Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Proxy server unwanted resetteting

Started by Supermatt01 , Feb 01 2016 06:54 PM
Proxy virus unwanted registry

  • Please log in to reply

#16
Supermatt01
Posted 03 February 2016 - 09:26 AM

Supermatt01

    Member

  • Topic Starter
  • Member
  • PipPip
  • 45 posts

okay I will. And I just found something strange. After my reboot just now I saw my libraries open before I touched anything. And in my library I found something I didn't put in. It is a text file.

 

Published on Nov 26, 2014
Unable to uncheck 127.0.0.1:8800 Proxy Server Proxy Server?
127.0.0.1 Proxy Settings Keep Changing back?

127.0.0.1 Proxy Server removal guide:
Step1: Reboot your computer into Safe Mode.
Step2: Remove Proxy Server associated Registry Information.
What is Proxy Server?A proxy server acts as a relay between your home network and a website
or online service to which you are attempting to connect.The Proxy Server setting is in the registry.
If you are seeing a “The proxy server isn’t responding” when trying to load a web page
while using Internet Explorer, then you machine may be infected with a Proxy Server virus/trojan(PUM.Bad.Proxy).
In the recent days, we can see an increasing number of malicious viru/malware who will change the proxy settings
to 127.0.0.1:8888 or 127.0.0.1:8800.
If you are infected Proxy Server virus/malware, the setting for the Internet LAN cannot modify,
and you cannot access the internet.
It keeps ticking Proxy Server box in IE.

 

I didn't put it in, but It has a stamp from last year.


  • 0

Advertisements

#17
Supermatt01
Posted 03 February 2016 - 10:03 AM

Supermatt01

    Member

  • Topic Starter
  • Member
  • PipPip
  • 45 posts

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:27-01-2016
Ran by Supermatt (administrator) on SUPERMATT-PC (03-02-2016 15:56:32)
Running from C:\Users\Supermatt\Desktop
Loaded Profiles: Supermatt (Available Profiles: Supermatt)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.117.0\BBSvc.EXE
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Comodo) C:\Program Files (x86)\Comodo\Chromodo\chromodo_updater.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
(arvato digital services llc) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Microsoft©) C:\Windows\SysWOW64\router.exe
(AVG Technologies) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
(WordWeb Software) C:\Program Files (x86)\WordWeb\wweb32.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
() C:\Program Files (x86)\DFX\DFX.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(AVG Technologies) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
() C:\Program Files (x86)\DFX\Universal\Apps\DfxSharedApp32.exe
() C:\Program Files (x86)\DFX\Universal\Apps\DfxSharedApp64.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.5\GoogleCrashHandler64.exe
(Intel® Corporation) C:\Program Files\Intel\TurboBoost\TurboBoost.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office15\MSOSYNC.EXE
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2697512 2015-01-10] (Synaptics Incorporated)
HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1427648 2015-08-07] (COMODO)
HKLM-x32\...\Run: [DFX] => C:\Program Files (x86)\DFX\DFX.exe [1328632 2015-12-25] ()
HKLM-x32\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe [2622432 2016-02-02] (Malwarebytes Corporation)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41360 2016-02-01] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840592 2016-02-01] (Adobe Systems Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3797239318-1157007529-570800937-1000\...\Run: [WordWeb] => C:\Program Files (x86)\WordWeb\wweb32.exe [80000 2015-01-11] (WordWeb Software)
HKU\S-1-5-21-3797239318-1157007529-570800937-1000\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7935904 2016-02-02] (SUPERAntiSpyware)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2015-05-17]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
BootExecute: autocheck autochk /r \??\M:autocheck autochk *
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxySettingsPerUser] 0 <======= ATTENTION (Restriction - ProxySettings)
ProxyEnable: [HKLM] => Proxy is enabled.
ProxyEnable: [HKLM-x32] => Proxy is enabled.
ProxyServer: [HKLM] => http=127.0.0.1:8080;https=127.0.0.1:8080
ProxyServer: [HKLM-x32] => http=127.0.0.1:8080;https=127.0.0.1:8080
AutoConfigURL: [HKLM] => http=127.0.0.1:8080;https=127.0.0.1:8080
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 140.0.223.250 111.94.159.250 61.247.0.133
Tcpip\..\Interfaces\{4D667F57-0C7B-4433-8185-D6FCF6C28DC4}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{5B5D6538-1510-4743-914F-24A93E95F39B}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{5B5D6538-1510-4743-914F-24A93E95F39B}: [DhcpNameServer] 140.0.223.250 111.94.159.250 61.247.0.133
Tcpip\..\Interfaces\{768528CC-02BF-4D80-B033-FF7FA0EF7B96}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{E7FEDADC-9F33-43B5-A033-D31CF0FC7FBB}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKU\S-1-5-21-3797239318-1157007529-570800937-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3797239318-1157007529-570800937-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3797239318-1157007529-570800937-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.com/
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin64.dll [2015-06-17] (RealDownloader)
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2013-11-15] (Microsoft Corporation)
BHO: Dragon Web Extension For Internet Explorer -> {609C0837-8DD3-4F9B-AAC5-446F36BC0353} -> C:\Program Files (x86)\Nuance\NaturallySpeaking13\Program\x64\dgnriaie_x64.dll [2014-07-12] (Nuance Communications, Inc.)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_51\bin\ssv.dll [2015-07-15] (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2013-09-13] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2013-11-02] (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-07-15] (Oracle Corporation)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2015-06-17] (RealDownloader)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2013-11-15] (Microsoft Corporation)
BHO-x32: Dragon Web Extension For Internet Explorer -> {609C0837-8DD3-4F9B-AAC5-446F36BC0353} -> C:\Program Files (x86)\Nuance\NaturallySpeaking13\Program\dgnriaie.dll [2014-07-12] (Nuance Communications, Inc.)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\ssv.dll [2015-07-15] (Oracle Corporation)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-09-24] (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2013-09-13] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2013-11-02] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-07-15] (Oracle Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-09-24] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-09-24] (Adobe Systems Incorporated)
DPF: HKLM {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_207.dll [2015-10-14] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1217157.dll [2015-02-16] (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll [2015-07-15] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\plugin2\npjp2.dll [2015-07-15] (Oracle Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2016-02-02] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL [2013-12-10] (Nero AG)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll [2013-11-12] (Nitro PDF)
FF Plugin-x32: @real.com/nppl3260;version=18.0.1.9 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll [2015-07-02] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=18.0.1.9 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll [2015-07-02] (RealTimes)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll [2015-09-24] (Adobe Systems Inc.)
FF Plugin-x32: nuance.com/DgnRia2 -> C:\Program Files (x86)\Nuance\NaturallySpeaking13\Program\npDgnRia2.dll [2014-07-12] (Nuance Communications, Inc.)
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2016-02-01] [not signed]

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2016-02-02] (SUPERAntiSpyware.com)
S4 AdAppMgrSvc; C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe [597896 2014-09-04] (Autodesk Inc.)
R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2252504 2015-01-10] (Broadcom Corporation.)
R2 ChromodoUpdater; C:\Program Files (x86)\Comodo\Chromodo\chromodo_updater.exe [2055352 2015-12-18] (Comodo)
S4 CLHNServiceForPowerDVD12; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe [90640 2012-07-25] (CyberLink Corp.)
R2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [5542472 2015-09-10] (COMODO)
S3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2265792 2015-08-07] (COMODO)
S4 CyberLink PowerDVD 12 Media Server Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [78352 2012-07-25] (CyberLink)
S4 CyberLink PowerDVD 12 Media Server Service; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [295440 2012-07-25] (CyberLink)
S4 DragonLoggerService; C:\Program Files (x86)\Common Files\Nuance\loggerservice.exe [137280 2015-01-07] (Nuance Communications, Inc.)
S4 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1858048 2015-01-25] (MAGIX AG) [File not signed]
S4 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2702848 2015-01-25] (MAGIX®) [File not signed]
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [127752 2016-01-31] (SurfRight B.V.)
R2 MbaeSvc; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [740832 2016-02-02] (Malwarebytes Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1513784 2016-01-29] (Malwarebytes)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2016-01-29] (Malwarebytes)
R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-11-12] (Nitro PDF Software)
R2 PSI_SVC_2_x64; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [337776 2015-09-19] (arvato digital services llc)
S4 RealPlayerUpdateSvc; C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe [31856 2015-07-02] ()
S4 RealTimes Desktop Service; C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpdsvc.exe [1115224 2015-07-02] (RealNetworks, Inc.)
R2 router.exe; C:\Windows\SysWOW64\router.exe [16384 2014-08-20] (Microsoft©) [File not signed]
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [2970424 2015-07-20] (AVG Technologies)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-09-15] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 anvsnddrv; C:\Windows\System32\drivers\anvsnddrv.sys [33872 2011-11-28] (AnvSoft Inc.)
S3 aswTap; C:\Windows\System32\DRIVERS\aswTap.sys [44640 2015-10-16] (The OpenVPN Project)
S3 b06diag; C:\Windows\system32\drivers\bxdiaga.sys [88104 2012-03-08] (Broadcom Corporation)
S3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [170712 2015-01-10] (Broadcom Corporation.)
S3 BFN7x64; C:\Windows\system32\drivers\Xeno7x64.sys [157288 2012-02-22] (Bigfoot Networks, Inc.)
S3 BthMtpEnum; C:\Windows\System32\DRIVERS\BthMtpEnum.sys [64512 2009-07-14] (Microsoft Corporation)
S3 bxfcoe; C:\Windows\system32\drivers\bxfcoe.sys [178216 2012-02-22] (Broadcom Corporation)
S3 bxois; C:\Windows\system32\drivers\bxois.sys [539176 2012-02-22] (Broadcom Corporation)
S3 CisUtMonitor; C:\Windows\System32\DRIVERS\CisUtMonitor.sys [33360 2015-07-05] (CrystalIdea Software)
R1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [21184 2015-11-19] (COMODO)
R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [806032 2015-11-19] (COMODO)
R1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [45856 2015-08-05] (COMODO)
S3 DFX11_1; C:\Windows\System32\drivers\dfx11_1x64.sys [28008 2015-05-05] (Windows ® Win 7 DDK provider)
R3 DFX12; C:\Windows\System32\drivers\dfx12x64.sys [29688 2015-12-25] (Windows ® Win 7 DDK provider)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2014-02-18] (DT Soft Ltd)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3341904 2012-03-26] (Broadcom Corporation)
R1 ESProtectionDriver; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [66080 2016-02-02] ()
S3 EtronSTOR; C:\Windows\System32\Drivers\EtronSTOR.sys [32512 2012-07-25] (Etron Technology Inc)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2015-01-10] (Intel Corporation)
R1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [105096 2015-08-05] (COMODO)
R2 IntelHaxm; C:\Windows\System32\DRIVERS\IntelHaxm.sys [84992 2015-01-24] (Intel  Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2016-01-29] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-02-03] (Malwarebytes)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2016-01-29] (Malwarebytes Corporation)
R2 ntk_PowerDVD12; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [83704 2012-06-20] (Cyberlink Corp.)
S3 plkusbser; C:\Windows\System32\DRIVERS\plkusbser.sys [113664 2008-01-23] (QUALCOMM Incorporated)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19152 2013-09-30] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [12504 2013-09-30] ()
S3 qcusbser; C:\Windows\System32\DRIVERS\qcusbser.sys [361984 2012-05-02] (QUALCOMM Incorporated)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-13] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [33008 2015-01-10] (Synaptics Incorporated)
S3 tap0801; C:\Windows\System32\DRIVERS\tap0801.sys [30720 2005-04-14] (The OpenVPN Project) [File not signed]
S3 tapSF0901; C:\Windows\System32\DRIVERS\tapSF0901.sys [39104 2015-10-14] (Spotflux, Inc.)
S3 TosRfSnd; C:\Windows\System32\drivers\tosrfsnd.sys [63488 2015-05-17] (TOSHIBA Corporation) [File not signed]
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [24688 2016-02-01] ()
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys [31144 2015-06-25] (TuneUp Software)
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2015-01-29] ()
S2 WCMVCAM; C:\Windows\System32\DRIVERS\wcmvcam64.sys [1071032 2015-04-04] (Windows ® Win 7 DDK provider)
R2 {73526619-C24F-470B-9BED-53D455FBB5C6}; C:\Program Files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl [147704 2012-08-10] (CyberLink Corp.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-02-03 15:52 - 2016-02-03 15:52 - 00000000 ____D C:\Users\Supermatt\AppData\Local\GWX
2016-02-03 15:16 - 2016-02-03 15:51 - 00003758 _____ C:\Windows\System32\Tasks\AutoKMS
2016-02-03 15:00 - 2016-02-03 15:00 - 00005926 _____ C:\Users\Supermatt\Downloads\fixlist.txt
2016-02-02 16:39 - 2016-02-02 16:44 - 00138996 _____ C:\Users\Supermatt\Desktop\Addition.txt
2016-02-02 16:35 - 2016-02-03 15:56 - 00022676 _____ C:\Users\Supermatt\Desktop\FRST.txt
2016-02-02 16:28 - 2016-02-03 15:30 - 00000000 ___SD C:\Windows\system32\GWX
2016-02-02 16:28 - 2016-02-02 16:28 - 00000000 ___SD C:\Windows\system32\CompatTel
2016-02-02 16:28 - 2016-02-02 16:28 - 00000000 ____D C:\Windows\SysWOW64\GWX
2016-02-02 16:28 - 2016-02-02 16:28 - 00000000 ____D C:\Windows\system32\appraiser
2016-02-02 16:17 - 2016-02-03 15:00 - 00013062 _____ C:\Users\Supermatt\Desktop\Fixlog.txt
2016-02-02 15:33 - 2016-02-03 15:33 - 00000518 _____ C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task d50be755-5c1f-442b-8cc1-4a01fb4aac00.job
2016-02-02 15:33 - 2016-02-03 02:00 - 00000518 _____ C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 77381a73-6ce6-4d46-9a56-192c0cd86de3.job
2016-02-02 15:33 - 2016-02-02 15:33 - 00003608 _____ C:\Windows\System32\Tasks\SUPERAntiSpyware Scheduled Task 77381a73-6ce6-4d46-9a56-192c0cd86de3
2016-02-02 15:33 - 2016-02-02 15:33 - 00003534 _____ C:\Windows\System32\Tasks\SUPERAntiSpyware Scheduled Task d50be755-5c1f-442b-8cc1-4a01fb4aac00
2016-02-02 15:33 - 2016-02-02 15:33 - 00000000 ____D C:\Users\Supermatt\AppData\Roaming\SUPERAntiSpyware.com
2016-02-02 15:32 - 2016-02-02 15:33 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2016-02-02 15:32 - 2016-02-02 15:32 - 00001813 _____ C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk
2016-02-02 15:32 - 2016-02-02 15:32 - 00000000 ____D C:\ProgramData\SUPERAntiSpyware.com
2016-02-02 15:32 - 2016-02-02 15:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
2016-02-02 15:28 - 2016-02-02 15:28 - 24587696 _____ (SUPERAntiSpyware) C:\Users\Supermatt\Desktop\SUPERAntiSpywarePro.exe
2016-02-02 13:18 - 2016-02-02 13:18 - 00001082 _____ C:\Users\Supermatt\Desktop\JRT.txt
2016-02-02 12:42 - 2016-02-02 12:42 - 01508352 _____ C:\Users\Supermatt\Desktop\adwcleaner_5.032.exe
2016-02-02 11:18 - 2016-02-02 11:18 - 00000320 ____N C:\Windows\SysWOW64\win_hcleaner.ini
2016-02-01 23:29 - 2016-02-01 23:29 - 14176768 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2016-02-01 23:28 - 2016-02-01 23:28 - 12875776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2016-02-01 23:28 - 2016-02-01 23:28 - 01866752 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2016-02-01 23:28 - 2016-02-01 23:28 - 01498624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2016-02-01 22:45 - 2016-02-01 22:45 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2016-02-01 22:45 - 2016-02-01 22:45 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2016-02-01 22:45 - 2016-02-01 22:45 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2016-02-01 22:45 - 2016-02-01 22:45 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2016-02-01 22:45 - 2016-02-01 22:45 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2016-02-01 22:45 - 2016-02-01 22:45 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2016-02-01 22:44 - 2016-02-01 22:44 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\basesrv.dll
2016-02-01 22:43 - 2016-02-01 22:43 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2016-02-01 22:43 - 2016-02-01 22:43 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2016-02-01 22:43 - 2016-02-01 22:43 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2016-02-01 22:43 - 2016-02-01 22:43 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2016-02-01 22:43 - 2016-02-01 22:43 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2016-02-01 22:43 - 2016-02-01 22:43 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2016-02-01 22:43 - 2016-02-01 22:43 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2016-02-01 22:43 - 2016-02-01 22:43 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2016-02-01 22:43 - 2016-02-01 22:43 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2016-02-01 22:42 - 2016-02-01 22:42 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2016-02-01 22:42 - 2016-02-01 22:42 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2016-02-01 22:42 - 2016-02-01 22:42 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2016-02-01 22:42 - 2016-02-01 22:42 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2016-02-01 22:42 - 2016-02-01 22:42 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2016-02-01 22:42 - 2016-02-01 22:42 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2016-02-01 22:42 - 2016-02-01 22:42 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2016-02-01 22:42 - 2016-02-01 22:42 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2016-02-01 22:42 - 2016-02-01 22:42 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2016-02-01 22:42 - 2016-02-01 22:42 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2016-02-01 22:42 - 2016-02-01 22:42 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2016-02-01 22:42 - 2016-02-01 22:42 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2016-02-01 22:42 - 2016-02-01 22:42 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2016-02-01 22:42 - 2016-02-01 22:42 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2016-02-01 22:42 - 2016-02-01 22:42 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2016-02-01 22:42 - 2016-02-01 22:42 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2016-02-01 22:42 - 2016-02-01 22:42 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2016-02-01 22:42 - 2016-02-01 22:42 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2016-02-01 22:42 - 2016-02-01 22:42 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2016-02-01 22:42 - 2016-02-01 22:42 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2016-02-01 22:42 - 2016-02-01 22:42 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2016-02-01 22:42 - 2016-02-01 22:42 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2016-02-01 22:40 - 2016-02-01 22:40 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2016-02-01 22:40 - 2016-02-01 22:40 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2016-02-01 22:40 - 2016-02-01 22:40 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2016-02-01 22:40 - 2016-02-01 22:40 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2016-02-01 22:40 - 2016-02-01 22:40 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2016-02-01 22:40 - 2016-02-01 22:40 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2016-02-01 22:40 - 2016-02-01 22:40 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2016-02-01 22:40 - 2016-02-01 22:40 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2016-02-01 22:40 - 2016-02-01 22:40 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2016-02-01 22:40 - 2016-02-01 22:40 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2016-02-01 22:40 - 2016-02-01 22:40 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2016-02-01 22:40 - 2016-02-01 22:40 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2016-02-01 22:39 - 2016-02-01 22:39 - 02887168 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-02-01 22:39 - 2016-02-01 22:39 - 02280448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-02-01 22:39 - 2016-02-01 22:39 - 00718336 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-02-01 22:39 - 2016-02-01 22:39 - 00341192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-02-01 22:39 - 2016-02-01 22:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2016-02-01 22:39 - 2016-02-01 22:39 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2016-02-01 22:39 - 2016-02-01 22:39 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2016-02-01 22:39 - 2016-02-01 22:39 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2016-02-01 22:39 - 2016-02-01 22:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2016-02-01 22:39 - 2016-02-01 22:39 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2016-02-01 22:39 - 2016-02-01 22:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-02-01 22:39 - 2016-02-01 22:39 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 25837568 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 20367360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 14457856 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 12856320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 06051328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 04610560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 02487808 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 02123264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-02-01 22:38 - 2016-02-01 22:38 - 02050560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-02-01 22:38 - 2016-02-01 22:38 - 02011136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 01546752 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 01311744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2016-02-01 22:38 - 2016-02-01 22:38 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00687104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00387784 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-02-01 22:38 - 2016-02-01 22:38 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2016-02-01 22:38 - 2016-02-01 22:38 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2016-02-01 22:38 - 2016-02-01 22:38 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2016-02-01 22:38 - 2015-12-13 01:31 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-02-01 22:38 - 2015-12-13 01:15 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-02-01 22:38 - 2015-12-13 00:49 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2016-02-01 22:38 - 2015-12-13 00:36 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2016-02-01 22:37 - 2016-02-01 22:37 - 05572544 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-02-01 22:37 - 2016-02-01 22:37 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-02-01 22:37 - 2016-02-01 22:37 - 01461248 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-02-01 22:37 - 2016-02-01 22:37 - 01214464 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 03993536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2016-02-01 22:36 - 2016-02-01 22:36 - 03938240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2016-02-01 22:36 - 2016-02-01 22:36 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00460776 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2016-02-01 22:36 - 2016-02-01 22:36 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2016-02-01 22:36 - 2016-02-01 22:36 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00299632 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2016-02-01 22:36 - 2016-02-01 22:36 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-02-01 22:36 - 2016-02-01 22:36 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00251392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00251000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcryptprimitives.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-02-01 22:36 - 2016-02-01 22:36 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-02-01 22:36 - 2016-02-01 22:36 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-02-01 22:36 - 2016-02-01 22:36 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2016-02-01 22:36 - 2016-02-01 22:36 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-02-01 22:36 - 2016-02-01 22:36 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2016-02-01 22:36 - 2016-02-01 22:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2016-02-01 22:36 - 2016-02-01 22:36 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-02-01 22:36 - 2016-02-01 22:36 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2016-02-01 22:36 - 2016-02-01 22:36 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2016-02-01 22:36 - 2016-02-01 22:36 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2016-02-01 22:36 - 2016-02-01 22:36 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2016-02-01 22:35 - 2016-02-01 22:35 - 01390592 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2016-02-01 22:35 - 2016-02-01 22:35 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2016-02-01 22:35 - 2016-02-01 22:35 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2016-02-01 22:35 - 2016-02-01 22:35 - 00624640 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2016-02-01 22:35 - 2016-02-01 22:35 - 00509952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2016-02-01 22:35 - 2016-02-01 22:35 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2016-02-01 22:33 - 2016-02-01 22:33 - 01743360 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2016-02-01 22:33 - 2016-02-01 22:33 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2016-02-01 22:33 - 2016-02-01 22:33 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2016-02-01 22:32 - 2016-02-01 22:32 - 00692672 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2016-02-01 22:32 - 2016-02-01 22:32 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2016-02-01 22:32 - 2016-02-01 22:32 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2016-02-01 22:32 - 2016-02-01 22:32 - 00532176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2016-02-01 22:32 - 2016-02-01 22:32 - 00457400 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2016-02-01 22:32 - 2016-02-01 22:32 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2016-02-01 22:32 - 2016-02-01 22:32 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2016-02-01 22:32 - 2016-02-01 22:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2016-02-01 22:32 - 2016-02-01 22:32 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2016-02-01 22:32 - 2016-02-01 22:32 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2016-02-01 22:32 - 2016-02-01 22:32 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2016-02-01 22:32 - 2016-02-01 22:32 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2016-02-01 22:29 - 2016-02-01 22:29 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlsbres.dll
2016-02-01 22:29 - 2016-02-01 22:29 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\nlsbres.dll
2016-02-01 22:29 - 2016-02-01 22:29 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDAZE.DLL
2016-02-01 22:29 - 2016-02-01 22:29 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\kbdgeoqw.dll
2016-02-01 22:29 - 2016-02-01 22:29 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDAZEL.DLL
2016-02-01 22:29 - 2016-02-01 22:29 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDAZE.DLL
2016-02-01 22:29 - 2016-02-01 22:29 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kbdgeoqw.dll
2016-02-01 22:29 - 2016-02-01 22:29 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDAZEL.DLL
2016-02-01 22:29 - 2015-12-16 21:38 - 00419928 _____ C:\Windows\SysWOW64\locale.nls
2016-02-01 22:29 - 2015-12-16 21:37 - 00419928 _____ C:\Windows\system32\locale.nls
2016-02-01 22:28 - 2016-02-01 22:28 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2016-02-01 22:28 - 2016-02-01 22:28 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2016-02-01 22:26 - 2016-02-01 22:26 - 03242496 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2016-02-01 22:26 - 2016-02-01 22:26 - 02364416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2016-02-01 22:26 - 2016-02-01 22:26 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2016-02-01 22:26 - 2016-02-01 22:26 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2016-02-01 22:26 - 2016-02-01 22:26 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2016-02-01 22:26 - 2016-02-01 22:26 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2016-02-01 22:26 - 2016-02-01 22:26 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2016-02-01 22:26 - 2016-02-01 22:26 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2016-02-01 22:26 - 2016-02-01 22:26 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2016-02-01 22:26 - 2016-02-01 22:26 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2016-02-01 22:25 - 2016-02-01 22:25 - 00950720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2016-02-01 22:23 - 2016-02-01 22:23 - 07077376 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2016-02-01 22:23 - 2016-02-01 22:23 - 06131200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2016-02-01 22:23 - 2016-02-01 22:23 - 01110016 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2016-02-01 22:23 - 2016-02-01 22:23 - 01057792 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2016-02-01 22:23 - 2016-02-01 22:23 - 00856064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2016-02-01 22:23 - 2016-02-01 22:23 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2016-02-01 22:23 - 2016-02-01 22:23 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2016-02-01 22:23 - 2016-02-01 22:23 - 00254976 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll
2016-02-01 22:23 - 2016-02-01 22:23 - 00210432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cewmdm.dll
2016-02-01 22:23 - 2016-02-01 22:23 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2016-02-01 22:23 - 2016-02-01 22:23 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2016-02-01 22:22 - 2016-02-01 22:22 - 14635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2016-02-01 22:22 - 2016-02-01 22:22 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2016-02-01 22:22 - 2016-02-01 22:22 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2016-02-01 22:22 - 2016-02-01 22:22 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2016-02-01 22:22 - 2016-02-01 22:22 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2016-02-01 22:22 - 2016-02-01 22:22 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2016-02-01 22:22 - 2016-02-01 22:22 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2016-02-01 22:22 - 2016-02-01 22:22 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2016-02-01 22:22 - 2016-02-01 22:22 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2016-02-01 22:22 - 2016-02-01 22:22 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2016-02-01 22:12 - 2016-02-01 22:12 - 03170304 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2016-02-01 22:12 - 2016-02-01 22:12 - 02609152 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2016-02-01 22:12 - 2016-02-01 22:12 - 00802304 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2016-02-01 22:12 - 2016-02-01 22:12 - 00709632 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2016-02-01 22:12 - 2016-02-01 22:12 - 00627712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2016-02-01 22:12 - 2016-02-01 22:12 - 00573440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2016-02-01 22:12 - 2016-02-01 22:12 - 00192512 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2016-02-01 22:12 - 2016-02-01 22:12 - 00174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2016-02-01 22:12 - 2016-02-01 22:12 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2016-02-01 22:12 - 2016-02-01 22:12 - 00098816 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2016-02-01 22:12 - 2016-02-01 22:12 - 00093696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2016-02-01 22:12 - 2016-02-01 22:12 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2016-02-01 22:12 - 2016-02-01 22:12 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2016-02-01 22:12 - 2016-02-01 22:12 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2016-02-01 22:12 - 2016-02-01 22:12 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2016-02-01 22:12 - 2016-02-01 22:12 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2016-02-01 22:12 - 2016-02-01 22:12 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2016-02-01 22:12 - 2016-02-01 22:12 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2016-02-01 22:11 - 2016-02-01 22:11 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2016-02-01 22:11 - 2016-02-01 22:11 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2016-02-01 22:11 - 2016-02-01 22:11 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2016-02-01 22:11 - 2016-02-01 22:11 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2016-02-01 22:11 - 2016-02-01 22:11 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2016-02-01 22:11 - 2016-02-01 22:11 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2016-02-01 22:11 - 2016-02-01 22:11 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2016-02-01 22:09 - 2016-02-01 22:09 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2016-02-01 22:09 - 2016-02-01 22:09 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2016-02-01 22:02 - 2016-02-01 22:02 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2016-02-01 22:02 - 2016-02-01 22:02 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2016-02-01 22:02 - 2016-02-01 22:02 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2016-02-01 22:02 - 2016-02-01 22:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2016-02-01 22:02 - 2016-02-01 22:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2016-02-01 22:02 - 2016-02-01 22:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2016-02-01 22:02 - 2016-02-01 22:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2016-02-01 22:02 - 2016-02-01 22:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2016-02-01 22:02 - 2016-02-01 22:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2016-02-01 22:02 - 2016-02-01 22:02 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2016-02-01 22:02 - 2016-02-01 22:02 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2016-02-01 22:02 - 2016-02-01 22:02 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2016-02-01 22:02 - 2016-02-01 22:02 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2016-02-01 22:01 - 2016-02-01 22:01 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2016-02-01 22:01 - 2016-02-01 22:01 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2016-02-01 22:01 - 2016-02-01 22:01 - 01648128 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2016-02-01 22:01 - 2016-02-01 22:01 - 01251328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2016-02-01 22:01 - 2016-02-01 22:01 - 01180160 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2016-02-01 22:01 - 2016-02-01 22:01 - 01008640 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2016-02-01 22:01 - 2016-02-01 22:01 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2016-02-01 22:01 - 2016-02-01 22:01 - 00260096 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2016-02-01 22:01 - 2016-02-01 22:01 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2016-02-01 22:01 - 2016-02-01 22:01 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2016-02-01 22:01 - 2016-02-01 22:01 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2016-02-01 22:00 - 2016-02-01 22:00 - 02087424 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2016-02-01 22:00 - 2016-02-01 22:00 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2016-02-01 22:00 - 2016-02-01 22:00 - 01414656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2016-02-01 22:00 - 2016-02-01 22:00 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2016-02-01 22:00 - 2016-02-01 22:00 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2016-02-01 22:00 - 2016-02-01 22:00 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2016-02-01 22:00 - 2016-02-01 22:00 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2016-02-01 22:00 - 2016-02-01 22:00 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2016-02-01 22:00 - 2016-02-01 22:00 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2016-02-01 22:00 - 2016-02-01 22:00 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2016-02-01 21:59 - 2016-02-01 21:59 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rmcast.sys
2016-02-01 21:59 - 2016-02-01 21:59 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\wshrm.dll
2016-02-01 21:59 - 2016-02-01 21:59 - 00014848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshrm.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 01735680 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 01242624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comsvcs.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 01112576 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00984448 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00901264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00525312 _____ (Microsoft Corporation) C:\Windows\system32\catsrvut.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2016-02-01 21:57 - 2016-02-01 21:57 - 00487936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\catsrvut.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\notepad.exe
2016-02-01 21:57 - 2016-02-01 21:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\notepad.exe
2016-02-01 21:57 - 2016-02-01 21:57 - 00179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
2016-02-01 21:57 - 2016-02-01 21:57 - 00162816 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2016-02-01 21:57 - 2016-02-01 21:57 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00066400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00063840 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2016-02-01 21:57 - 2016-02-01 21:57 - 00022368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2016-02-01 21:57 - 2016-02-01 21:57 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2016-02-01 21:57 - 2016-02-01 21:57 - 00020832 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00019808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00019808 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00016224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00016224 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00015712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00015712 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00013664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-eventing-provider-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-eventing-provider-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2016-02-01 21:57 - 2016-02-01 21:57 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 01955328 _____ (Microsoft Corporation) C:\Windows\system32\WMVENCOD.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 01575424 _____ (Microsoft Corporation) C:\Windows\system32\WMSPDMOE.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 01573888 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 01568768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVENCOD.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 01325056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMSPDMOE.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 01307136 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2adec.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 01232896 _____ (Microsoft Corporation) C:\Windows\system32\WMADMOD.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 01160192 _____ (Microsoft Corporation) C:\Windows\system32\MSMPEG2ENC.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 01153024 _____ (Microsoft Corporation) C:\Windows\system32\WMADMOE.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 01026048 _____ (Microsoft Corporation) C:\Windows\system32\wmpmde.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 01010688 _____ (Microsoft Corporation) C:\Windows\system32\mcmde.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 00978944 _____ (Microsoft Corporation) C:\Windows\system32\WMSPDMOD.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00970240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2adec.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 00902144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMADMOD.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00829952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSMPEG2ENC.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00815616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMADMOE.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00740352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpmde.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 00739328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMSPDMOD.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00666112 _____ (Microsoft Corporation) C:\Windows\system32\WMVSDECD.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVXENCD.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00653824 _____ (Microsoft Corporation) C:\Windows\system32\MP4SDECD.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00642048 _____ (Microsoft Corporation) C:\Windows\system32\WMVXENCD.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00632320 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 00609280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFWMAAEC.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00541184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVSDECD.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\MFWMAAEC.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00447488 _____ (Microsoft Corporation) C:\Windows\system32\WMVSENCD.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 00415744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MP4SDECD.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00378880 _____ (Microsoft Corporation) C:\Windows\system32\SysFxUI.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 00358400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVSENCD.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 00292352 _____ (Microsoft Corporation) C:\Windows\system32\VIDRESZR.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00254464 _____ (Microsoft Corporation) C:\Windows\system32\qasf.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 00250880 _____ (Microsoft Corporation) C:\Windows\system32\ksproxy.ax
2016-02-01 21:54 - 2016-02-01 21:54 - 00241152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MPG4DECD.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00241152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MP43DECD.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2016-02-01 21:54 - 2016-02-01 21:54 - 00225792 _____ (Microsoft Corporation) C:\Windows\system32\RESAMPLEDMO.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00224768 _____ (Microsoft Corporation) C:\Windows\system32\MPG4DECD.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00223744 _____ (Microsoft Corporation) C:\Windows\system32\MP43DECD.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RESAMPLEDMO.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qasf.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ksproxy.ax
2016-02-01 21:54 - 2016-02-01 21:54 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\COLORCNV.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00154112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VIDRESZR.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00153600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\COLORCNV.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2016-02-01 21:54 - 2016-02-01 21:54 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2016-02-01 21:54 - 2016-02-01 21:54 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2016-02-01 21:54 - 2016-02-01 21:54 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\MP3DMOD.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00079872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MP3DMOD.DLL
2016-02-01 21:54 - 2016-02-01 21:54 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\devenum.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\mfvdsp.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\devenum.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2016-02-01 21:54 - 2016-02-01 21:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfvdsp.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2016-02-01 21:54 - 2016-02-01 21:54 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2016-02-01 21:54 - 2016-02-01 21:54 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2016-02-01 21:54 - 2016-02-01 21:54 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmkaud.sys
2016-02-01 21:54 - 2016-02-01 21:54 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\ksuser.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 00004608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ksuser.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2016-02-01 21:54 - 2016-02-01 21:54 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2016-02-01 21:53 - 2016-02-01 21:53 - 03211264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-02-01 21:53 - 2016-02-01 21:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2016-02-01 21:53 - 2016-02-01 21:53 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2016-02-01 21:53 - 2016-02-01 21:53 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2016-02-01 21:52 - 2016-02-01 21:52 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2016-02-01 21:52 - 2016-02-01 21:52 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2016-02-01 21:51 - 2016-02-01 21:51 - 02004480 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2016-02-01 21:51 - 2016-02-01 21:51 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2016-02-01 21:51 - 2016-02-01 21:51 - 01391104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2016-02-01 21:51 - 2016-02-01 21:51 - 01241088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2016-02-01 21:51 - 2016-02-01 21:51 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2016-02-01 21:51 - 2016-02-01 21:51 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2016-02-01 21:51 - 2016-02-01 21:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2016-02-01 21:51 - 2016-02-01 21:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2016-02-01 21:51 - 2016-02-01 21:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2016-02-01 21:51 - 2016-02-01 21:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2016-02-01 21:51 - 2015-02-25 10:18 - 00754688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2016-02-01 21:45 - 2016-02-01 21:45 - 01381376 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-02-01 21:45 - 2016-02-01 21:45 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2016-02-01 21:45 - 2016-02-01 21:45 - 01164800 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2016-02-01 21:45 - 2016-02-01 21:45 - 00792064 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2016-02-01 21:45 - 2016-02-01 21:45 - 00705536 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2016-02-01 21:45 - 2016-02-01 21:45 - 00505856 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2016-02-01 21:45 - 2016-02-01 21:45 - 00367552 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2016-02-01 21:45 - 2016-02-01 21:45 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2016-02-01 21:45 - 2016-02-01 21:45 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2016-02-01 21:45 - 2016-02-01 21:45 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2016-02-01 21:45 - 2016-02-01 21:45 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2016-02-01 21:45 - 2016-02-01 21:45 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-02-01 21:45 - 2016-02-01 21:45 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2016-02-01 21:45 - 2016-02-01 21:45 - 00025024 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2016-02-01 21:45 - 2016-02-01 21:45 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2016-02-01 21:42 - 2016-02-01 21:42 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-02-01 21:42 - 2016-02-01 21:42 - 00312320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2016-02-01 21:41 - 2016-02-01 21:41 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2016-02-01 21:41 - 2016-02-01 21:41 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2016-02-01 21:41 - 2016-02-01 21:41 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2016-02-01 21:41 - 2016-02-01 21:41 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2016-02-01 21:40 - 2016-02-01 19:53 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2016-02-01 21:40 - 2016-02-01 19:53 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2016-02-01 21:38 - 2016-02-01 19:53 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2016-02-01 21:37 - 2016-02-01 21:37 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2016-02-01 21:37 - 2016-02-01 21:37 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2016-02-01 21:37 - 2016-02-01 21:37 - 00115136 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2016-02-01 21:37 - 2016-02-01 21:37 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2016-02-01 21:36 - 2016-02-01 21:36 - 00241664 _____ (Microsoft Corporation) C:\Windows\system32\els.dll
2016-02-01 21:36 - 2016-02-01 21:36 - 00179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\els.dll
2016-02-01 21:36 - 2016-02-01 21:36 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\mapistub.dll
2016-02-01 21:36 - 2016-02-01 21:36 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\mapi32.dll
2016-02-01 21:36 - 2016-02-01 21:36 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mapistub.dll
2016-02-01 21:36 - 2016-02-01 21:36 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mapi32.dll
2016-02-01 21:36 - 2016-02-01 21:36 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\fixmapi.exe
2016-02-01 21:36 - 2016-02-01 21:36 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fixmapi.exe
2016-02-01 21:33 - 2016-02-02 07:25 - 00000000 ____D C:\ProgramData\RogueKiller
2016-02-01 21:33 - 2016-02-01 21:33 - 00024688 _____ C:\Windows\system32\Drivers\TrueSight.sys
2016-02-01 21:31 - 2016-02-01 21:31 - 20943432 _____ C:\Users\Supermatt\Desktop\RogueKiller.exe
2016-02-01 19:53 - 2016-02-01 19:53 - 01632256 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2016-02-01 19:53 - 2016-02-01 19:53 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2016-02-01 19:53 - 2016-02-01 19:53 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2016-02-01 19:53 - 2016-02-01 19:53 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2016-02-01 19:32 - 2016-02-01 19:32 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2016-02-01 19:32 - 2016-02-01 19:32 - 00372736 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2016-02-01 19:32 - 2016-02-01 19:32 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2016-02-01 19:32 - 2016-02-01 19:32 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2016-02-01 19:32 - 2016-02-01 19:32 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2016-02-01 19:32 - 2016-02-01 19:32 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2016-02-01 19:32 - 2016-02-01 19:32 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2016-02-01 19:32 - 2016-02-01 19:32 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2016-02-01 19:32 - 2016-02-01 19:32 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2016-02-01 19:32 - 2016-02-01 19:32 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2016-02-01 19:32 - 2016-02-01 19:32 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2016-02-01 19:32 - 2015-02-04 10:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2016-02-01 18:09 - 2016-02-01 18:40 - 00051210 ____N C:\Users\Supermatt\Desktop\MTB.txt
2016-02-01 16:57 - 2016-02-01 17:03 - 00000000 ____D C:\Users\Supermatt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth Devices
2016-01-31 16:46 - 2016-02-02 16:04 - 00000000 ____D C:\ProgramData\Malwarebytes Anti-Exploit
2016-01-31 16:46 - 2016-02-02 11:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Exploit
2016-01-31 16:46 - 2016-02-02 11:24 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Exploit
2016-01-31 16:45 - 2016-01-31 17:57 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2016-01-31 16:45 - 2016-01-31 16:45 - 01846024 ____N (Malwarebytes ) C:\Users\Supermatt\Downloads\mbae-setup-1.08.1.1045.exe
2016-01-31 16:27 - 2016-01-31 17:57 - 00000000 ____D C:\Users\Supermatt\Desktop\mbar
2016-01-31 16:14 - 2016-01-31 16:15 - 00001486 ____N C:\Users\Supermatt\Desktop\FixExec.txt
2016-01-31 15:56 - 2016-01-31 15:57 - 01609032 _____ (Malwarebytes) C:\Users\Supermatt\Desktop\JRT.exe
2016-01-31 15:36 - 2016-01-31 15:36 - 00082312 ____N C:\Users\Supermatt\Desktop\bookmarks_1_31_16.html
2016-01-31 08:37 - 2016-02-03 15:56 - 00000000 ____D C:\FRST
2016-01-31 08:37 - 2016-01-31 08:37 - 02370560 _____ (Farbar) C:\Users\Supermatt\Desktop\FRST64.exe
2016-01-31 08:31 - 2016-01-31 08:31 - 00891392 _____ (Farbar) C:\Users\Supermatt\Desktop\MiniToolBox.exe
2016-01-31 04:01 - 2016-01-31 04:01 - 00016334 _____ C:\Windows\system32\.crusader
2016-01-31 03:40 - 2016-01-31 03:40 - 00001898 ____N C:\Users\Public\Desktop\HitmanPro.lnk
2016-01-31 03:40 - 2016-01-31 03:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2016-01-31 03:35 - 2016-01-31 03:40 - 00000000 ____D C:\Program Files\HitmanPro
2016-01-31 03:23 - 2016-01-31 04:22 - 00000000 ____D C:\ProgramData\HitmanPro
2016-01-31 03:20 - 2016-01-31 03:23 - 09741664 ____N (SurfRight B.V.) C:\Users\Supermatt\Downloads\HitmanPro35_x64.exe
2016-01-31 03:10 - 2016-01-31 03:10 - 00035436 ____N C:\ComboFix.txt
2016-01-30 14:29 - 2011-06-26 13:45 - 00256000 ____N C:\Windows\PEV.exe
2016-01-30 14:29 - 2010-11-08 00:20 - 00208896 ____N C:\Windows\MBR.exe
2016-01-30 14:29 - 2009-04-20 11:56 - 00060416 ____N (NirSoft) C:\Windows\NIRCMD.exe
2016-01-30 14:29 - 2000-08-31 07:00 - 00518144 ____N (SteelWerX) C:\Windows\SWREG.exe
2016-01-30 14:29 - 2000-08-31 07:00 - 00406528 ____N (SteelWerX) C:\Windows\SWSC.exe
2016-01-30 14:29 - 2000-08-31 07:00 - 00098816 ____N C:\Windows\sed.exe
2016-01-30 14:29 - 2000-08-31 07:00 - 00080412 ____N C:\Windows\grep.exe
2016-01-30 14:29 - 2000-08-31 07:00 - 00068096 ____N C:\Windows\zip.exe
2016-01-30 14:25 - 2016-01-31 03:10 - 00000000 ____D C:\Qoobox
2016-01-30 11:41 - 2016-01-30 15:04 - 00000000 ____D C:\Windows\erdnt
2016-01-30 11:37 - 2016-01-30 11:37 - 01507840 ____N C:\Users\Supermatt\Downloads\AdwCleaner.exe
2016-01-29 12:37 - 2016-01-30 15:58 - 00000000 ____D C:\AdwCleaner
2016-01-29 12:26 - 2016-01-29 12:26 - 00000000 ____D C:\Program Files (x86)\ESET
2016-01-29 12:01 - 2016-02-03 15:51 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-01-29 11:59 - 2016-01-31 16:28 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-01-29 11:59 - 2016-01-29 13:26 - 00001107 ____N C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-01-29 11:59 - 2016-01-29 11:59 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-01-29 11:59 - 2016-01-29 11:59 - 00025816 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-01-29 11:59 - 2016-01-29 11:59 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-01-29 11:59 - 2016-01-29 11:59 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-01-26 22:59 - 2016-02-03 15:54 - 00005002 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Supermatt-PC-Supermatt Supermatt-PC
2016-01-25 10:00 - 2016-01-25 10:02 - 00000000 ____D C:\Users\Supermatt\AppData\OICE_15_974FA576_32C1D314_3103
2016-01-22 09:27 - 2016-01-22 09:27 - 00118018 ____N C:\Users\Supermatt\Downloads\CC statement template konvensional_20160118_0055794802.pdf
2016-01-22 09:26 - 2016-01-22 09:26 - 00052365 ____N C:\Users\Supermatt\Downloads\eStatement_01192016 (1).pdf
2016-01-22 09:25 - 2016-01-22 09:25 - 00051794 ____N C:\Users\Supermatt\Downloads\eStatement_01192016.pdf
2016-01-22 09:09 - 2016-01-22 09:09 - 00099547 ____N C:\Users\Supermatt\Downloads\461785816034XXXX.pdf
2016-01-22 09:06 - 2016-01-22 09:06 - 00137129 ____N C:\Users\Supermatt\Downloads\20160113.pdf
2016-01-22 09:04 - 2016-01-22 09:04 - 00036234 ____N C:\Users\Supermatt\Downloads\7010296916010026635.pdf
2016-01-22 09:02 - 2016-01-22 09:02 - 00035635 ____N C:\Users\Supermatt\Downloads\3650559416010026653.pdf
2016-01-22 09:00 - 2016-01-22 09:00 - 00231295 ____N C:\Users\Supermatt\Downloads\544741804332XXXX (1).pdf
2016-01-22 08:58 - 2016-01-22 08:58 - 00231295 ____N C:\Users\Supermatt\Downloads\544741804332XXXX.pdf
2016-01-22 08:56 - 2016-01-22 08:56 - 00135964 ____N C:\Users\Supermatt\Downloads\20160105.pdf
2016-01-22 08:49 - 2016-01-22 08:49 - 00140974 ____N C:\Users\Supermatt\Downloads\20160104.pdf
2016-01-22 08:49 - 2016-01-22 08:49 - 00140974 ____N C:\Users\Supermatt\Downloads\20160104 (1).pdf

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-02-03 15:53 - 2014-01-08 23:27 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-02-03 15:51 - 2015-01-24 07:08 - 00000091 _____ C:\HaxLogs.txt
2016-02-03 15:51 - 2015-01-03 00:36 - 00000575 _____ C:\Windows\SysWOW64\router.xml
2016-02-03 15:51 - 2014-01-12 19:27 - 00000439 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2016-02-03 15:51 - 2014-01-08 23:27 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-02-03 15:51 - 2009-07-14 12:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-02-03 15:36 - 2009-07-14 11:45 - 00026576 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-02-03 15:36 - 2009-07-14 11:45 - 00026576 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-02-03 15:20 - 2009-07-14 12:13 - 00918384 _____ C:\Windows\system32\PerfStringBackup.INI
2016-02-03 15:20 - 2009-07-14 10:20 - 00000000 ____D C:\Windows\inf
2016-02-03 15:03 - 2014-06-18 01:16 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-02-03 03:43 - 2009-07-14 10:20 - 00000000 ____D C:\Windows\AppCompat
2016-02-02 17:22 - 2009-07-14 10:20 - 00000000 ____D C:\Windows\rescache
2016-02-02 16:29 - 2009-07-14 10:20 - 00000000 ____D C:\Windows\tracing
2016-02-02 16:29 - 2009-07-14 10:20 - 00000000 ____D C:\Windows\SysWOW64\Dism
2016-02-02 16:29 - 2009-07-14 10:20 - 00000000 ____D C:\Windows\system32\Dism
2016-02-02 16:29 - 2009-07-14 10:20 - 00000000 ____D C:\Windows\system32\AdvancedInstallers
2016-02-02 16:29 - 2009-07-14 10:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2016-02-02 16:28 - 2011-04-12 15:28 - 00000000 ____D C:\Program Files\Windows Journal
2016-02-02 16:18 - 2014-02-14 14:30 - 00000000 ____D C:\Users\Supermatt\AppData\Roaming\DMCache
2016-02-02 16:17 - 2015-10-22 10:00 - 00000000 ____D C:\Users\Supermatt\AppData\LocalLow\Temp
2016-02-02 16:17 - 2015-05-02 23:31 - 00000000 ____D C:\Users\Supermatt\AppData\Roaming\IDM
2016-02-02 16:17 - 2015-05-02 23:31 - 00000000 ____D C:\Program Files (x86)\Internet Download Manager
2016-02-02 16:17 - 2014-01-10 22:23 - 00000000 ____D C:\Users\Supermatt\AppData\Roaming\tixati
2016-02-02 14:48 - 2014-01-08 23:27 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-02-02 14:48 - 2014-01-08 23:27 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-02-02 12:11 - 2015-04-16 00:59 - 01474832 _____ C:\Windows\system32\Drivers\sfi.dat
2016-02-02 11:07 - 2015-02-01 11:03 - 00000000 ____D C:\Users\Supermatt\AppData\Local\EmieUserList
2016-02-02 11:07 - 2015-02-01 11:03 - 00000000 ____D C:\Users\Supermatt\AppData\Local\EmieSiteList
2016-02-02 11:07 - 2015-02-01 11:03 - 00000000 ____D C:\Users\Supermatt\AppData\Local\EmieBrowserModeList
2016-02-02 11:02 - 2015-03-01 16:25 - 00000000 ____D C:\Users\Supermatt\AppData\LocalLow\EmieUserList
2016-02-02 11:02 - 2015-03-01 16:25 - 00000000 ____D C:\Users\Supermatt\AppData\LocalLow\EmieSiteList
2016-02-02 11:02 - 2015-03-01 16:25 - 00000000 ____D C:\Users\Supermatt\AppData\LocalLow\EmieBrowserModeList
2016-02-02 09:45 - 2014-01-10 22:13 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2016-02-02 09:45 - 2014-01-10 22:13 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2016-02-02 09:45 - 2009-07-14 11:45 - 05296216 _____ C:\Windows\system32\FNTCACHE.DAT
2016-02-02 06:32 - 2015-03-02 11:03 - 00000000 ____D C:\Windows\AF54923662584AC6A0435B5B89C6EB61.TMP
2016-02-02 01:09 - 2014-01-10 22:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2016-02-02 00:45 - 2014-01-08 21:56 - 00000000 ____D C:\Windows\system32\MRT
2016-02-02 00:36 - 2014-01-08 21:56 - 143671360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-02-01 23:59 - 2014-01-08 22:06 - 00910998 ____N C:\Windows\SysWOW64\PerfStringBackup.INI
2016-02-01 21:54 - 2009-07-14 07:22 - 01393152 _____ (Microsoft Corporation) C:\Windows\system32\WMALFXGFXDSP.dll
2016-02-01 17:40 - 2015-08-17 21:49 - 01487528 ____N C:\Windows\ntbtlog.txt
2016-02-01 17:20 - 2014-01-08 23:28 - 00000000 ____D C:\Program Files\Google
2016-02-01 17:20 - 2014-01-08 23:27 - 00000000 ____D C:\Program Files (x86)\Google
2016-02-01 17:13 - 2014-08-18 22:23 - 00000000 ____D C:\Users\Supermatt\AppData\Roaming\Opera Software
2016-02-01 17:13 - 2014-08-18 22:23 - 00000000 ____D C:\Users\Supermatt\AppData\Local\Opera Software
2016-02-01 17:06 - 2014-01-08 23:27 - 00000000 ____D C:\Users\Supermatt\AppData\Local\Google
2016-02-01 17:02 - 2014-01-10 18:05 - 00000000 ____D C:\Users\Supermatt\AppData\Local\ElevatedDiagnostics
2016-02-01 16:56 - 2014-01-25 09:09 - 00000000 ____D C:\Users\Supermatt\Desktop\shortcuts
2016-02-01 16:35 - 2015-08-13 20:56 - 00002465 ____N C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller X.lnk
2016-02-01 16:35 - 2015-08-13 20:56 - 00002453 ____N C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat X Pro.lnk
2016-02-01 16:35 - 2015-08-13 20:56 - 00002031 ____N C:\Users\Public\Desktop\Adobe Acrobat X Pro.lnk
2016-02-01 16:35 - 2014-12-04 06:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle ES2
2016-01-31 16:36 - 2009-07-14 10:20 - 00000000 ____D C:\Windows\system32\NDF
2016-01-31 15:38 - 2015-04-27 20:51 - 07367446 _____ C:\Windows\system32\Drivers\fvstore.dat
2016-01-31 12:33 - 2014-12-01 02:02 - 00000000 ____D C:\Program Files (x86)\Comodo
2016-01-31 08:32 - 2014-01-25 09:09 - 00000000 ____D C:\Program Files (x86)\e-Sword
2016-01-31 04:01 - 2015-07-15 12:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico
2016-01-31 04:01 - 2015-07-15 12:11 - 00000000 ____D C:\Program Files\KMSpico
2016-01-31 03:07 - 2009-07-14 09:34 - 00000215 ____N C:\Windows\system.ini
2016-01-30 16:44 - 2015-11-14 21:50 - 00000000 ____D C:\Windows\pss
2016-01-30 15:58 - 2014-11-12 17:50 - 00000000 ____D C:\Users\Supermatt\AppData\Roaming\Yahoo!
2016-01-30 15:58 - 2014-11-12 17:50 - 00000000 ____D C:\Users\Supermatt\AppData\LocalLow\Yahoo!
2016-01-30 15:39 - 2015-12-19 19:52 - 00000000 ____D C:\Program Files (x86)\iZotope
2016-01-30 14:50 - 2014-11-12 17:50 - 00000000 ____D C:\ProgramData\Yahoo!
2016-01-30 14:50 - 2014-11-12 17:46 - 00000000 ____D C:\Program Files (x86)\Yahoo!
2016-01-30 11:58 - 2014-01-08 20:52 - 00000000 ____D C:\Users\Supermatt\AppData\Local\VirtualStore
2016-01-29 14:46 - 2015-12-25 15:28 - 00001882 ____N C:\Users\Public\Desktop\DFX.lnk
2016-01-29 14:46 - 2015-09-19 00:11 - 00003045 ____N C:\Users\Public\Desktop\Corel PHOTO-PAINT X7 (64-Bit).lnk
2016-01-29 14:46 - 2015-09-19 00:11 - 00003042 ____N C:\Users\Public\Desktop\Corel CAPTURE X7 (64-Bit).lnk
2016-01-29 14:46 - 2015-09-19 00:11 - 00002997 ____N C:\Users\Public\Desktop\CorelDRAW X7 (64-Bit).lnk
2016-01-29 14:46 - 2015-09-19 00:11 - 00002510 ____N C:\Users\Public\Desktop\Bitstream Font Navigator (64-Bit).lnk
2016-01-29 14:46 - 2015-09-19 00:11 - 00002330 ____N C:\Users\Public\Desktop\Corel CONNECT X7 (64-Bit).lnk
2016-01-29 14:46 - 2015-09-14 17:03 - 00001826 ____N C:\Users\Public\Desktop\Intel GPA Platform Analyzer 2013 R3.lnk
2016-01-29 14:46 - 2015-09-14 17:03 - 00001812 ____N C:\Users\Public\Desktop\Intel GPA System Analyzer 2013 R3.lnk
2016-01-29 14:46 - 2015-09-14 17:03 - 00001806 ____N C:\Users\Public\Desktop\Intel GPA Frame Analyzer 2013 R3.lnk
2016-01-29 14:46 - 2015-09-14 17:03 - 00001792 ____N C:\Users\Public\Desktop\Intel GPA Monitor 2013 R3.lnk
2016-01-29 14:46 - 2015-09-12 22:05 - 00000935 ____N C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2016-01-29 14:46 - 2015-07-20 17:01 - 00001311 ____N C:\Users\Public\Desktop\Anime Studio Pro (x86).lnk
2016-01-29 14:46 - 2015-07-20 17:01 - 00001150 ____N C:\Users\Public\Desktop\Anime Studio Pro.lnk
2016-01-29 14:46 - 2015-07-20 15:17 - 00002230 ____N C:\Users\Public\Desktop\AVG 1-Click Maintenance.lnk
2016-01-29 14:46 - 2015-07-20 15:17 - 00002204 ____N C:\Users\Public\Desktop\AVG PC TuneUp 2015.lnk
2016-01-29 14:46 - 2015-04-16 00:59 - 00001963 ____N C:\Users\Public\Desktop\COMODO Internet Security.lnk
2016-01-29 14:46 - 2015-03-16 19:56 - 00001950 ____N C:\Users\Public\Desktop\e-Sword.lnk
2016-01-29 14:46 - 2015-01-25 17:21 - 00001170 ____N C:\Users\Public\Desktop\MAGIX Music Maker 2014 Premium.lnk
2016-01-29 14:46 - 2015-01-23 21:55 - 00001151 ____N C:\Users\Public\Desktop\FL Studio 10.lnk
2016-01-29 14:45 - 2015-10-14 20:53 - 00001516 ____N C:\Users\Supermatt\Desktop\UninstallTool_x64.exe - Shortcut.lnk
2016-01-29 14:45 - 2015-07-22 16:33 - 00001007 ____N C:\Users\Supermatt\Desktop\Telegram.lnk
2016-01-29 14:45 - 2015-05-09 11:55 - 00001363 ____N C:\Users\Supermatt\Desktop\Hippo Animator 3.lnk
2016-01-29 14:45 - 2015-05-02 23:31 - 00001014 ____N C:\Users\Supermatt\Desktop\Internet Download Manager.lnk
2016-01-29 14:45 - 2014-01-20 07:27 - 00001180 ____N C:\Users\Supermatt\Desktop\Roaming - Shortcut.lnk
2016-01-29 14:44 - 2015-08-13 23:40 - 00000994 ____N C:\Users\Supermatt\Desktop\AppData - Shortcut.lnk
2016-01-29 14:44 - 2015-01-30 23:21 - 00000663 ____N C:\Users\Supermatt\Desktop\downloads - Shortcut.lnk
2016-01-29 14:44 - 2014-01-14 17:01 - 00013340 ____N C:\Users\Supermatt\Desktop\cmd - Shortcut.lnk
2016-01-29 14:42 - 2009-07-14 10:20 - 00000000 ____D C:\Windows\PLA
2016-01-29 13:26 - 2015-11-26 19:30 - 00000974 ____N C:\Users\Public\Desktop\Sibelius 7.lnk
2016-01-29 13:26 - 2015-07-23 12:30 - 00002183 ____N C:\Users\Public\Desktop\Xilisoft Video Converter Ultimate.lnk
2016-01-29 13:26 - 2015-03-25 19:27 - 00002741 ____N C:\Users\Public\Desktop\Vocabulary Worksheet Factory 5.lnk
2016-01-29 13:23 - 2014-09-13 22:48 - 00000000 ____D C:\Program Files\Autodesk
2016-01-29 12:26 - 2009-07-14 12:32 - 00000000 ____D C:\Windows\Downloaded Program Files
2016-01-27 23:42 - 2015-05-05 23:41 - 00000000 ____D C:\Users\Supermatt\AppData\Roaming\vlc
2016-01-24 15:06 - 2014-04-24 19:49 - 00000000 ____D C:\Program Files (x86)\Neuratron AudioScore Ultimate Demo
2016-01-24 13:40 - 2014-01-08 20:52 - 00000000 ____D C:\Users\Supermatt
2016-01-19 22:32 - 2014-05-31 11:33 - 00000000 ____D C:\Users\Supermatt\Documents\Calibre Library
2016-01-18 06:10 - 2015-01-10 21:32 - 00000000 ____D C:\Windows\AutoKMS
2016-01-06 11:26 - 2009-07-14 12:08 - 00032638 ____N C:\Windows\Tasks\SCHEDLGU.TXT

==================== Files in the root of some directories =======

2014-04-30 09:03 - 2014-04-30 09:03 - 2174976 ____N (Advanced Micro Devices Inc.) C:\Program Files (x86)\Common Files\atimpenc.dll
2014-01-19 01:20 - 2014-06-18 00:57 - 4216840 ____N (Microsoft Corporation) C:\Program Files (x86)\Common Files\vcredist.exe
2014-01-12 14:54 - 2015-12-03 09:53 - 0002115 _____ () C:\Users\Supermatt\AppData\Roaming\SAS7_000.DAT
2015-05-02 23:29 - 2015-05-02 23:31 - 0047104 _____ () C:\Users\Supermatt\AppData\Roaming\Thumbs.db
2015-08-17 23:37 - 2015-08-17 23:37 - 0000036 _____ () C:\Users\Supermatt\AppData\Local\housecall.guid.cache
2015-02-18 16:01 - 2015-07-31 10:02 - 0007603 _____ () C:\Users\Supermatt\AppData\Local\Resmon.ResmonCfg
2015-08-18 01:08 - 2015-08-18 01:08 - 0000010 _____ () C:\Users\Supermatt\AppData\Local\sponge.last.runtime.cache
2015-05-11 21:44 - 2015-05-11 21:46 - 0000000 _____ () C:\Users\Supermatt\AppData\Local\TaskMan.cmd.done
2014-07-16 20:27 - 2014-07-16 20:27 - 0000000 _____ () C:\Users\Supermatt\AppData\Local\{B6A17797-1312-4D71-B698-87AF7CAD21F9}
2015-02-01 16:07 - 2015-08-01 16:07 - 0000211 _____ () C:\ProgramData\acer.zip
2015-01-03 00:20 - 2015-01-03 00:20 - 5404888 _____ (COMODO) C:\ProgramData\cis28B.exe
2015-01-17 09:14 - 2015-01-17 09:14 - 0010466 _____ () C:\ProgramData\regid.2002-03.com.schoolhousetech_25E9AB98-8909-46D8-8DB6-EDCF1F32EB56.swidtag
2014-11-17 06:29 - 2014-11-17 06:29 - 0010494 _____ () C:\ProgramData\regid.2002-03.com.schoolhousetech_91210511-7AF9-4433-BFA0-27835E6A620E.swidtag
2013-04-20 08:11 - 2013-04-20 08:11 - 0010313 _____ () C:\ProgramData\regid.2002-03.com.schoolhousetech_D0224F9C-EA21-4DFC-BF88-2799ED2826DB.swidtag

Files to move or delete:
====================
C:\ProgramData\cis28B.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-01-29 00:38

==================== End of FRST.txt ============================

 

I didn't notice the additions tick was set to off. I was looking at the log and I see that the IExplorer is set to google homepage but that's not true. I set it to yahoo. is that normal?

 

The problem seems to be still with me. The reg keys are not gone.


Edited by Supermatt01, 03 February 2016 - 10:06 AM.

  • 0

#18
RKinner
Posted 03 February 2016 - 10:30 AM

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP

Get TCPView:

 

https://live.sysinte...com/Tcpview.exe

 

Download Save and run by right click and Run As Admin.

 

File, Save As (to your desktop), tcplog, OK.

 

Open tcplog.txt on your desktiop and copy and paste the text into a REPLY.  Let's see if we can see what is running this proxy.

 

Here another fixlist to try:

 

[attachment=80225:fixlist.txt]

 

 

 

 


  • 0

#19
Supermatt01
Posted 03 February 2016 - 10:37 AM

Supermatt01

    Member

  • Topic Starter
  • Member
  • PipPip
  • 45 posts

[System Process] 0 TCP Supermatt-PC 8080 localhost 49591 TIME_WAIT          
[System Process] 0 TCP supermatt-pc 49537 sa-in-f95.1e100.net http TIME_WAIT          
[System Process] 0 TCP supermatt-pc 49538 sa-in-f95.1e100.net http TIME_WAIT          
[System Process] 0 TCP supermatt-pc 49540 kul01s09-in-f4.1e100.net https TIME_WAIT          
[System Process] 0 TCP supermatt-pc 49546 sc-in-f154.1e100.net http TIME_WAIT          
[System Process] 0 TCP supermatt-pc 49559 sc-in-f154.1e100.net http TIME_WAIT          
[System Process] 0 TCP supermatt-pc 49563 fm-dyn-111-95-240-37.fast.net.id https TIME_WAIT          
[System Process] 0 TCP supermatt-pc 49578 fm-dyn-111-95-240-37.fast.net.id https TIME_WAIT          
[System Process] 0 TCP supermatt-pc 49579 fm-dyn-111-95-240-37.fast.net.id https TIME_WAIT          
[System Process] 0 TCP supermatt-pc 49581 sa-in-f84.1e100.net https TIME_WAIT          
[System Process] 0 TCP supermatt-pc 49588 sa-in-f132.1e100.net https TIME_WAIT          
[System Process] 0 TCP supermatt-pc 49589 fm-dyn-111-94-248-59.fast.net.id https TIME_WAIT          
cmdagent.exe 4152 UDP Supermatt-PC 54447 * *           
lsass.exe 828 TCP Supermatt-PC 49153 Supermatt-PC 0 LISTENING          
lsass.exe 828 TCPV6 supermatt-pc 49153 supermatt-pc 0 LISTENING          
mbam.exe 3960 TCP supermatt-pc 49496 ec2-54-221-221-178.compute-1.amazonaws.com https CLOSE_WAIT          
mbamservice.exe 2372 TCP Supermatt-PC 43227 Supermatt-PC 0 LISTENING          
router.exe 2664 TCP Supermatt-PC 8080 Supermatt-PC 0 LISTENING          
router.exe 2664 TCPV6 supermatt-pc 8080 supermatt-pc 0 LISTENING          
services.exe 800 TCP Supermatt-PC 49169 Supermatt-PC 0 LISTENING          
services.exe 800 TCPV6 supermatt-pc 49169 supermatt-pc 0 LISTENING          
spoolsv.exe 1584 TCP Supermatt-PC 49160 Supermatt-PC 0 LISTENING          
spoolsv.exe 1584 TCPV6 supermatt-pc 49160 supermatt-pc 0 LISTENING          
svchost.exe 160 TCP Supermatt-PC epmap Supermatt-PC 0 LISTENING          
svchost.exe 5548 TCP Supermatt-PC ftps Supermatt-PC 0 LISTENING          
svchost.exe 5548 TCP Supermatt-PC dccm Supermatt-PC 0 LISTENING          
svchost.exe 5548 TCP Supermatt-PC 7438 Supermatt-PC 0 LISTENING          
svchost.exe 1048 TCP Supermatt-PC 49154 Supermatt-PC 0 LISTENING          
svchost.exe 1156 TCP Supermatt-PC 49155 Supermatt-PC 0 LISTENING          
svchost.exe 3780 TCP Supermatt-PC 49172 Supermatt-PC 0 LISTENING          
svchost.exe 1156 UDP Supermatt-PC isakmp * *           
svchost.exe 1124 UDP Supermatt-PC ws-discovery * *           
svchost.exe 1124 UDP Supermatt-PC ws-discovery * *           
svchost.exe 5268 UDP Supermatt-PC ws-discovery * *           
svchost.exe 5268 UDP Supermatt-PC ws-discovery * *           
svchost.exe 1156 UDP Supermatt-PC ipsec-msft * *           
svchost.exe 344 UDP Supermatt-PC llmnr * *           
svchost.exe 1156 UDP Supermatt-PC 54985 * *           
svchost.exe 1156 UDP Supermatt-PC 54986 * *           
svchost.exe 5268 UDP Supermatt-PC 56165 * *           
svchost.exe 1124 UDP Supermatt-PC 56167 * *           
svchost.exe 160 TCPV6 supermatt-pc epmap supermatt-pc 0 LISTENING          
svchost.exe 5548 TCPV6 supermatt-pc ftps supermatt-pc 0 LISTENING          
svchost.exe 5548 TCPV6 [0:0:0:0:0:0:0:1] dccm supermatt-pc 0 LISTENING          
svchost.exe 1048 TCPV6 supermatt-pc 49154 supermatt-pc 0 LISTENING          
svchost.exe 1156 TCPV6 supermatt-pc 49155 supermatt-pc 0 LISTENING          
svchost.exe 3780 TCPV6 supermatt-pc 49172 supermatt-pc 0 LISTENING          
svchost.exe 1156 UDPV6 supermatt-pc 500 * *           
svchost.exe 5268 UDPV6 supermatt-pc 3702 * *           
svchost.exe 5268 UDPV6 supermatt-pc 3702 * *           
svchost.exe 1124 UDPV6 supermatt-pc 3702 * *           
svchost.exe 1124 UDPV6 supermatt-pc 3702 * *           
svchost.exe 1156 UDPV6 supermatt-pc 4500 * *           
svchost.exe 344 UDPV6 supermatt-pc 5355 * *           
svchost.exe 5268 UDPV6 supermatt-pc 56166 * *           
svchost.exe 1124 UDPV6 supermatt-pc 56168 * *           
System 4 TCP supermatt-pc netbios-ssn Supermatt-PC 0 LISTENING          
System 4 TCP supermatt-pc netbios-ssn Supermatt-PC 0 LISTENING          
System 4 TCP Supermatt-PC 1001 Supermatt-PC 0 LISTENING          
System 4 TCP Supermatt-PC microsoft-ds Supermatt-PC 0 LISTENING          
System 4 TCP Supermatt-PC wsd Supermatt-PC 0 LISTENING          
System 4 UDP supermatt-pc netbios-ns * *  18 900 6 300      
System 4 UDP supermatt-pc netbios-ns * *           
System 4 UDP supermatt-pc netbios-dgm * *           
System 4 UDP supermatt-pc netbios-dgm * *           
System 4 TCPV6 supermatt-pc microsoft-ds supermatt-pc 0 LISTENING          
System 4 TCPV6 supermatt-pc wsd supermatt-pc 0 LISTENING          
wininit.exe 700 TCP Supermatt-PC 49152 Supermatt-PC 0 LISTENING          
wininit.exe 700 TCPV6 supermatt-pc 49152 supermatt-pc 0 LISTENING          

 

I will try the new fix
 


  • 0

#20
Supermatt01
Posted 03 February 2016 - 10:52 AM

Supermatt01

    Member

  • Topic Starter
  • Member
  • PipPip
  • 45 posts

Fix result of Farbar Recovery Scan Tool (x64) Version:27-01-2016
Ran by Supermatt (2016-02-03 16:38:55) Run:3
Running from C:\Users\Supermatt\Desktop
Loaded Profiles: Supermatt (Available Profiles: Supermatt)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxySettingsPerUser] 0 <======= ATTENTION (Restriction - ProxySettings)
ProxyEnable: [HKLM] => Proxy is enabled.
ProxyEnable: [HKLM-x32] => Proxy is enabled.
ProxyServer: [HKLM] => http=127.0.0.1:8080;https=127.0.0.1:8080
ProxyServer: [HKLM-x32] => http=127.0.0.1:8080;https=127.0.0.1:8080
AutoConfigURL: [HKLM] => http=127.0.0.1:8080;https=127.0.0.1:8080
S3 tapSF0901; C:\Windows\System32\DRIVERS\tapSF0901.sys [39104 2015-10-14] (Spotflux, Inc.)
EmptyTemp:

*****************

"HKLM\SOFTWARE\Policies\Google" => key removed successfully
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxySettingsPerUser => value removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\AutoConfigURL => value not found.
tapSF0901 => service removed successfully
EmptyTemp: => 182.5 MB temporary data Removed.

The system needed a reboot.

==== End of Fixlog 16:39:04 ====

 

Proxy values still found after a reboot. 


  • 0

#21
RKinner
Posted 03 February 2016 - 11:35 AM

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP

Appears it's router.exe that is doing it.  

 

I knew it didn't look right.  Surprised that virustotal did not catch it.  

 

Perhaps whatever it is doing is harmless but it's going down now.

 

Use this fixlist:

 

[attachment=80226:fixlist.txt]

 

After you do the Fix, Run a FRST scan and post the log.

 

 


  • 0

#22
Supermatt01
Posted 03 February 2016 - 07:04 PM

Supermatt01

    Member

  • Topic Starter
  • Member
  • PipPip
  • 45 posts

Fix result of Farbar Recovery Scan Tool (x64) Version:27-01-2016
Ran by Supermatt (2016-02-03 17:57:56) Run:4
Running from C:\Users\Supermatt\Desktop
Loaded Profiles: Supermatt (Available Profiles: Supermatt)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxySettingsPerUser] 0 <======= ATTENTION (Restriction - ProxySettings)
ProxyEnable: [HKLM] => Proxy is enabled.
ProxyEnable: [HKLM-x32] => Proxy is enabled.
ProxyServer: [HKLM] => http=127.0.0.1:8080;https=127.0.0.1:8080
ProxyServer: [HKLM-x32] => http=127.0.0.1:8080;https=127.0.0.1:8080
AutoConfigURL: [HKLM] => http=127.0.0.1:8080;https=127.0.0.1:8080
R2 router.exe; C:\Windows\SysWOW64\router.exe [16384 2014-08-20] (Microsoft©) [File not signed]
EmptyTemp:

*****************

HKLM\SOFTWARE\Policies\Google => key not found.
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxySettingsPerUser => value removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\AutoConfigURL => value not found.
router.exe => Unable to stop service.
router.exe => service removed successfully
EmptyTemp: => 25.8 MB temporary data Removed.

The system needed a reboot.

 

 

There are still some keys, proxy override (loopback) though it seems to be dead in the water, also MigrateProxy is still something I'm not sure about, it is set to (1) if it is normal I won't bother it. Otherwise seems to be working well now and the check box is set to auto detect now. I wonder what is safe to put back in to my computer at this time. I will start trying to restore my programs if I need them. I'm going to pluck a pitch for you guys on my Facebook page. 


  • 0

#23
RKinner
Posted 03 February 2016 - 07:51 PM

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP

MigrateProxy is used to force one time detection of proxysetting.

- If 'Automatically detect settings' is disabled and migrateProxy is set to 0 setting detection will occur at first internet connection and value of Key MigrateProxy will be changed to 1.

- If 'Automatically detect settings' is enabled. The key MigrateProxy has no effect.

 

Don't think it's important.

 

We should probably clean up and remove FRST.  

 

proxy override (loopback)   is probably a default value since if there were a proxy you would not want to send loopback traffic to it.

 

 

We usually clean up with Delfix.  This removes our tools and their logs and quarantines and also removes all but the latest System Restore point so there is no chance of the malware coming back with a system restore.  Follow the instructions and ignore the picture since it doesn't show the correct options as checked.
 
 
Ensure Remove disinfection tools is ticked
Also tick:
Create registry backup
Purge system restore
 
Click Run
The program will run for a few moments and then notepad will open with a log. Please paste the log in your next reply
 
Any of our tools (and their logs) that it doesn't remove can be deleted manually.  
 
 
Also make sure you have the latest versions of any adobe.com products you use like Shockwave, Flash or Acrobat.  Flash is now the most malware targeted program so it must be kept up to date.  Be careful with Adobe.  They are fond of offering optional downloads like yahoo or Ask toolbars or that worthless McAfee Security Scan.  Go slow and uncheck the optional stuff.
 
Whether you use adobe reader, acrobat or fox-it to read pdf files you need to disable Javascript in the program.  There is an exploit out there now that can use it to get on your PC.  For Adobe Reader:  Start, All Programs, Adobe Reader, Edit, Preferences, Click on Javascript in the left column and uncheck Enable Acrobat Javascript.  OK Close program.  It's the same for Foxit reader except you uncheck Enable Javascript Actions. 

 

 
If you use Chrome/Firefox/IE then get the AdBlock Plus Add-on.  Go to adblockplus.org with each browser and get the add-on.  (It's actually a program for IE)
 
If Chrome/Firefox is slow loading make sure it only has the current Java add-on.  Then download and run Speedy Fox.
http://www.crystalidea.com/speedyfox.  Close Chrome/Firefox/Skpe. Hit Optimize.   You can run it any time that Chrome/Firefox seems slow starting..
 
Be warned:  If you use Limewire, utorrent or any of the other P2P programs you will probably be coming back to the Malware Removal forum.  If you must use P2P then submit any files you get to http://virustotal.combefore you open them.
 
Due to a recent rise in the number of Crytolocker infections I am now recommending you install:
 
CryptoPrevent
 
 
Last time I downloaded it you had to give them your IP address and they would send you the link to download it.  When it ran it asked if you were sure your PC was clean then it would try to allow everything on your PC to continue running.  The free version does not update on its own so you should check for updated versions once in a while.  If you have problems after installing CryptoPrevent you can just uninstall it.
 
If you have a router, log on to it today and change the default password!  If using a Wireless router you really should be using encryption on the link.  Use the strongest (newest) encryption method that your router and PC wireless adapter support especially if you own a business.  See http://www.king5.com...-120637284.htmland http://www.seattlepi...ted-1344185.php for why encryption is important.  If you don't know how, visit the router maker's website.  They all have detailed step by step instructions or a wizard you can download.
 
Special note on Java.  Old Java versions should be removed after first clearing the Java Cache by following the instructions in:
Then remove the old versions by going to Control Panel, Programs and Features and Uninstall all Java programs which are not Java Version 8 update 71 or better.  These may call themselves: Java Runtime, Runtime Environment, Runtime, JRE, Java Virtual Machine, Virtual Machine, Java VM, JVM, VM, J2RE, J2SE.  Get the latest version from Java.com.  They will usually attempt to foist some garbage like the Ask toolbar, Yahoo toolbar or McAfee Security Scan on you as part of the download.  Just uncheck the garbage before the download (or install) starts.  If you use a 64-bit browser and want the 64-bit version of Java you need to use it to visit java.com.
Due to multiple security problems with Java we are now recommending that it not be installed unless you absolutely know you need it. 
 
Make sure Windows Updates is turned on and that it works.  Go to Control panel, Windows Updates and see if it works.  
 
My help is free but if you wish to show your appreciation, please donate to Kwiaht instead of me. It's a local environmental organization that I volunteer with: http://www.kwiaht.org/donate.htm
(The name means something like "clean place" in one of the local native-American dialects)
 
 
Ron
 

  • 0

#24
Supermatt01
Posted 03 February 2016 - 08:15 PM

Supermatt01

    Member

  • Topic Starter
  • Member
  • PipPip
  • 45 posts

Cool beans Ron. Thanks for the help. I will be taking the suggested actions ASAP. Again thank you. I only have an in-home connection but encryption is important these days. I will try it out.

 

 # DelFix v1.011 - Logfile created 04/02/2016 at 09:07:12

# Updated 18/08/2015 by Xplode
# Username : Supermatt - SUPERMATT-PC
# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)
 
~ Removing disinfection tools ...
 
Deleted : C:\Qoobox
Deleted : C:\FRST
Deleted : C:\AdwCleaner
Deleted : C:\Users\Supermatt\Desktop\mbar
Deleted : C:\ComboFix.txt
Deleted : C:\Users\Supermatt\Desktop\Addition.txt
Deleted : C:\Users\Supermatt\Desktop\adwcleaner_5.032.exe
Deleted : C:\Users\Supermatt\Desktop\Fixlog.txt
Deleted : C:\Users\Supermatt\Desktop\FRST.txt
Deleted : C:\Users\Supermatt\Desktop\FRST64.exe
Deleted : C:\Users\Supermatt\Desktop\JRT.exe
Deleted : C:\Users\Supermatt\Desktop\JRT.txt
Deleted : C:\Users\Supermatt\Desktop\MiniToolBox.exe
Deleted : C:\Users\Supermatt\Desktop\RogueKiller.exe
Deleted : C:\Users\Supermatt\Downloads\AdwCleaner.exe
Deleted : C:\Windows\grep.exe
Deleted : C:\Windows\PEV.exe
Deleted : C:\Windows\NIRCMD.exe
Deleted : C:\Windows\MBR.exe
Deleted : C:\Windows\SED.exe
Deleted : C:\Windows\SWREG.exe
Deleted : C:\Windows\SWSC.exe
Deleted : C:\Windows\SWXCACLS.exe
Deleted : C:\Windows\Zip.exe
Deleted : HKLM\SOFTWARE\AdwCleaner
Deleted : HKLM\SOFTWARE\Swearware
Deleted : HKLM\SOFTWARE\TrendMicro\Hijackthis
Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\combofix.exe
 
~ Cleaning system restore ...
 
Deleted : RP #278 [Checkpoint by HitmanPro | 01/31/2016 05:38:08]
Deleted : RP #279 [Checkpoint by HitmanPro | 01/31/2016 08:39:43]
Deleted : RP #280 [JRT Pre-Junkware Removal | 01/31/2016 08:58:59]
Deleted : RP #281 [Checkpoint by HitmanPro | 02/01/2016 09:07:04]
Deleted : RP #282 [Checkpoint by HitmanPro | 02/01/2016 10:57:33]
Deleted : RP #283 [Windows Update | 02/01/2016 12:54:08]
Deleted : RP #284 [JRT Pre-Junkware Removal | 02/01/2016 13:55:58]
Deleted : RP #285 [Windows Update | 02/01/2016 16:36:33]
Deleted : RP #286 [Removed SpyHunter | 02/01/2016 23:31:27]
Deleted : RP #287 [JRT Pre-Junkware Removal | 02/02/2016 06:04:43]
Deleted : RP #288 [Windows Modules Installer | 02/03/2016 10:11:15]
 
New restore point created !
 
########## - EOF - ##########

  • 0

#25
RKinner
Posted 03 February 2016 - 08:37 PM

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP

OK.  You are good to go.


  • 1

Advertisements

#26
Supermatt01
Posted 06 February 2016 - 08:08 PM

Supermatt01

    Member

  • Topic Starter
  • Member
  • PipPip
  • 45 posts

Hello. I'm now having a bit of a problem. My computer is not allowing me Admin privileges. I am the Admin of my system it's a home system and I now can not change system settings. Could you please help me regain full control of my system. 


  • 0

#27
RKinner
Posted 09 February 2016 - 08:37 AM

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP

Are you able to run FRST again?

 

 Perhaps you have to do it this way:

 

http://www.geekstogo...l/#entry2151691


  • 0

#28
Supermatt01
Posted 14 February 2016 - 11:14 AM

Supermatt01

    Member

  • Topic Starter
  • Member
  • PipPip
  • 45 posts

Sorry, I didn't know you had replied. It's okay I fought with my computer a bit and got it to work :-) It was just some hidden settings getting in my way. It is all up to speed now. Thanks a million. I am promoting this web site on my Facebook page.  


  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics


Also tagged with one or more of these keywords: Proxy, virus, unwanted, registry

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP