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\System32\wuwebv.dll

2015-08-11 23:08 - 2015-07-20 10:12 - 00139776 _____ (Microsoft Corporation) C:\Windows\System32\wuauclt.exe

2015-08-11 23:08 - 2015-07-20 10:12 - 00098304 _____ (Microsoft Corporation) C:\Windows\System32\wudriver.dll

2015-08-11 23:08 - 2015-07-20 10:12 - 00091136 _____ (Microsoft Corporation) C:\Windows\System32\WinSetupUI.dll

2015-08-11 23:08 - 2015-07-20 10:12 - 00037888 _____ (Microsoft Corporation) C:\Windows\System32\wups2.dll

2015-08-11 23:08 - 2015-07-20 10:12 - 00037376 _____ (Microsoft Corporation) C:\Windows\System32\wuapp.exe

2015-08-11 23:08 - 2015-07-20 10:12 - 00036864 _____ (Microsoft Corporation) C:\Windows\System32\wups.dll

2015-08-11 23:08 - 2015-07-20 10:12 - 00012288 _____ (Microsoft Corporation) C:\Windows\System32\wu.upgrade.ps.dll

2015-08-11 23:08 - 2015-07-20 09:56 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2015-08-11 23:08 - 2015-07-20 09:56 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2015-08-11 23:08 - 2015-07-20 09:56 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2015-08-11 23:08 - 2015-07-20 09:56 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2015-08-11 23:08 - 2015-07-20 09:56 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll

2015-08-11 23:08 - 2015-05-09 10:26 - 00493504 _____ (Microsoft Corporation) C:\Windows\System32\mcupdate_GenuineIntel.dll

2015-08-09 22:39 - 2015-08-09 22:39 - 00006490 _____ C:\AdwCleaner[R4].txt

2015-08-09 22:39 - 2015-08-09 22:39 - 00000316 _____ C:\AdwCleaner[S3].txt

2015-08-09 22:38 - 2015-08-09 22:38 - 00006430 _____ C:\AdwCleaner[R3].txt

2015-08-09 22:29 - 2015-08-09 22:29 - 00000000 ____D C:\AdwCleaner

2015-08-07 22:48 - 2015-08-07 22:48 - 00001480 _____ C:\Users\Rajagopal Kumar\Downloads\daily-show-host-jon-stewart-bids-adieu-after-16-years-1514479

2015-08-02 16:22 - 2015-08-02 16:23 - 00023593 _____ C:\Users\Rajagopal Kumar\Downloads\download (2)

2015-08-02 16:20 - 2015-08-02 16:20 - 00013315 _____ C:\Users\Rajagopal Kumar\Downloads\download (1)

2015-07-31 10:42 - 2015-07-31 10:42 - 00000229 _____ C:\Users\Rajagopal Kumar\Downloads\ads-iframe-display (2).php

2015-07-31 10:34 - 2015-07-31 10:34 - 00000039 _____ C:\Users\Rajagopal Kumar\Downloads\ads-iframe-display (1).php

2015-07-31 10:32 - 2015-07-31 10:36 - 00000850 _____ C:\Users\Rajagopal Kumar\Downloads\container.html

2015-07-31 00:03 - 2015-07-31 00:03 - 00000000 ____D C:\Users\Rajagopal Kumar\AppData\Local\GWX

2015-07-31 00:02 - 2015-07-31 00:02 - 00001941 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk

2015-07-31 00:02 - 2015-07-31 00:02 - 00000000 ____D C:\Program Files\McAfee Security Scan

 

==================== One Month Modified files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-08-25 21:04 - 2011-11-25 17:07 - 00000948 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2180650751-2005149398-3877183700-1000UA.job

2015-08-25 21:04 - 2011-11-25 17:07 - 00000896 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2180650751-2005149398-3877183700-1000Core.job

2015-08-25 21:04 - 2010-09-08 07:55 - 00913024 _____ C:\Windows\System32\TPHDLOG0.LOG

2015-08-25 21:04 - 2009-07-13 20:45 - 00022704 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-08-25 21:04 - 2009-07-13 20:45 - 00022704 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-08-25 21:03 - 2011-11-21 08:28 - 02870004 _____ C:\FaceProv.log

2015-08-25 21:02 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-08-25 21:02 - 2009-07-13 20:51 - 00194624 _____ C:\Windows\setupact.log

2015-08-25 21:01 - 2010-09-08 07:54 - 01678110 _____ C:\Windows\PFRO.log

2015-08-25 08:27 - 2011-11-21 08:25 - 01177952 _____ C:\Windows\WindowsUpdate.log

2015-08-25 08:21 - 2015-01-23 09:08 - 00000558 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-2180650751-2005149398-3877183700-1000.job

2015-08-25 07:39 - 2015-05-30 16:08 - 00000654 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-2180650751-2005149398-3877183700-1000.job

2015-08-25 07:29 - 2012-09-03 19:26 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-08-25 02:31 - 2012-01-28 12:13 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-08-25 02:27 - 2015-06-19 08:42 - 00000000 ____D C:\Program Files\Microsoft Office 15

2015-08-25 02:15 - 2010-09-08 07:55 - 01844352 _____ C:\Windows\System32\TPAPSLOG.LOG

2015-08-24 23:01 - 2014-09-22 21:53 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbamchameleon.sys

2015-08-24 23:01 - 2011-12-10 15:34 - 00000000 ____D C:\Users\Rajagopal Kumar\AppData\Local\CrashDumps

2015-08-24 23:01 - 2010-09-08 07:49 - 00000000 ____D C:\ProgramData\Temp

2015-08-24 23:00 - 2012-09-03 19:36 - 00000000 ____D C:\Program Files (x86)\SpywareBlaster

2015-08-24 22:59 - 2009-07-13 19:20 - 00000000 ___HD C:\Windows\System32\GroupPolicy

2015-08-24 22:59 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\GroupPolicy

2015-08-24 22:57 - 2013-09-08 17:03 - 00000000 ____D C:\Raju

2015-08-24 22:18 - 2012-03-18 12:57 - 00000000 ____D C:\Program Files (x86)\ExpressFiles

2015-08-24 20:25 - 2011-11-23 08:19 - 00000000 ____D C:\users\Rajagopal Kumar

2015-08-24 19:05 - 2015-04-04 11:37 - 00000000 ___SD C:\Windows\System32\GWX

2015-08-24 19:05 - 2011-11-25 16:54 - 00000000 ____D C:\ProgramData\McAfee Security Scan

2015-08-24 19:04 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\registration

2015-08-24 19:03 - 2015-06-26 09:11 - 00000000 __RHD C:\MSOCache

2015-08-24 17:23 - 2012-03-18 12:57 - 00000000 ____D C:\Users\Rajagopal Kumar\AppData\Roaming\ExpressFiles

2015-08-20 19:54 - 2010-09-08 07:51 - 00000000 ____D C:\ProgramData\VeriFace

2015-08-20 19:53 - 2009-07-13 21:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD

2015-08-18 23:21 - 2012-05-30 10:18 - 00000000 ____D C:\Users\Rajagopal Kumar\AppData\Roaming\PrimoPDF

2015-08-15 17:38 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache

2015-08-14 08:21 - 2009-07-13 20:45 - 00442424 _____ C:\Windows\System32\FNTCACHE.DAT

2015-08-14 08:17 - 2014-12-17 23:45 - 00000000 ____D C:\Windows\System32\appraiser

2015-08-14 08:17 - 2014-05-10 01:53 - 00000000 ___SD C:\Windows\System32\CompatTel

2015-08-13 23:48 - 2012-09-03 19:26 - 00778440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-08-13 23:48 - 2012-09-03 19:26 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-08-13 23:48 - 2011-11-25 16:55 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-08-12 20:13 - 2012-04-21 15:51 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2015-08-12 20:13 - 2012-04-21 15:51 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2015-08-09 22:16 - 2011-12-10 15:25 - 00000000 ____D C:\norton

2015-08-09 11:25 - 2014-09-22 21:53 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-08-05 19:26 - 2010-09-08 07:55 - 01819584 _____ C:\Windows\System32\TPAPSLOG(19).LOG

2015-08-03 22:56 - 2011-12-05 01:12 - 00000000 ____D C:\Users\Rajagopal Kumar\AppData\Roaming\vlc

 

Some files in TEMP:

====================

C:\Users\Rajagopal Kumar\AppData\Local\Temp\AutoUpdate.exe

C:\Users\Rajagopal Kumar\AppData\Local\Temp\contentDATs.exe

C:\Users\Rajagopal Kumar\AppData\Local\Temp\GURC186.exe

C:\Users\Rajagopal Kumar\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe

C:\Users\Rajagopal Kumar\AppData\Local\Temp\mpam-6c4e9ec3.exe

C:\Users\Rajagopal Kumar\AppData\Local\Temp\proxy_vole2742309071092863516.dll

C:\Users\Rajagopal Kumar\AppData\Local\Temp\psWinControl.dll

C:\Users\Rajagopal Kumar\AppData\Local\Temp\Quarantine.exe

C:\Users\Rajagopal Kumar\AppData\Local\Temp\RA_LOG.dll

C:\Users\Rajagopal Kumar\AppData\Local\Temp\SecurityScan_Release.exe

C:\Users\Rajagopal Kumar\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Rajagopal Kumar\AppData\Local\Temp\sqlite3.dll

C:\Users\Rajagopal Kumar\AppData\Local\Temp\ydetect.exe

 

==================== Known DLLs (Whitelisted) =========================

 

 

==================== Bamital & volsnap =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\dnsapi.dll => MD5 is legit

C:\Windows\SysWOW64\dnsapi.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

 

==================== Restore Points =========================

 

Restore point date: 2015-08-25 03:01:25

Restore point date: 2015-08-25 08:26:59

 

==================== Memory info =========================== 

 

Percentage of memory in use: 17%

Total physical RAM: 3893.86 MB

Available physical RAM: 3230.53 MB

Total Virtual: 3892.01 MB

Available Virtual: 3225.04 MB

 

==================== Drives ================================

 

Drive c: (Windows) (Fixed) (Total:420.66 GB) (Free:47.15 GB) NTFS

Drive e: () (Fixed) (Total:30 GB) (Free:29.91 GB) NTFS

Drive f: (PENDRIVE) (Removable) (Total:7.24 GB) (Free:3.96 GB) FAT32

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Drive y: (System) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from reading drive)]

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 600F9598)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=420.7 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=30 GB) - (Type=07 NTFS)

 

========================================================

Disk: 1 (Size: 7.3 GB) (Disk ID: 00012570)

Partition 1: (Active) - (Size=7.3 GB) - (Type=0B)

 

 

LastRegBack: 2015-08-25 02:54

 

==================== End of FRST.txt ============================

[emeraldnzl]

Hello ragagopal,

Hmm... I wonder whether there is some conflict going on.

Let's do this:

Open notepad.

Please copy the contents of the code box below.

To do this highlight the contents of the box and right click on it. Paste this into the open notepad.

Save it on the flashdrive as fixlist.txt
 

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
C:\Users\Rajagopal Kumar\AppData\Local\Temp\AutoUpdate.exe
C:\Users\Rajagopal Kumar\AppData\Local\Temp\contentDATs.exe
C:\Users\Rajagopal Kumar\AppData\Local\Temp\GURC186.exe
C:\Users\Rajagopal Kumar\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\Rajagopal Kumar\AppData\Local\Temp\mpam-6c4e9ec3.exe
C:\Users\Rajagopal Kumar\AppData\Local\Temp\proxy_vole2742309071092863516.dll
C:\Users\Rajagopal Kumar\AppData\Local\Temp\psWinControl.dll
C:\Users\Rajagopal Kumar\AppData\Local\Temp\Quarantine.exe
C:\Users\Rajagopal Kumar\AppData\Local\Temp\RA_LOG.dll
C:\Users\Rajagopal Kumar\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\Rajagopal Kumar\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Rajagopal Kumar\AppData\Local\Temp\sqlite3.dll
C:\Users\Rajagopal Kumar\AppData\Local\Temp\ydetect.exe

This script is specifically written for the infection on this person's computer. It should NOT to be used on another machine. It may cause serious damage even to the point of rendering the computer unusable.

Please enter System Recovery Options, as we've done previously.
Run FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

After that

See if you can start up your computer in Safe Mode.

Boot into Safe Mode:

1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, tap F8 continually.
3) If you are asked what mode to bootup in press Esc to boot in the default settings
4) Instead of Windows loading as normal, a menu should appear
5) Select the option to run Windows in Safe Mode.

If you can boot into Safe Mode download a fresh copy of Farbar Recovery Scan Tool from here and save it to your desktop.

 

Important - We ask that the tools we use be downloaded to your computers desktop.

If you are unsure about how to do that, please press the Show button beside Spoiler below to see guides for the most popular browsers:

Spoiler

For Internet Explorer (excluding IE8):

• Please press both Ctrl + J on your keyboard.
• Press Options in the lower left corner.
• Click Browse and in the shown window highlight your Desktop.
• When done, click Select Folder.
• Click OK and close the View Downloads screen.

Please note that Internet Explorer 8 doesn't support changing the downloads location. In this case, upon completion you need to navigate to the Downloads folder and transfer the tool to your Desktop.

For Mozilla Firefox:

• Click the button (upper-right corner) and select Options.
• In the General tab find the Downloads section and check Save files to.
• Click Browse, Navigate to the Desktop and click Select Folder.
• Click OK and the Window will close.

For Google Chrome:

• Click the button (upper-right corner) and select Settings.
• Scroll down and at the bottom press Show advanced settings.
• Scroll down to the Downloads section and click the Change button.
• Navigate to your Desktop and click OK.

 

• Right click to run as administrator. When the tool opens click Yes to disclaimer.
• Ensure that the Addition.txt box is
• Press Scan button.
• Please copy and paste the logs FRST.txt and Addition.txt back here.

If you can't boot into Safe Mode come back and tell me.

So when you return please post

• Fixlog.txt
• FRST.txt
• Addition.txt
• or if you can't boot to Safe Mode come back and tell me

 

[rajagopal]

Hi,

 

Thank you for these steps.. I was able to boot into the safe mode after running farbar recovery scan tool to fix. Please see below for the 3 files content

 

FixLog.txt

 

-----------------------------------

 

Fix result of Farbar Recovery Scan Tool (x64) Version:26-08-2015

Ran by SYSTEM (2015-08-26 21:47:12) Run:1

Running from f:\

Boot Mode: Recovery

==============================================

 

fixlist content:

*****************

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

C:\Users\Rajagopal Kumar\AppData\Local\Temp\AutoUpdate.exe

C:\Users\Rajagopal Kumar\AppData\Local\Temp\contentDATs.exe

C:\Users\Rajagopal Kumar\AppData\Local\Temp\GURC186.exe

C:\Users\Rajagopal Kumar\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe

C:\Users\Rajagopal Kumar\AppData\Local\Temp\mpam-6c4e9ec3.exe

C:\Users\Rajagopal Kumar\AppData\Local\Temp\proxy_vole2742309071092863516.dll

C:\Users\Rajagopal Kumar\AppData\Local\Temp\psWinControl.dll

C:\Users\Rajagopal Kumar\AppData\Local\Temp\Quarantine.exe

C:\Users\Rajagopal Kumar\AppData\Local\Temp\RA_LOG.dll

C:\Users\Rajagopal Kumar\AppData\Local\Temp\SecurityScan_Release.exe

C:\Users\Rajagopal Kumar\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Rajagopal Kumar\AppData\Local\Temp\sqlite3.dll

C:\Users\Rajagopal Kumar\AppData\Local\Temp\ydetect.exe

 

*****************

 

C:\Windows\System32\GroupPolicy\Machine => moved successfully

C:\Windows\System32\GroupPolicy\GPT.ini => moved successfully

C:\Windows\SysWOW64\GroupPolicy\GPT.ini => moved successfully

C:\Users\Rajagopal Kumar\AppData\Local\Temp\AutoUpdate.exe => moved successfully

C:\Users\Rajagopal Kumar\AppData\Local\Temp\contentDATs.exe => moved successfully

C:\Users\Rajagopal Kumar\AppData\Local\Temp\GURC186.exe => moved successfully

C:\Users\Rajagopal Kumar\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe => moved successfully

C:\Users\Rajagopal Kumar\AppData\Local\Temp\mpam-6c4e9ec3.exe => moved successfully

C:\Users\Rajagopal Kumar\AppData\Local\Temp\proxy_vole2742309071092863516.dll => moved successfully

C:\Users\Rajagopal Kumar\AppData\Local\Temp\psWinControl.dll => moved successfully

C:\Users\Rajagopal Kumar\AppData\Local\Temp\Quarantine.exe => moved successfully

C:\Users\Rajagopal Kumar\AppData\Local\Temp\RA_LOG.dll => moved successfully

C:\Users\Rajagopal Kumar\AppData\Local\Temp\SecurityScan_Release.exe => moved successfully

C:\Users\Rajagopal Kumar\AppData\Local\Temp\SkypeSetup.exe => moved successfully

C:\Users\Rajagopal Kumar\AppData\Local\Temp\sqlite3.dll => moved successfully

C:\Users\Rajagopal Kumar\AppData\Local\Temp\ydetect.exe => moved successfully

 

==== End of Fixlog 21:47:13 ====

 

------------------------------------------------------------------------------

 

FRST.txt (after booting into safe mode)

 

-----------------------------------------------------------------------------------

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:26-08-2015

Ran by Rajagopal Kumar (administrator) on RAJAGOPALKUMAR (26-08-2015 21:52:56)

Running from C:\Users\Rajagopal Kumar\Desktop

Loaded Profiles: Rajagopal Kumar (Available Profiles: Rajagopal Kumar)

Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Safe Mode (with Networking)

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe

(Microsoft Corporation) C:\Windows\HelpPane.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Google Inc.) C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\chrome.exe

 

 

==================== Registry (Whitelisted) ===========================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10144288 2010-04-06] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [908320 2010-04-06] (Realtek Semiconductor)

HKLM\...\Run: [TpShocks] => C:\Windows\System32\TpShocks.exe [231264 2009-09-02] (Lenovo.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2104104 2010-03-18] (Synaptics Incorporated)

HKLM\...\Run: [PSQLLauncher] => C:\Program Files\Lenovo\LenovoSecuritySolution FP\launcher.exe [84744 2010-03-29] (UPEK Inc.)

HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4448704 2010-03-11] (Lenovo(beijing) Limited)

HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [7056832 2010-03-11] (Lenovo (Beijing) Limited)

HKLM\...\Run: [ISW] => C:\Program Files\CheckPoint\ZAForceField\ForceField.exe [1127592 2012-07-14] (Check Point Software Technologies)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)

HKLM\...\Run: [HPRAService] => C:\Program Files\RA2HP\HPRAService.exe [126464 2010-04-01] (Hewlett-Packard Company)

HKLM\...\Run: [acevents] => C:\Program Files\ActivIdentity\ActivClient\acevents.exe [196648 2009-06-03] (ActivIdentity)

HKLM\...\Run: [accrdsub] => C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe [483880 2009-06-03] (ActivIdentity)

HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284696 2009-12-23] (Intel Corporation)

HKLM-x32\...\Run: [YouCam Mirror Tray icon] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [167008 2009-11-11] (CyberLink Corp.)

HKLM-x32\...\Run: [JunosPulse] => c:\Program Files (x86)\Common Files\Juniper Networks\JamUI\Pulse.exe [2522672 2014-04-09] (Juniper Networks, Inc.)

HKLM-x32\...\Run: [UCam_Menu] => C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [3508624 2012-02-03] (Samsung Electronics Co., Ltd.)

HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331_STI.EXE [536576 2010-01-15] (Vimicro)

Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)

Winlogon\Notify\psfus: C:\Program Files\Lenovo\LenovoSecuritySolution FP\psqlpwd.dll (UPEK Inc.)

HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\Run: [FileHippo.com] => C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [306688 2012-03-26] (FileHippo.com)

HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\Run: [Google Update] => C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2014-10-26] (Google Inc.)

HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\Run: [KiesPDLR] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [21416 2012-03-01] ()

HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\Run: [KiesHelper] => C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe [943504 2012-02-03] (Samsung)

HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\Run: [cdloader] => C:\Users\Rajagopal Kumar\AppData\Roaming\mjusbsp\cdloader2.exe [50592 2012-02-01] (magicJack L.P.)

HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\Run: [Lync] => C:\Program Files\Microsoft Office 15\root\office15\lync.exe [24055464 2015-07-14] (Microsoft Corporation)

Lsa: [Notification Packages] scecli C:\Program Files\Lenovo\LenovoSecuritySolution FP\psqlpwd.dll

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ActivClient Agent.lnk [2015-05-24]

ShortcutTarget: ActivClient Agent.lnk -> C:\Program Files\ActivIdentity\ActivClient\acsagent.exe (ActivIdentity)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2015-05-24]

ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2015-05-24]

ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.149\SSScheduler.exe (McAfee, Inc.)

Startup: C:\Users\Rajagopal Kumar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk [2012-09-03]

ShortcutTarget: ERUNT AutoBackup.lnk -> C:\Program Files (x86)\ERUNT\AUTOBACK.EXE ()

ShellIconOverlayIdentifiers: [UEAFOverlay] -> {F2F31467-B1AC-4df0-AE79-FD5FA085E22B} => C:\Program Files\Lenovo\LenovoSecuritySolution FP\farchns.dll [2010-03-29] (UPEK Inc.)

ShellIconOverlayIdentifiers: [UEAFOverlayOpen] -> {A3E208F7-0E3A-4182-A7A6-B169D5D691AA} => C:\Program Files\Lenovo\LenovoSecuritySolution FP\farchns.dll [2010-03-29] (UPEK Inc.)

ShellIconOverlayIdentifiers: [VeriFace Enc] -> {771C7324-DA80-49D3-8017-753B0AF60951} => C:\windows\system32\IcnOvrly.dll [2010-09-08] ()

ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-07-14] (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-07-14] (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-07-14] (Microsoft Corporation)

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

URLSearchHook: HKLM-x32 - AOL Toolbar Search Class - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll (AOL Inc.)

URLSearchHook: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000 - AOL Toolbar Search Class - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll (AOL Inc.)

SearchScopes: HKLM-x32 -> {443789B7-F39C-4b5c-9287-DA72D38F4FE6} URL = hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=843&query={searchTerms}&invocationType=tb50-ie-opencandy.r-chromesbox-en-us&tb_uuid=20111210211539639&tb_oid=10-12-2011&tb_mrud=10-12-2011

SearchScopes: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000 -> DefaultScope {7111F2F3-9F5A-4B74-A4AE-01681430D82C} URL = hxxp://search.zonealarm.com/search?Source=Browser&oemCode=ZLN114561554185250-1001&toolbarId=base&affiliateId=1001 tlbrid=ZoneAlarmSecurity&Lan=en&utid=f2f8102e000000000000f07bcbf7ba3f&q={searchTerms}&r=123

SearchScopes: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000 -> {443789B7-F39C-4b5c-9287-DA72D38F4FE6} URL = hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=843&query={searchTerms}&invocationType=tb50-ie-opencandy.r-chromesbox-en-us&tb_uuid=20111210211539639&tb_oid=10-12-2011&tb_mrud=10-12-2011

SearchScopes: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000 -> {7111F2F3-9F5A-4B74-A4AE-01681430D82C} URL = hxxp://search.zonealarm.com/search?Source=Browser&oemCode=ZLN114561554185250-1001&toolbarId=base&affiliateId=1001 tlbrid=ZoneAlarmSecurity&Lan=en&utid=f2f8102e000000000000f07bcbf7ba3f&q={searchTerms}&r=123

BHO: KeyScramblerBHO Class -> {2B9F5787-88A5-4945-90E7-C4B18563BC5E} -> C:\Program Files (x86)\KeyScrambler\x64\KeyScramblerIE.dll [2012-06-07] (QFX Software Corporation)

BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-07-14] (Microsoft Corporation)

BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2012-09-03] (Oracle Corporation)

BHO: ZoneAlarm Security Engine Registrar -> {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} -> C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll [2012-07-14] (Check Point Software Technologies)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-07-14] (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-07-14] (Microsoft Corporation)

BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2012-09-03] (Oracle Corporation)

BHO-x32: KeyScramblerBHO Class -> {2B9F5787-88A5-4945-90E7-C4B18563BC5E} -> C:\Program Files (x86)\KeyScrambler\KeyScramblerIE.dll [2012-09-03] (QFX Software Corporation)

BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2015-07-14] (Microsoft Corporation)

BHO-x32: AOL Toolbar Loader -> {3ef64538-8b54-4573-b48f-4d34b0238ab2} -> C:\Program Files (x86)\AOL Toolbar\aoltb.dll [2011-10-03] (AOL Inc.)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre6\bin\ssv.dll [2012-09-03] (Sun Microsystems, Inc.)

BHO-x32: ZoneAlarm Security Engine Registrar -> {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} -> C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll [2012-07-14] (Check Point Software Technologies)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-07-14] (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-07-14] (Microsoft Corporation)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2012-09-03] (Sun Microsystems, Inc.)

BHO-x32: Norton Safe Web Lite BHO -> {F0DA78E9-6B60-42fb-BC26-EF2CFB8C8FF3} -> C:\Program Files (x86)\Norton Safe Web Lite\Engine\2.0.0.16\coIEPlg.dll [2011-10-14] (Symantec Corporation)

Toolbar: HKLM - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll [2012-07-14] (Check Point Software Technologies)

Toolbar: HKLM-x32 - AOL Toolbar - {ba00b7b1-0351-477a-b948-23e3ee5a73d4} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll [2011-10-03] (AOL Inc.)

Toolbar: HKLM-x32 - ZoneAlarm Security Toolbar - {438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59} - C:\Program Files (x86)\Check Point Software Technologies LTD\zonealarm\1.6.7.4\zonealarmTlbr.dll No File

Toolbar: HKLM-x32 - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll [2012-07-14] (Check Point Software Technologies)

Toolbar: HKLM-x32 - Norton Safe Web Lite - {30CEEEA2-3742-40e4-85DD-812BF1CBB83D} - C:\Program Files (x86)\Norton Safe Web Lite\Engine\2.0.0.16\coIEPlg.dll [2011-10-14] (Symantec Corporation)

Toolbar: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000 -> No Name - {BA00B7B1-0351-477A-B948-23E3EE5A73D4} -  No File

DPF: HKLM {AA570693-00E2-4907-B6F1-60A1199B030C} hxxps://juniper.net/dana-cached/sc/JuniperSetupClient64.cab

DPF: HKLM-x32 {00000035-9593-4264-8B29-930B3E4EDCCD} hxxps://www.rooms.hp.com/vRoom_Cab/WebHPVCInstall35.cab

DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: HKLM-x32 {AB01FF2E-A848-410C-B47B-CB467C476AD9} hxxps://digitalbadge.external.hp.com/hp/HPPKI.cab

DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} hxxps://juniper.net/dana-cached/sc/JuniperSetupClient.cab

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-06-19] (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

Winsock: Catalog5 01 C:\windows\SysWOW64\mswsock.dll [231424 2013-10-08] (Microsoft Corporation)ATTENTION: LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"

Winsock: Catalog5-x64 01 mswsock.dll No File ATTENTION: LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Tcpip\..\Interfaces\{38DED0E4-DCFB-40F3-BE6A-B632F1CBC7B6}: [DhcpNameServer] 192.168.42.129

Tcpip\..\Interfaces\{9078A1CE-17DD-49B7-90E1-13FEF8584260}: [NameServer] 16.110.135.51,16.110.135.52

Tcpip\..\Interfaces\{982B7804-FBA3-42FB-817E-8FF9DC05C9DA}: [DhcpNameServer] 192.168.2.1

 

FireFox:

========

FF ProfilePath: C:\Users\Rajagopal Kumar\AppData\Roaming\Mozilla\Firefox\Profiles\u8k2wabt.default

FF DefaultSearchEngine.US: Google

FF Homepage: about:home

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-14] ()

FF Plugin: @java.com/DTPlugin,version=10.7.2 -> C:\windows\system32\npDeployJava1.dll [2012-09-03] (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.7.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2012-09-03] (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin: @videolan.org/vlc,version=2.0.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2012-06-28] (VideoLAN)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-14] ()

FF Plugin-x32: @checkpoint.com/FFApi -> C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll [2012-07-14] ()

FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_35 -> C:\windows\SysWOW64\npdeployJava1.dll [2012-09-03] (Sun Microsystems, Inc.)

FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll [2012-09-03] (Sun Microsystems, Inc.)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-06-19] (Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-06-19] (Microsoft Corporation)

FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro PDF\Reader 2\npnitromozilla.dll [2012-04-11] ( )

FF Plugin-x32: @rooms.hp.com -> C:\Program Files (x86)\Hewlett-Packard\HP Virtual Room Client Launcher Plugin\nphpvrl.dll [2012-10-10] ( )

FF Plugin-x32: @vmware.com/vmrc,version=2.5.0.00000 -> C:\Program Files (x86)\Common Files\VMware\VMware VMRC Plug-in\Firefox\np-vmware-vmrc.dll [2011-06-01] (VMware, Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-2180650751-2005149398-3877183700-1000: @citrixonline.com/appdetectorplugin -> C:\Users\Rajagopal Kumar\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2015-01-23] (Citrix Online)

FF Plugin HKU\S-1-5-21-2180650751-2005149398-3877183700-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\Rajagopal Kumar\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2012-07-17] (Google)

FF Plugin HKU\S-1-5-21-2180650751-2005149398-3877183700-1000: @talk.google.com/O3DPlugin -> C:\Users\Rajagopal Kumar\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll [2012-07-17] ()

FF Plugin HKU\S-1-5-21-2180650751-2005149398-3877183700-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-15] (Google Inc.)

FF Plugin HKU\S-1-5-21-2180650751-2005149398-3877183700-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-15] (Google Inc.)

FF Plugin HKU\S-1-5-21-2180650751-2005149398-3877183700-1000: SkypeForBusinessPlugin-15.8 -> C:\Users\Rajagopal Kumar\AppData\Local\Microsoft\SkypeForBusinessPlugin\15.8.20020.351\npGatewayNpapi.dll [2015-03-13] (Microsoft Corporation)

FF Plugin HKU\S-1-5-21-2180650751-2005149398-3877183700-1000: SkypeForBusinessPlugin64-15.8 -> C:\Users\Rajagopal Kumar\AppData\Local\Microsoft\SkypeForBusinessPlugin\15.8.20020.351\npGatewayNpapi-x64.dll [2015-03-13] (Microsoft Corporation)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL [2006-10-26] (Microsoft Corporation)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Users\Rajagopal Kumar\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2012-07-17] (Google)

FF Plugin ProgramFiles/Appdata: C:\Users\Rajagopal Kumar\AppData\Roaming\mozilla\plugins\npgtpo3dautoplugin.dll [2012-07-17] ()

FF Plugin ProgramFiles/Appdata: C:\Users\Rajagopal Kumar\AppData\Roaming\mozilla\plugins\npMeetingJoinPluginAOCUser.dll [2014-05-01] ()

FF SearchPlugin: C:\Users\Rajagopal Kumar\AppData\Roaming\Mozilla\Firefox\Profiles\u8k2wabt.default\searchplugins\youtube.xml [2012-03-14]

FF Extension: Coupon Companion - C:\Users\Rajagopal Kumar\AppData\Roaming\Mozilla\Firefox\Profiles\u8k2wabt.default\Extensions\[email protected] [2014-09-01]

FF Extension: zonealarm.com - C:\Users\Rajagopal Kumar\AppData\Roaming\Mozilla\Firefox\Profiles\u8k2wabt.default\Extensions\[email protected] [2012-09-03]

FF Extension: KeyScrambler - C:\Users\Rajagopal Kumar\AppData\Roaming\Mozilla\Firefox\Profiles\u8k2wabt.default\Extensions\[email protected] [2012-09-03]

FF Extension: DivX Web Player - C:\Users\Rajagopal Kumar\AppData\Roaming\Mozilla\Firefox\Profiles\u8k2wabt.default\Extensions\[email protected] [2012-02-20]

FF Extension: NoScript - C:\Users\Rajagopal Kumar\AppData\Roaming\Mozilla\Firefox\Profiles\u8k2wabt.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-09-03]

FF Extension: Download YouTube Videos as MP4 - C:\Users\Rajagopal Kumar\AppData\Roaming\Mozilla\Firefox\Profiles\u8k2wabt.default\Extensions\{b9bfaf1c-a63f-47cd-8b9a-29526ced9060}.xpi [2013-11-12]

FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2015-06-04]

FF HKLM\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] - C:\Program Files\CheckPoint\ZAForceField\TrustChecker

FF Extension: No Name - C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2012-09-03]

FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker

FF Extension: ZoneAlarm Security Engine - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker [2012-09-03]

FF HKLM-x32\...\Firefox\Extensions: [{203FB6B2-2E1E-4474-863B-4C483ECCE78E}] - C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2.0.0.16\coFFNST

FF Extension: Norton Safe Web Lite Toolbar - C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2.0.0.16\coFFNST [2015-08-25]

FF HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi

 

Chrome: 

=======

CHR Profile: C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Slides) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-07-03]

CHR Extension: (Angry Birds) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2012-07-07]

CHR Extension: (Ad Block Express) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\ankoaclbfmdocnmjbokdkohpehjjinen [2013-11-25]

CHR Extension: (Google Docs) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-07-03]

CHR Extension: (Google Drive) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-07-03]

CHR Extension: (YouTube) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-15]

CHR Extension: (Google Cast) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2015-02-14]

CHR Extension: (Pop Up Blocker Program ) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdbefhoembdcnpapmodimamlnahaciih [2014-10-09]

CHR Extension: (TOEFL Essay Practice) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\ceeicgdpllljlklonpkbhjighniifjij [2012-07-07]

CHR Extension: (Google Search) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-15]

CHR Extension: (Adblock Plus Popup) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\eaglijdkglfgnodgahnfalkohplchphh [2014-10-09]

CHR Extension: (Type Scout - Better Typing! ) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\fedokkaolmkkoeedicihicdeppjjeamj [2012-07-07]

CHR Extension: (Google Sheets) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-07-03]

CHR Extension: (AdBlock) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-10-09]

CHR Extension: (Cut the Rope) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkddaofiamhgfjmaccfcfpfolpgbeomj [2012-07-07]

CHR Extension: (Apple Shooter) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\ingecjekeggadjbbklelffkgeppklgnm [2012-07-07]

CHR Extension: (Typing Test - KeyHero) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\jkcieoaeooeidmpaopkpjpjfakidlabm [2012-07-07]

CHR Extension: (Island Runner) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\kccnmldhohpnaahmlnafmfdigggmhaoc [2012-07-07]

CHR Extension: (Google Voice (by Google)) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcnhkahnjcbndmmehfkdnkjomaanaooo [2013-06-29]

CHR Extension: (Youtube Downloader Google Chrome) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\kepfmlbnmfkakibipenekfmdgenllpke [2014-12-08]

CHR Extension: (Save as PDF) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdjmbiefanbdgnkcikhllpmjnnllbbc [2013-01-21]

CHR Extension: (Ad Block Express) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\lbcmmpmjjaockhkcofljpakjcbmjmgla [2013-02-10]

CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-12]

CHR Extension: (Capture Webpage Screenshot - FireShot) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbpblocgmgfnpjjppndjkmgjaogfceg [2013-01-21]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21]

CHR Extension: (Type Fu (hosted)) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\okboeogmnhjpgbeaokfogelclpblaemo [2012-07-07]

CHR Extension: (Gmail) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-15]

CHR HKLM-x32\...\Chrome\Extension: [bejbohlohkkgompgecdcbbglkpjfjgdj] - C:\Users\RAJAGO~1\AppData\Local\Temp\ccex.crx <not found>

StartMenuInternet: Google Chrome - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\chrome.exe

 

==================== Services (Whitelisted) ========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

S2 ac.sharedstore; C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe [277032 2009-06-03] (ActivIdentity)

S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2252504 2013-08-09] (Broadcom Corporation.)

S2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [873248 2010-02-18] (Broadcom Corporation.)

S2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2765496 2015-07-14] (Microsoft Corporation)

S2 IGRS; C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe [38152 2009-07-14] (Lenovo Group Limited)

S2 IswSvc; C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe [827560 2012-07-14] (Check Point Software Technologies)

S3 Lenovo ReadyComm AppSvc; C:\Program Files\Lenovo\ReadyComm\AppSvc.exe [414984 2009-07-28] (Lenovo Group Limited)

S3 Lenovo ReadyComm ConnSvc; C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe [472328 2009-07-28] (Lenovo Group Limited)

S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.149\McCHSvc.exe [289256 2015-06-26] (McAfee, Inc.)

R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)

S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)

S2 NitroReaderDriverReadSpool2; C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [204304 2012-04-11] (Nitro PDF Software)

S2 NSL; C:\Program Files (x86)\Norton Safe Web Lite\Engine\2.0.0.16\ccSvcHst.exe [138760 2011-08-10] (Symantec Corporation)

S3 PS_MDP; C:\Program Files (x86)\Lenovo\ReadyComm\PS_MDP.dll [276296 2009-07-16] (Lenovo Group Limited)

S2 ReadyComm.DirectRouter; C:\Program Files (x86)\Lenovo\ReadyComm\common\router.dll [103688 2009-07-14] (Lenovo Group Limited)

S2 UpekSrvc; C:\Program Files\Lenovo\LenovoSecuritySolution FP\upeksrvc.exe [72456 2010-03-29] (UPEK Inc.)

S3 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [2445880 2012-08-29] (Check Point Software Technologies LTD)

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)

 

===================== Drivers (Whitelisted) ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)

S3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [170712 2013-08-09] (Broadcom Corporation.)

S3 Bridge0; C:\Windows\System32\drivers\WDBridge.sys [79376 2009-07-16] (Lenovo)

S1 ccSet_NST; C:\Windows\system32\drivers\NSTx64\0200000.010\ccSetx64.sys [167048 2011-08-08] (Symantec Corporation)

S3 dgderdrv; C:\Windows\SysWOW64\drivers\dgderdrv.sys [20032 2011-08-22] (Devguru Co., Ltd)

S2 ISWKL; C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [33712 2012-07-14] (Check Point Software Technologies)

R1 jnprns; C:\Windows\System32\DRIVERS\jnprns.sys [506160 2014-03-13] (Juniper Networks)

S4 jnprTdi_803_44983; C:\windows\system32\Drivers\jnprTdi_803_44983.sys [108344 2014-04-09] (Juniper Networks, Inc.)

S3 jnprva; C:\Windows\System32\DRIVERS\jnprva.sys [30072 2014-03-13] (Juniper Networks, Inc.)

R3 JnprVaMgr; C:\Windows\System32\DRIVERS\jnprvamgr.sys [45352 2014-03-13] (Juniper Networks, Inc.)

R3 KeyScrambler; C:\Windows\System32\drivers\keyscrambler.sys [222904 2011-12-14] (QFX Software Corporation)

S3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)

S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)

S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [102600 2009-06-18] (McAfee, Inc.)

S1 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [307400 2009-06-18] (McAfee, Inc.)

S3 mferkdk; C:\Windows\System32\drivers\mferkdk.sys [40904 2009-06-18] (McAfee, Inc.)

S3 mfesmfk; C:\Windows\System32\drivers\mfesmfk.sys [49480 2009-06-18] (McAfee, Inc.)

S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)

S2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)

S3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2011-08-19] (The OpenVPN Project)

S3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [215040 2010-02-24] (Vimicro Corporation)

R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [454232 2011-05-07] (Check Point Software Technologies LTD)

S3 wdmirror; C:\Windows\System32\DRIVERS\WDMirror.sys [11280 2009-07-16] (Lenovo)

S1 A2DDA; \??\C:\Users\Rajagopal Kumar\Desktop\EmsisoftEmergencyKit\Run\a2ddax64.sys [X]

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One Month Created files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-08-26 22:01 - 2015-08-26 21:53 - 00000000 ____D C:\FRST

2015-08-26 21:52 - 2015-08-26 21:53 - 00033202 _____ C:\Users\Rajagopal Kumar\Desktop\FRST.txt

2015-08-26 21:51 - 2015-08-26 21:52 - 02186752 _____ (Farbar) C:\Users\Rajagopal Kumar\Desktop\FRST64.exe

2015-08-25 09:27 - 2015-08-10 18:20 - 25191936 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2015-08-25 09:27 - 2015-08-10 18:14 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2015-08-25 09:27 - 2015-08-10 17:33 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2015-08-25 09:27 - 2015-08-10 17:20 - 19871232 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2015-08-25 03:13 - 2015-08-25 03:13 - 00000258 __RSH C:\ProgramData\ntuser.pol

2015-08-25 00:05 - 2015-08-25 00:05 - 00006645 _____ C:\AdwCleaner[S4].txt

2015-08-25 00:01 - 2015-08-25 00:01 - 00006688 _____ C:\AdwCleaner[R6].txt

2015-08-24 23:58 - 2015-08-24 23:58 - 00001090 _____ C:\Users\Public\Desktop\SpywareBlaster.lnk

2015-08-24 23:58 - 2015-08-24 23:58 - 00000000 ____D C:\ProgramData\Licenses

2015-08-24 23:55 - 2015-08-24 23:55 - 00006628 _____ C:\AdwCleaner[R5].txt

2015-08-24 00:31 - 2015-08-24 00:31 - 02620595 _____ C:\Users\Rajagopal Kumar\Downloads\B26B.tmp

2015-08-23 21:26 - 2015-08-23 21:27 - 77789672 _____ C:\Users\Rajagopal Kumar\Downloads\Windows6.1-KB947821-v34-x64.msu.crdownload

2015-08-21 12:06 - 2015-08-21 12:06 - 00022011 _____ C:\Users\Rajagopal Kumar\Downloads\friend039s-wife-[bleep]ed-by-me-when-she-visit-my-house-620905.html

2015-08-18 20:42 - 2015-08-18 20:42 - 00025914 _____ C:\Users\Rajagopal Kumar\Downloads\sabudana-upma

2015-08-18 20:39 - 2015-08-18 20:47 - 00006843 _____ C:\Users\Rajagopal Kumar\Downloads\Unconfirmed 76468.crdownload

2015-08-17 19:08 - 2015-08-17 19:08 - 00013958 _____ C:\Users\Rajagopal Kumar\Downloads\registerform.php

2015-08-16 12:07 - 2015-08-16 12:07 - 00000233 _____ C:\Users\Rajagopal Kumar\Downloads\ads-iframe-display (3).php

2015-08-15 17:56 - 2015-08-15 17:57 - 00019081 _____ C:\Users\Rajagopal Kumar\Downloads\Chinese-masseuse-[bleep]s-customer-in-Manchester-hidden-c-822663.html

2015-08-15 17:56 - 2015-08-15 17:57 - 00004243 _____ C:\Users\Rajagopal Kumar\Downloads\sh.4c9a1c77.html

2015-08-15 17:54 - 2015-08-15 18:02 - 00008212 _____ C:\Users\Rajagopal Kumar\Downloads\7tUlZKGPU61.js

2015-08-15 17:54 - 2015-08-15 17:55 - 00014346 _____ C:\Users\Rajagopal Kumar\Downloads\video (1).php

2015-08-15 17:53 - 2015-08-15 17:54 - 00008872 _____ C:\Users\Rajagopal Kumar\Downloads\video.php

2015-08-12 23:41 - 2015-07-30 06:13 - 00124624 _____ (Microsoft Corporation) C:\windows\system32\PresentationCFFRasterizerNative_v0300.dll

2015-08-12 23:41 - 2015-07-30 06:13 - 00103120 _____ (Microsoft Corporation) C:\windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll

2015-08-12 00:18 - 2015-07-28 13:09 - 00017344 _____ (Microsoft Corporation) C:\windows\system32\CompatTelRunner.exe

2015-08-12 00:18 - 2015-07-28 13:05 - 01116672 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll

2015-08-12 00:18 - 2015-07-28 13:05 - 00774656 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll

2015-08-12 00:18 - 2015-07-28 13:05 - 00743424 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll

2015-08-12 00:18 - 2015-07-28 13:05 - 00437760 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll

2015-08-12 00:18 - 2015-07-28 13:05 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll

2015-08-12 00:18 - 2015-07-28 13:05 - 00069120 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll

2015-08-12 00:18 - 2015-07-28 12:55 - 01148416 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll

2015-08-12 00:18 - 2015-07-15 11:15 - 05568960 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe

2015-08-12 00:18 - 2015-07-15 11:15 - 00155584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys

2015-08-12 00:18 - 2015-07-15 11:15 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys

2015-08-12 00:18 - 2015-07-15 11:15 - 00094656 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mountmgr.sys

2015-08-12 00:18 - 2015-07-15 11:12 - 01730496 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll

2015-08-12 00:18 - 2015-07-15 11:11 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll

2015-08-12 00:18 - 2015-07-15 11:11 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll

2015-08-12 00:18 - 2015-07-15 11:11 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll

2015-08-12 00:18 - 2015-07-15 11:11 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll

2015-08-12 00:18 - 2015-07-15 11:11 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 01743360 _____ (Microsoft Corporation) C:\windows\system32\sysmain.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 01461760 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 01216512 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 01163264 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00729088 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00424960 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00342016 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00315392 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe

2015-08-12 00:18 - 2015-07-15 11:10 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe

2015-08-12 00:18 - 2015-07-15 11:10 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00044032 _____ (Microsoft Corporation) C:\windows\system32\cryptbase.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe

2015-08-12 00:18 - 2015-07-15 11:10 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00011264 _____ (Microsoft Corporation) C:\windows\system32\msmmsp.dll

2015-08-12 00:18 - 2015-07-15 11:09 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe

2015-08-12 00:18 - 2015-07-15 11:09 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe

2015-08-12 00:18 - 2015-07-15 11:05 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll

2015-08-12 00:18 - 2015-07-15 11:05 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:59 - 03989952 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe

2015-08-12 00:18 - 2015-07-15 10:59 - 03934656 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe

2015-08-12 00:18 - 2015-07-15 10:56 - 01311768 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll

2015-08-12 00:18 - 2015-07-15 10:55 - 00248832 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll

2015-08-12 00:18 - 2015-07-15 10:55 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll

2015-08-12 00:18 - 2015-07-15 10:55 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll

2015-08-12 00:18 - 2015-07-15 10:55 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll

2015-08-12 00:18 - 2015-07-15 10:55 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll

2015-08-12 00:18 - 2015-07-15 10:54 - 00552960 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll

2015-08-12 00:18 - 2015-07-15 10:54 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll

2015-08-12 00:18 - 2015-07-15 10:54 - 00221184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll

2015-08-12 00:18 - 2015-07-15 10:54 - 00036864 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptbase.dll

2015-08-12 00:18 - 2015-07-15 10:54 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe

2015-08-12 00:18 - 2015-07-15 10:54 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll

2015-08-12 00:18 - 2015-07-15 10:54 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll

2015-08-12 00:18 - 2015-07-15 10:53 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll

2015-08-12 00:18 - 2015-07-15 10:53 - 00665088 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll

2015-08-12 00:18 - 2015-07-15 10:53 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll

2015-08-12 00:18 - 2015-07-15 10:53 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll

2015-08-12 00:18 - 2015-07-15 10:53 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe

2015-08-12 00:18 - 2015-07-15 10:53 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll

2015-08-12 00:18 - 2015-07-15 10:49 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll

2015-08-12 00:18 - 2015-07-15 10:48 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00686080 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 09:46 - 00290816 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys

2015-08-12 00:18 - 2015-07-15 09:46 - 00159232 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys

2015-08-12 00:18 - 2015-07-15 09:46 - 00129024 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys

2015-08-12 00:18 - 2015-07-15 09:37 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe

2015-08-12 00:18 - 2015-07-15 09:37 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe

2015-08-12 00:18 - 2015-07-15 09:34 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 09:34 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 09:34 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 09:34 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll

2015-08-12 00:15 - 2015-07-14 20:19 - 00052736 _____ (Microsoft Corporation) C:\windows\system32\basesrv.dll

2015-08-12 00:14 - 2015-07-20 17:39 - 00389840 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll

2015-08-12 00:14 - 2015-07-20 17:12 - 00342736 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll

2015-08-12 00:14 - 2015-07-16 13:54 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll

2015-08-12 00:14 - 2015-07-16 13:37 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2015-08-12 00:14 - 2015-07-16 13:36 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll

2015-08-12 00:14 - 2015-07-16 13:36 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll

2015-08-12 00:14 - 2015-07-16 13:35 - 02885632 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2015-08-12 00:14 - 2015-07-16 13:27 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2015-08-12 00:14 - 2015-07-16 13:26 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2015-08-12 00:14 - 2015-07-16 13:23 - 00615936 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2015-08-12 00:14 - 2015-07-16 13:21 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe

2015-08-12 00:14 - 2015-07-16 13:21 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe

2015-08-12 00:14 - 2015-07-16 13:12 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe

2015-08-12 00:14 - 2015-07-16 13:08 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll

2015-08-12 00:14 - 2015-07-16 13:00 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll

2015-08-12 00:14 - 2015-07-16 12:51 - 00504320 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll

2015-08-12 00:14 - 2015-07-16 12:51 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll

2015-08-12 00:14 - 2015-07-16 12:51 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2015-08-12 00:14 - 2015-07-16 12:50 - 00341504 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec

2015-08-12 00:14 - 2015-07-16 12:50 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll

2015-08-12 00:14 - 2015-07-16 12:49 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll

2015-08-12 00:14 - 2015-07-16 12:45 - 02279424 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2015-08-12 00:14 - 2015-07-16 12:43 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2015-08-12 00:14 - 2015-07-16 12:43 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2015-08-12 00:14 - 2015-07-16 12:41 - 00479232 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2015-08-12 00:14 - 2015-07-16 12:39 - 00664064 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2015-08-12 00:14 - 2015-07-16 12:39 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe

2015-08-12 00:14 - 2015-07-16 12:38 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll

2015-08-12 00:14 - 2015-07-16 12:36 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2015-08-12 00:14 - 2015-07-16 12:35 - 00720384 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2015-08-12 00:14 - 2015-07-16 12:32 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2015-08-12 00:14 - 2015-07-16 12:29 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll

2015-08-12 00:14 - 2015-07-16 12:24 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll

2015-08-12 00:14 - 2015-07-16 12:20 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll

2015-08-12 00:14 - 2015-07-16 12:19 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll

2015-08-12 00:14 - 2015-07-16 12:17 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll

2015-08-12 00:14 - 2015-07-16 12:12 - 04520448 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2015-08-12 00:14 - 2015-07-16 12:10 - 12856832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2015-08-12 00:14 - 2015-07-16 12:06 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl

2015-08-12 00:14 - 2015-07-16 12:06 - 00689152 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2015-08-12 00:14 - 2015-07-16 12:05 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll

2015-08-12 00:14 - 2015-07-16 12:01 - 01545728 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2015-08-12 00:14 - 2015-07-16 11:49 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll

2015-08-12 00:14 - 2015-07-16 11:42 - 01951232 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2015-08-12 00:14 - 2015-07-16 11:38 - 01310720 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2015-08-12 00:14 - 2015-07-16 11:37 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll

2015-08-12 00:13 - 2015-07-16 13:36 - 00417792 _____ (Microsoft Corporation) C:\windows\system32\html.iec

2015-08-12 00:13 - 2015-07-16 13:35 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll

2015-08-12 00:13 - 2015-07-16 13:26 - 05923328 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2015-08-12 00:13 - 2015-07-16 13:21 - 00816640 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2015-08-12 00:13 - 2015-07-16 13:21 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll

2015-08-12 00:13 - 2015-07-16 12:55 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2015-08-12 00:13 - 2015-07-16 12:54 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll

2015-08-12 00:13 - 2015-07-16 12:34 - 14451200 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2015-08-12 00:13 - 2015-07-16 12:33 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll

2015-08-12 00:13 - 2015-07-16 12:12 - 02427904 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2015-08-12 00:09 - 2015-07-30 11:06 - 02565120 _____ (Microsoft Corporation) C:\windows\system32\d3d10warp.dll

2015-08-12 00:09 - 2015-07-30 11:06 - 01648128 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll

2015-08-12 00:09 - 2015-07-30 11:06 - 01180160 _____ (Microsoft Corporation) C:\windows\system32\FntCache.dll

2015-08-12 00:09 - 2015-07-30 11:06 - 00100864 _____ (Microsoft Corporation) C:\windows\system32\fontsub.dll

2015-08-12 00:09 - 2015-07-30 11:06 - 00046080 _____ (Adobe Systems) C:\windows\system32\atmlib.dll

2015-08-12 00:09 - 2015-07-30 11:06 - 00041984 _____ (Microsoft Corporation) C:\windows\system32\lpk.dll

2015-08-12 00:09 - 2015-07-30 11:06 - 00014336 _____ (Microsoft Corporation) C:\windows\system32\dciman32.dll

2015-08-12 00:09 - 2015-07-30 10:57 - 01987584 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3d10warp.dll

2015-08-12 00:09 - 2015-07-30 10:57 - 01251328 _____ (Microsoft Corporation) C:\windows\SysWOW64\DWrite.dll

2015-08-12 00:09 - 2015-07-30 10:57 - 00070656 _____ (Microsoft Corporation) C:\windows\SysWOW64\fontsub.dll

2015-08-12 00:09 - 2015-07-30 10:57 - 00034304 _____ (Adobe Systems) C:\windows\SysWOW64\atmlib.dll

2015-08-12 00:09 - 2015-07-30 10:57 - 00010240 _____ (Microsoft Corporation) C:\windows\SysWOW64\dciman32.dll

2015-08-12 00:09 - 2015-07-30 10:55 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\lpk.dll

2015-08-12 00:09 - 2015-07-30 09:56 - 03208192 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys

2015-08-12 00:09 - 2015-07-30 09:52 - 00372736 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll

2015-08-12 00:09 - 2015-07-30 09:49 - 00299520 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\atmfd.dll

2015-08-12 00:09 - 2015-07-20 11:12 - 03154944 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll

2015-08-12 00:09 - 2015-07-20 11:12 - 02606080 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll

2015-08-12 00:09 - 2015-07-16 12:12 - 04922368 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstscax.dll

2015-08-12 00:09 - 2015-07-16 12:12 - 00269824 _____ (Microsoft Corporation) C:\windows\SysWOW64\aaclient.dll

2015-08-12 00:09 - 2015-07-16 12:12 - 00037376 _____ (Microsoft Corporation) C:\windows\SysWOW64\tsgqec.dll

2015-08-12 00:09 - 2015-07-16 12:11 - 05779456 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll

2015-08-12 00:09 - 2015-07-16 12:11 - 00322560 _____ (Microsoft Corporation) C:\windows\system32\aaclient.dll

2015-08-12 00:09 - 2015-07-16 12:11 - 00044032 _____ (Microsoft Corporation) C:\windows\system32\tsgqec.dll

2015-08-12 00:09 - 2015-07-14 20:19 - 02004992 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll

2015-08-12 00:09 - 2015-07-14 20:19 - 01887232 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll

2015-08-12 00:09 - 2015-07-14 20:14 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll

2015-08-12 00:09 - 2015-07-14 20:13 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll

2015-08-12 00:09 - 2015-07-14 19:55 - 01390592 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml6.dll

2015-08-12 00:09 - 2015-07-14 19:55 - 01241088 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3.dll

2015-08-12 00:09 - 2015-07-14 19:51 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml6r.dll

2015-08-12 00:09 - 2015-07-14 19:51 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3r.dll

2015-08-12 00:09 - 2015-07-10 10:51 - 14177280 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll

2015-08-12 00:09 - 2015-07-10 10:34 - 12875776 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll

2015-08-12 00:09 - 2015-07-09 10:57 - 00193536 _____ (Microsoft Corporation) C:\windows\system32\notepad.exe

2015-08-12 00:09 - 2015-07-09 10:57 - 00193536 _____ (Microsoft Corporation) C:\windows\notepad.exe

2015-08-12 00:09 - 2015-07-09 10:42 - 00179712 _____ (Microsoft Corporation) C:\windows\SysWOW64\notepad.exe

2015-08-12 00:09 - 2015-07-01 13:49 - 00260096 _____ (Microsoft Corporation) C:\windows\system32\WebClnt.dll

2015-08-12 00:09 - 2015-07-01 13:48 - 00102912 _____ (Microsoft Corporation) C:\windows\system32\davclnt.dll

2015-08-12 00:09 - 2015-07-01 13:30 - 00206848 _____ (Microsoft Corporation) C:\windows\SysWOW64\WebClnt.dll

2015-08-12 00:09 - 2015-07-01 13:30 - 00082432 _____ (Microsoft Corporation) C:\windows\SysWOW64\davclnt.dll

2015-08-12 00:08 - 2015-07-20 11:12 - 00696320 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll

2015-08-12 00:08 - 2015-07-20 11:12 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll

2015-08-12 00:08 - 2015-07-20 11:12 - 00139776 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe

2015-08-12 00:08 - 2015-07-20 11:12 - 00098304 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll

2015-08-12 00:08 - 2015-07-20 11:12 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll

2015-08-12 00:08 - 2015-07-20 11:12 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll

2015-08-12 00:08 - 2015-07-20 11:12 - 00037376 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe

2015-08-12 00:08 - 2015-07-20 11:12 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\wups.dll

2015-08-12 00:08 - 2015-07-20 11:12 - 00012288 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll

2015-08-12 00:08 - 2015-07-20 10:56 - 00566784 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll

2015-08-12 00:08 - 2015-07-20 10:56 - 00173056 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll

2015-08-12 00:08 - 2015-07-20 10:56 - 00093184 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll

2015-08-12 00:08 - 2015-07-20 10:56 - 00034816 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe

2015-08-12 00:08 - 2015-07-20 10:56 - 00030208 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll

2015-08-12 00:08 - 2015-05-09 11:26 - 00493504 _____ (Microsoft Corporation) C:\windows\system32\mcupdate_GenuineIntel.dll

2015-08-09 23:39 - 2015-08-09 23:39 - 00006490 _____ C:\AdwCleaner[R4].txt

2015-08-09 23:39 - 2015-08-09 23:39 - 00000316 _____ C:\AdwCleaner[S3].txt

2015-08-09 23:38 - 2015-08-09 23:38 - 00006430 _____ C:\AdwCleaner[R3].txt

2015-08-09 23:29 - 2015-08-09 23:29 - 00000000 ____D C:\AdwCleaner

2015-08-07 23:48 - 2015-08-07 23:48 - 00001480 _____ C:\Users\Rajagopal Kumar\Downloads\daily-show-host-jon-stewart-bids-adieu-after-16-years-1514479

2015-08-02 17:22 - 2015-08-02 17:23 - 00023593 _____ C:\Users\Rajagopal Kumar\Downloads\download (2)

2015-08-02 17:20 - 2015-08-02 17:20 - 00013315 _____ C:\Users\Rajagopal Kumar\Downloads\download (1)

2015-07-31 11:42 - 2015-07-31 11:42 - 00000229 _____ C:\Users\Rajagopal Kumar\Downloads\ads-iframe-display (2).php

2015-07-31 11:34 - 2015-07-31 11:34 - 00000039 _____ C:\Users\Rajagopal Kumar\Downloads\ads-iframe-display (1).php

2015-07-31 11:32 - 2015-07-31 11:36 - 00000850 _____ C:\Users\Rajagopal Kumar\Downloads\container.html

2015-07-31 01:03 - 2015-07-31 01:03 - 00000000 ____D C:\Users\Rajagopal Kumar\AppData\Local\GWX

2015-07-31 01:02 - 2015-07-31 01:02 - 00001941 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk

2015-07-31 01:02 - 2015-07-31 01:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus

2015-07-31 01:02 - 2015-07-31 01:02 - 00000000 ____D C:\Program Files\McAfee Security Scan

 

==================== One Month Modified files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-08-26 22:47 - 2009-07-13 20:20 - 00000000 ___HD C:\windows\system32\GroupPolicy

2015-08-26 22:47 - 2009-07-13 20:20 - 00000000 ____D C:\windows\SysWOW64\GroupPolicy

2015-08-25 22:04 - 2011-11-25 18:07 - 00000948 _____ C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2180650751-2005149398-3877183700-1000UA.job

2015-08-25 22:04 - 2011-11-25 18:07 - 00000896 _____ C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2180650751-2005149398-3877183700-1000Core.job

2015-08-25 22:04 - 2010-09-08 08:55 - 00913024 _____ C:\windows\system32\TPHDLOG0.LOG

2015-08-25 22:04 - 2009-07-13 21:45 - 00022704 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-08-25 22:04 - 2009-07-13 21:45 - 00022704 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-08-25 22:03 - 2011-11-21 09:28 - 02870004 _____ C:\FaceProv.log

2015-08-25 22:02 - 2009-07-13 22:08 - 00000006 ____H C:\windows\Tasks\SA.DAT

2015-08-25 22:02 - 2009-07-13 21:51 - 00194624 _____ C:\windows\setupact.log

2015-08-25 22:01 - 2010-09-08 08:54 - 01678110 _____ C:\windows\PFRO.log

2015-08-25 09:27 - 2011-11-21 09:25 - 01177952 _____ C:\windows\WindowsUpdate.log

2015-08-25 09:21 - 2015-01-23 10:08 - 00000558 _____ C:\windows\Tasks\G2MUpdateTask-S-1-5-21-2180650751-2005149398-3877183700-1000.job

2015-08-25 08:39 - 2015-05-30 17:08 - 00000654 _____ C:\windows\Tasks\G2MUploadTask-S-1-5-21-2180650751-2005149398-3877183700-1000.job

2015-08-25 08:29 - 2012-09-03 20:26 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2015-08-25 03:31 - 2012-01-28 13:13 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-08-25 03:27 - 2015-06-19 09:42 - 00000000 ____D C:\Program Files\Microsoft Office 15

2015-08-25 03:15 - 2010-09-08 08:55 - 01844352 _____ C:\windows\system32\TPAPSLOG.LOG

2015-08-25 00:01 - 2014-09-22 22:53 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2015-08-25 00:01 - 2011-12-10 16:34 - 00000000 ____D C:\Users\Rajagopal Kumar\AppData\Local\CrashDumps

2015-08-25 00:01 - 2010-09-08 08:49 - 00000000 ____D C:\ProgramData\Temp

2015-08-25 00:00 - 2012-09-03 20:36 - 00000000 ____D C:\Program Files (x86)\SpywareBlaster

2015-08-24 23:58 - 2012-09-03 20:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster

2015-08-24 23:57 - 2013-09-08 18:03 - 00000000 ____D C:\Raju

2015-08-24 23:18 - 2012-03-18 13:57 - 00000000 ____D C:\Program Files (x86)\ExpressFiles

2015-08-24 21:25 - 2011-11-23 09:19 - 00000000 ____D C:\Users\Rajagopal Kumar

2015-08-24 20:05 - 2015-04-04 12:37 - 00000000 ___SD C:\windows\system32\GWX

2015-08-24 20:05 - 2011-11-25 18:08 - 00000000 ____D C:\Users\Rajagopal Kumar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome

2015-08-24 20:05 - 2011-11-25 17:54 - 00000000 ____D C:\ProgramData\McAfee Security Scan

2015-08-24 20:05 - 2011-11-23 09:19 - 00000000 ____D C:\Users\Rajagopal Kumar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo

2015-08-24 20:04 - 2009-07-13 20:20 - 00000000 ____D C:\windows\registration

2015-08-24 20:03 - 2015-06-26 10:11 - 00000000 __RHD C:\MSOCache

2015-08-24 18:23 - 2012-03-18 13:57 - 00000000 ____D C:\Users\Rajagopal Kumar\AppData\Roaming\ExpressFiles

2015-08-20 20:54 - 2010-09-08 08:51 - 00000000 ____D C:\ProgramData\VeriFace

2015-08-20 20:53 - 2009-07-13 22:09 - 00000000 ____D C:\windows\System32\Tasks\WPD

2015-08-19 00:21 - 2012-05-30 11:18 - 00000000 ____D C:\Users\Rajagopal Kumar\AppData\Roaming\PrimoPDF

2015-08-17 18:28 - 2009-07-13 21:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

2015-08-15 18:38 - 2009-07-13 20:20 - 00000000 ____D C:\windows\rescache

2015-08-14 09:21 - 2009-07-13 21:45 - 00442424 _____ C:\windows\system32\FNTCACHE.DAT

2015-08-14 09:17 - 2014-12-18 00:45 - 00000000 ____D C:\windows\system32\appraiser

2015-08-14 09:17 - 2014-05-10 02:53 - 00000000 ___SD C:\windows\system32\CompatTel

2015-08-14 00:48 - 2012-09-03 20:26 - 00778440 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2015-08-14 00:48 - 2012-09-03 20:26 - 00003768 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater

2015-08-14 00:48 - 2011-11-25 17:55 - 00142536 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-08-12 23:41 - 2012-04-21 16:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2015-08-12 21:13 - 2012-04-21 16:51 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2015-08-12 21:13 - 2012-04-21 16:51 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2015-08-09 23:16 - 2011-12-10 16:25 - 00000000 ____D C:\norton

2015-08-09 12:25 - 2014-09-22 22:53 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-08-05 20:26 - 2010-09-08 08:55 - 01819584 _____ C:\windows\system32\TPAPSLOG(19).LOG

2015-08-03 23:56 - 2011-12-05 02:12 - 00000000 ____D C:\Users\Rajagopal Kumar\AppData\Roaming\vlc

 

==================== Files in the root of some directories =======

 

2015-01-15 07:38 - 2015-01-15 07:38 - 0008704 _____ () C:\Users\Rajagopal Kumar\AppData\Roaming\agmas.msy

2011-12-06 01:24 - 2012-09-27 19:49 - 0000600 _____ () C:\Users\Rajagopal Kumar\AppData\Local\PUTTY.RND

2014-09-22 23:18 - 2015-05-27 21:12 - 0007605 _____ () C:\Users\Rajagopal Kumar\AppData\Local\resmon.resmoncfg

 

==================== Bamital & volsnap =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\windows\system32\winlogon.exe => File is digitally signed

C:\windows\system32\wininit.exe => File is digitally signed

C:\windows\SysWOW64\wininit.exe => File is digitally signed

C:\windows\explorer.exe => File is digitally signed

C:\windows\SysWOW64\explorer.exe => File is digitally signed

C:\windows\system32\svchost.exe => File is digitally signed

C:\windows\SysWOW64\svchost.exe => File is digitally signed

C:\windows\system32\services.exe => File is digitally signed

C:\windows\system32\User32.dll => File is digitally signed

C:\windows\SysWOW64\User32.dll => File is digitally signed

C:\windows\system32\userinit.exe => File is digitally signed

C:\windows\SysWOW64\userinit.exe => File is digitally signed

C:\windows\system32\rpcss.dll => File is digitally signed

C:\windows\system32\dnsapi.dll => File is digitally signed

C:\windows\SysWOW64\dnsapi.dll => File is digitally signed

C:\windows\system32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2015-08-25 03:54

 

==================== End of FRST.txt ============================

 

----------------------------------------------------------------------------------------------------------------------------------------

 

 

Addition.txt(after booting into safe mode)

 

------------------------------------------------------------------------------------------------------------------------------------

 

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version:26-08-2015

Ran by Rajagopal Kumar (2015-08-26 21:54:27)

Running from C:\Users\Rajagopal Kumar\Desktop

Boot Mode: Safe Mode (with Networking)

==========================================================

 

 

==================== Accounts: =============================

 

Administrator (S-1-5-21-2180650751-2005149398-3877183700-500 - Administrator - Disabled)

Guest (S-1-5-21-2180650751-2005149398-3877183700-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-2180650751-2005149398-3877183700-1004 - Limited - Enabled)

Rajagopal Kumar (S-1-5-21-2180650751-2005149398-3877183700-1000 - Administrator - Enabled) => C:\Users\Rajagopal Kumar

rajagopal ravikumar (S-1-5-21-2180650751-2005149398-3877183700-1006 - Administrator - Enabled)

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}

AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: ZoneAlarm Free Firewall Firewall (Disabled) {E6380B7E-D4B2-19F1-083E-56486607704B}

 

==================== Installed Programs ======================

 

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

ActivClient x64 (HKLM\...\{86E45973-5352-439F-A115-2E8EE4D40140}) (Version: 6.2 - ActivIdentity)

Active Protection System (HKLM-x32\...\{F493761C-E465-4B9E-9FC1-A312F161DE0A}) (Version: 1.70.08 - Lenovo)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.4.0.2540 - Adobe Systems Incorporated)

Adobe Flash Player 18 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 18.0.0.232 - Adobe Systems Incorporated)

Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.12) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)

AoA Audio Extractor (HKLM-x32\...\{D1725D54-279A-40C5-A70D-23C1785DB920}_is1) (Version:  - AoAMedia.com)

AOL Toolbar (HKLM-x32\...\AOL Toolbar) (Version:  - )

AOL Toolbar (HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\AOL Toolbar) (Version:  - )

Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.26 - Atheros Communications Inc.)

ChromecastApp (HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\{079ede36-133d-44b0-8053-c7c1fa8d2e0d}_is1) (Version: 1.5.1383.0 - Google Inc.)

Citrix Online Launcher (HKLM-x32\...\{AFB80939-4486-49D8-A04E-2B05C0F2DE39}) (Version: 1.0.252 - Citrix)

CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.0.2311 - CyberLink Corp.)

Energy Management (HKLM-x32\...\{0CE226F3-EB27-4ECD-BBF5-F088716779FD}) (Version: 5.4.1.6 - Lenovo)

ERUNT 1.1j (HKLM-x32\...\ERUNT_is1) (Version:  - Lars Hederer)

ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )

FileHippo.com Update Checker (HKLM-x32\...\FileHippo.com) (Version:  - )

Google Chrome (HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\Google Chrome) (Version: 44.0.2403.155 - Google Inc.)

Google Talk Plugin (HKLM-x32\...\{83A5D4E9-7FE6-336D-9525-F1C879496014}) (Version: 3.3.2.8436 - Google)

GoToMeeting 7.2.3.3019 (HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\GoToMeeting) (Version: 7.2.3.3019 - CitrixOnline)

HipChat (HKLM-x32\...\{D841EE48-5BDF-433C-A6C4-261855E542E9}) (Version: 2.2.1221 - Atlassian Inc)

HP Virtual Room Client Launcher Plugin (HKLM-x32\...\{E9C450A0-4606-11E0-9207-0800200C9A66}) (Version: 2.0.0.1 - Hewlett-Packard)

Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)

Intel® Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2086 - Intel Corporation)

Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)

Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.5.6.1001 - Intel Corporation)

Java 7 Update 7 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417007FF}) (Version: 7.0.70 - Oracle)

Java™ 6 Update 35 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216035FF}) (Version: 6.0.350 - Oracle)

JDownloader (HKLM-x32\...\JDownloader) (Version: 0.89 - AppWork UG (haftungsbeschränkt))

JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)

Juniper Networks Setup Client (HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\Juniper_Setup_Client) (Version: 8.0.3.44983 - Juniper Networks)

Juniper Networks Setup Client 64-bit Activex Control (HKLM\...\Juniper_Setup_Client Activex Control) (Version: 2.1.1.1 - Juniper Networks)

Juniper Networks Setup Client Activex Control (HKLM-x32\...\Juniper_Setup_Client Activex Control) (Version: 2.1.1.1 - Juniper Networks)

Junos Pulse (Version: 5.0.44983 - Juniper Networks) Hidden

Junos Pulse 5.0 (HKLM-x32\...\Junos Pulse 5.0) (Version: 5.0.44983 - Juniper Networks, Inc.)

KeyScrambler (HKLM-x32\...\KeyScrambler) (Version: 2.9.2.0 - QFX Software Corporation)

Kies mini (HKLM-x32\...\InstallShield_{EE43894E-FDCF-4A8C-BCD6-3AAA9A48B486}) (Version: 1.00.0000 - Samsung Electronics Co., Ltd.)

Kies mini (x32 Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Hidden

Lenovo Bluetooth with Enhanced Data Rate Software (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.1.1400 - Broadcom Corporation)

Lenovo DirectShare (HKLM-x32\...\InstallShield_{B2164CCB-C002-4B80-8550-7535D80DF237}) (Version: 1.0.1.38 - ArcSoft)

Lenovo DirectShare (x32 Version: 1.0.1.38 - ArcSoft) Hidden

Lenovo EasyCamera (HKLM-x32\...\{ADE16A9D-FBDC-4ecc-B6BD-9C31E51D0332}) (Version: 2.10.02.23.1 - Vimicro)

Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 7.0.0723 - CyberLink Corp.)

Lenovo OneKey Recovery (Version: 7.0.0723 - CyberLink Corp.) Hidden

Lenovo ReadyComm 5 (HKLM-x32\...\{17542DBF-E17C-4562-BC4D-FA3EF3076C45}) (Version: 5.1.1.17 - Lenovo)

Lenovo ReadyComm 5.0 Service (HKLM-x32\...\{76C66170-C538-4E77-B54D-48E136B5B533}) (Version: 5.0.0.1 - Lenovo Group Limited)

Lenovo Security Solution FP (HKLM\...\{0F841121-4DB6-4B31-839F-7F5AB3BB3423}) (Version: 5.9.3.6245 - UPEK Inc.)

magicJack (HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\magicJack) (Version: 2.0.6073.4413 - magicJack L.P.)

Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)

McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.149.2 - McAfee, Inc.)

Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)

Microsoft Lync 2010 Attendee (HKLM-x32\...\{6F72D695-5188-4484-B21E-E16CD89C4008}) (Version: 4.0.7577.4446 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office 365 ProPlus - en-us (HKLM\...\O365ProPlusRetail - en-us) (Version: 15.0.4745.1002 - Microsoft Corporation)

Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Save as PDF Add-in for 2007 Microsoft Office programs (HKLM-x32\...\{90120000-00B0-0409-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)

Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual J# 2.0 Redistributable Package - SE (x64) (HKLM\...\Microsoft Visual J# 2.0 Redistributable Package - SE (x64)) (Version:  - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

Mozilla Firefox 38.0.5 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 38.0.5 (x86 en-US)) (Version: 38.0.5 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.1.1 - Mozilla)

NEF Codec (HKLM-x32\...\{D6506521-0959-4FA3-875F-E2E28830B0D2}) (Version: 1.00.0000 - Nikon)

NEF to JPG (HKLM-x32\...\{13D87B39-2A3B-4675-A0D9-B8B01EA2F8E3}_is1) (Version:  - neftojpg.com)

Nitro Reader 2 (HKLM\...\{7B72A3FB-2563-4A83-B054-98C57415DFFA}) (Version: 2.3.1.7 - Nitro PDF Software)

Norton Safe Web Lite (HKLM-x32\...\NST) (Version: 2.0.0.16 - Symantec Corporation)

Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4745.1002 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Licensing Component (Version: 15.0.4745.1002 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4745.1002 - Microsoft Corporation) Hidden

Oracle VM VirtualBox 4.1.18 (HKLM\...\{4EE61784-10C6-4B7C-A0B2-5BED17B05741}) (Version: 4.1.18 - Oracle Corporation)

PDFBinder (HKLM-x32\...\{8BA03AC2-579F-41CD-A250-740137D86F7A}) (Version: 1.0.0 - Malamute.dk)

Pidgin (HKLM-x32\...\Pidgin) (Version: 2.10.6 - )

PrimoPDF -- brought to you by Nitro PDF Software (HKLM-x32\...\PrimoPDF) (Version: 5 - Nitro PDF Software)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6083 - Realtek Semiconductor Corp.)

Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30116 - Realtek Semiconductor Corp.)

Remote Access to HP Network 6.2 (HKLM\...\{9F150026-E7A4-47D9-B0E2-7666EEC54AA6}) (Version: 6.2.3.52064 - Hewlett-Packard Company)

Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.2.0.12014_18 - Samsung Electronics Co., Ltd.)

Samsung Kies (x32 Version: 2.2.0.12014_18 - Samsung Electronics Co., Ltd.) Hidden

SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.3.2300.0 - SAMSUNG Electronics Co., Ltd.)

Skype for Business Web App Plug-in (HKLM-x32\...\{7EA9A4CD-6875-4F3C-A4D4-42C924AD3CF8}) (Version: 15.8.20020.351 - Microsoft Corporation)

Skype™ 7.1 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.1.105 - Skype Technologies S.A.)

SpywareBlaster 5.2 (HKLM-x32\...\SpywareBlaster_is1) (Version: 5.2.0 - BrightFort LLC)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.13.0 - Synaptics Incorporated)

TeamViewer 7 (HKLM-x32\...\TeamViewer 7) (Version: 7.0.12541 - TeamViewer)

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

VeriFace (HKLM-x32\...\VeriFace) (Version: 3.6.0.0730 - Lenovo)

Vim 7.3 (self-installing) (HKLM\...\Vim 7.3) (Version:  - )

VLC media player 1.1.11 (HKLM-x32\...\VLC media player) (Version: 1.1.11 - VideoLAN)

VLC media player 2.0.2 (HKLM\...\VLC media player) (Version: 2.0.2 - VideoLAN)

VMware vSphere Client 4.1 (HKLM-x32\...\{A0B433B1-941D-46F5-AE59-286263534232}) (Version: 4.1.0.17435 - VMware, Inc.)

VMware vSphere Client 5.0 (HKLM-x32\...\{04805AB6-F757-496A-8D56-37A0FC5FF6F3}) (Version: 5.0.0.16964 - VMware, Inc.)

Windows Driver Package - Broadcom (BTHUSB) Bluetooth  (02/25/2010 6.2.0.9419) (HKLM\...\85CE3A3657FAE5FD305B143E90E6FC89BA53001C) (Version: 02/25/2010 6.2.0.9419 - Broadcom)

Windows Driver Package - Broadcom Bluetooth  (01/19/2010 6.2.0.1417) (HKLM\...\7341A1B43E7FE58942EB1E820A17C18305DFBCE6) (Version: 01/19/2010 6.2.0.1417 - Broadcom)

Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (HKLM\...\3BA80AB4C7E9F8497C115C844953A3D4BEB84D21) (Version: 07/28/2009 6.2.0.9800 - Broadcom)

Windows Driver Package - Lenovo (ACPIVPC) System  (10/19/2009 5.4.0.1) (HKLM\...\0A4175B489A1B4A6E07E11B063A6263480C51D71) (Version: 10/19/2009 5.4.0.1 - Lenovo)

WinRAR 4.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

WinRAR archiver (HKLM-x32\...\WinRAR archiver) (Version:  - )

Yahoo! Detect (HKLM-x32\...\YTdetect) (Version:  - )

ZoneAlarm Firewall (x32 Version: 10.2.078.000 - Check Point Software Technologies Ltd.) Hidden

ZoneAlarm LTD Toolbar (HKLM\...\ZoneAlarm LTD Toolbar) (Version:  - Check Point Software Technologies)

ZoneAlarm Security (HKLM-x32\...\ZoneAlarm Security) (Version: 10.2.078.000 - Check Point)

ZoneAlarm Security (x32 Version: 10.2.078.000 - Check Point Software Technologies Ltd.) Hidden

ZoneAlarm Security Toolbar  (HKLM-x32\...\ZoneAlarm Security Toolbar) (Version:  - Check Point Software Technologies LTD)

 

==================== Custom CLSID (Whitelisted): ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No File

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll No File

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{1542FC7D-8D51-43D5-B757-67C763F27BF4}\localserver32 -> C:\Users\Rajagopal Kumar\AppData\Local\Microsoft\SkypeForBusinessPlugin\15.8.20020.351\GatewayVersion-x64.exe (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}\InprocServer32 -> C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\1.3.28.1\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{7ECF6F97-B4F3-4168-9835-F59C06D7875F}\InprocServer32 -> C:\Users\Rajagopal Kumar\AppData\Local\Microsoft\SkypeForBusinessPlugin\15.8.20020.351\GatewayActiveX-x64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files (x86)\Citrix\GoToMeeting\2759\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll No File

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll No File

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\1.3.28.1\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File

 

==================== Restore Points =========================

 

25-08-2015 04:01:06 Scheduled Checkpoint

25-08-2015 09:26:51 Windows Update

 

==================== Hosts content: ===============================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2009-07-13 19:34 - 2015-08-09 15:34 - 00000188 ____A C:\windows\system32\Drivers\etc\hosts

127.0.0.1       localhost

::1       localhost

਍⸰⸰⸰ऱ獭灳畬⹳捭晡敥挮浯਍਍⸰⸰⸰ऱ獭灳畬⹳捭晡敥挮浯਍਍⸰⸰⸰ऱ獭灳畬⹳捭晡敥挮浯਍

 

==================== Scheduled Tasks (Whitelisted) =============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

Task: {0A48790B-8F21-49D6-BCA2-002FCDE66934} - System32\Tasks\{CAA2C271-9E78-4B13-B771-BFEAB9B43BF6} => Firefox.exe http://ui.skype.com/...all?page=tsMain

Task: {15FCD675-73D4-4897-827E-3BFA92A8BB3F} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-06-19] (Microsoft Corporation)

Task: {1E836FBE-A247-4075-A0E7-78F272158E84} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-07-14] (Microsoft Corporation)

Task: {24FB4A52-7D86-4D24-873D-9D159EBF5D2C} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-14] (Microsoft Corporation)

Task: {5428AE52-65C6-4FE8-8D37-3EDCD57189F9} - System32\Tasks\{67D128B7-CF09-424C-B021-85A1D7231D4D} => pcalua.exe -a "C:\Users\Rajagopal Kumar\Downloads\IN3VDO43WW6.exe" -d "C:\Program Files (x86)\Mozilla Firefox"

Task: {55F19CD7-5DDC-40B4-8FDA-407C1644F7CA} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)

Task: {58362B81-CD62-43EC-AF59-791AFF86439C} - System32\Tasks\Express Files Updater => C:\Program Files (x86)\ExpressFiles\EFupdater.exe <==== ATTENTION

Task: {87FD0532-5C3B-44F7-9AE6-0466BA097486} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiser

Task: {88277C0E-4E7E-476C-B420-5DE07C77594C} - System32\Tasks\{AEB01D3F-7D48-4A30-BDBC-F3F68CBE86EE} => Firefox.exe http://ui.skype.com/...all?page=tsBing

Task: {93CD187A-AD37-42A9-8DE8-1F0DF268302B} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-14] (Microsoft Corporation)

Task: {A1FAA169-2519-49D6-A9D2-86AFEC913226} - System32\Tasks\G2MUpdateTask-S-1-5-21-2180650751-2005149398-3877183700-1000 => C:\Program Files (x86)\Citrix\GoToMeeting\3019\g2mupdate.exe [2015-07-19] (Citrix Online, a division of Citrix Systems, Inc.)

Task: {B461737D-578C-4030-B304-9EF0F4FF78E8} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2180650751-2005149398-3877183700-1000Core => C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-26] (Google Inc.)

Task: {C43905FD-C93B-4E0C-806F-4A4661FA2BD0} - System32\Tasks\G2MUploadTask-S-1-5-21-2180650751-2005149398-3877183700-1000 => C:\Program Files (x86)\Citrix\GoToMeeting\3019\g2mupload.exe [2015-07-19] (Citrix Online, a division of Citrix Systems, Inc.)

Task: {C69F1BB0-3857-4F61-8E12-125B616DFB70} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-14] (Adobe Systems Incorporated)

Task: {D20757B0-CFF4-4239-AEEC-0C6EA939D0CF} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-06-19] (Microsoft Corporation)

Task: {E0E97A4B-C8D4-4B17-9E32-5E6BBD65AFE8} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2180650751-2005149398-3877183700-1000UA => C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-26] (Google Inc.)

 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

 

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\windows\Tasks\G2MUpdateTask-S-1-5-21-2180650751-2005149398-3877183700-1000.job => C:\Program Files (x86)\Citrix\GoToMeeting\3019\g2mupdate.exe

Task: C:\windows\Tasks\G2MUploadTask-S-1-5-21-2180650751-2005149398-3877183700-1000.job => C:\Program Files (x86)\Citrix\GoToMeeting\3019\g2mupload.exe

Task: C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2180650751-2005149398-3877183700-1000Core.job => C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2180650751-2005149398-3877183700-1000UA.job => C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\GoogleUpdate.exe

 

==================== Loaded Modules (Whitelisted) ==============

 

2015-06-19 11:39 - 2015-06-19 11:39 - 08898720 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll

2010-09-08 08:51 - 2010-09-08 08:51 - 01502720 _____ () C:\windows\system32\IcnOvrly.dll

2015-06-19 11:39 - 2015-06-19 11:39 - 08898720 _____ () C:\Program Files\Microsoft Office 15\root\Office15\1033\GrooveIntlResource.dll

2015-08-24 21:40 - 2014-02-10 13:44 - 04592128 _____ () C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libglesv2.dll

2015-08-24 21:40 - 2014-02-10 13:44 - 00112128 _____ () C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libegl.dll

 

==================== Alternate Data Streams (Whitelisted) =========

 

(If an entry is included in the fixlist, only the ADS will be removed.)

 

AlternateDataStreams: C:\ProgramData\Temp:5C321E34

AlternateDataStreams: C:\ProgramData\Temp:8CE646EE

AlternateDataStreams: C:\Users\Rajagopal Kumar\Desktop\noname.eml:OECustomProperty

 

==================== Safe Mode (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2"

 

==================== EXE Association (Whitelisted) ===============

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

 

 

==================== Internet Explorer trusted/restricted ===============

 

(If an entry is included in the fixlist, it will be removed from the registry.)

 

IE trusted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\hp.com -> hxxps://hp.com

 

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\008i.com -> 008i.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\008k.com -> 008k.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\00hq.com -> 00hq.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\0190-dialers.com -> 0190-dialers.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\01i.info -> 01i.info

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\0411dd.com -> 0411dd.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\0511zfhl.com -> 0511zfhl.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\05p.com -> 05p.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\0632qyw.com -> 0632qyw.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\0calories.net -> 0calories.net

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\0cj.net -> 0cj.net

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\0scan.com -> 0scan.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\1-britney-spears-nude.com -> 1-britney-spears-nude.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\1-domains-registrations.com -> 1-domains-registrations.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\1-se.com -> 1-se.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\1001movie.com -> 1001movie.com

 

There are 6091 more restricted sites.

 

==================== Other Areas ============================

 

(Currently there is no automatic fix for this section.)

 

HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Rajagopal Kumar\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 192.168.2.1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)

Windows Firewall is disabled.

 

==================== MSCONFIG/TASK MANAGER disabled items ==

 

(Currently there is no automatic fix for this section.)

 

MSCONFIG\startupreg: GrooveMonitor => "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

MSCONFIG\startupreg: VeriFaceManager => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe

 

==================== FirewallRules (Whitelisted) ===============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

FirewallRules: [{8215C609-9286-4EEF-BC10-2318CEF88218}] => (Allow) C:\Users\Rajagopal Kumar\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe

FirewallRules: [{EB147613-C33A-4499-84A4-0A3ADF07DD65}] => (Allow) C:\Users\Rajagopal Kumar\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe

FirewallRules: [TCP Query User{7459A482-86DC-4D9F-8847-E7BD8D47958E}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [UDP Query User{C3F1332D-4B6E-4F39-8425-414AA1C6949C}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [{1EAD79F7-B4AE-4EE5-87EF-E128A1FC8889}] => (Block) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [{6299D513-4903-4014-BA28-F48423DE4058}] => (Block) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [{E7162A74-E8A9-4405-AE3C-9CDB57DB5BB7}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe

FirewallRules: [TCP Query User{BE4615D3-A12D-4C39-AE1E-16EB7794D6B6}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe

FirewallRules: [UDP Query User{E3B50CE2-4C0E-4273-9F1A-DDA98A4A2FDD}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe

FirewallRules: [{421B08B4-2012-4645-AABE-B2C416F17986}] => (Allow) C:\program files\java\jre7\bin\javaw.exe

FirewallRules: [{B477A468-0555-4711-A87A-9F60F0A7F9CD}] => (Allow) C:\program files\java\jre7\bin\javaw.exe

FirewallRules: [{E267EF39-2810-4130-8188-CE084AF56ABB}] => (Allow) C:\Program Files (x86)\JDownloader\JDownloader.exe

FirewallRules: [{3D42C315-0A07-4FB5-AB82-07B62ADFFED2}] => (Allow) C:\Program Files (x86)\JDownloader\JDownloader.exe

FirewallRules: [{40B0CEB0-3399-4D92-97E6-3BE8179AFD0F}] => (Allow) C:\Program Files (x86)\JDownloader\JDownloader.exe

FirewallRules: [{8924E548-5944-4BBA-9174-A6EB4E16697D}] => (Allow) C:\Program Files (x86)\JDownloader\JDownloader.exe

FirewallRules: [{969EE50C-E0CA-4D29-91FD-023B887F6DA4}] => (Allow) C:\Users\Rajagopal Kumar\AppData\Roaming\mjusbsp\magicJack.exe

FirewallRules: [{5CFF30FE-8D45-4BC6-A99B-6AEB732653D8}] => (Allow) C:\Users\Rajagopal Kumar\AppData\Roaming\mjusbsp\magicJack.exe

FirewallRules: [{047D8F8E-1158-42AA-B959-1D65D3AAED82}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{05D2B766-E6EF-472B-AAC0-CBCEEA6C8402}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{5558A5DF-E982-4A81-B784-79BB3E93D94D}] => (Allow) C:\Users\Rajagopal Kumar\AppData\Local\Microsoft Lync Attendee\AttendeeCommunicator.exe

FirewallRules: [{CF4C00FF-9B7D-491C-8C36-F328FB105F4C}] => (Allow) C:\Users\Rajagopal Kumar\AppData\Local\Microsoft Lync Attendee\AttendeeCommunicator.exe

FirewallRules: [{14BCE56C-B290-4B80-854C-7F54428B2F14}] => (Allow) C:\Users\Rajagopal Kumar\AppData\Local\Microsoft Lync Attendee\AttendeeCommunicator.exe

FirewallRules: [{626E21BA-AA40-4CB1-A5E2-963043E56E81}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe

FirewallRules: [{ABB2BA79-1F7B-440A-A4D0-40972DEE3557}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe

FirewallRules: [{76636A7A-1F5E-4A9A-B15C-273379BB25B2}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe

FirewallRules: [{26A22A1C-2103-46E3-B33A-FF06201A95E9}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe

FirewallRules: [{567B008F-5BB7-4C04-81DB-7A9EC9195A96}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe

FirewallRules: [{A815176F-0FC6-45AE-A3C9-C4695D92FBD2}] => (Allow) C:\Program Files\Microsoft Office 15\root\office15\lync.exe

FirewallRules: [{3FE0076A-395B-4A1C-A486-8E6871B05CE3}] => (Allow) C:\Program Files\Microsoft Office 15\root\office15\lync.exe

FirewallRules: [{338A3E5B-68B9-40DF-9E0D-0313DD640670}] => (Allow) C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\chrome.exe

 

==================== Faulty Device Manager Devices =============

 

Name: Security Processor Loader Driver

Description: Security Processor Loader Driver

Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Manufacturer: 

Service: spldr

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.

 

 

==================== Event log errors: =========================

 

Application errors:

==================

Error: (08/26/2015 09:49:31 PM) (Source: SideBySide) (EventID: 35) (User: )

Description: Activation context generation failed for "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1".Error in manifest or policy file "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" on line UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.

Component identity found in manifest does not match the identity of the component requested.

Reference is UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".

Definition is UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".

Please use sxstrace.exe for detailed diagnosis.

 

Error: (08/25/2015 10:06:48 PM) (Source: SideBySide) (EventID: 35) (User: )

Description: Activation context generation failed for "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1".Error in manifest or policy file "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" on line UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.

Component identity found in manifest does not match the identity of the component requested.

Reference is UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".

Definition is UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".

Please use sxstrace.exe for detailed diagnosis.

 

Error: (08/25/2015 10:05:33 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: IswSvc.exe, version: 1.5.395.0, time stamp: 0x5001768d

Faulting module name: CRYPT32.dll, version: 6.1.7601.18839, time stamp: 0x553e8c21

Exception code: 0xc0000005

Fault offset: 0x000000000001edca

Faulting process id: 0x7ac

Faulting application start time: 0xIswSvc.exe0

Faulting application path: IswSvc.exe1

Faulting module path: IswSvc.exe2

Report Id: IswSvc.exe3

 

Error: (08/25/2015 10:04:08 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: mbamservice.exe, version: 3.0.2.0, time stamp: 0x5318d363

Faulting module name: mbamservice.exe, version: 3.0.2.0, time stamp: 0x5318d363

Exception code: 0x40000015

Fault offset: 0x0007da8a

Faulting process id: 0x4a0

Faulting application start time: 0xmbamservice.exe0

Faulting application path: mbamservice.exe1

Faulting module path: mbamservice.exe2

Report Id: mbamservice.exe3

 

Error: (08/25/2015 10:03:44 PM) (Source: SideBySide) (EventID: 35) (User: )

Description: Activation context generation failed for "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1".Error in manifest or policy file "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" on line UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.

Component identity found in manifest does not match the identity of the component requested.

Reference is UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".

Definition is UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".

Please use sxstrace.exe for detailed diagnosis.

 

Error: (08/25/2015 10:03:37 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: mbamscheduler.exe, version: 3.0.2.0, time stamp: 0x5339cec3

Faulting module name: MSVCR100.dll, version: 10.0.40219.325, time stamp: 0x4df2be1e

Exception code: 0x40000015

Fault offset: 0x0008d6fd

Faulting process id: 0xdd8

Faulting application start time: 0xmbamscheduler.exe0

Faulting application path: mbamscheduler.exe1

Faulting module path: mbamscheduler.exe2

Report Id: mbamscheduler.exe3

 

Error: (08/25/2015 08:43:03 AM) (Source: MsiInstaller) (EventID: 11714) (User: RajagopalKumar)

Description: Product: Google Talk Plugin -- Error 1714. The older version of Google Talk Plugin cannot be removed.  Contact your technical support group.  System Error 1612.

 

Error: (08/25/2015 08:42:15 AM) (Source: SideBySide) (EventID: 35) (User: )

Description: Activation context generation failed for "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1".Error in manifest or policy file "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" on line UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.

Component identity found in manifest does not match the identity of the component requested.

Reference is UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".

Definition is UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".

Please use sxstrace.exe for detailed diagnosis.

 

Error: (08/25/2015 08:41:46 AM) (Source: SideBySide) (EventID: 35) (User: )

Description: Activation context generation failed for "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1".Error in manifest or policy file "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" on line UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.

Component identity found in manifest does not match the identity of the component requested.

Reference is UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".

Definition is UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".

Please use sxstrace.exe for detailed diagnosis.

 

Error: (08/25/2015 03:13:07 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: mbamservice.exe, version: 3.0.2.0, time stamp: 0x5318d363

Faulting module name: mbamservice.exe, version: 3.0.2.0, time stamp: 0x5318d363

Exception code: 0x40000015

Fault offset: 0x0007da8a

Faulting process id: 0x960

Faulting application start time: 0xmbamservice.exe0

Faulting application path: mbamservice.exe1

Faulting module path: mbamservice.exe2

Report Id: mbamservice.exe3

 

 

System errors:

=============

Error: (08/26/2015 09:49:39 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: 

%%1068

 

Error: (08/26/2015 09:49:39 PM) (Source: DCOM) (EventID: 10005) (User: )

Description: 1084WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}

 

Error: (08/26/2015 09:49:38 PM) (Source: DCOM) (EventID: 10005) (User: )

Description: 1084WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

 

Error: (08/26/2015 09:49:33 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Computer Browser service depends on the Server service which failed to start because of the following error: 

%%1068

 

Error: (08/26/2015 09:49:33 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Computer Browser service depends on the Server service which failed to start because of the following error: 

%%1068

 

Error: (08/26/2015 09:49:32 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Computer Browser service depends on the Server service which failed to start because of the following error: 

%%1068

 

Error: (08/26/2015 09:49:32 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Computer Browser service depends on the Server service which failed to start because of the following error: 

%%1068

 

Error: (08/26/2015 09:49:32 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Computer Browser service depends on the Server service which failed to start because of the following error: 

%%1068

 

Error: (08/26/2015 09:49:32 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Computer Browser service depends on the Server service which failed to start because of the following error: 

%%1068

 

Error: (08/26/2015 09:49:31 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Computer Browser service depends on the Server service which failed to start because of the following error: 

%%1068

 

 

Microsoft Office:

=========================

 

CodeIntegrity:

===================================

  Date: 2015-08-25 09:26:46.785

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-08-25 08:42:28.363

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-08-25 08:41:37.996

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-08-24 18:24:52.376

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-08-21 12:01:13.919

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-08-20 23:58:11.759

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-08-20 20:57:07.795

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-08-19 01:21:20.476

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-08-18 23:56:16.231

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-08-18 23:12:42.908

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

 

 

==================== Memory info =========================== 

 

Processor: Intel® Core™ i5 CPU M 450 @ 2.40GHz

Percentage of memory in use: 29%

Total physical RAM: 3893.86 MB

Available physical RAM: 2736.46 MB

Total Virtual: 7785.92 MB

Available Virtual: 6620.34 MB

 

==================== Drives ================================

 

Drive c: (Windows) (Fixed) (Total:420.66 GB) (Free:47.17 GB) NTFS

Drive d: () (Fixed) (Total:30 GB) (Free:29.91 GB) NTFS

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 600F9598)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=420.7 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=30 GB) - (Type=07 NTFS)

 

==================== End of Addition.txt ============================

 

--------------------------------------------------------------------------------------------------------------------------------------------

[emeraldnzl]

Hello again ragagopal,

 

Open notepad.

Please copy the contents of the code box below.

To do this highlight (click in the box and press Ctrl + A) the contents of the box and right click on it. Paste this into the open notepad. Save it to the Desktop as fixlist.txt.

Alternatively type the contents of the box into notepad and save it to your desktop as fixlist.txt.

NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.
 

C:\Program Files (x86)\ExpressFiles
C:\Users\Rajagopal Kumar\AppData\Roaming\ExpressFiles
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
FF Extension: Coupon Companion - C:\Users\Rajagopal Kumar\AppData\Roaming\Mozilla\Firefox\Profiles\u8k2wabt.default\Extensions\[email protected] [2014-09-01]
Winsock: Catalog5 01 C:\windows\SysWOW64\mswsock.dll [231424 2013-10-08] (Microsoft Corporation)ATTENTION: LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 01 mswsock.dll No File ATTENTION: LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Task: {58362B81-CD62-43EC-AF59-791AFF86439C} - System32\Tasks\Express Files Updater => C:\Program Files (x86)\ExpressFiles\EFupdater.exe <==== ATTENTION
CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No File
AlternateDataStreams: C:\ProgramData\Temp:5C321E34
AlternateDataStreams: C:\ProgramData\Temp:8CE646EE
Hosts:
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
CMD: bitsadmin /reset /allusers
CMD: ipconfig /flushdns
EmptyTemp:

This script is specifically written for the infection on this person's computer. It should NOT to be used on another machine. It may cause serious damage even to the point of rendering the computer unusable.

Run FRST/FRST64 and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

After that

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right click JRT.exe and "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

Finally in this post

Please run AdwCleaner again and clean anything it finds.

So when you return please post

• Fixlog.txt
• JRT.txt
• AdwCleaner log

 

[rajagopal]

Thank you for those steps. I ran adwcleaner to clean after doing a search, it did clean and did reboot my computer, but the log did not open up after I rebooted my computer in safe mode. I checked C:\Adwcleaner to see if I can find the logs, but there is nothing inside the C:\Adwcleaner\Quarantine folder. I am guessing, it probably did not find much to clean. Please see below for the other 2 logs - 

 

Fixlog.txt

 

-------------------------------------------------------

 

Fix result of Farbar Recovery Scan Tool (x64) Version:26-08-2015

Ran by Rajagopal Kumar (2015-08-26 23:23:51) Run:2

Running from C:\Users\Rajagopal Kumar\Desktop

Loaded Profiles: Rajagopal Kumar (Available Profiles: Rajagopal Kumar)

Boot Mode: Safe Mode (with Networking)

==============================================

 

fixlist content:

*****************

C:\Program Files (x86)\ExpressFiles

C:\Users\Rajagopal Kumar\AppData\Roaming\ExpressFiles

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

FF Extension: Coupon Companion - C:\Users\Rajagopal Kumar\AppData\Roaming\Mozilla\Firefox\Profiles\u8k2wabt.default\Extensions\[email protected] [2014-09-01]

Winsock: Catalog5 01 C:\windows\SysWOW64\mswsock.dll [231424 2013-10-08] (Microsoft Corporation)ATTENTION: LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"

Winsock: Catalog5-x64 01 mswsock.dll No File ATTENTION: LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"

Task: {58362B81-CD62-43EC-AF59-791AFF86439C} - System32\Tasks\Express Files Updater => C:\Program Files (x86)\ExpressFiles\EFupdater.exe <==== ATTENTION

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No File

AlternateDataStreams: C:\ProgramData\Temp:5C321E34

AlternateDataStreams: C:\ProgramData\Temp:8CE646EE

Hosts:

Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f

Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f

RemoveProxy:

CMD: bitsadmin /reset /allusers

CMD: ipconfig /flushdns

EmptyTemp:

*****************

 

C:\Program Files (x86)\ExpressFiles => moved successfully

C:\Users\Rajagopal Kumar\AppData\Roaming\ExpressFiles => moved successfully

"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully

"HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully

C:\Users\Rajagopal Kumar\AppData\Roaming\Mozilla\Firefox\Profiles\u8k2wabt.default\Extensions\[email protected] => moved successfully

C:\Users\Rajagopal Kumar\AppData\Roaming\Mozilla\Firefox\Profiles\u8k2wabt.default\Extensions\[email protected] => path removed successfullyWinsock: Catalog5 000000000001\\LibraryPath => restored successfully (%SystemRoot%\system32\NLAapi.dll)

Winsock: Catalog5-x64 000000000001\\LibraryPath => restored successfully (%SystemRoot%\system32\NLAapi.dll)

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{58362B81-CD62-43EC-AF59-791AFF86439C}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{58362B81-CD62-43EC-AF59-791AFF86439C}" => key removed successfully

C:\windows\System32\Tasks\Express Files Updater => moved successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Express Files Updater" => key removed successfully

"HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}" => key removed successfully

C:\ProgramData\Temp => ":5C321E34" ADS removed successfully.

C:\ProgramData\Temp => ":8CE646EE" ADS removed successfully.

C:\Windows\System32\Drivers\etc\hosts => moved successfully

Hosts restored successfully.

 

========= reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

 

The operation completed successfully.

 

 

 

========= End of Reg: =========

 

 

========= reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

 

The operation completed successfully.

 

 

 

========= End of Reg: =========

 

 

========= RemoveProxy: =========

 

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully

HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully

HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully

 

 

========= End of RemoveProxy: =========

 

 

=========  bitsadmin /reset /allusers =========

 

 

BITSADMIN version 3.0 [ 7.5.7601 ]

BITS administration utility.

© Copyright 2000-2006 Microsoft Corp.

 

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.

Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

 

Unable to connect to BITS - 0x8007042c

The dependency service or group failed to start.

 

 

 

========= End of CMD: =========

 

 

=========  ipconfig /flushdns =========

 

 

Windows IP Configuration

 

Successfully flushed the DNS Resolver Cache.

 

========= End of CMD: =========

 

EmptyTemp: => 2.5 GB temporary data Removed.

 

 

The system needed a reboot.. 

 

==== End of Fixlog 23:29:07 ====

 

-----------------------------------------------------------------------------------------------------------

 

JRT.txt

 

----------------------------------------------------------------------------------------------------------

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Malwarebytes

Version: 7.5.8 (08.24.2015:1)

OS: Windows 7 Home Premium x64

Ran by Rajagopal Kumar on Wed 08/26/2015 at 23:36:01.53

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

~~~ Services

 

 

 

~~~ Tasks

 

 

 

~~~ Registry Values

 

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\AboutURLs\\Tabs

 

 

 

~~~ Registry Keys

 

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{22222222-2222-2222-2222-220022442293}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{66666666-6666-6666-6666-660066446693}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{22222222-2222-2222-2222-220022442293}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{66666666-6666-6666-6666-660066446693}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{443789B7-F39C-4b5c-9287-DA72D38F4FE6}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{7111F2F3-9F5A-4B74-A4AE-01681430D82C}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{66666666-6666-6666-6666-660066446693}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{66666666-6666-6666-6666-660066446693}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{443789B7-F39C-4b5c-9287-DA72D38F4FE6}

 

 

 

~~~ Files

 

 

 

~~~ Folders

 

Successfully deleted: [Folder] C:\Program Files (x86)\aol toolbar

Successfully deleted: [Folder] C:\Program Files (x86)\norton safe web lite

Successfully deleted: [Folder] C:\ProgramData\aol toolbar

Successfully deleted: [Folder] C:\Users\Rajagopal Kumar\Appdata\Local\aol toolbar

Successfully deleted: [Folder] C:\Users\Rajagopal Kumar\AppData\Roaming\yourfiledownloader

 

 

 

~~~ FireFox

 

Successfully deleted: [Folder] C:\Users\Rajagopal Kumar\AppData\Roaming\mozilla\firefox\profiles\u8k2wabt.default\extensions\[email protected]

Successfully deleted the following from C:\Users\Rajagopal Kumar\AppData\Roaming\mozilla\firefox\profiles\u8k2wabt.default\prefs.js

 

user_pref(extensions.crossrider.bic, 13b5a51f22994d4efd696b9a382b7a9e);

user_pref(extensions.zonealarm.hmpgUrl, hxxp://search.zonealarm.com/?Source=Homepage&oemCode=ZLN114561554185250-1001&toolbarId=base&affiliateId=1001 tlbrid=ZoneAlarmSecurit

user_pref(extensions.zonealarm.keyWordUrl, hxxp://search.zonealarm.com/search?Source=Browser&oemCode=ZLN114561554185250-1001&toolbarId=base&affiliateId=1001 tlbrid=ZoneAlar

user_pref(extensions.zonealarm.newTabUrl, hxxp://search.zonealarm.com/?Source=Newtab&oemCode=ZLN114561554185250-1001&toolbarId=base&affiliateId=1001 tlbrid=ZoneAlarmSecurit

user_pref(extensions.zonealarm.tlbrSrchUrl, hxxp://search.zonealarm.com/search?Source=ToolBar&oemCode=ZLN114561554185250-1001&toolbarId=base&affiliateId=1001 tlbrid=ZoneAla

Emptied folder: C:\Users\Rajagopal Kumar\AppData\Roaming\mozilla\firefox\profiles\u8k2wabt.default\minidumps [10 files]

 

 

 

~~~ Chrome

 

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\bejbohlohkkgompgecdcbbglkpjfjgdj

 

[C:\Users\Rajagopal Kumar\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

 

[C:\Users\Rajagopal Kumar\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

 

[C:\Users\Rajagopal Kumar\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

 

[C:\Users\Rajagopal Kumar\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:

[

  pbkdpahkifcigckmhiafindmaflfifgm

]

 

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Wed 08/26/2015 at 23:38:47.79

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

-----------------------------------------------------------------------------------------------------

[emeraldnzl]

Hello ragagopal,

See if you can boot into normal mode and run the following scans.

If you can't that's okay, just run them in Safe Mode anyway.

 

Also, just to tell you I will be signing off after I posted this. Evening where I am lol.

 

Edit: I will catch you tomorrow my time.

Now

Please download Farbar Service Scanner and run.
 

• Make sure the following options are checked:
  
   
• Internet Services
• Windows Firewall
• System Restore
• Security Center/Action Center
• Windows Update
• Windows Defender
• Other Services

• Press Scan
• A log (FSS.txt) will be created in the same directory the tool is run.
• Copy and paste the log back here.

Next

Please run another FRST scan with the Addition.txt box ticked and post back the two logs generated - FRST.txt and Addition.txt.

When you return please post

• FSS.txt
• FRST.txt
• Addition.txt

[rajagopal]

Thanks very much. I did those steps after booting in normal mode and here are the details. This time the AdwCleaner log opened up after booting in normal mode. So I have pasted Adwcleaner logs here along with FSS.txt, FRST.txt, Addition.txt. Please see below - 

 

---------------------------------------------------

AdwCleaner logs

 

----------------------------------------------------

 

# AdwCleaner v1.801 - Logfile created 08/26/2015 at 23:49:55

# Updated 14/08/2012 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Rajagopal Kumar - RAJAGOPALKUMAR

# Boot Mode : Safe mode with networking

# Running from : C:\Users\Rajagopal Kumar\Desktop\adwcleaner.exe

# Option [Delete]

 

 

***** [Services] *****

 

 

***** [Files / Folders] *****

 

 

***** [Registry] *****

 

 

***** [Registre - GUID] *****

 

 

***** [Internet Browsers] *****

 

-\\ Internet Explorer v9.11.9600.17959

 

[OK] Registry is clean.

 

-\\ Mozilla Firefox v38.0.5 (x86 en-US)

 

Profile name : default 

File : C:\Users\Rajagopal Kumar\AppData\Roaming\Mozilla\Firefox\Profiles\u8k2wabt.default\prefs.js

 

[OK] File is clean.

 

-\\ Google Chrome v44.0.2403.157

 

File : C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Preferences

 

[OK] File is clean.

 

*************************

 

AdwCleaner[R1].txt - [6318 octets] - [16/08/2012 00:09:37]

AdwCleaner[S1].txt - [5484 octets] - [16/08/2012 22:13:38]

AdwCleaner[R2].txt - [21446 octets] - [30/05/2015 10:30:44]

AdwCleaner[S2].txt - [20896 octets] - [30/05/2015 10:31:57]

AdwCleaner[R3].txt - [6430 octets] - [09/08/2015 23:38:27]

AdwCleaner[R4].txt - [6490 octets] - [09/08/2015 23:39:23]

AdwCleaner[S3].txt - [316 octets] - [09/08/2015 23:39:43]

AdwCleaner[R5].txt - [6628 octets] - [24/08/2015 23:55:43]

AdwCleaner[R6].txt - [6688 octets] - [25/08/2015 00:01:47]

AdwCleaner[S4].txt - [6645 octets] - [25/08/2015 00:05:49]

AdwCleaner[R7].txt - [1671 octets] - [26/08/2015 23:49:14]

AdwCleaner[S5].txt - [1602 octets] - [26/08/2015 23:49:55]

 

########## EOF - C:\AdwCleaner[S5].txt - [1730 octets] ##########

 

-------------------------------------------------------------------------------

 

FSS.txt

 

 

-------------------------------------------------------------------------------

 

Farbar Service Scanner Version: 26-07-2015

Ran by Rajagopal Kumar (administrator) on 27-08-2015 at 11:52:18

Running from "C:\Users\Rajagopal Kumar\Desktop"

Microsoft Windows 7 Home Premium  Service Pack 1 (X64)

Boot Mode: Normal

****************************************************************

 

Internet Services:

============

 

Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Google.com is accessible.

Yahoo.com is accessible.

 

 

Windows Firewall:

=============

 

Firewall Disabled Policy: 

==================

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall"=DWORD:0

 

 

System Restore:

============

 

System Restore Policy: 

========================

 

 

Action Center:

============

 

Action Center Notification Icon =====> HKLM\...\ShellServiceObjects\{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A}\\"AutoStart" value does not exist.

 

 

Windows Update:

============

 

Windows Autoupdate Disabled Policy: 

============================

 

 

Windows Defender:

==============

WinDefend Service is not running. Checking service configuration:

The start type of WinDefend service is set to Demand. The default start type is Auto.

The ImagePath of WinDefend service is OK.

The ServiceDll of WinDefend service is OK.

 

 

Windows Defender Disabled Policy: 

==========================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]

"DisableAntiSpyware"=DWORD:1

 

 

Other Services:

==============

 

 

File Check:

========

C:\Windows\System32\nsisvc.dll => File is digitally signed

C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed

C:\Windows\System32\dhcpcore.dll => File is digitally signed

C:\Windows\System32\drivers\afd.sys => File is digitally signed

C:\Windows\System32\drivers\tdx.sys => File is digitally signed

C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed

C:\Windows\System32\dnsrslvr.dll => File is digitally signed

C:\Windows\System32\mpssvc.dll => File is digitally signed

C:\Windows\System32\bfe.dll => File is digitally signed

C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed

C:\Windows\System32\SDRSVC.dll => File is digitally signed

C:\Windows\System32\vssvc.exe => File is digitally signed

C:\Windows\System32\wscsvc.dll => File is digitally signed

C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed

C:\Windows\System32\wuaueng.dll => File is digitally signed

C:\Windows\System32\qmgr.dll => File is digitally signed

C:\Windows\System32\es.dll => File is digitally signed

C:\Windows\System32\cryptsvc.dll => File is digitally signed

C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed

C:\Windows\System32\ipnathlp.dll => File is digitally signed

C:\Windows\System32\iphlpsvc.dll => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

 

 

**** End of log ****

 

-------------------------------------------------------------------------------------------------------

 

FRST.txt

 

-------------------------------------------------------------------------------------------------------

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:26-08-2015

Ran by Rajagopal Kumar (administrator) on RAJAGOPALKUMAR (27-08-2015 11:54:10)

Running from C:\Users\Rajagopal Kumar\Desktop

Loaded Profiles: Rajagopal Kumar (Available Profiles: Rajagopal Kumar)

Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe

(Juniper Networks, Inc.) C:\Program Files (x86)\Common Files\Juniper Networks\JUNS\dsAccessService.exe

(UPEK Inc.) C:\Program Files\Lenovo\LenovoSecuritySolution FP\upeksvr.exe

(Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe

(UPEK Inc.) C:\Program Files\Lenovo\LenovoSecuritySolution FP\upeksrvc.exe

(ActivIdentity) C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe

(ActivIdentity) C:\Program Files\ActivIdentity\ActivClient\acevents.exe

(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe

(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

(Nitro PDF Software) C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe

(Lenovo.) C:\Windows\System32\TPHDEXLG64.exe

(VMware, Inc.) C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

(Juniper Networks, Inc.) C:\Program Files (x86)\Common Files\Juniper Networks\JUNS\dsAccessService.exe

(Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ForceField.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Lenovo.) C:\Windows\System32\TpShocks.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(UPEK Inc.) C:\Program Files\Lenovo\LenovoSecuritySolution FP\psqltray.exe

(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(Hewlett-Packard Company) C:\Program Files\RA2HP\HPRAService.exe

(ActivIdentity) C:\Program Files\ActivIdentity\ActivClient\acevents.exe

(ActivIdentity) C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe

(FileHippo.com) C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe

() C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

(Samsung) C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\lync.exe

(ActivIdentity) C:\Program Files\ActivIdentity\ActivClient\acsagent.exe

(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.149\SSScheduler.exe

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe

(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTStackServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

(CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe

(Juniper Networks, Inc.) C:\Program Files (x86)\Common Files\Juniper Networks\JamUI\Pulse.exe

(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe

(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BluetoothHeadsetProxy.exe

(Vimicro) C:\Program Files (x86)\USB Camera\VM331_STI.EXE

(Google Inc.) C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\chrome.exe

(Mobileleader Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\External\DeviceModules\DeviceManager.exe

(Mobileleader Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\External\DeviceModules\ConnectionManager.exe

(Google Inc.) C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\chrome.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

(Google Inc.) C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\chrome.exe

(Farbar) C:\Users\Rajagopal Kumar\Desktop\FSS.exe

(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

 

 

==================== Registry (Whitelisted) ===========================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10144288 2010-04-06] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [908320 2010-04-06] (Realtek Semiconductor)

HKLM\...\Run: [TpShocks] => C:\Windows\System32\TpShocks.exe [231264 2009-09-02] (Lenovo.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2104104 2010-03-18] (Synaptics Incorporated)

HKLM\...\Run: [PSQLLauncher] => C:\Program Files\Lenovo\LenovoSecuritySolution FP\launcher.exe [84744 2010-03-29] (UPEK Inc.)

HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4448704 2010-03-11] (Lenovo(beijing) Limited)

HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [7056832 2010-03-11] (Lenovo (Beijing) Limited)

HKLM\...\Run: [ISW] => C:\Program Files\CheckPoint\ZAForceField\ForceField.exe [1127592 2012-07-14] (Check Point Software Technologies)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)

HKLM\...\Run: [HPRAService] => C:\Program Files\RA2HP\HPRAService.exe [126464 2010-04-01] (Hewlett-Packard Company)

HKLM\...\Run: [acevents] => C:\Program Files\ActivIdentity\ActivClient\acevents.exe [196648 2009-06-03] (ActivIdentity)

HKLM\...\Run: [accrdsub] => C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe [483880 2009-06-03] (ActivIdentity)

HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284696 2009-12-23] (Intel Corporation)

HKLM-x32\...\Run: [YouCam Mirror Tray icon] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [167008 2009-11-11] (CyberLink Corp.)

HKLM-x32\...\Run: [JunosPulse] => c:\Program Files (x86)\Common Files\Juniper Networks\JamUI\Pulse.exe [2522672 2014-04-09] (Juniper Networks, Inc.)

HKLM-x32\...\Run: [UCam_Menu] => C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [3508624 2012-02-03] (Samsung Electronics Co., Ltd.)

HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331_STI.EXE [536576 2010-01-15] (Vimicro)

Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)

Winlogon\Notify\psfus: C:\Program Files\Lenovo\LenovoSecuritySolution FP\psqlpwd.dll (UPEK Inc.)

HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\Run: [FileHippo.com] => C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [306688 2012-03-26] (FileHippo.com)

HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\Run: [Google Update] => C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2014-10-26] (Google Inc.)

HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\Run: [KiesPDLR] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [21416 2012-03-01] ()

HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\Run: [KiesHelper] => C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe [943504 2012-02-03] (Samsung)

HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\Run: [cdloader] => C:\Users\Rajagopal Kumar\AppData\Roaming\mjusbsp\cdloader2.exe [50592 2012-02-01] (magicJack L.P.)

HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\Run: [Lync] => C:\Program Files\Microsoft Office 15\root\office15\lync.exe [24055464 2015-07-14] (Microsoft Corporation)

Lsa: [Notification Packages] scecli C:\Program Files\Lenovo\LenovoSecuritySolution FP\psqlpwd.dll

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ActivClient Agent.lnk [2015-05-24]

ShortcutTarget: ActivClient Agent.lnk -> C:\Program Files\ActivIdentity\ActivClient\acsagent.exe (ActivIdentity)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2015-05-24]

ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2015-05-24]

ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.149\SSScheduler.exe (McAfee, Inc.)

Startup: C:\Users\Rajagopal Kumar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk [2012-09-03]

ShortcutTarget: ERUNT AutoBackup.lnk -> C:\Program Files (x86)\ERUNT\AUTOBACK.EXE ()

ShellIconOverlayIdentifiers: [UEAFOverlay] -> {F2F31467-B1AC-4df0-AE79-FD5FA085E22B} => C:\Program Files\Lenovo\LenovoSecuritySolution FP\farchns.dll [2010-03-29] (UPEK Inc.)

ShellIconOverlayIdentifiers: [UEAFOverlayOpen] -> {A3E208F7-0E3A-4182-A7A6-B169D5D691AA} => C:\Program Files\Lenovo\LenovoSecuritySolution FP\farchns.dll [2010-03-29] (UPEK Inc.)

ShellIconOverlayIdentifiers: [VeriFace Enc] -> {771C7324-DA80-49D3-8017-753B0AF60951} => C:\windows\system32\IcnOvrly.dll [2010-09-08] ()

ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-07-14] (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-07-14] (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-07-14] (Microsoft Corporation)

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

URLSearchHook: HKLM-x32 - AOL Toolbar Search Class - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File

URLSearchHook: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000 - AOL Toolbar Search Class - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File

SearchScopes: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000 -> DefaultScope {7111F2F3-9F5A-4B74-A4AE-01681430D82C} URL = 

BHO: KeyScramblerBHO Class -> {2B9F5787-88A5-4945-90E7-C4B18563BC5E} -> C:\Program Files (x86)\KeyScrambler\x64\KeyScramblerIE.dll [2012-06-07] (QFX Software Corporation)

BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-07-14] (Microsoft Corporation)

BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2012-09-03] (Oracle Corporation)

BHO: ZoneAlarm Security Engine Registrar -> {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} -> C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll [2012-07-14] (Check Point Software Technologies)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-07-14] (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-07-14] (Microsoft Corporation)

BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2012-09-03] (Oracle Corporation)

BHO-x32: KeyScramblerBHO Class -> {2B9F5787-88A5-4945-90E7-C4B18563BC5E} -> C:\Program Files (x86)\KeyScrambler\KeyScramblerIE.dll [2012-09-03] (QFX Software Corporation)

BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2015-07-14] (Microsoft Corporation)

BHO-x32: AOL Toolbar Loader -> {3ef64538-8b54-4573-b48f-4d34b0238ab2} -> C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre6\bin\ssv.dll [2012-09-03] (Sun Microsystems, Inc.)

BHO-x32: ZoneAlarm Security Engine Registrar -> {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} -> C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll [2012-07-14] (Check Point Software Technologies)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-07-14] (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-07-14] (Microsoft Corporation)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2012-09-03] (Sun Microsystems, Inc.)

BHO-x32: Norton Safe Web Lite BHO -> {F0DA78E9-6B60-42fb-BC26-EF2CFB8C8FF3} -> C:\Program Files (x86)\Norton Safe Web Lite\Engine\2.0.0.16\coIEPlg.dll No File

Toolbar: HKLM - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll [2012-07-14] (Check Point Software Technologies)

Toolbar: HKLM-x32 - AOL Toolbar - {ba00b7b1-0351-477a-b948-23e3ee5a73d4} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File

Toolbar: HKLM-x32 - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll [2012-07-14] (Check Point Software Technologies)

Toolbar: HKLM-x32 - Norton Safe Web Lite - {30CEEEA2-3742-40e4-85DD-812BF1CBB83D} - C:\Program Files (x86)\Norton Safe Web Lite\Engine\2.0.0.16\coIEPlg.dll No File

Toolbar: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000 -> No Name - {BA00B7B1-0351-477A-B948-23E3EE5A73D4} -  No File

DPF: HKLM {AA570693-00E2-4907-B6F1-60A1199B030C} hxxps://juniper.net/dana-cached/sc/JuniperSetupClient64.cab

DPF: HKLM-x32 {00000035-9593-4264-8B29-930B3E4EDCCD} hxxps://www.rooms.hp.com/vRoom_Cab/WebHPVCInstall35.cab

DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: HKLM-x32 {AB01FF2E-A848-410C-B47B-CB467C476AD9} hxxps://digitalbadge.external.hp.com/hp/HPPKI.cab

DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} hxxps://juniper.net/dana-cached/sc/JuniperSetupClient.cab

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-06-19] (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 10.10.0.1

Tcpip\..\Interfaces\{38DED0E4-DCFB-40F3-BE6A-B632F1CBC7B6}: [DhcpNameServer] 192.168.42.129

Tcpip\..\Interfaces\{9078A1CE-17DD-49B7-90E1-13FEF8584260}: [NameServer] 16.110.135.51,16.110.135.52

Tcpip\..\Interfaces\{982B7804-FBA3-42FB-817E-8FF9DC05C9DA}: [DhcpNameServer] 10.10.0.1

 

FireFox:

========

FF ProfilePath: C:\Users\Rajagopal Kumar\AppData\Roaming\Mozilla\Firefox\Profiles\u8k2wabt.default

FF DefaultSearchEngine.US: Google

FF Homepage: about:home

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-14] ()

FF Plugin: @java.com/DTPlugin,version=10.7.2 -> C:\windows\system32\npDeployJava1.dll [2012-09-03] (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.7.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2012-09-03] (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin: @videolan.org/vlc,version=2.0.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2012-06-28] (VideoLAN)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-14] ()

FF Plugin-x32: @checkpoint.com/FFApi -> C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll [2012-07-14] ()

FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_35 -> C:\windows\SysWOW64\npdeployJava1.dll [2012-09-03] (Sun Microsystems, Inc.)

FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll [2012-09-03] (Sun Microsystems, Inc.)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-06-19] (Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-06-19] (Microsoft Corporation)

FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro PDF\Reader 2\npnitromozilla.dll [2012-04-11] ( )

FF Plugin-x32: @rooms.hp.com -> C:\Program Files (x86)\Hewlett-Packard\HP Virtual Room Client Launcher Plugin\nphpvrl.dll [2012-10-10] ( )

FF Plugin-x32: @vmware.com/vmrc,version=2.5.0.00000 -> C:\Program Files (x86)\Common Files\VMware\VMware VMRC Plug-in\Firefox\np-vmware-vmrc.dll [2011-06-01] (VMware, Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-2180650751-2005149398-3877183700-1000: @citrixonline.com/appdetectorplugin -> C:\Users\Rajagopal Kumar\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2015-01-23] (Citrix Online)

FF Plugin HKU\S-1-5-21-2180650751-2005149398-3877183700-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\Rajagopal Kumar\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2012-07-17] (Google)

FF Plugin HKU\S-1-5-21-2180650751-2005149398-3877183700-1000: @talk.google.com/O3DPlugin -> C:\Users\Rajagopal Kumar\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll [2012-07-17] ()

FF Plugin HKU\S-1-5-21-2180650751-2005149398-3877183700-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-15] (Google Inc.)

FF Plugin HKU\S-1-5-21-2180650751-2005149398-3877183700-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-15] (Google Inc.)

FF Plugin HKU\S-1-5-21-2180650751-2005149398-3877183700-1000: SkypeForBusinessPlugin-15.8 -> C:\Users\Rajagopal Kumar\AppData\Local\Microsoft\SkypeForBusinessPlugin\15.8.20020.351\npGatewayNpapi.dll [2015-03-13] (Microsoft Corporation)

FF Plugin HKU\S-1-5-21-2180650751-2005149398-3877183700-1000: SkypeForBusinessPlugin64-15.8 -> C:\Users\Rajagopal Kumar\AppData\Local\Microsoft\SkypeForBusinessPlugin\15.8.20020.351\npGatewayNpapi-x64.dll [2015-03-13] (Microsoft Corporation)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL [2006-10-26] (Microsoft Corporation)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Users\Rajagopal Kumar\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2012-07-17] (Google)

FF Plugin ProgramFiles/Appdata: C:\Users\Rajagopal Kumar\AppData\Roaming\mozilla\plugins\npgtpo3dautoplugin.dll [2012-07-17] ()

FF Plugin ProgramFiles/Appdata: C:\Users\Rajagopal Kumar\AppData\Roaming\mozilla\plugins\npMeetingJoinPluginAOCUser.dll [2014-05-01] ()

FF SearchPlugin: C:\Users\Rajagopal Kumar\AppData\Roaming\Mozilla\Firefox\Profiles\u8k2wabt.default\searchplugins\youtube.xml [2012-03-14]

FF Extension: KeyScrambler - C:\Users\Rajagopal Kumar\AppData\Roaming\Mozilla\Firefox\Profiles\u8k2wabt.default\Extensions\[email protected] [2012-09-03]

FF Extension: DivX Web Player - C:\Users\Rajagopal Kumar\AppData\Roaming\Mozilla\Firefox\Profiles\u8k2wabt.default\Extensions\[email protected] [2012-02-20]

FF Extension: NoScript - C:\Users\Rajagopal Kumar\AppData\Roaming\Mozilla\Firefox\Profiles\u8k2wabt.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-09-03]

FF Extension: Download YouTube Videos as MP4 - C:\Users\Rajagopal Kumar\AppData\Roaming\Mozilla\Firefox\Profiles\u8k2wabt.default\Extensions\{b9bfaf1c-a63f-47cd-8b9a-29526ced9060}.xpi [2013-11-12]

FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2015-06-04]

FF HKLM\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] - C:\Program Files\CheckPoint\ZAForceField\TrustChecker

FF Extension: No Name - C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2012-09-03]

FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker

FF Extension: ZoneAlarm Security Engine - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker [2012-09-03]

FF HKLM-x32\...\Firefox\Extensions: [{203FB6B2-2E1E-4474-863B-4C483ECCE78E}] - C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2.0.0.16\coFFNST

FF Extension: Norton Safe Web Lite Toolbar - C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2.0.0.16\coFFNST [2015-08-25]

FF HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi

 

Chrome: 

=======

CHR Profile: C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Slides) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-07-03]

CHR Extension: (Angry Birds) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2012-07-07]

CHR Extension: (Ad Block Express) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\ankoaclbfmdocnmjbokdkohpehjjinen [2013-11-25]

CHR Extension: (Google Docs) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-07-03]

CHR Extension: (Google Drive) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-07-03]

CHR Extension: (YouTube) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-15]

CHR Extension: (Google Cast) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2015-02-14]

CHR Extension: (Pop Up Blocker Program ) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdbefhoembdcnpapmodimamlnahaciih [2014-10-09]

CHR Extension: (TOEFL Essay Practice) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\ceeicgdpllljlklonpkbhjighniifjij [2012-07-07]

CHR Extension: (Google Search) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-15]

CHR Extension: (Adblock Plus Popup) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\eaglijdkglfgnodgahnfalkohplchphh [2014-10-09]

CHR Extension: (Type Scout - Better Typing! ) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\fedokkaolmkkoeedicihicdeppjjeamj [2012-07-07]

CHR Extension: (Google Sheets) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-07-03]

CHR Extension: (AdBlock) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-10-09]

CHR Extension: (Cut the Rope) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkddaofiamhgfjmaccfcfpfolpgbeomj [2012-07-07]

CHR Extension: (Apple Shooter) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\ingecjekeggadjbbklelffkgeppklgnm [2012-07-07]

CHR Extension: (Typing Test - KeyHero) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\jkcieoaeooeidmpaopkpjpjfakidlabm [2012-07-07]

CHR Extension: (Island Runner) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\kccnmldhohpnaahmlnafmfdigggmhaoc [2012-07-07]

CHR Extension: (Google Voice (by Google)) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcnhkahnjcbndmmehfkdnkjomaanaooo [2013-06-29]

CHR Extension: (Youtube Downloader Google Chrome) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\kepfmlbnmfkakibipenekfmdgenllpke [2014-12-08]

CHR Extension: (Save as PDF) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdjmbiefanbdgnkcikhllpmjnnllbbc [2013-01-21]

CHR Extension: (Ad Block Express) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\lbcmmpmjjaockhkcofljpakjcbmjmgla [2013-02-10]

CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-12]

CHR Extension: (Capture Webpage Screenshot - FireShot) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbpblocgmgfnpjjppndjkmgjaogfceg [2013-01-21]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21]

CHR Extension: (Type Fu (hosted)) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\okboeogmnhjpgbeaokfogelclpblaemo [2012-07-07]

CHR Extension: (Gmail) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-15]

StartMenuInternet: Google Chrome - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\chrome.exe

 

==================== Services (Whitelisted) ========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 ac.sharedstore; C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe [277032 2009-06-03] (ActivIdentity)

R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2252504 2013-08-09] (Broadcom Corporation.)

R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [873248 2010-02-18] (Broadcom Corporation.)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2765496 2015-07-14] (Microsoft Corporation)

R2 IGRS; C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe [38152 2009-07-14] (Lenovo Group Limited)

R2 IswSvc; C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe [827560 2012-07-14] (Check Point Software Technologies)

S3 Lenovo ReadyComm AppSvc; C:\Program Files\Lenovo\ReadyComm\AppSvc.exe [414984 2009-07-28] (Lenovo Group Limited)

S3 Lenovo ReadyComm ConnSvc; C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe [472328 2009-07-28] (Lenovo Group Limited)

S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.149\McCHSvc.exe [289256 2015-06-26] (McAfee, Inc.)

R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)

R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)

R2 NitroReaderDriverReadSpool2; C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [204304 2012-04-11] (Nitro PDF Software)

S3 PS_MDP; C:\Program Files (x86)\Lenovo\ReadyComm\PS_MDP.dll [276296 2009-07-16] (Lenovo Group Limited)

S2 ReadyComm.DirectRouter; C:\Program Files (x86)\Lenovo\ReadyComm\common\router.dll [103688 2009-07-14] (Lenovo Group Limited)

R2 UpekSrvc; C:\Program Files\Lenovo\LenovoSecuritySolution FP\upeksrvc.exe [72456 2010-03-29] (UPEK Inc.)

S3 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [2445880 2012-08-29] (Check Point Software Technologies LTD)

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)

S2 NSL; "C:\Program Files (x86)\Norton Safe Web Lite\Engine\2.0.0.16\ccSvcHst.exe" /s "NSL" /m "C:\Program Files (x86)\Norton Safe Web Lite\Engine\2.0.0.16\diMaster.dll" /prefetch:1

 

===================== Drivers (Whitelisted) ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)

R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [170712 2013-08-09] (Broadcom Corporation.)

S3 Bridge0; C:\Windows\System32\drivers\WDBridge.sys [79376 2009-07-16] (Lenovo)

R1 ccSet_NST; C:\Windows\system32\drivers\NSTx64\0200000.010\ccSetx64.sys [167048 2011-08-08] (Symantec Corporation)

S3 dgderdrv; C:\Windows\SysWOW64\drivers\dgderdrv.sys [20032 2011-08-22] (Devguru Co., Ltd)

R2 ISWKL; C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [33712 2012-07-14] (Check Point Software Technologies)

R1 jnprns; C:\Windows\System32\DRIVERS\jnprns.sys [506160 2014-03-13] (Juniper Networks)

S4 jnprTdi_803_44983; C:\windows\system32\Drivers\jnprTdi_803_44983.sys [108344 2014-04-09] (Juniper Networks, Inc.)

S3 jnprva; C:\Windows\System32\DRIVERS\jnprva.sys [30072 2014-03-13] (Juniper Networks, Inc.)

R3 JnprVaMgr; C:\Windows\System32\DRIVERS\jnprvamgr.sys [45352 2014-03-13] (Juniper Networks, Inc.)

R3 KeyScrambler; C:\Windows\System32\drivers\keyscrambler.sys [222904 2011-12-14] (QFX Software Corporation)

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)

S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)

S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [102600 2009-06-18] (McAfee, Inc.)

R1 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [307400 2009-06-18] (McAfee, Inc.)

S3 mferkdk; C:\Windows\System32\drivers\mferkdk.sys [40904 2009-06-18] (McAfee, Inc.)

S3 mfesmfk; C:\Windows\System32\drivers\mfesmfk.sys [49480 2009-06-18] (McAfee, Inc.)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)

R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)

S3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2011-08-19] (The OpenVPN Project)

R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [215040 2010-02-24] (Vimicro Corporation)

R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [454232 2011-05-07] (Check Point Software Technologies LTD)

R3 wdmirror; C:\Windows\System32\DRIVERS\WDMirror.sys [11280 2009-07-16] (Lenovo)

S1 A2DDA; \??\C:\Users\Rajagopal Kumar\Desktop\EmsisoftEmergencyKit\Run\a2ddax64.sys [X]

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One Month Created files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-08-27 11:52 - 2015-08-27 11:52 - 00003050 _____ C:\Users\Rajagopal Kumar\Desktop\FSS.txt

2015-08-27 11:50 - 2015-08-27 11:50 - 00899072 _____ (Farbar) C:\Users\Rajagopal Kumar\Desktop\FSS.exe

2015-08-27 11:08 - 2015-08-27 11:08 - 00000008 __RSH C:\ProgramData\ntuser.pol

2015-08-26 23:49 - 2015-08-26 23:50 - 00001731 _____ C:\AdwCleaner[S5].txt

2015-08-26 23:49 - 2015-08-26 23:49 - 00001671 _____ C:\AdwCleaner[R7].txt

2015-08-26 23:38 - 2015-08-26 23:38 - 00004360 _____ C:\Users\Rajagopal Kumar\Desktop\JRT.txt

2015-08-26 23:35 - 2015-08-26 23:35 - 01798560 _____ (Malwarebytes Corporation) C:\Users\Rajagopal Kumar\Downloads\JRT.exe

2015-08-26 22:01 - 2015-08-27 11:54 - 00000000 ____D C:\FRST

2015-08-26 21:54 - 2015-08-26 21:54 - 00044913 _____ C:\Users\Rajagopal Kumar\Desktop\Addition.txt

2015-08-26 21:52 - 2015-08-27 11:54 - 00035454 _____ C:\Users\Rajagopal Kumar\Desktop\FRST.txt

2015-08-26 21:51 - 2015-08-26 21:52 - 02186752 _____ (Farbar) C:\Users\Rajagopal Kumar\Desktop\FRST64.exe

2015-08-25 09:27 - 2015-08-10 18:20 - 25191936 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2015-08-25 09:27 - 2015-08-10 18:14 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2015-08-25 09:27 - 2015-08-10 17:33 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2015-08-25 09:27 - 2015-08-10 17:20 - 19871232 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2015-08-25 00:05 - 2015-08-25 00:05 - 00006645 _____ C:\AdwCleaner[S4].txt

2015-08-25 00:01 - 2015-08-25 00:01 - 00006688 _____ C:\AdwCleaner[R6].txt

2015-08-24 23:58 - 2015-08-24 23:58 - 00001090 _____ C:\Users\Public\Desktop\SpywareBlaster.lnk

2015-08-24 23:58 - 2015-08-24 23:58 - 00000000 ____D C:\ProgramData\Licenses

2015-08-24 23:55 - 2015-08-24 23:55 - 00006628 _____ C:\AdwCleaner[R5].txt

2015-08-24 00:31 - 2015-08-24 00:31 - 02620595 _____ C:\Users\Rajagopal Kumar\Downloads\B26B.tmp

2015-08-23 21:26 - 2015-08-23 21:27 - 77789672 _____ C:\Users\Rajagopal Kumar\Downloads\Windows6.1-KB947821-v34-x64.msu.crdownload

2015-08-21 12:06 - 2015-08-21 12:06 - 00022011 _____ C:\Users\Rajagopal Kumar\Downloads\friend039s-wife-[bleep]ed-by-me-when-she-visit-my-house-620905.html

2015-08-18 20:42 - 2015-08-18 20:42 - 00025914 _____ C:\Users\Rajagopal Kumar\Downloads\sabudana-upma

2015-08-18 20:39 - 2015-08-18 20:47 - 00006843 _____ C:\Users\Rajagopal Kumar\Downloads\Unconfirmed 76468.crdownload

2015-08-17 19:08 - 2015-08-17 19:08 - 00013958 _____ C:\Users\Rajagopal Kumar\Downloads\registerform.php

2015-08-16 12:07 - 2015-08-16 12:07 - 00000233 _____ C:\Users\Rajagopal Kumar\Downloads\ads-iframe-display (3).php

2015-08-15 17:56 - 2015-08-15 17:57 - 00019081 _____ C:\Users\Rajagopal Kumar\Downloads\Chinese-masseuse-[bleep]s-customer-in-Manchester-hidden-c-822663.html

2015-08-15 17:56 - 2015-08-15 17:57 - 00004243 _____ C:\Users\Rajagopal Kumar\Downloads\sh.4c9a1c77.html

2015-08-15 17:54 - 2015-08-15 18:02 - 00008212 _____ C:\Users\Rajagopal Kumar\Downloads\7tUlZKGPU61.js

2015-08-15 17:54 - 2015-08-15 17:55 - 00014346 _____ C:\Users\Rajagopal Kumar\Downloads\video (1).php

2015-08-15 17:53 - 2015-08-15 17:54 - 00008872 _____ C:\Users\Rajagopal Kumar\Downloads\video.php

2015-08-12 23:41 - 2015-07-30 06:13 - 00124624 _____ (Microsoft Corporation) C:\windows\system32\PresentationCFFRasterizerNative_v0300.dll

2015-08-12 23:41 - 2015-07-30 06:13 - 00103120 _____ (Microsoft Corporation) C:\windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll

2015-08-12 00:18 - 2015-07-28 13:09 - 00017344 _____ (Microsoft Corporation) C:\windows\system32\CompatTelRunner.exe

2015-08-12 00:18 - 2015-07-28 13:05 - 01116672 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll

2015-08-12 00:18 - 2015-07-28 13:05 - 00774656 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll

2015-08-12 00:18 - 2015-07-28 13:05 - 00743424 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll

2015-08-12 00:18 - 2015-07-28 13:05 - 00437760 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll

2015-08-12 00:18 - 2015-07-28 13:05 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll

2015-08-12 00:18 - 2015-07-28 13:05 - 00069120 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll

2015-08-12 00:18 - 2015-07-28 12:55 - 01148416 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll

2015-08-12 00:18 - 2015-07-15 11:15 - 05568960 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe

2015-08-12 00:18 - 2015-07-15 11:15 - 00155584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys

2015-08-12 00:18 - 2015-07-15 11:15 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys

2015-08-12 00:18 - 2015-07-15 11:15 - 00094656 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mountmgr.sys

2015-08-12 00:18 - 2015-07-15 11:12 - 01730496 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll

2015-08-12 00:18 - 2015-07-15 11:11 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll

2015-08-12 00:18 - 2015-07-15 11:11 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll

2015-08-12 00:18 - 2015-07-15 11:11 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll

2015-08-12 00:18 - 2015-07-15 11:11 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll

2015-08-12 00:18 - 2015-07-15 11:11 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 01743360 _____ (Microsoft Corporation) C:\windows\system32\sysmain.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 01461760 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 01216512 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 01163264 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00729088 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00424960 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00342016 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00315392 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe

2015-08-12 00:18 - 2015-07-15 11:10 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe

2015-08-12 00:18 - 2015-07-15 11:10 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00044032 _____ (Microsoft Corporation) C:\windows\system32\cryptbase.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe

2015-08-12 00:18 - 2015-07-15 11:10 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll

2015-08-12 00:18 - 2015-07-15 11:10 - 00011264 _____ (Microsoft Corporation) C:\windows\system32\msmmsp.dll

2015-08-12 00:18 - 2015-07-15 11:09 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe

2015-08-12 00:18 - 2015-07-15 11:09 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe

2015-08-12 00:18 - 2015-07-15 11:05 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll

2015-08-12 00:18 - 2015-07-15 11:05 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 11:00 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:59 - 03989952 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe

2015-08-12 00:18 - 2015-07-15 10:59 - 03934656 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe

2015-08-12 00:18 - 2015-07-15 10:56 - 01311768 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll

2015-08-12 00:18 - 2015-07-15 10:55 - 00248832 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll

2015-08-12 00:18 - 2015-07-15 10:55 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll

2015-08-12 00:18 - 2015-07-15 10:55 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll

2015-08-12 00:18 - 2015-07-15 10:55 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll

2015-08-12 00:18 - 2015-07-15 10:55 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll

2015-08-12 00:18 - 2015-07-15 10:54 - 00552960 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll

2015-08-12 00:18 - 2015-07-15 10:54 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll

2015-08-12 00:18 - 2015-07-15 10:54 - 00221184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll

2015-08-12 00:18 - 2015-07-15 10:54 - 00036864 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptbase.dll

2015-08-12 00:18 - 2015-07-15 10:54 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe

2015-08-12 00:18 - 2015-07-15 10:54 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll

2015-08-12 00:18 - 2015-07-15 10:54 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll

2015-08-12 00:18 - 2015-07-15 10:53 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll

2015-08-12 00:18 - 2015-07-15 10:53 - 00665088 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll

2015-08-12 00:18 - 2015-07-15 10:53 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll

2015-08-12 00:18 - 2015-07-15 10:53 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll

2015-08-12 00:18 - 2015-07-15 10:53 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe

2015-08-12 00:18 - 2015-07-15 10:53 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll

2015-08-12 00:18 - 2015-07-15 10:49 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll

2015-08-12 00:18 - 2015-07-15 10:48 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00686080 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 10:44 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 09:46 - 00290816 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys

2015-08-12 00:18 - 2015-07-15 09:46 - 00159232 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys

2015-08-12 00:18 - 2015-07-15 09:46 - 00129024 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys

2015-08-12 00:18 - 2015-07-15 09:37 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe

2015-08-12 00:18 - 2015-07-15 09:37 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe

2015-08-12 00:18 - 2015-07-15 09:34 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 09:34 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 09:34 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll

2015-08-12 00:18 - 2015-07-15 09:34 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll

2015-08-12 00:15 - 2015-07-14 20:19 - 00052736 _____ (Microsoft Corporation) C:\windows\system32\basesrv.dll

2015-08-12 00:14 - 2015-07-20 17:39 - 00389840 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll

2015-08-12 00:14 - 2015-07-20 17:12 - 00342736 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll

2015-08-12 00:14 - 2015-07-16 13:54 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll

2015-08-12 00:14 - 2015-07-16 13:37 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2015-08-12 00:14 - 2015-07-16 13:36 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll

2015-08-12 00:14 - 2015-07-16 13:36 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll

2015-08-12 00:14 - 2015-07-16 13:35 - 02885632 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2015-08-12 00:14 - 2015-07-16 13:27 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2015-08-12 00:14 - 2015-07-16 13:26 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2015-08-12 00:14 - 2015-07-16 13:23 - 00615936 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2015-08-12 00:14 - 2015-07-16 13:21 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe

2015-08-12 00:14 - 2015-07-16 13:21 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe

2015-08-12 00:14 - 2015-07-16 13:12 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe

2015-08-12 00:14 - 2015-07-16 13:08 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll

2015-08-12 00:14 - 2015-07-16 13:00 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll

2015-08-12 00:14 - 2015-07-16 12:51 - 00504320 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll

2015-08-12 00:14 - 2015-07-16 12:51 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll

2015-08-12 00:14 - 2015-07-16 12:51 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2015-08-12 00:14 - 2015-07-16 12:50 - 00341504 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec

2015-08-12 00:14 - 2015-07-16 12:50 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll

2015-08-12 00:14 - 2015-07-16 12:49 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll

2015-08-12 00:14 - 2015-07-16 12:45 - 02279424 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2015-08-12 00:14 - 2015-07-16 12:43 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2015-08-12 00:14 - 2015-07-16 12:43 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2015-08-12 00:14 - 2015-07-16 12:41 - 00479232 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2015-08-12 00:14 - 2015-07-16 12:39 - 00664064 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2015-08-12 00:14 - 2015-07-16 12:39 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe

2015-08-12 00:14 - 2015-07-16 12:38 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll

2015-08-12 00:14 - 2015-07-16 12:36 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2015-08-12 00:14 - 2015-07-16 12:35 - 00720384 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2015-08-12 00:14 - 2015-07-16 12:32 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2015-08-12 00:14 - 2015-07-16 12:29 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll

2015-08-12 00:14 - 2015-07-16 12:24 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll

2015-08-12 00:14 - 2015-07-16 12:20 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll

2015-08-12 00:14 - 2015-07-16 12:19 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll

2015-08-12 00:14 - 2015-07-16 12:17 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll

2015-08-12 00:14 - 2015-07-16 12:12 - 04520448 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2015-08-12 00:14 - 2015-07-16 12:10 - 12856832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2015-08-12 00:14 - 2015-07-16 12:06 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl

2015-08-12 00:14 - 2015-07-16 12:06 - 00689152 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2015-08-12 00:14 - 2015-07-16 12:05 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll

2015-08-12 00:14 - 2015-07-16 12:01 - 01545728 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2015-08-12 00:14 - 2015-07-16 11:49 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll

2015-08-12 00:14 - 2015-07-16 11:42 - 01951232 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2015-08-12 00:14 - 2015-07-16 11:38 - 01310720 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2015-08-12 00:14 - 2015-07-16 11:37 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll

2015-08-12 00:13 - 2015-07-16 13:36 - 00417792 _____ (Microsoft Corporation) C:\windows\system32\html.iec

2015-08-12 00:13 - 2015-07-16 13:35 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll

2015-08-12 00:13 - 2015-07-16 13:26 - 05923328 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2015-08-12 00:13 - 2015-07-16 13:21 - 00816640 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2015-08-12 00:13 - 2015-07-16 13:21 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll

2015-08-12 00:13 - 2015-07-16 12:55 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2015-08-12 00:13 - 2015-07-16 12:54 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll

2015-08-12 00:13 - 2015-07-16 12:34 - 14451200 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2015-08-12 00:13 - 2015-07-16 12:33 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll

2015-08-12 00:13 - 2015-07-16 12:12 - 02427904 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2015-08-12 00:09 - 2015-07-30 11:06 - 02565120 _____ (Microsoft Corporation) C:\windows\system32\d3d10warp.dll

2015-08-12 00:09 - 2015-07-30 11:06 - 01648128 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll

2015-08-12 00:09 - 2015-07-30 11:06 - 01180160 _____ (Microsoft Corporation) C:\windows\system32\FntCache.dll

2015-08-12 00:09 - 2015-07-30 11:06 - 00100864 _____ (Microsoft Corporation) C:\windows\system32\fontsub.dll

2015-08-12 00:09 - 2015-07-30 11:06 - 00046080 _____ (Adobe Systems) C:\windows\system32\atmlib.dll

2015-08-12 00:09 - 2015-07-30 11:06 - 00041984 _____ (Microsoft Corporation) C:\windows\system32\lpk.dll

2015-08-12 00:09 - 2015-07-30 11:06 - 00014336 _____ (Microsoft Corporation) C:\windows\system32\dciman32.dll

2015-08-12 00:09 - 2015-07-30 10:57 - 01987584 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3d10warp.dll

2015-08-12 00:09 - 2015-07-30 10:57 - 01251328 _____ (Microsoft Corporation) C:\windows\SysWOW64\DWrite.dll

2015-08-12 00:09 - 2015-07-30 10:57 - 00070656 _____ (Microsoft Corporation) C:\windows\SysWOW64\fontsub.dll

2015-08-12 00:09 - 2015-07-30 10:57 - 00034304 _____ (Adobe Systems) C:\windows\SysWOW64\atmlib.dll

2015-08-12 00:09 - 2015-07-30 10:57 - 00010240 _____ (Microsoft Corporation) C:\windows\SysWOW64\dciman32.dll

2015-08-12 00:09 - 2015-07-30 10:55 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\lpk.dll

2015-08-12 00:09 - 2015-07-30 09:56 - 03208192 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys

2015-08-12 00:09 - 2015-07-30 09:52 - 00372736 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll

2015-08-12 00:09 - 2015-07-30 09:49 - 00299520 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\atmfd.dll

2015-08-12 00:09 - 2015-07-20 11:12 - 03154944 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll

2015-08-12 00:09 - 2015-07-20 11:12 - 02606080 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll

2015-08-12 00:09 - 2015-07-16 12:12 - 04922368 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstscax.dll

2015-08-12 00:09 - 2015-07-16 12:12 - 00269824 _____ (Microsoft Corporation) C:\windows\SysWOW64\aaclient.dll

2015-08-12 00:09 - 2015-07-16 12:12 - 00037376 _____ (Microsoft Corporation) C:\windows\SysWOW64\tsgqec.dll

2015-08-12 00:09 - 2015-07-16 12:11 - 05779456 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll

2015-08-12 00:09 - 2015-07-16 12:11 - 00322560 _____ (Microsoft Corporation) C:\windows\system32\aaclient.dll

2015-08-12 00:09 - 2015-07-16 12:11 - 00044032 _____ (Microsoft Corporation) C:\windows\system32\tsgqec.dll

2015-08-12 00:09 - 2015-07-14 20:19 - 02004992 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll

2015-08-12 00:09 - 2015-07-14 20:19 - 01887232 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll

2015-08-12 00:09 - 2015-07-14 20:14 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll

2015-08-12 00:09 - 2015-07-14 20:13 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll

2015-08-12 00:09 - 2015-07-14 19:55 - 01390592 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml6.dll

2015-08-12 00:09 - 2015-07-14 19:55 - 01241088 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3.dll

2015-08-12 00:09 - 2015-07-14 19:51 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml6r.dll

2015-08-12 00:09 - 2015-07-14 19:51 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3r.dll

2015-08-12 00:09 - 2015-07-10 10:51 - 14177280 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll

2015-08-12 00:09 - 2015-07-10 10:34 - 12875776 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll

2015-08-12 00:09 - 2015-07-09 10:57 - 00193536 _____ (Microsoft Corporation) C:\windows\system32\notepad.exe

2015-08-12 00:09 - 2015-07-09 10:57 - 00193536 _____ (Microsoft Corporation) C:\windows\notepad.exe

2015-08-12 00:09 - 2015-07-09 10:42 - 00179712 _____ (Microsoft Corporation) C:\windows\SysWOW64\notepad.exe

2015-08-12 00:09 - 2015-07-01 13:49 - 00260096 _____ (Microsoft Corporation) C:\windows\system32\WebClnt.dll

2015-08-12 00:09 - 2015-07-01 13:48 - 00102912 _____ (Microsoft Corporation) C:\windows\system32\davclnt.dll

2015-08-12 00:09 - 2015-07-01 13:30 - 00206848 _____ (Microsoft Corporation) C:\windows\SysWOW64\WebClnt.dll

2015-08-12 00:09 - 2015-07-01 13:30 - 00082432 _____ (Microsoft Corporation) C:\windows\SysWOW64\davclnt.dll

2015-08-12 00:08 - 2015-07-20 11:12 - 00696320 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll

2015-08-12 00:08 - 2015-07-20 11:12 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll

2015-08-12 00:08 - 2015-07-20 11:12 - 00139776 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe

2015-08-12 00:08 - 2015-07-20 11:12 - 00098304 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll

2015-08-12 00:08 - 2015-07-20 11:12 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll

2015-08-12 00:08 - 2015-07-20 11:12 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll

2015-08-12 00:08 - 2015-07-20 11:12 - 00037376 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe

2015-08-12 00:08 - 2015-07-20 11:12 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\wups.dll

2015-08-12 00:08 - 2015-07-20 11:12 - 00012288 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll

2015-08-12 00:08 - 2015-07-20 10:56 - 00566784 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll

2015-08-12 00:08 - 2015-07-20 10:56 - 00173056 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll

2015-08-12 00:08 - 2015-07-20 10:56 - 00093184 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll

2015-08-12 00:08 - 2015-07-20 10:56 - 00034816 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe

2015-08-12 00:08 - 2015-07-20 10:56 - 00030208 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll

2015-08-12 00:08 - 2015-05-09 11:26 - 00493504 _____ (Microsoft Corporation) C:\windows\system32\mcupdate_GenuineIntel.dll

2015-08-09 23:39 - 2015-08-09 23:39 - 00006490 _____ C:\AdwCleaner[R4].txt

2015-08-09 23:39 - 2015-08-09 23:39 - 00000316 _____ C:\AdwCleaner[S3].txt

2015-08-09 23:38 - 2015-08-09 23:38 - 00006430 _____ C:\AdwCleaner[R3].txt

2015-08-09 23:29 - 2015-08-09 23:29 - 00000000 ____D C:\AdwCleaner

2015-08-07 23:48 - 2015-08-07 23:48 - 00001480 _____ C:\Users\Rajagopal Kumar\Downloads\daily-show-host-jon-stewart-bids-adieu-after-16-years-1514479

2015-08-02 17:22 - 2015-08-02 17:23 - 00023593 _____ C:\Users\Rajagopal Kumar\Downloads\download (2)

2015-08-02 17:20 - 2015-08-02 17:20 - 00013315 _____ C:\Users\Rajagopal Kumar\Downloads\download (1)

2015-07-31 11:42 - 2015-07-31 11:42 - 00000229 _____ C:\Users\Rajagopal Kumar\Downloads\ads-iframe-display (2).php

2015-07-31 11:34 - 2015-07-31 11:34 - 00000039 _____ C:\Users\Rajagopal Kumar\Downloads\ads-iframe-display (1).php

2015-07-31 11:32 - 2015-07-31 11:36 - 00000850 _____ C:\Users\Rajagopal Kumar\Downloads\container.html

2015-07-31 01:03 - 2015-07-31 01:03 - 00000000 ____D C:\Users\Rajagopal Kumar\AppData\Local\GWX

2015-07-31 01:02 - 2015-07-31 01:02 - 00001941 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk

2015-07-31 01:02 - 2015-07-31 01:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus

2015-07-31 01:02 - 2015-07-31 01:02 - 00000000 ____D C:\Program Files\McAfee Security Scan

 

==================== One Month Modified files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-08-27 11:49 - 2010-09-08 08:55 - 01844608 _____ C:\windows\system32\TPAPSLOG.LOG

2015-08-27 11:29 - 2012-09-03 20:26 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2015-08-27 11:24 - 2009-07-13 21:45 - 00022704 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-08-27 11:24 - 2009-07-13 21:45 - 00022704 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-08-27 11:21 - 2015-01-23 10:08 - 00000558 _____ C:\windows\Tasks\G2MUpdateTask-S-1-5-21-2180650751-2005149398-3877183700-1000.job

2015-08-27 11:20 - 2011-11-21 09:25 - 01206411 _____ C:\windows\WindowsUpdate.log

2015-08-27 11:13 - 2009-07-13 22:13 - 00799790 _____ C:\windows\system32\PerfStringBackup.INI

2015-08-27 11:08 - 2011-11-25 18:07 - 00000948 _____ C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2180650751-2005149398-3877183700-1000UA.job

2015-08-27 11:08 - 2011-11-21 09:28 - 02874313 _____ C:\FaceProv.log

2015-08-27 11:08 - 2010-09-08 08:55 - 00913152 _____ C:\windows\system32\TPHDLOG0.LOG

2015-08-27 11:08 - 2009-07-13 22:08 - 00000006 ____H C:\windows\Tasks\SA.DAT

2015-08-27 11:05 - 2009-07-13 21:51 - 00194680 _____ C:\windows\setupact.log

2015-08-26 22:47 - 2009-07-13 20:20 - 00000000 ___HD C:\windows\system32\GroupPolicy

2015-08-26 22:47 - 2009-07-13 20:20 - 00000000 ____D C:\windows\SysWOW64\GroupPolicy

2015-08-25 22:04 - 2011-11-25 18:07 - 00000896 _____ C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2180650751-2005149398-3877183700-1000Core.job

2015-08-25 22:01 - 2010-09-08 08:54 - 01678110 _____ C:\windows\PFRO.log

2015-08-25 08:39 - 2015-05-30 17:08 - 00000654 _____ C:\windows\Tasks\G2MUploadTask-S-1-5-21-2180650751-2005149398-3877183700-1000.job

2015-08-25 03:31 - 2012-01-28 13:13 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-08-25 03:27 - 2015-06-19 09:42 - 00000000 ____D C:\Program Files\Microsoft Office 15

2015-08-25 00:01 - 2014-09-22 22:53 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2015-08-25 00:01 - 2011-12-10 16:34 - 00000000 ____D C:\Users\Rajagopal Kumar\AppData\Local\CrashDumps

2015-08-25 00:01 - 2010-09-08 08:49 - 00000000 ____D C:\ProgramData\Temp

2015-08-25 00:00 - 2012-09-03 20:36 - 00000000 ____D C:\Program Files (x86)\SpywareBlaster

2015-08-24 23:58 - 2012-09-03 20:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster

2015-08-24 23:57 - 2013-09-08 18:03 - 00000000 ____D C:\Raju

2015-08-24 21:25 - 2011-11-23 09:19 - 00000000 ____D C:\Users\Rajagopal Kumar

2015-08-24 20:05 - 2015-04-04 12:37 - 00000000 ___SD C:\windows\system32\GWX

2015-08-24 20:05 - 2011-11-25 18:08 - 00000000 ____D C:\Users\Rajagopal Kumar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome

2015-08-24 20:05 - 2011-11-25 17:54 - 00000000 ____D C:\ProgramData\McAfee Security Scan

2015-08-24 20:05 - 2011-11-23 09:19 - 00000000 ____D C:\Users\Rajagopal Kumar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo

2015-08-24 20:04 - 2009-07-13 20:20 - 00000000 ____D C:\windows\registration

2015-08-24 20:03 - 2015-06-26 10:11 - 00000000 __RHD C:\MSOCache

2015-08-20 20:54 - 2010-09-08 08:51 - 00000000 ____D C:\ProgramData\VeriFace

2015-08-20 20:53 - 2009-07-13 22:09 - 00000000 ____D C:\windows\System32\Tasks\WPD

2015-08-19 00:21 - 2012-05-30 11:18 - 00000000 ____D C:\Users\Rajagopal Kumar\AppData\Roaming\PrimoPDF

2015-08-17 18:28 - 2009-07-13 21:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

2015-08-15 18:38 - 2009-07-13 20:20 - 00000000 ____D C:\windows\rescache

2015-08-14 09:21 - 2009-07-13 21:45 - 00442424 _____ C:\windows\system32\FNTCACHE.DAT

2015-08-14 09:17 - 2014-12-18 00:45 - 00000000 ____D C:\windows\system32\appraiser

2015-08-14 09:17 - 2014-05-10 02:53 - 00000000 ___SD C:\windows\system32\CompatTel

2015-08-14 00:48 - 2012-09-03 20:26 - 00778440 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2015-08-14 00:48 - 2012-09-03 20:26 - 00003768 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater

2015-08-14 00:48 - 2011-11-25 17:55 - 00142536 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-08-12 23:41 - 2012-04-21 16:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2015-08-12 21:13 - 2012-04-21 16:51 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2015-08-12 21:13 - 2012-04-21 16:51 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2015-08-09 23:16 - 2011-12-10 16:25 - 00000000 ____D C:\norton

2015-08-09 12:25 - 2014-09-22 22:53 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-08-05 20:26 - 2010-09-08 08:55 - 01819584 _____ C:\windows\system32\TPAPSLOG(19).LOG

2015-08-03 23:56 - 2011-12-05 02:12 - 00000000 ____D C:\Users\Rajagopal Kumar\AppData\Roaming\vlc

 

==================== Files in the root of some directories =======

 

2015-01-15 07:38 - 2015-01-15 07:38 - 0008704 _____ () C:\Users\Rajagopal Kumar\AppData\Roaming\agmas.msy

2011-12-06 01:24 - 2012-09-27 19:49 - 0000600 _____ () C:\Users\Rajagopal Kumar\AppData\Local\PUTTY.RND

2014-09-22 23:18 - 2015-05-27 21:12 - 0007605 _____ () C:\Users\Rajagopal Kumar\AppData\Local\resmon.resmoncfg

 

==================== Bamital & volsnap =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\windows\system32\winlogon.exe => File is digitally signed

C:\windows\system32\wininit.exe => File is digitally signed

C:\windows\SysWOW64\wininit.exe => File is digitally signed

C:\windows\explorer.exe => File is digitally signed

C:\windows\SysWOW64\explorer.exe => File is digitally signed

C:\windows\system32\svchost.exe => File is digitally signed

C:\windows\SysWOW64\svchost.exe => File is digitally signed

C:\windows\system32\services.exe => File is digitally signed

C:\windows\system32\User32.dll => File is digitally signed

C:\windows\SysWOW64\User32.dll => File is digitally signed

C:\windows\system32\userinit.exe => File is digitally signed

C:\windows\SysWOW64\userinit.exe => File is digitally signed

C:\windows\system32\rpcss.dll => File is digitally signed

C:\windows\system32\dnsapi.dll => File is digitally signed

C:\windows\SysWOW64\dnsapi.dll => File is digitally signed

C:\windows\system32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2015-08-25 03:54

 

==================== End of FRST.txt ============================

 

 

---------------------------------------------------------------------------------------------------------------

 

 

Addition.txt

 

 

-------------------------------------------------------------------------------------------------------------

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version:26-08-2015

Ran by Rajagopal Kumar (2015-08-27 11:55:45)

Running from C:\Users\Rajagopal Kumar\Desktop

Boot Mode: Normal

==========================================================

 

 

==================== Accounts: =============================

 

Administrator (S-1-5-21-2180650751-2005149398-3877183700-500 - Administrator - Disabled)

Guest (S-1-5-21-2180650751-2005149398-3877183700-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-2180650751-2005149398-3877183700-1004 - Limited - Enabled)

Rajagopal Kumar (S-1-5-21-2180650751-2005149398-3877183700-1000 - Administrator - Enabled) => C:\Users\Rajagopal Kumar

rajagopal ravikumar (S-1-5-21-2180650751-2005149398-3877183700-1006 - Administrator - Enabled)

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}

AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: ZoneAlarm Free Firewall Firewall (Disabled) {E6380B7E-D4B2-19F1-083E-56486607704B}

 

==================== Installed Programs ======================

 

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

ActivClient x64 (HKLM\...\{86E45973-5352-439F-A115-2E8EE4D40140}) (Version: 6.2 - ActivIdentity)

Active Protection System (HKLM-x32\...\{F493761C-E465-4B9E-9FC1-A312F161DE0A}) (Version: 1.70.08 - Lenovo)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.4.0.2540 - Adobe Systems Incorporated)

Adobe Flash Player 18 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 18.0.0.232 - Adobe Systems Incorporated)

Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.12) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)

AoA Audio Extractor (HKLM-x32\...\{D1725D54-279A-40C5-A70D-23C1785DB920}_is1) (Version:  - AoAMedia.com)

AOL Toolbar (HKLM-x32\...\AOL Toolbar) (Version:  - )

AOL Toolbar (HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\AOL Toolbar) (Version:  - )

Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.26 - Atheros Communications Inc.)

ChromecastApp (HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\{079ede36-133d-44b0-8053-c7c1fa8d2e0d}_is1) (Version: 1.5.1383.0 - Google Inc.)

Citrix Online Launcher (HKLM-x32\...\{AFB80939-4486-49D8-A04E-2B05C0F2DE39}) (Version: 1.0.252 - Citrix)

CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.0.2311 - CyberLink Corp.)

Energy Management (HKLM-x32\...\{0CE226F3-EB27-4ECD-BBF5-F088716779FD}) (Version: 5.4.1.6 - Lenovo)

ERUNT 1.1j (HKLM-x32\...\ERUNT_is1) (Version:  - Lars Hederer)

ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )

FileHippo.com Update Checker (HKLM-x32\...\FileHippo.com) (Version:  - )

Google Chrome (HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\Google Chrome) (Version: 44.0.2403.155 - Google Inc.)

Google Talk Plugin (HKLM-x32\...\{83A5D4E9-7FE6-336D-9525-F1C879496014}) (Version: 3.3.2.8436 - Google)

GoToMeeting 7.2.3.3019 (HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\GoToMeeting) (Version: 7.2.3.3019 - CitrixOnline)

HipChat (HKLM-x32\...\{D841EE48-5BDF-433C-A6C4-261855E542E9}) (Version: 2.2.1221 - Atlassian Inc)

HP Virtual Room Client Launcher Plugin (HKLM-x32\...\{E9C450A0-4606-11E0-9207-0800200C9A66}) (Version: 2.0.0.1 - Hewlett-Packard)

Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)

Intel® Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2086 - Intel Corporation)

Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)

Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.5.6.1001 - Intel Corporation)

Java 7 Update 7 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417007FF}) (Version: 7.0.70 - Oracle)

Java™ 6 Update 35 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216035FF}) (Version: 6.0.350 - Oracle)

JDownloader (HKLM-x32\...\JDownloader) (Version: 0.89 - AppWork UG (haftungsbeschränkt))

JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)

Juniper Networks Setup Client (HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\Juniper_Setup_Client) (Version: 8.0.3.44983 - Juniper Networks)

Juniper Networks Setup Client 64-bit Activex Control (HKLM\...\Juniper_Setup_Client Activex Control) (Version: 2.1.1.1 - Juniper Networks)

Juniper Networks Setup Client Activex Control (HKLM-x32\...\Juniper_Setup_Client Activex Control) (Version: 2.1.1.1 - Juniper Networks)

Junos Pulse (Version: 5.0.44983 - Juniper Networks) Hidden

Junos Pulse 5.0 (HKLM-x32\...\Junos Pulse 5.0) (Version: 5.0.44983 - Juniper Networks, Inc.)

KeyScrambler (HKLM-x32\...\KeyScrambler) (Version: 2.9.2.0 - QFX Software Corporation)

Kies mini (HKLM-x32\...\InstallShield_{EE43894E-FDCF-4A8C-BCD6-3AAA9A48B486}) (Version: 1.00.0000 - Samsung Electronics Co., Ltd.)

Kies mini (x32 Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Hidden

Lenovo Bluetooth with Enhanced Data Rate Software (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.1.1400 - Broadcom Corporation)

Lenovo DirectShare (HKLM-x32\...\InstallShield_{B2164CCB-C002-4B80-8550-7535D80DF237}) (Version: 1.0.1.38 - ArcSoft)

Lenovo DirectShare (x32 Version: 1.0.1.38 - ArcSoft) Hidden

Lenovo EasyCamera (HKLM-x32\...\{ADE16A9D-FBDC-4ecc-B6BD-9C31E51D0332}) (Version: 2.10.02.23.1 - Vimicro)

Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 7.0.0723 - CyberLink Corp.)

Lenovo OneKey Recovery (Version: 7.0.0723 - CyberLink Corp.) Hidden

Lenovo ReadyComm 5 (HKLM-x32\...\{17542DBF-E17C-4562-BC4D-FA3EF3076C45}) (Version: 5.1.1.17 - Lenovo)

Lenovo ReadyComm 5.0 Service (HKLM-x32\...\{76C66170-C538-4E77-B54D-48E136B5B533}) (Version: 5.0.0.1 - Lenovo Group Limited)

Lenovo Security Solution FP (HKLM\...\{0F841121-4DB6-4B31-839F-7F5AB3BB3423}) (Version: 5.9.3.6245 - UPEK Inc.)

magicJack (HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\magicJack) (Version: 2.0.6073.4413 - magicJack L.P.)

Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)

McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.149.2 - McAfee, Inc.)

Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)

Microsoft Lync 2010 Attendee (HKLM-x32\...\{6F72D695-5188-4484-B21E-E16CD89C4008}) (Version: 4.0.7577.4446 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office 365 ProPlus - en-us (HKLM\...\O365ProPlusRetail - en-us) (Version: 15.0.4745.1002 - Microsoft Corporation)

Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Save as PDF Add-in for 2007 Microsoft Office programs (HKLM-x32\...\{90120000-00B0-0409-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)

Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual J# 2.0 Redistributable Package - SE (x64) (HKLM\...\Microsoft Visual J# 2.0 Redistributable Package - SE (x64)) (Version:  - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

Mozilla Firefox 38.0.5 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 38.0.5 (x86 en-US)) (Version: 38.0.5 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.1.1 - Mozilla)

NEF Codec (HKLM-x32\...\{D6506521-0959-4FA3-875F-E2E28830B0D2}) (Version: 1.00.0000 - Nikon)

NEF to JPG (HKLM-x32\...\{13D87B39-2A3B-4675-A0D9-B8B01EA2F8E3}_is1) (Version:  - neftojpg.com)

Nitro Reader 2 (HKLM\...\{7B72A3FB-2563-4A83-B054-98C57415DFFA}) (Version: 2.3.1.7 - Nitro PDF Software)

Norton Safe Web Lite (HKLM-x32\...\NST) (Version: 2.0.0.16 - Symantec Corporation)

Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4745.1002 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Licensing Component (Version: 15.0.4745.1002 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4745.1002 - Microsoft Corporation) Hidden

Oracle VM VirtualBox 4.1.18 (HKLM\...\{4EE61784-10C6-4B7C-A0B2-5BED17B05741}) (Version: 4.1.18 - Oracle Corporation)

PDFBinder (HKLM-x32\...\{8BA03AC2-579F-41CD-A250-740137D86F7A}) (Version: 1.0.0 - Malamute.dk)

Pidgin (HKLM-x32\...\Pidgin) (Version: 2.10.6 - )

PrimoPDF -- brought to you by Nitro PDF Software (HKLM-x32\...\PrimoPDF) (Version: 5 - Nitro PDF Software)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6083 - Realtek Semiconductor Corp.)

Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30116 - Realtek Semiconductor Corp.)

Remote Access to HP Network 6.2 (HKLM\...\{9F150026-E7A4-47D9-B0E2-7666EEC54AA6}) (Version: 6.2.3.52064 - Hewlett-Packard Company)

Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.2.0.12014_18 - Samsung Electronics Co., Ltd.)

Samsung Kies (x32 Version: 2.2.0.12014_18 - Samsung Electronics Co., Ltd.) Hidden

SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.3.2300.0 - SAMSUNG Electronics Co., Ltd.)

Skype for Business Web App Plug-in (HKLM-x32\...\{7EA9A4CD-6875-4F3C-A4D4-42C924AD3CF8}) (Version: 15.8.20020.351 - Microsoft Corporation)

Skype™ 7.1 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.1.105 - Skype Technologies S.A.)

SpywareBlaster 5.2 (HKLM-x32\...\SpywareBlaster_is1) (Version: 5.2.0 - BrightFort LLC)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.13.0 - Synaptics Incorporated)

TeamViewer 7 (HKLM-x32\...\TeamViewer 7) (Version: 7.0.12541 - TeamViewer)

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

VeriFace (HKLM-x32\...\VeriFace) (Version: 3.6.0.0730 - Lenovo)

Vim 7.3 (self-installing) (HKLM\...\Vim 7.3) (Version:  - )

VLC media player 1.1.11 (HKLM-x32\...\VLC media player) (Version: 1.1.11 - VideoLAN)

VLC media player 2.0.2 (HKLM\...\VLC media player) (Version: 2.0.2 - VideoLAN)

VMware vSphere Client 4.1 (HKLM-x32\...\{A0B433B1-941D-46F5-AE59-286263534232}) (Version: 4.1.0.17435 - VMware, Inc.)

VMware vSphere Client 5.0 (HKLM-x32\...\{04805AB6-F757-496A-8D56-37A0FC5FF6F3}) (Version: 5.0.0.16964 - VMware, Inc.)

Windows Driver Package - Broadcom (BTHUSB) Bluetooth  (02/25/2010 6.2.0.9419) (HKLM\...\85CE3A3657FAE5FD305B143E90E6FC89BA53001C) (Version: 02/25/2010 6.2.0.9419 - Broadcom)

Windows Driver Package - Broadcom Bluetooth  (01/19/2010 6.2.0.1417) (HKLM\...\7341A1B43E7FE58942EB1E820A17C18305DFBCE6) (Version: 01/19/2010 6.2.0.1417 - Broadcom)

Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (HKLM\...\3BA80AB4C7E9F8497C115C844953A3D4BEB84D21) (Version: 07/28/2009 6.2.0.9800 - Broadcom)

Windows Driver Package - Lenovo (ACPIVPC) System  (10/19/2009 5.4.0.1) (HKLM\...\0A4175B489A1B4A6E07E11B063A6263480C51D71) (Version: 10/19/2009 5.4.0.1 - Lenovo)

WinRAR 4.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

WinRAR archiver (HKLM-x32\...\WinRAR archiver) (Version:  - )

Yahoo! Detect (HKLM-x32\...\YTdetect) (Version:  - )

ZoneAlarm Firewall (x32 Version: 10.2.078.000 - Check Point Software Technologies Ltd.) Hidden

ZoneAlarm LTD Toolbar (HKLM\...\ZoneAlarm LTD Toolbar) (Version:  - Check Point Software Technologies)

ZoneAlarm Security (HKLM-x32\...\ZoneAlarm Security) (Version: 10.2.078.000 - Check Point)

ZoneAlarm Security (x32 Version: 10.2.078.000 - Check Point Software Technologies Ltd.) Hidden

ZoneAlarm Security Toolbar  (HKLM-x32\...\ZoneAlarm Security Toolbar) (Version:  - Check Point Software Technologies LTD)

 

==================== Custom CLSID (Whitelisted): ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll No File

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{1542FC7D-8D51-43D5-B757-67C763F27BF4}\localserver32 -> C:\Users\Rajagopal Kumar\AppData\Local\Microsoft\SkypeForBusinessPlugin\15.8.20020.351\GatewayVersion-x64.exe (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}\InprocServer32 -> C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\1.3.28.1\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{7ECF6F97-B4F3-4168-9835-F59C06D7875F}\InprocServer32 -> C:\Users\Rajagopal Kumar\AppData\Local\Microsoft\SkypeForBusinessPlugin\15.8.20020.351\GatewayActiveX-x64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files (x86)\Citrix\GoToMeeting\2759\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll No File

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll No File

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\1.3.28.1\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File

 

==================== Restore Points =========================

 

25-08-2015 04:01:06 Scheduled Checkpoint

25-08-2015 09:26:51 Windows Update

 

==================== Hosts content: ===============================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2009-07-13 19:34 - 2015-08-26 23:23 - 00000035 ____A C:\windows\system32\Drivers\etc\hosts

 

==================== Scheduled Tasks (Whitelisted) =============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

Task: {0A48790B-8F21-49D6-BCA2-002FCDE66934} - System32\Tasks\{CAA2C271-9E78-4B13-B771-BFEAB9B43BF6} => Firefox.exe http://ui.skype.com/...all?page=tsMain

Task: {15FCD675-73D4-4897-827E-3BFA92A8BB3F} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-06-19] (Microsoft Corporation)

Task: {1E836FBE-A247-4075-A0E7-78F272158E84} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-07-14] (Microsoft Corporation)

Task: {24FB4A52-7D86-4D24-873D-9D159EBF5D2C} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-14] (Microsoft Corporation)

Task: {5428AE52-65C6-4FE8-8D37-3EDCD57189F9} - System32\Tasks\{67D128B7-CF09-424C-B021-85A1D7231D4D} => pcalua.exe -a "C:\Users\Rajagopal Kumar\Downloads\IN3VDO43WW6.exe" -d "C:\Program Files (x86)\Mozilla Firefox"

Task: {55F19CD7-5DDC-40B4-8FDA-407C1644F7CA} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)

Task: {87FD0532-5C3B-44F7-9AE6-0466BA097486} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiser

Task: {88277C0E-4E7E-476C-B420-5DE07C77594C} - System32\Tasks\{AEB01D3F-7D48-4A30-BDBC-F3F68CBE86EE} => Firefox.exe http://ui.skype.com/...all?page=tsBing

Task: {93CD187A-AD37-42A9-8DE8-1F0DF268302B} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-14] (Microsoft Corporation)

Task: {A1FAA169-2519-49D6-A9D2-86AFEC913226} - System32\Tasks\G2MUpdateTask-S-1-5-21-2180650751-2005149398-3877183700-1000 => C:\Program Files (x86)\Citrix\GoToMeeting\3019\g2mupdate.exe [2015-07-19] (Citrix Online, a division of Citrix Systems, Inc.)

Task: {B461737D-578C-4030-B304-9EF0F4FF78E8} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2180650751-2005149398-3877183700-1000Core => C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-26] (Google Inc.)

Task: {C43905FD-C93B-4E0C-806F-4A4661FA2BD0} - System32\Tasks\G2MUploadTask-S-1-5-21-2180650751-2005149398-3877183700-1000 => C:\Program Files (x86)\Citrix\GoToMeeting\3019\g2mupload.exe [2015-07-19] (Citrix Online, a division of Citrix Systems, Inc.)

Task: {C69F1BB0-3857-4F61-8E12-125B616DFB70} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-14] (Adobe Systems Incorporated)

Task: {D20757B0-CFF4-4239-AEEC-0C6EA939D0CF} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-06-19] (Microsoft Corporation)

Task: {E0E97A4B-C8D4-4B17-9E32-5E6BBD65AFE8} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2180650751-2005149398-3877183700-1000UA => C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-26] (Google Inc.)

 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

 

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\windows\Tasks\G2MUpdateTask-S-1-5-21-2180650751-2005149398-3877183700-1000.job => C:\Program Files (x86)\Citrix\GoToMeeting\3019\g2mupdate.exe

Task: C:\windows\Tasks\G2MUploadTask-S-1-5-21-2180650751-2005149398-3877183700-1000.job => C:\Program Files (x86)\Citrix\GoToMeeting\3019\g2mupload.exe

Task: C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2180650751-2005149398-3877183700-1000Core.job => C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2180650751-2005149398-3877183700-1000UA.job => C:\Users\Rajagopal Kumar\AppData\Local\Google\Update\GoogleUpdate.exe

 

==================== Loaded Modules (Whitelisted) ==============

 

2012-05-30 11:16 - 2011-02-28 15:37 - 00095008 _____ () C:\windows\System32\Primomonnt.dll

2015-06-19 09:42 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll

2015-06-19 11:39 - 2015-06-19 11:39 - 08898720 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll

2010-09-08 08:51 - 2010-09-08 08:51 - 01502720 _____ () C:\windows\system32\IcnOvrly.dll

2010-02-18 00:26 - 2010-02-18 00:26 - 00173344 _____ () C:\Program Files\Lenovo\Bluetooth Software\btkeyind.dll

2010-09-08 08:42 - 2009-07-15 15:55 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll

2010-09-08 08:42 - 2009-07-15 15:55 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll

2010-01-22 16:32 - 2010-01-22 16:32 - 00094208 _____ () C:\Program Files\RA2HP\psWinControl.dll

2012-02-03 18:50 - 2012-03-01 00:35 - 00021416 _____ () C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

2010-09-08 08:42 - 2009-12-23 17:32 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll

2015-08-27 11:09 - 2015-08-27 11:09 - 00115137 _____ () C:\Users\Rajagopal Kumar\AppData\Local\Temp\c06086cf-47b1-4760-b263-4e4271d9922f\CliSecureRT.dll

2012-02-01 18:20 - 2012-02-01 18:20 - 00033792 _____ () C:\Program Files (x86)\Samsung\Kies\Common\Kies.Common.DeviceServiceLib.Interface.dll

2012-02-01 18:20 - 2012-02-01 18:20 - 13673984 _____ () C:\Program Files (x86)\Samsung\Kies\Theme\Kies.Theme.dll

2012-02-01 18:20 - 2012-02-01 18:20 - 00440832 _____ () C:\Program Files (x86)\Samsung\Kies\UI\Kies.UI.dll

2012-01-31 19:21 - 2012-01-31 19:21 - 00022528 _____ () C:\Program Files (x86)\Samsung\Kies\Common\Kies.MVVM.dll

2012-02-03 18:47 - 2012-02-03 18:47 - 00079360 _____ () C:\Program Files (x86)\Samsung\Kies\Common\Kies.Common.DeviceServiceLib.FileService.dll

2012-01-31 19:15 - 2012-01-31 19:15 - 00720896 _____ () C:\Program Files (x86)\Samsung\Kies\External\MediaModules\LDBCShConv.dll

2012-01-31 19:16 - 2012-01-31 19:16 - 00712704 _____ () C:\Program Files (x86)\Samsung\Kies\External\DeviceModules\SHOWDRM_UCC.dll

2012-01-31 19:16 - 2012-01-31 19:16 - 00237568 _____ () C:\Program Files (x86)\Samsung\Kies\External\DeviceModules\drmcm.dll

2012-01-31 19:16 - 2012-01-31 19:16 - 00839680 _____ () C:\Program Files (x86)\Samsung\Kies\External\System.Data.SQLite.dll

2015-06-19 09:50 - 2015-06-19 09:50 - 00316576 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream32.dll

2015-06-19 11:06 - 2015-06-19 11:22 - 01754296 _____ () C:\Program Files\Microsoft Office 15\root\office15\tmpod.dll

2015-06-19 11:06 - 2015-06-19 11:18 - 00022696 _____ () C:\Program Files\Microsoft Office 15\root\office15\lynchtmlconvpxy.dll

2015-06-19 11:39 - 2015-06-19 11:39 - 08898720 _____ () C:\Program Files\Microsoft Office 15\root\Office15\1033\GrooveIntlResource.dll

2015-08-14 01:04 - 2015-08-07 17:13 - 01405768 _____ () C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\44.0.2403.155\libglesv2.dll

2015-08-14 01:04 - 2015-08-07 17:13 - 00081224 _____ () C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\44.0.2403.155\libegl.dll

 

==================== Alternate Data Streams (Whitelisted) =========

 

(If an entry is included in the fixlist, only the ADS will be removed.)

 

AlternateDataStreams: C:\Users\Rajagopal Kumar\Desktop\noname.eml:OECustomProperty

 

==================== Safe Mode (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service"

 

==================== EXE Association (Whitelisted) ===============

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

 

 

==================== Internet Explorer trusted/restricted ===============

 

(If an entry is included in the fixlist, it will be removed from the registry.)

 

IE trusted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\hp.com -> hxxps://hp.com

 

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\008i.com -> 008i.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\008k.com -> 008k.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\00hq.com -> 00hq.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\0190-dialers.com -> 0190-dialers.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\01i.info -> 01i.info

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\0411dd.com -> 0411dd.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\0511zfhl.com -> 0511zfhl.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\05p.com -> 05p.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\0632qyw.com -> 0632qyw.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\0calories.net -> 0calories.net

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\0cj.net -> 0cj.net

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\0scan.com -> 0scan.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\1-britney-spears-nude.com -> 1-britney-spears-nude.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\1-domains-registrations.com -> 1-domains-registrations.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\1-se.com -> 1-se.com

IE restricted site: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\1001movie.com -> 1001movie.com

 

There are 6091 more restricted sites.

 

==================== Other Areas ============================

 

(Currently there is no automatic fix for this section.)

 

HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Rajagopal Kumar\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 10.10.0.1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)

Windows Firewall is disabled.

 

==================== MSCONFIG/TASK MANAGER disabled items ==

 

(Currently there is no automatic fix for this section.)

 

MSCONFIG\startupreg: GrooveMonitor => "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

MSCONFIG\startupreg: VeriFaceManager => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe

 

==================== FirewallRules (Whitelisted) ===============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

FirewallRules: [{8215C609-9286-4EEF-BC10-2318CEF88218}] => (Allow) C:\Users\Rajagopal Kumar\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe

FirewallRules: [{EB147613-C33A-4499-84A4-0A3ADF07DD65}] => (Allow) C:\Users\Rajagopal Kumar\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe

FirewallRules: [TCP Query User{7459A482-86DC-4D9F-8847-E7BD8D47958E}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [UDP Query User{C3F1332D-4B6E-4F39-8425-414AA1C6949C}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [{1EAD79F7-B4AE-4EE5-87EF-E128A1FC8889}] => (Block) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [{6299D513-4903-4014-BA28-F48423DE4058}] => (Block) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [{E7162A74-E8A9-4405-AE3C-9CDB57DB5BB7}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe

FirewallRules: [TCP Query User{BE4615D3-A12D-4C39-AE1E-16EB7794D6B6}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe

FirewallRules: [UDP Query User{E3B50CE2-4C0E-4273-9F1A-DDA98A4A2FDD}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe

FirewallRules: [{421B08B4-2012-4645-AABE-B2C416F17986}] => (Allow) C:\program files\java\jre7\bin\javaw.exe

FirewallRules: [{B477A468-0555-4711-A87A-9F60F0A7F9CD}] => (Allow) C:\program files\java\jre7\bin\javaw.exe

FirewallRules: [{E267EF39-2810-4130-8188-CE084AF56ABB}] => (Allow) C:\Program Files (x86)\JDownloader\JDownloader.exe

FirewallRules: [{3D42C315-0A07-4FB5-AB82-07B62ADFFED2}] => (Allow) C:\Program Files (x86)\JDownloader\JDownloader.exe

FirewallRules: [{40B0CEB0-3399-4D92-97E6-3BE8179AFD0F}] => (Allow) C:\Program Files (x86)\JDownloader\JDownloader.exe

FirewallRules: [{8924E548-5944-4BBA-9174-A6EB4E16697D}] => (Allow) C:\Program Files (x86)\JDownloader\JDownloader.exe

FirewallRules: [{969EE50C-E0CA-4D29-91FD-023B887F6DA4}] => (Allow) C:\Users\Rajagopal Kumar\AppData\Roaming\mjusbsp\magicJack.exe

FirewallRules: [{5CFF30FE-8D45-4BC6-A99B-6AEB732653D8}] => (Allow) C:\Users\Rajagopal Kumar\AppData\Roaming\mjusbsp\magicJack.exe

FirewallRules: [{047D8F8E-1158-42AA-B959-1D65D3AAED82}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{05D2B766-E6EF-472B-AAC0-CBCEEA6C8402}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{5558A5DF-E982-4A81-B784-79BB3E93D94D}] => (Allow) C:\Users\Rajagopal Kumar\AppData\Local\Microsoft Lync Attendee\AttendeeCommunicator.exe

FirewallRules: [{CF4C00FF-9B7D-491C-8C36-F328FB105F4C}] => (Allow) C:\Users\Rajagopal Kumar\AppData\Local\Microsoft Lync Attendee\AttendeeCommunicator.exe

FirewallRules: [{14BCE56C-B290-4B80-854C-7F54428B2F14}] => (Allow) C:\Users\Rajagopal Kumar\AppData\Local\Microsoft Lync Attendee\AttendeeCommunicator.exe

FirewallRules: [{626E21BA-AA40-4CB1-A5E2-963043E56E81}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe

FirewallRules: [{ABB2BA79-1F7B-440A-A4D0-40972DEE3557}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe

FirewallRules: [{76636A7A-1F5E-4A9A-B15C-273379BB25B2}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe

FirewallRules: [{26A22A1C-2103-46E3-B33A-FF06201A95E9}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe

FirewallRules: [{567B008F-5BB7-4C04-81DB-7A9EC9195A96}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe

FirewallRules: [{A815176F-0FC6-45AE-A3C9-C4695D92FBD2}] => (Allow) C:\Program Files\Microsoft Office 15\root\office15\lync.exe

FirewallRules: [{3FE0076A-395B-4A1C-A486-8E6871B05CE3}] => (Allow) C:\Program Files\Microsoft Office 15\root\office15\lync.exe

FirewallRules: [{338A3E5B-68B9-40DF-9E0D-0313DD640670}] => (Allow) C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\Application\chrome.exe

 

==================== Faulty Device Manager Devices =============

 

Name: Bluetooth Device (Personal Area Network)

Description: Bluetooth Device (Personal Area Network)

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: BthPan

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

 

Name: A2 Direct Disk Access Support Driver

Description: A2 Direct Disk Access Support Driver

Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Manufacturer: 

Service: A2DDA

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.

 

 

==================== Event log errors: =========================

 

Application errors:

==================

Error: (08/27/2015 11:19:23 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )

Description: Subscription licensing service failed: -2146762481

 

Error: (08/27/2015 11:19:23 AM) (Source: Microsoft Office 15) (EventID: 2011) (User: )

Description: Office Subscription licensing exception: Error Code: 0x800B010F; CorrelationId: {0CBC8CE7-F67C-4D1F-A88A-B027EE39526D}

 

Error: (08/27/2015 11:11:01 AM) (Source: SideBySide) (EventID: 35) (User: )

Description: Activation context generation failed for "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1".Error in manifest or policy file "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" on line UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.

Component identity found in manifest does not match the identity of the component requested.

Reference is UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".

Definition is UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".

Please use sxstrace.exe for detailed diagnosis.

 

Error: (08/27/2015 11:09:05 AM) (Source: SideBySide) (EventID: 35) (User: )

Description: Activation context generation failed for "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1".Error in manifest or policy file "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" on line UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.

Component identity found in manifest does not match the identity of the component requested.

Reference is UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".

Definition is UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".

Please use sxstrace.exe for detailed diagnosis.

 

Error: (08/27/2015 11:08:58 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: mbamservice.exe, version: 3.0.2.0, time stamp: 0x5318d363

Faulting module name: mbamservice.exe, version: 3.0.2.0, time stamp: 0x5318d363

Exception code: 0x40000015

Fault offset: 0x0007da8a

Faulting process id: 0xa3c

Faulting application start time: 0xmbamservice.exe0

Faulting application path: mbamservice.exe1

Faulting module path: mbamservice.exe2

Report Id: mbamservice.exe3

 

Error: (08/27/2015 11:08:36 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: mbamscheduler.exe, version: 3.0.2.0, time stamp: 0x5339cec3

Faulting module name: MSVCR100.dll, version: 10.0.40219.325, time stamp: 0x4df2be1e

Exception code: 0x40000015

Fault offset: 0x0008d6fd

Faulting process id: 0x8e8

Faulting application start time: 0xmbamscheduler.exe0

Faulting application path: mbamscheduler.exe1

Faulting module path: mbamscheduler.exe2

Report Id: mbamscheduler.exe3

 

Error: (08/26/2015 11:51:45 PM) (Source: SideBySide) (EventID: 35) (User: )

Description: Activation context generation failed for "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1".Error in manifest or policy file "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" on line UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.

Component identity found in manifest does not match the identity of the component requested.

Reference is UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".

Definition is UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".

Please use sxstrace.exe for detailed diagnosis.

 

Error: (08/26/2015 11:44:37 PM) (Source: PerfNet) (EventID: 2004) (User: )

Description: 

 

Error: (08/26/2015 11:38:37 PM) (Source: PerfNet) (EventID: 2004) (User: )

Description: 

 

Error: (08/26/2015 11:36:27 PM) (Source: PerfNet) (EventID: 2004) (User: )

Description: 

 

 

System errors:

=============

Error: (08/27/2015 11:43:34 AM) (Source: Schannel) (EventID: 4116) (User: RajagopalKumar)

Description: The certificate received from the remote server does not contain the expected name. It is therefore not possible to determine whether we are connecting to the correct server. The server name we were expecting is sipexternal.snapfish-llc.com. The SSL connection request has failed. The attached data contains the server certificate.

 

Error: (08/27/2015 11:43:34 AM) (Source: Schannel) (EventID: 4120) (User: RajagopalKumar)

Description: The following fatal alert was generated: 43. The internal error state is 552.

 

Error: (08/27/2015 11:43:12 AM) (Source: Schannel) (EventID: 4116) (User: RajagopalKumar)

Description: The certificate received from the remote server does not contain the expected name. It is therefore not possible to determine whether we are connecting to the correct server. The server name we were expecting is sip.snapfish-llc.com. The SSL connection request has failed. The attached data contains the server certificate.

 

Error: (08/27/2015 11:43:12 AM) (Source: Schannel) (EventID: 4120) (User: RajagopalKumar)

Description: The following fatal alert was generated: 43. The internal error state is 552.

 

Error: (08/27/2015 11:42:36 AM) (Source: Schannel) (EventID: 4116) (User: RajagopalKumar)

Description: The certificate received from the remote server does not contain the expected name. It is therefore not possible to determine whether we are connecting to the correct server. The server name we were expecting is sipdir.online.lync.com. The SSL connection request has failed. The attached data contains the server certificate.

 

Error: (08/27/2015 11:42:36 AM) (Source: Schannel) (EventID: 4120) (User: RajagopalKumar)

Description: The following fatal alert was generated: 43. The internal error state is 552.

 

Error: (08/27/2015 11:36:17 AM) (Source: Schannel) (EventID: 4116) (User: RajagopalKumar)

Description: The certificate received from the remote server does not contain the expected name. It is therefore not possible to determine whether we are connecting to the correct server. The server name we were expecting is sipexternal.snapfish-llc.com. The SSL connection request has failed. The attached data contains the server certificate.

 

Error: (08/27/2015 11:36:17 AM) (Source: Schannel) (EventID: 4120) (User: RajagopalKumar)

Description: The following fatal alert was generated: 43. The internal error state is 552.

 

Error: (08/27/2015 11:35:56 AM) (Source: Schannel) (EventID: 4116) (User: RajagopalKumar)

Description: The certificate received from the remote server does not contain the expected name. It is therefore not possible to determine whether we are connecting to the correct server. The server name we were expecting is sip.snapfish-llc.com. The SSL connection request has failed. The attached data contains the server certificate.

 

Error: (08/27/2015 11:35:56 AM) (Source: Schannel) (EventID: 4120) (User: RajagopalKumar)

Description: The following fatal alert was generated: 43. The internal error state is 552.

 

 

Microsoft Office:

=========================

 

CodeIntegrity:

===================================

  Date: 2015-08-27 11:48:10.661

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-08-27 11:48:10.407

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-08-27 11:48:10.154

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-08-27 11:48:09.816

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-08-27 11:47:12.299

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-08-27 11:27:34.670

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-08-27 11:12:06.958

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-08-25 09:26:46.785

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-08-25 08:42:28.363

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-08-25 08:41:37.996

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

 

 

==================== Memory info =========================== 

 

Processor: Intel® Core™ i5 CPU M 450 @ 2.40GHz

Percentage of memory in use: 54%

Total physical RAM: 3893.86 MB

Available physical RAM: 1780.72 MB

Total Virtual: 7785.92 MB

Available Virtual: 4999.81 MB

 

==================== Drives ================================

 

Drive c: (Windows) (Fixed) (Total:420.66 GB) (Free:49.44 GB) NTFS

Drive d: () (Fixed) (Total:30 GB) (Free:29.91 GB) NTFS

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 600F9598)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=420.7 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=30 GB) - (Type=07 NTFS)

 

==================== End of Addition.txt ============================

 

 

-----------------------------------------------------------------------------------------------------

 

 

 

 

 

 

[emeraldnzl]

Hello again ragagopal,

 

Open notepad.

Please copy the contents of the code box below.

To do this highlight (click in the box and press Ctrl + A) the contents of the box and right click on it. Paste this into the open notepad. Save it to the Desktop as fixlist.txt.

Alternatively type the contents of the box into notepad and save it to your desktop as fixlist.txt.

NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.
 

URLSearchHook: HKLM-x32 - AOL Toolbar Search Class - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File
C:\Program Files (x86)\AOL Toolbar
SearchScopes: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000 -> DefaultScope {7111F2F3-9F5A-4B74-A4AE-01681430D82C} URL =
BHO-x32: AOL Toolbar Loader -> {3ef64538-8b54-4573-b48f-4d34b0238ab2} -> C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File
Toolbar: HKLM-x32 - AOL Toolbar - {ba00b7b1-0351-477a-b948-23e3ee5a73d4} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File
BHO-x32: Norton Safe Web Lite BHO -> {F0DA78E9-6B60-42fb-BC26-EF2CFB8C8FF3} -> C:\Program Files (x86)\Norton Safe Web Lite\Engine\2.0.0.16\coIEPlg.dll No File
Toolbar: HKLM-x32 - Norton Safe Web Lite - {30CEEEA2-3742-40e4-85DD-812BF1CBB83D} - C:\Program Files (x86)\Norton Safe Web Lite\Engine\2.0.0.16\coIEPlg.dll No File
C:\Program Files (x86)\Norton Safe Web Lite
Toolbar: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000 -> No Name - {BA00B7B1-0351-477A-B948-23E3EE5A73D4} -  No File
FF HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
C:\ProgramData\McAfee Security Scan
CHR Extension: (AdBlock) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-10-09]
C:\Users\Rajagopal Kumar\AppData\Roaming\agmas.msy
C:\Users\Rajagopal Kumar\AppData\Local\PUTTY.RND

This script is specifically written for the infection on this person's computer. It should NOT to be used on another machine. It may cause serious damage even to the point of rendering the computer unusable.

Run FRST/FRST64 and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

After that

Please run a free online scan with the ESET Online Scanner

Vista / Win7 users: Right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator.

Windows 8 & 8.1 users may face another warning from the Windows SmartScreen Protection - please click More information and Run.

Note: This scan works with Internet Explorer or Mozilla FireFox.

If using Mozilla Firefox you may need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.

Disable your security programs.

• Click the blue Run ESET Online Scanner box
• Tick the box next to YES, I accept the Terms of Use
   then click on: Start
• You may see a panel towards the top of the screen telling you the website wants to install an addon... click and allow/install to install. If your firewall asks whether you want to allow installation, say yes. If asked, click yes to allow the program to run on your computer.
• Check "Enable detection of potentially unwanted applications"
• Click on Start and say yes to allow the program to proceed.
• The virus signature database will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically. The scan may take several hours.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed click "List of found threats" and click again on Copy to clipboard. Open notepad and past in the clipboard list. Save it as ESET log somewhere that you can find .
• After that click the button "Back"
• Select and check Uninstall application on close and Delete quarantined files.
• Then click on: Finish
• Copy and paste the ESET log back here and tell me how your machine is now.

When you return please post

• Fixlog.txt
• results of ESET scan
• and tell me how your machine is now

 

[rajagopal]

Hi emeraldnzl,

 

Thank you very much. I followed the steps and ESET scanning did not find any threats to fix. I did the ESET scanning on normal mode and it ran for 3 hours. My machine did not freeze or crash in the middle of it. Please see below for the Fixlog.txt - 

 

Fix result of Farbar Recovery Scan Tool (x64) Version:26-08-2015

Ran by Rajagopal Kumar (2015-08-27 15:08:33) Run:3

Running from C:\Users\Rajagopal Kumar\Desktop

Loaded Profiles: Rajagopal Kumar (Available Profiles: Rajagopal Kumar)

Boot Mode: Normal

==============================================

 

fixlist content:

*****************

URLSearchHook: HKLM-x32 - AOL Toolbar Search Class - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File

C:\Program Files (x86)\AOL Toolbar

SearchScopes: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000 -> DefaultScope {7111F2F3-9F5A-4B74-A4AE-01681430D82C} URL =

BHO-x32: AOL Toolbar Loader -> {3ef64538-8b54-4573-b48f-4d34b0238ab2} -> C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File

Toolbar: HKLM-x32 - AOL Toolbar - {ba00b7b1-0351-477a-b948-23e3ee5a73d4} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File

BHO-x32: Norton Safe Web Lite BHO -> {F0DA78E9-6B60-42fb-BC26-EF2CFB8C8FF3} -> C:\Program Files (x86)\Norton Safe Web Lite\Engine\2.0.0.16\coIEPlg.dll No File

Toolbar: HKLM-x32 - Norton Safe Web Lite - {30CEEEA2-3742-40e4-85DD-812BF1CBB83D} - C:\Program Files (x86)\Norton Safe Web Lite\Engine\2.0.0.16\coIEPlg.dll No File

C:\Program Files (x86)\Norton Safe Web Lite

Toolbar: HKU\S-1-5-21-2180650751-2005149398-3877183700-1000 -> No Name - {BA00B7B1-0351-477A-B948-23E3EE5A73D4} -  No File

FF HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi

C:\ProgramData\McAfee Security Scan

CHR Extension: (AdBlock) - C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-10-09]

C:\Users\Rajagopal Kumar\AppData\Roaming\agmas.msy

C:\Users\Rajagopal Kumar\AppData\Local\PUTTY.RND

*****************

 

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\URLSearchHooks\\{f0e98552-8e47-4c6c-9b3a-11ab0549f94d} => value removed successfully

"HKCR\Wow6432Node\CLSID\{f0e98552-8e47-4c6c-9b3a-11ab0549f94d}" => key removed successfully

"C:\Program Files (x86)\AOL Toolbar" => File/Folder not found.

HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully

"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3ef64538-8b54-4573-b48f-4d34b0238ab2}" => key removed successfully

"HKCR\Wow6432Node\CLSID\{3ef64538-8b54-4573-b48f-4d34b0238ab2}" => key removed successfully

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{ba00b7b1-0351-477a-b948-23e3ee5a73d4} => value removed successfully

"HKCR\Wow6432Node\CLSID\{ba00b7b1-0351-477a-b948-23e3ee5a73d4}" => key removed successfully

"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0DA78E9-6B60-42fb-BC26-EF2CFB8C8FF3}" => key removed successfully

"HKCR\Wow6432Node\CLSID\{F0DA78E9-6B60-42fb-BC26-EF2CFB8C8FF3}" => key removed successfully

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{30CEEEA2-3742-40e4-85DD-812BF1CBB83D} => value removed successfully

"HKCR\Wow6432Node\CLSID\{30CEEEA2-3742-40e4-85DD-812BF1CBB83D}" => key removed successfully

"C:\Program Files (x86)\Norton Safe Web Lite" => File/Folder not found.

HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BA00B7B1-0351-477A-B948-23E3EE5A73D4} => value removed successfully

HKCR\CLSID\{BA00B7B1-0351-477A-B948-23E3EE5A73D4} => key not found. 

HKU\S-1-5-21-2180650751-2005149398-3877183700-1000\Software\Mozilla\Firefox\Extensions\\{e4f94d1e-2f53-401e-8885-681602c0ddd8} => value removed successfully

C:\ProgramData\McAfee Security Scan => moved successfully

C:\Users\Rajagopal Kumar\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom => moved successfully

C:\Users\Rajagopal Kumar\AppData\Roaming\agmas.msy => moved successfully

C:\Users\Rajagopal Kumar\AppData\Local\PUTTY.RND => moved successfully

 

==== End of Fixlog 15:08:34 ====

[emeraldnzl]

 

I followed the steps and ESET scanning did not find any threats to fix. I did the ESET scanning on normal mode and it ran for 3 hours. My machine did not freeze or crash in the middle of it.

 

Excellent news.

 

I think you are good to go now.

 

We have a couple of last steps to perform and then you're all set.

To clear away the tools we have been using download Delfix from here. You will be taken to the download page. Just wait and shortly the download will appear.

Put a check (tick) in the following boxes:
 

• Remove disinfection tools
• Purge System Restore
• Then click Run

The tool will run for a short time. When completed a notepad window will open with a log. Please copy and paste the log back here.

Any remaining tools may be deleted.

-------------------------------------------------------------------------------------------------------------------

A reminder:  Remember to (re-install if uninstalled during cleaning) update and turn back on any anti-malware programs you may have turned off during the cleaning process.
-------------------------------------------------------------------------------------------------------------------

Here are some things that I think are worth having a look at if you don't already know about them:

---------------------------------------------------------------------------------------------------------------------

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article Strong passwords: How to create and use them.

----------------------------------------------------------------------------------------------------------------------

So many of us use Facebook nowadays. Go here for a guide to Facebook security.

-----------------------------------------------------------------------------------------------------------------------

Java warning

Java is a popular point of entry to your computer for malicious programs. Unless you need it to run an important software the safest approach is to completely uninstall Java. Where you do require it, then the next safest option is to disable it in your browsers until you need it, then enable it.

How to disable Java in your web browser and How to unplug Java from the browser

If you do still need Java then regularly check that it is up to date. Older versions are the most vulnerable to malicious attack.
 

• Download Java for Windows
  
  Reboot your computer.
  You also need to unininstall older versions of Java.
  
     
• Click Start > Control Panel > Add or Remove Programs
     
• Remove all Java updates except the latest one you have just installed.

--------------------------------------------------------------------------------------------------------------------

CryptoLocker Warning

There is a particularly nasty infection out there at the moment.

Go here for information about CryptoLocker Ransomeware

Download CryptoPrevent free for home use.

--------------------------------------------------------------------------------------------------------------------

Hola users warning.

If you use the Hola VPN (Virtual Private Network) you should be aware that you might be compromised. See here.

--------------------------------------------------------------------------------------------------------------------

To help protect your computer in the future:



If you do not already have automatic updates set then it is recommended that you do set Windows to check, download and install your updates automatically.

    * Click Start > Control Panel > System and Security > Windows Update
    * Under Windows Update click on Turn automatic updating on or off
    * Check items shown to ensure you receive updates automatically. Click OK.

Be aware of what emails you open and websites you visit.

Go here for some good advice about how to prevent infection.

For some common sense advice about protecting your computer read How to boost your malware defense and protect your PC

A fun way to check your online safety literacy.

Quiz - getsafeonline

Have a safe and happy computing day!

 

[rajagopal]

Awesome. That's great to hear. I followed all the steps mentioned above in your post and pasted below the Delfix logs. I really appreciate you helping me to bring back my PC into normal state. Thank you very much ! ! ! ..    

 

----------------------------------------------------------------------------------------

 

Delfix logs

 

 

--------------------------------------------------------------------------------------------

 

# DelFix v1.011 - Logfile created 28/08/2015 at 00:24:28

# Updated 18/08/2015 by Xplode

# Username : Rajagopal Kumar - RAJAGOPALKUMAR

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

 

~ Removing disinfection tools ...

 

Deleted : C:\FRST

Deleted : C:\TDSSKiller_Quarantine

Deleted : C:\AdwCleaner

Deleted : C:\AdwCleaner[R1].txt

Deleted : C:\AdwCleaner[R2].txt

Deleted : C:\AdwCleaner[R3].txt

Deleted : C:\AdwCleaner[R4].txt

Deleted : C:\AdwCleaner[R5].txt

Deleted : C:\AdwCleaner[R6].txt

Deleted : C:\AdwCleaner[R7].txt

Deleted : C:\AdwCleaner[S1].txt

Deleted : C:\AdwCleaner[S2].txt

Deleted : C:\AdwCleaner[S3].txt

Deleted : C:\AdwCleaner[S4].txt

Deleted : C:\AdwCleaner[S5].txt

Deleted : C:\Users\Rajagopal Kumar\Desktop\Addition.txt

Deleted : C:\Users\Rajagopal Kumar\Desktop\adwcleaner.exe

Deleted : C:\Users\Rajagopal Kumar\Desktop\Fixlog.txt

Deleted : C:\Users\Rajagopal Kumar\Desktop\FRST.txt

Deleted : C:\Users\Rajagopal Kumar\Desktop\FRST64.exe

Deleted : C:\Users\Rajagopal Kumar\Desktop\FSS.exe

Deleted : C:\Users\Rajagopal Kumar\Desktop\FSS.txt

Deleted : C:\Users\Rajagopal Kumar\Desktop\JRT.txt

Deleted : C:\Users\Rajagopal Kumar\Downloads\avengers-ichthyander.mkv

Deleted : C:\Users\Rajagopal Kumar\Downloads\esetsmartinstaller_enu.exe

Deleted : C:\Users\Rajagopal Kumar\Downloads\JRT.exe

Deleted : C:\Users\Rajagopal Kumar\Downloads\Info & Instructions!.txt

Deleted : C:\Users\Rajagopal Kumar\Downloads\SecurityCheck.exe

Deleted : HKLM\SOFTWARE\AdwCleaner

Deleted : HKLM\SOFTWARE\Swearware

Deleted : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASWMBR

 

~ Cleaning system restore ...

 

Deleted : RP #532 [Scheduled Checkpoint | 08/25/2015 11:01:06]

Deleted : RP #533 [Windows Update | 08/25/2015 16:26:51]

 

New restore point created !

 

########## - EOF - ##########

[emeraldnzl]

The DelFix log is good.

 

 

Thank you very much ! ! !

 

You are very welcome.

 

I will keep this topic open for a day or two in case any issues arise.

[rajagopal]

Ok.