FRST LOGFILE 4/13/2016
NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\AESTSr64.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Aladdin Knowledge Systems Ltd.) C:\Windows\System32\hasplms.exe
(Intuit) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
() C:\Windows\System32\rpcnetp.exe
() C:\Windows\System32\valWBFPolicyService.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\swriter.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.bin
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1085656 2015-12-17] (Adobe Systems Incorporated)
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKU\S-1-5-21-3241789850-2206600503-3642038317-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\S-1-5-21-3241789850-2206600503-3642038317-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [50599552 2016-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-3241789850-2206600503-3642038317-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3077712 2016-03-31] (Valve Corporation)
HKU\S-1-5-21-3241789850-2206600503-3642038317-1000\...\MountPoints2: F - F:\Setup.exe
HKU\S-1-5-21-3241789850-2206600503-3642038317-1000\...\MountPoints2: {4ba63d2b-c62f-11e5-b561-e02a82c7ab80} - E:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-3241789850-2206600503-3642038317-1000\...\MountPoints2: {bb422514-fba2-11e5-b760-68b599f76810} - E:\VerizonSWUpgradeAssistantLauncher.exe
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{9AAE24C3-BDCE-4DAC-A9ED-F9B97641C0CA}: [DhcpNameServer] 209.18.47.61 209.18.47.62
Tcpip\..\Interfaces\{EC357CEF-B0D0-494B-BD10-C9BD33FEBE6E}: [DhcpNameServer] 192.168.1.254
ManualProxies:
Internet Explorer:
==================
SearchScopes: HKLM-x32 -> DefaultScope {20B9D1AE-AD1A-38B4-87FE-AF278DA9861D} URL =
SearchScopes: HKU\S-1-5-21-3241789850-2206600503-3642038317-1000 -> DefaultScope {20B9D1AE-AD1A-38B4-87FE-AF278DA9861D} URL =
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)
Handler-x32: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - c:\Program Files (x86)\Intuit\QuickBooks 2010\HelpAsyncPluggableProtocol.dll [2009-09-03] (Intuit, Inc.)
Handler-x32: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\SysWOW64\mscoree.dll [2010-11-20] (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)
FireFox:
========
FF ProfilePath: C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\2e9otsft.default
FF Homepage: hxxps://www.malwarebytes.org/restorebrowser//?u=ed8d2ecf7011b27b6f97010abb89239b&c=p1&src=hp&inst=1458091873
FF NetworkProxy: "type", 5)user_pref("xpinstall.signatures.required", false
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_20_0_0_267.dll [2015-12-30] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @unity3d.com/UnityPlayer64,version=1.0 -> C:\Program Files\Unity\WebPlayer64\loader-x64\npUnity3D64.dll [2016-04-09] (Unity Technologies ApS)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_267.dll [2015-12-30] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [No File]
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [No File]
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-12-17] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\2e9otsft.default\searchplugins\search.xml [2016-04-10]
FF Extension: Adblock Plus - C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\2e9otsft.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-02-25]
FF Extension: Skype - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2016-01-06]
Chrome:
=======
CHR StartupUrls: Default -> "hxxps://search.protectedio.com/?u=ed8d2ecf7011b27b6f97010abb89239b&c=p1&src=hp&inst=1459302561"
CHR Profile: C:\Users\HP\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\HP\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-03-13]
CHR Extension: (Google Drive) - C:\Users\HP\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-03-13]
CHR Extension: (Adblock Plus) - C:\Users\HP\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-03-19]
CHR Extension: (Google Docs Offline) - C:\Users\HP\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-18]
CHR Extension: (Chrome Web Store Payments) - C:\Users\HP\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-05]
CHR Extension: (Gmail) - C:\Users\HP\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-03-13]
CHR Extension: (ed8d2ecf7011b27b6f97010abb89239b) - C:\Program Files (x86)\Google\Chrome\Application\ed8d2ecf7011b27b6f97010abb89239b [2016-03-18]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\AESTSr64.exe [89600 2009-03-03] (Andrea Electronics Corporation)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2016-01-08] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2016-01-08] (Microsoft Corporation)
R2 QBCFMonitorService; c:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe [24576 2009-09-03] (Intuit) [File not signed]
S3 QBFCService; c:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [61440 2009-07-23] (Intuit Inc.) [File not signed]
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\STacSV64.exe [244736 2010-03-17] (IDT, Inc.)
R2 valWBFPolicyService; C:\Windows\system32\valWBFPolicyService.exe [28672 2013-10-17] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
S2 Transbase TECDOC CD 1_2014 Service; E:\TECDOC_CD\1_2014\db\tbmux32.exe [X]
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2015-02-13] (Disc Soft Ltd)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S2 rimmptsk; C:\Windows\System32\DRIVERS\rimmpx64.sys [67584 2009-06-25] (REDC) [File not signed]
S2 rimsptsk; C:\Windows\System32\DRIVERS\rimspx64.sys [55296 2009-06-25] (REDC) [File not signed]
S3 rismcx64; C:\Windows\System32\DRIVERS\rismcx64.sys [59008 2009-07-20] (RICOH Company, Ltd.) [File not signed]
S2 rismxdp; C:\Windows\System32\DRIVERS\rixdpx64.sys [57856 2009-06-25] (REDC) [File not signed]
S4 secdrv; C:\Windows\SysWow64\Drivers\secdrv.sys [11376 2016-01-24] () [File not signed]
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1803904 2010-06-03] ()
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-04-12 11:05 - 2016-04-12 11:05 - 00012181 _____ C:\Users\HP\Desktop\FRST.txt
2016-04-12 11:03 - 2016-04-12 11:03 - 02375168 _____ (Farbar) C:\Users\HP\Desktop\FRST64.exe
2016-04-12 11:01 - 2016-04-12 11:05 - 00000000 ____D C:\FRST
2016-04-12 08:54 - 2016-04-12 08:54 - 00000097 ____H C:\Users\HP\Desktop\.~lock.Dms.odt#
2016-04-12 08:43 - 2016-04-12 08:43 - 00018379 _____ C:\Users\HP\Desktop\Dms.odt
2016-04-11 22:49 - 2016-04-11 22:50 - 03237248 _____ (Enigma Software Group USA, LLC.) C:\Users\HP\Downloads\sh-remover.exe
2016-04-09 20:14 - 2016-04-09 20:14 - 01166936 _____ C:\Users\HP\Downloads\Houdini_15a.zip
2016-04-09 18:49 - 2016-04-09 18:49 - 00000000 ____D C:\Users\HP\Downloads\stockfish-7-win (1)
2016-04-09 15:46 - 2016-04-09 15:46 - 00000000 ____D C:\Users\HP\AppData\Roaming\Unity
2016-04-09 15:14 - 2016-04-09 15:14 - 00000000 ____D C:\Users\HP\AppData\LocalLow\Unity
2016-04-09 15:11 - 2016-04-09 15:11 - 00000000 ____D C:\Program Files\Unity
2016-04-09 11:30 - 2016-04-09 11:30 - 03286400 _____ (Enigma Software Group USA, LLC.) C:\Users\HP\Downloads\SpyHunter-Installer.exe
2016-04-09 11:29 - 2016-04-12 08:27 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-04-09 11:29 - 2016-04-09 11:29 - 00001106 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-04-09 11:29 - 2016-04-09 11:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-04-09 11:29 - 2016-03-10 14:09 - 00064896 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-04-09 11:29 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-04-09 11:29 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-04-09 11:28 - 2016-04-09 11:29 - 22851472 _____ (Malwarebytes ) C:\Users\HP\Downloads\mbam-setup-2.2.1.1043 (1).exe
2016-04-08 11:45 - 2016-04-08 11:45 - 01556392 _____ C:\Users\HP\Downloads\stockfish-7-win (2).zip
2016-04-08 11:45 - 2016-04-08 11:45 - 01556392 _____ C:\Users\HP\Downloads\stockfish-7-win (1).zip
2016-04-05 15:42 - 2016-04-05 15:42 - 00000855 _____ C:\Users\HP\Desktop\Kyle G Resume.txt
2016-03-27 19:25 - 2016-03-27 19:26 - 00000908 _____ C:\Users\HP\Desktop\Andrew's Resume.txt
2016-03-27 19:05 - 2016-03-27 19:05 - 00016220 _____ C:\Users\HP\Downloads\Andrew's Resume.odt
2016-03-27 19:05 - 2016-03-27 19:05 - 00016220 _____ C:\Users\HP\Downloads\Andrew's Resume (1).odt
2016-03-24 07:07 - 2016-03-24 07:07 - 00003402 _____ C:\Users\HP\Desktop\Brandons Resume obt.txt
2016-03-23 19:00 - 2016-03-23 19:00 - 00478776 _____ (Advanced Mouse Auto Clicker ltd. ) C:\Users\HP\Downloads\free-mouse-auto-clicker-3-7-en-win.exe
2016-03-23 19:00 - 2016-03-23 19:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FreeMouseAutoClicker
2016-03-23 19:00 - 2016-03-23 19:00 - 00000000 ____D C:\Program Files (x86)\FreeMouseAutoClicker
2016-03-23 02:10 - 2016-03-23 02:10 - 00001111 _____ C:\Users\Public\Desktop\Arena.lnk
2016-03-23 02:08 - 2016-03-23 02:09 - 16992844 _____ ( ) C:\Users\HP\Downloads\arena_3.5.1setup (1).exe
2016-03-23 02:07 - 2016-03-23 02:08 - 18199132 _____ C:\Users\HP\Downloads\arena_3.5.1 (1).zip
2016-03-22 17:57 - 2016-03-22 17:58 - 04988970 _____ C:\Users\HP\Downloads\wlist_match1 (1).zip
2016-03-22 17:57 - 2016-03-22 17:57 - 04988970 _____ C:\Users\HP\Downloads\wlist_match1.zip
2016-03-19 17:19 - 2016-03-19 17:20 - 25028744 _____ (SUPERAntiSpyware) C:\Users\HP\Downloads\SUPERAntiSpyware.exe
2016-03-19 01:25 - 2016-03-26 08:38 - 00000000 ____D C:\Program Files (x86)\AdwCleaner
2016-03-19 01:24 - 2016-03-19 01:24 - 01527296 _____ C:\Users\HP\Desktop\AdwCleaner.exe
2016-03-19 00:41 - 2016-03-19 00:42 - 22851472 _____ (Malwarebytes ) C:\Users\HP\Downloads\mbam-setup-2.2.1.1043.exe
2016-03-18 15:27 - 2016-04-11 18:31 - 00003260 _____ C:\Windows\System32\Tasks\Computer Security Service
2016-03-18 15:27 - 2016-03-18 15:27 - 00000000 ____D C:\Program Files (x86)\Computer Security
2016-03-13 20:32 - 2016-04-11 18:31 - 00002485 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-03-13 20:32 - 2016-03-13 20:32 - 00002271 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-03-13 20:30 - 2016-04-12 10:35 - 00000890 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-03-13 20:30 - 2016-04-12 08:44 - 00000886 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-03-13 20:30 - 2016-03-19 17:39 - 00000000 ____D C:\Program Files (x86)\Google
2016-03-13 20:30 - 2016-03-13 20:30 - 00003886 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-03-13 20:30 - 2016-03-13 20:30 - 00003634 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-04-12 10:49 - 2009-07-13 21:45 - 00029808 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-04-12 10:49 - 2009-07-13 21:45 - 00029808 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-04-12 10:47 - 2009-07-13 22:13 - 00783294 _____ C:\Windows\system32\PerfStringBackup.INI
2016-04-12 10:47 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\inf
2016-04-12 10:14 - 2015-09-29 10:26 - 00000000 ____D C:\Users\HP\AppData\Roaming\Skype
2016-04-12 08:44 - 2016-02-08 12:54 - 00000000 ____D C:\Program Files (x86)\Steam
2016-04-12 08:44 - 2016-02-01 15:19 - 00000000 ____D C:\Windows\erdnt
2016-04-12 08:44 - 2015-02-05 15:35 - 00017920 _____ C:\Windows\SysWOW64\rpcnetp.exe
2016-04-12 08:44 - 2015-02-05 15:35 - 00017920 _____ C:\Windows\SysWOW64\rpcnetp.dll
2016-04-12 08:44 - 2015-02-03 13:25 - 00017920 _____ C:\Windows\system32\rpcnetp.exe
2016-04-12 08:44 - 2009-07-13 22:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-04-12 08:39 - 2016-01-26 09:45 - 00000000 ____D C:\Gm
2016-04-09 19:17 - 2016-01-22 21:20 - 00000000 ____D C:\Program Files (x86)\Arena
2016-04-09 11:29 - 2016-01-30 12:47 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-04-09 11:15 - 2015-02-03 13:30 - 00000000 ____D C:\Users\HP\AppData\Local\VirtualStore
2016-03-27 17:37 - 2016-01-24 14:15 - 00000000 ____D C:\Users\HP\Documents\My Games
2016-03-26 09:50 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\system32\NDF
2016-03-26 08:51 - 2016-01-28 13:01 - 00000000 ____D C:\Users\HP\Desktop\Chess Games Pgn
2016-03-24 07:09 - 2015-09-21 12:20 - 00020073 _____ C:\Users\HP\Desktop\Brandons Resume.odt
2016-03-24 06:58 - 2016-01-25 19:15 - 00003403 _____ C:\Users\HP\Desktop\Brandons Resume.txt
2016-03-24 06:57 - 2016-01-27 19:42 - 00020073 _____ C:\Users\HP\Desktop\Brandons Resume template file.odt
2016-03-23 02:10 - 2016-01-28 14:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Arena
2016-03-19 18:34 - 2016-02-28 19:31 - 00000000 ____D C:\Program Files (x86)\Icoon
2016-03-19 17:56 - 2015-06-20 18:50 - 00529236 _____ C:\Windows\ntbtlog.txt
2016-03-19 01:02 - 2015-10-15 11:26 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-03-19 00:55 - 2009-07-13 22:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2016-03-19 00:55 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\registration
2016-03-19 00:54 - 2016-01-31 19:31 - 00000000 ____D C:\Program Files (x86)\Performance Updater
2016-03-17 16:42 - 2010-11-21 00:16 - 00000000 ___RD C:\Users\Public\Recorded TV
2016-03-13 22:01 - 2015-05-08 14:49 - 00000000 ____D C:\Users\HP\AppData\Local\Google
2016-03-13 20:29 - 2015-05-06 23:20 - 00000000 ____D C:\Users\HP\AppData\Local\Deployment
==================== Files in the root of some directories =======
2015-02-03 14:17 - 2015-02-03 14:17 - 0000000 _____ () C:\Users\HP\AppData\Local\AtStart.txt
2015-02-03 14:17 - 2015-02-03 14:17 - 0000000 _____ () C:\Users\HP\AppData\Local\DSwitch.txt
2015-02-03 14:17 - 2015-02-03 14:17 - 0000000 _____ () C:\Users\HP\AppData\Local\QSwitch.txt
2015-08-30 10:30 - 2015-08-30 10:30 - 0007602 _____ () C:\Users\HP\AppData\Local\Resmon.ResmonCfg
2015-02-13 16:07 - 2016-01-24 13:24 - 6216212 _____ () C:\ProgramData\OfflineCatalogue_1_2014_TECDOC_CD.log
Some files in TEMP:
====================
C:\Users\HP\AppData\Local\Temp\GPUpd56F87BBE0.exe
C:\Users\HP\AppData\Local\Temp\GPUpd57085B670.exe
C:\Users\HP\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll
[2010-11-20 20:24] - [2015-02-03 13:30] - 1008640 ____A (Microsoft Corporation) 2C353B6CE0C8D03225CAA2AF33B68D79
C:\Windows\SysWOW64\User32.dll
[2010-11-20 20:24] - [2015-02-03 13:30] - 0833024 ____A (Microsoft Corporation) 861C4346F9281DC0380DE72C8D55D6BE
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed