[almapa]

Hi there, 

 

After reviewing all the manuals, guides and similar cases to mine, I wasnt able to eliminate the multiple Chrome.exe*32 error. I ran Avast, Malwarebyes, Hitman, and Rogue, but only Rogue found something. However, after reviewing then, I wasnt sure if I should eliminate those "errors".

 

Anyway, I gave up and decided to create a topic since after installing all the other antimalware programs, they start to show as .exe*32 on my Task Manager and is making my PC really slow.   OTL.Txt   128.89KB   228 downloads  Extras.Txt   60.04KB   251 downloads

 

Thanks in advance from Costa Rica. 

 

Here is my OTL: 

 

OTL logfile created on: 28/04/2016 07:01:00 a.m. - Run 2

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Alvaro\Downloads

64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.18282)

Locale: 0000140A | Country: Costa Rica | Language: ESC | Date Format: dd/MM/yyyy

 

3,33 Gb Total Physical Memory | 1,68 Gb Available Physical Memory | 50,60% Memory free

6,65 Gb Paging File | 4,63 Gb Available in Paging File | 69,69% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 447,50 Gb Total Space | 379,22 Gb Free Space | 84,74% Space Free | Partition Type: NTFS

Drive Q: | 16,79 Gb Total Space | 0,01 Gb Free Space | 0,04% Space Free | Partition Type: NTFS

 

Computer Name: ALVARO-PC | User Name: Alvaro | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 

========== Processes (SafeList) ==========

 

PRC - [2016/04/27 21:25:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Alvaro\Downloads\OTL.exe

PRC - [2016/03/23 08:13:34 | 007,139,256 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\avastui.exe

PRC - [2016/03/10 14:07:30 | 001,136,608 | ---- | M] (Malwarebytes) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

PRC - [2016/03/10 14:07:28 | 001,514,464 | ---- | M] (Malwarebytes) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

PRC - [2016/03/10 14:07:20 | 009,926,112 | ---- | M] (Malwarebytes) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

PRC - [2016/02/09 12:15:32 | 000,237,096 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe

PRC - [2015/12/13 23:48:02 | 000,082,128 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2015/12/10 16:11:36 | 001,360,352 | ---- | M] (Lenovo) -- C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe

PRC - [2015/03/23 14:00:26 | 000,066,000 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Message Center Plus\MCPLaunch.exe

PRC - [2015/01/08 22:46:46 | 000,641,992 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe

PRC - [2014/12/11 02:47:00 | 000,111,048 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\micmute.exe

PRC - [2014/12/05 15:34:38 | 000,317,224 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\Lenovo\QuickControl\QuickControlService.exe

PRC - [2014/12/05 15:34:36 | 000,288,536 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\Lenovo\QuickControl\QuickControl.exe

PRC - [2014/11/13 15:07:00 | 001,668,848 | ---- | M] (Lenovo) -- C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe

PRC - [2014/11/13 15:07:00 | 000,127,216 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE

PRC - [2014/08/07 16:42:36 | 000,197,408 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe

PRC - [2014/08/07 16:42:30 | 000,295,712 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe

PRC - [2014/08/07 16:42:24 | 000,072,992 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe

PRC - [2014/08/07 16:42:00 | 000,059,168 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Communications Utility\CamMute.exe

PRC - [2014/04/01 00:45:20 | 000,126,512 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe

 

 

========== Modules (No Company Name) ==========

 

MOD - [2016/04/28 03:16:00 | 007,378,944 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\03e2061b19a18fb0f6498d2c37f355bf\System.Xml.ni.dll

MOD - [2016/04/28 03:15:03 | 000,974,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\74618fce57dc493df7103981ad60bd92\System.Configuration.ni.dll

MOD - [2016/04/28 03:14:41 | 007,518,208 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\e6b9d8e012319c21c74b503b972c7784\System.Core.ni.dll

MOD - [2016/04/28 03:14:32 | 009,981,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\c75082e107212b28aaab6d83dad9de97\System.ni.dll

MOD - [2016/04/28 03:14:23 | 018,111,488 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\affcb83bba04f782c2586a1788330891\mscorlib.ni.dll

MOD - [2016/04/27 18:32:10 | 000,157,376 | ---- | M] () -- C:\Program Files (x86)\Microsoft Office\root\Office16\JitV.dll

MOD - [2016/04/17 18:37:01 | 000,509,344 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\ffl2.dll

MOD - [2016/02/09 12:15:34 | 000,113,496 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\log.dll

MOD - [2016/02/09 12:15:32 | 000,133,768 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll

MOD - [2016/01/03 17:15:43 | 040,539,648 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\libcef.dll

 

 

========== Services (SafeList) ==========

 

SRV:64bit: - [2016/03/30 18:17:56 | 000,114,688 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)

SRV:64bit: - [2016/03/14 04:32:18 | 000,173,744 | ---- | M] (Lenovo.) [Auto | Running] -- C:\Windows\SysNative\ibmpmsvc.exe -- (IBMPMSVC)

SRV:64bit: - [2016/02/09 12:15:32 | 000,237,096 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)

SRV:64bit: - [2015/12/10 16:12:02 | 000,272,864 | ---- | M] (Lenovo) [On_Demand | Stopped] -- C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe -- (LSCWinService)

SRV:64bit: - [2015/07/22 18:02:54 | 001,390,592 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\diagtrack.dll -- (DiagTrack)

SRV:64bit: - [2014/12/11 02:47:00 | 000,111,048 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\micmute.exe -- (LENOVO.MICMUTE)

SRV:64bit: - [2014/11/06 01:00:16 | 000,087,384 | ---- | M] (Alps Electric Co., Ltd.) [Auto | Running] -- C:\Program Files\Apoint2K\HidMonitorSvc.exe -- (ApHidMonitorService)

SRV:64bit: - [2014/09/18 18:21:36 | 000,049,872 | ---- | M] (Lenovo.) [On_Demand | Stopped] -- C:\Windows\SysNative\TPHDEXLG64.exe -- (TPHDEXLGSVC)

SRV:64bit: - [2014/09/03 21:00:10 | 000,239,616 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV:64bit: - [2014/08/07 16:42:36 | 000,197,408 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe -- (LENOVO.TVTVCAM)

SRV:64bit: - [2014/08/07 16:42:24 | 000,072,992 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe -- (LENOVO.TPKNRSVC)

SRV:64bit: - [2014/08/07 16:42:00 | 000,059,168 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\Communications Utility\CamMute.exe -- (LENOVO.CAMMUTE)

SRV:64bit: - [2014/07/08 19:51:34 | 000,115,184 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe -- (Lenovo.VIRTSCRLSVC)

SRV:64bit: - [2014/06/09 20:15:44 | 000,124,400 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\tphkload.exe -- (TPHKLOAD)

SRV:64bit: - [2014/04/01 00:45:20 | 000,126,512 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe -- (TPHKSVC)

SRV:64bit: - [2014/03/31 20:39:34 | 009,954,096 | ---- | M] (DisplayLink Corp.) [Auto | Running] -- C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe -- (DisplayLinkService)

SRV:64bit: - [2014/02/21 17:30:46 | 000,021,552 | ---- | M] (Lenovo) [Auto | Running] -- C:\Program Files\Lenovo\Lenovo Peer Connect\LenovoDiscoverySvc.exe -- (lnvDiscoveryWinSvc)

SRV:64bit: - [2013/05/26 23:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV:64bit: - [2009/07/13 19:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)

SRV - [2016/03/10 14:07:30 | 001,136,608 | ---- | M] (Malwarebytes) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2016/03/10 14:07:28 | 001,514,464 | ---- | M] (Malwarebytes) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)

SRV - [2016/02/18 01:02:06 | 000,026,680 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe -- (HPSupportSolutionsFrameworkService)

SRV - [2016/01/29 16:11:22 | 000,327,296 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2016/01/20 21:09:16 | 000,031,176 | ---- | M] (SHAREit Technologies Co.Ltd) [On_Demand | Stopped] -- C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.Service.exe -- (ShareItSvc)

SRV - [2016/01/13 18:36:00 | 000,021,536 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\Lenovo\System Update\SUService.exe -- (SUService)

SRV - [2015/12/13 23:48:02 | 000,082,128 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2015/11/05 20:36:48 | 000,105,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2015/01/09 12:18:28 | 000,293,416 | ---- | M] (Aviata, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Lenovo Registration\EngageService.exe -- (LenovoProdRegManager)

SRV - [2014/12/05 19:49:10 | 000,619,776 | ---- | M] (Lenovo) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\LENOVO\easyplussdk\bin\EPHotspot64.exe -- (Lenovo EasyPlus Hotspot)

SRV - [2014/12/05 15:34:38 | 000,317,224 | ---- | M] (Lenovo Group Limited) [On_Demand | Running] -- C:\Program Files (x86)\Lenovo\QuickControl\QuickControlService.exe -- (QuickControlService)

SRV - [2014/12/05 15:34:32 | 000,061,232 | ---- | M] (Lenovo Group Limited) [Auto | Stopped] -- C:\Program Files (x86)\Lenovo\QuickControl\QuickControlMasterSvc.exe -- (QuickControlMasterSvc)

SRV - [2014/11/13 15:07:00 | 001,668,848 | ---- | M] (Lenovo) [On_Demand | Running] -- C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe -- (Power Manager DBC Service)

SRV - [2014/11/13 15:07:00 | 001,664,752 | ---- | M] (Lenovo Group Limited) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.exe -- (PwmEWSvc)

SRV - [2014/07/03 11:22:24 | 000,101,592 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTDevMgr.exe -- (BTDevManager)

SRV - [2014/07/03 11:22:24 | 000,050,392 | ---- | M] (Realtek Semiconductor Corporation) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek Bluetooth\RtkBleServ.exe -- (RtkBleServ)

SRV - [2014/07/03 11:22:24 | 000,043,224 | ---- | M] (Realtek Semiconductor Corporation) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek Bluetooth\AvrcpService.exe -- (AvrcpService)

SRV - [2014/03/20 16:49:18 | 000,067,224 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

 

 

========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2016/04/28 06:57:33 | 000,192,216 | ---- | M] (Malwarebytes) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys -- (MBAMSwissArmy)

DRV:64bit: - [2016/04/27 20:14:45 | 000,028,272 | ---- | M] () [Kernel | On_Demand | Unknown] -- C:\Windows\SysNative\drivers\TrueSight.sys -- (TrueSight)

DRV:64bit: - [2016/03/22 10:51:39 | 000,037,144 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswKbd.sys -- (aswKbd)

DRV:64bit: - [2016/03/14 04:32:18 | 000,072,784 | ---- | M] (Lenovo.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ibmpmdrv.sys -- (IBMPMDRV)

DRV:64bit: - [2016/03/10 14:09:06 | 000,064,896 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mwac.sys -- (MBAMWebAccessControl)

DRV:64bit: - [2016/03/10 14:08:54 | 000,027,008 | ---- | M] (Malwarebytes) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2016/03/09 18:16:26 | 001,070,904 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswsnx.sys -- (aswSnx)

DRV:64bit: - [2016/03/09 18:16:25 | 000,107,792 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswmonflt.sys -- (aswMonFlt)

DRV:64bit: - [2016/02/29 08:25:16 | 000,463,744 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswsp.sys -- (aswSP)

DRV:64bit: - [2016/02/13 16:26:44 | 000,287,016 | ---- | M] (AVAST Software) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswvmm.sys -- (aswVmm)

DRV:64bit: - [2016/02/09 12:15:38 | 000,165,344 | ---- | M] (AVAST Software) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aswStm.sys -- (aswStm)

DRV:64bit: - [2016/02/09 12:15:38 | 000,103,064 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)

DRV:64bit: - [2016/02/09 12:15:38 | 000,074,544 | ---- | M] (AVAST Software) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswRvrt.sys -- (aswRvrt)

DRV:64bit: - [2016/02/09 12:15:38 | 000,037,656 | ---- | M] (AVAST Software) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aswHwid.sys -- (aswHwid)

DRV:64bit: - [2016/02/05 13:03:08 | 000,147,904 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)

DRV:64bit: - [2015/05/19 01:30:54 | 001,709,320 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)

DRV:64bit: - [2014/11/13 15:07:00 | 000,020,736 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\TPPWR64V.SYS -- (TPPWRIF)

DRV:64bit: - [2014/09/29 23:27:28 | 000,571,696 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Apfiltr.sys -- (ApfiltrService)

DRV:64bit: - [2014/09/26 02:45:50 | 000,580,312 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtkBtfilter.sys -- (RtkBtFilter)

DRV:64bit: - [2014/09/18 18:21:36 | 000,155,856 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ApsX64.sys -- (Shockprf)

DRV:64bit: - [2014/09/18 18:21:36 | 000,029,392 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ApsHM64.sys -- (TPDIGIMN)

DRV:64bit: - [2014/09/11 10:59:04 | 002,599,128 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtsuvc.sys -- (rtsuvc)

DRV:64bit: - [2014/09/03 21:15:56 | 015,952,896 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)

DRV:64bit: - [2014/09/03 20:56:00 | 000,557,056 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)

DRV:64bit: - [2014/08/04 06:24:06 | 003,502,296 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtwlane.sys -- (RTWlanE)

DRV:64bit: - [2014/06/21 11:01:22 | 000,094,720 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)

DRV:64bit: - [2014/02/16 10:23:54 | 000,060,640 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)

DRV:64bit: - [2014/01/14 00:17:20 | 000,466,136 | ---- | M] (Realsil Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsPer.sys -- (RTSPER)

DRV:64bit: - [2013/11/05 21:40:46 | 000,083,176 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_sata.sys -- (amd_sata)

DRV:64bit: - [2013/11/05 21:40:46 | 000,043,240 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_xata.sys -- (amd_xata)

DRV:64bit: - [2013/10/01 20:22:20 | 000,056,832 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2013/08/27 00:08:42 | 000,883,928 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2013/05/27 13:09:38 | 000,227,648 | ---- | M] (Advanced Micro Devices, INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdxhc.sys -- (amdxhc)

DRV:64bit: - [2013/05/27 13:09:38 | 000,106,816 | ---- | M] (Advanced Micro Devices, INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdhub30.sys -- (amdhub30)

DRV:64bit: - [2012/08/23 08:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV:64bit: - [2012/08/23 08:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)

DRV:64bit: - [2012/03/01 00:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2011/12/26 03:10:44 | 000,040,248 | ---- | M] (Lenovo Information Product(ShenZhen China) Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\psadd.sys -- (psadd)

DRV:64bit: - [2011/05/29 04:48:04 | 000,040,248 | ---- | M] (Lenovo Information Product(ShenZhen China) Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tvti2c.sys -- (TVTI2C)

DRV:64bit: - [2011/03/11 00:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011/03/11 00:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010/11/20 21:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)

DRV:64bit: - [2010/11/20 21:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2009/07/13 19:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009/07/13 19:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009/07/13 19:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009/07/13 18:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)

DRV:64bit: - [2009/07/13 18:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)

DRV:64bit: - [2009/06/10 14:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009/06/10 14:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009/06/10 14:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009/06/10 14:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV - [2009/07/13 19:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 

========== Standard Registry (SafeList) ==========

 

 

========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {5FEA6CD4-231C-4B7C-9C0E-58E1F21F3D4A}

IE:64bit: - HKLM\..\SearchScopes\{5FEA6CD4-231C-4B7C-9C0E-58E1F21F3D4A}: "URL" = http://www.bing.com/...=IE11TR&pc=LCTE

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {5FEA6CD4-231C-4B7C-9C0E-58E1F21F3D4A}

IE - HKLM\..\SearchScopes\{5FEA6CD4-231C-4B7C-9C0E-58E1F21F3D4A}: "URL" = http://www.bing.com/...=IE11TR&pc=LCTE

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo13.msn.com/?pc=LCTE

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://mystart.lenovo.com[binary data]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/

IE - HKCU\..\SearchScopes,DefaultScope = {B67E77CA-4525-4139-B855-6C6843F0D796}

IE - HKCU\..\SearchScopes\{B67E77CA-4525-4139-B855-6C6843F0D796}: "URL" = https://www.google.c...utputEncoding?}

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

========== FireFox ==========

 

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@microsoft.com/Lync,version=15.0: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Alvaro\AppData\Local\Google\Update\1.3.29.5\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Alvaro\AppData\Local\Google\Update\1.3.29.5\npGoogleUpdate3.dll (Google Inc.)

 

64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF [2016/02/11 13:46:02 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2016/02/11 13:46:02 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016/02/11 13:46:02 | 000,000,000 | ---D | M]

 

 

========== Chrome  ==========

 

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd\15.1120.0.4_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\cnciopoikihiagdjbjpnocolokfelagl\2.16.427.0_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.60_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\elicpjhcidhpjomhibiffojpinpmmpil\1.97.51_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiiaigjnkhngdbnoookogelabohpglmd\2.6.45_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\

 

O1 HOSTS File: ([2009/06/10 15:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O4:64bit: - HKLM..\Run: [BtServer] C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe (Realtek Semiconductor Corporation)

O4:64bit: - HKLM..\Run: [LENOVO.TPKNRRES] C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe (Lenovo Group Limited)

O4:64bit: - HKLM..\Run: [RtsCM] C:\Windows\RtsCM64.exe (Realtek Semiconductor Corp.)

O4:64bit: - HKLM..\Run: [TpShocks] C:\Windows\SysNative\TpShocks.exe (Lenovo.)

O4 - HKLM..\Run: [AvastUI.exe] C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)

O4 - HKLM..\Run: [PWMTRV] C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL (Lenovo Group Limited)

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe (Advanced Micro Devices, Inc.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 186.177.66.3 186.177.65.3

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{002DE976-64C2-4AEA-8FEA-96579DCC11D1}: DhcpNameServer = 192.168.1.1 186.177.66.3 186.177.65.3

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{90B3B6C7-B5AC-409E-B3D0-D1EC6E421D75}: DhcpNameServer = 172.16.80.99 172.16.48.147 172.16.48.146

O18:64bit: - Protocol\Handler\mso-minsb.16 - No CLSID value found

O18:64bit: - Protocol\Handler\mso-minsb-roaming.16 - No CLSID value found

O18:64bit: - Protocol\Handler\osf.16 - No CLSID value found

O18:64bit: - Protocol\Handler\osf-roaming.16 - No CLSID value found

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2014/05/19 00:43:30 | 000,000,049 | -HS- | M] () - Q:\AUTORUN.INF -- [ NTFS ]

O33 - MountPoints2\{894f0fc6-87f7-11e5-90be-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{894f0fc6-87f7-11e5-90be-806e6f6e6963}\Shell\AutoRun\command - "" = Q:\LenovoQDrive.cmd -- [2014/06/05 02:27:20 | 000,000,065 | -HS- | M] ()

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

========== Files/Folders - Created Within 30 Days ==========

 

[2016/04/28 03:12:49 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2016/04/27 21:23:03 | 000,000,000 | ---D | C] -- C:\Users\Alvaro\Documents\Reports

[2016/04/27 21:13:39 | 000,000,000 | ---D | C] -- C:\Users\Alvaro\Documents\Quarantine

[2016/04/27 21:13:38 | 000,000,000 | ---D | C] -- C:\Users\Alvaro\Documents\Logs

[2016/04/27 21:10:48 | 003,723,376 | ---- | C] (Emsisoft Ltd) -- C:\Users\Alvaro\Documents\Start Emergency Kit Scanner.exe

[2016/04/27 21:10:48 | 003,723,376 | ---- | C] (Emsisoft Ltd) -- C:\Users\Alvaro\Documents\Start Commandline Scanner.exe

[2016/04/27 21:10:47 | 000,000,000 | ---D | C] -- C:\Users\Alvaro\Documents\bin64

[2016/04/27 21:10:47 | 000,000,000 | ---D | C] -- C:\Users\Alvaro\Documents\bin32

[2016/04/27 20:14:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller

[2016/04/27 20:13:51 | 000,000,000 | ---D | C] -- C:\Program Files\RogueKiller

[2016/04/27 20:13:44 | 000,000,000 | ---D | C] -- C:\ProgramData\RogueKiller

[2016/04/27 19:26:32 | 000,000,000 | ---D | C] -- C:\Program Files\HitmanPro

[2016/04/27 19:25:25 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro

[2016/04/27 19:20:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes' Anti-Malware (portable)

[2016/04/27 19:18:58 | 000,000,000 | ---D | C] -- C:\Users\Alvaro\Desktop\mbar

[2016/04/27 19:09:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER

[2016/04/27 18:47:10 | 000,192,216 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys

[2016/04/27 18:45:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

[2016/04/27 18:45:36 | 000,109,272 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\mbamchameleon.sys

[2016/04/27 18:45:36 | 000,064,896 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mwac.sys

[2016/04/27 18:45:36 | 000,027,008 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\mbam.sys

[2016/04/27 18:45:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes Anti-Malware

[2016/04/27 18:45:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2016/04/21 20:27:16 | 000,114,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe

[2016/04/21 20:27:16 | 000,091,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll

[2016/04/21 20:27:16 | 000,076,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll

[2016/04/21 20:27:16 | 000,064,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll

[2016/04/21 20:27:16 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll

[2016/04/21 20:27:16 | 000,047,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll

[2016/04/21 20:27:16 | 000,034,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll

[2016/04/21 20:27:16 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll

[2016/04/21 20:27:15 | 000,725,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe

[2016/04/21 20:27:15 | 000,130,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll

[2016/04/21 20:27:15 | 000,107,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll

[2016/04/21 20:27:15 | 000,077,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll

[2016/04/21 20:27:15 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll

[2016/04/21 20:27:13 | 000,710,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll

[2016/04/21 20:27:13 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll

[2016/04/21 20:27:13 | 000,062,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll

[2016/04/21 20:27:12 | 002,056,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl

[2016/04/21 20:27:11 | 000,968,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe

[2016/04/21 20:27:11 | 000,663,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll

[2016/04/21 20:27:11 | 000,620,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll

[2016/04/21 20:27:11 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll

[2016/04/21 20:27:10 | 000,806,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll

[2016/04/21 20:27:10 | 000,476,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll

[2016/04/21 20:27:10 | 000,315,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll

[2016/04/21 20:27:10 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll

[2016/04/21 20:27:09 | 002,131,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl

[2016/04/21 20:27:09 | 000,800,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll

[2016/04/21 20:27:08 | 001,155,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll

[2016/04/21 20:27:08 | 000,571,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll

[2016/04/21 20:27:08 | 000,115,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe

[2016/04/21 20:27:07 | 000,615,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll

[2016/04/21 20:27:07 | 000,489,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll

[2016/04/21 20:27:07 | 000,341,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec

[2016/04/21 20:27:07 | 000,168,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll

[2016/04/21 20:27:06 | 001,359,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll

[2016/04/21 20:27:06 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe

[2016/04/21 20:27:06 | 000,092,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll

[2016/04/21 20:27:05 | 006,052,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll

[2016/04/21 20:27:05 | 000,817,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll

[2016/04/21 20:27:05 | 000,814,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll

[2016/04/21 20:27:04 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec

[2016/04/21 20:27:04 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll

[2016/04/21 20:27:04 | 000,088,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll

[2016/04/21 20:26:52 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mtxoci.dll

[2016/04/21 20:26:51 | 000,176,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msorcl32.dll

[2016/04/21 20:26:51 | 000,111,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mtxoci.dll

[2016/04/21 20:26:42 | 002,084,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ole32.dll

[2016/04/21 20:26:42 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll

[2016/04/21 20:26:41 | 003,943,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe

[2016/04/21 20:26:41 | 000,631,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winresume.efi

[2016/04/21 20:26:40 | 003,998,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe

[2016/04/21 20:26:37 | 005,551,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe

[2016/04/21 20:26:37 | 001,732,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll

[2016/04/21 20:26:37 | 001,212,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rpcrt4.dll

[2016/04/21 20:26:37 | 000,706,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winload.efi

[2016/04/21 20:26:37 | 000,463,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certcli.dll

[2016/04/21 20:26:37 | 000,342,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certcli.dll

[2016/04/21 20:26:36 | 001,163,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll

[2016/04/21 20:26:36 | 000,880,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\advapi32.dll

[2016/04/21 20:26:36 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll

[2016/04/21 20:26:36 | 000,419,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll

[2016/04/21 20:26:36 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll

[2016/04/21 20:26:36 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe

[2016/04/21 20:26:36 | 000,312,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll

[2016/04/21 20:26:36 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rstrui.exe

[2016/04/21 20:26:36 | 000,243,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll

[2016/04/21 20:26:36 | 000,215,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll

[2016/04/21 20:26:36 | 000,190,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rpchttp.dll

[2016/04/21 20:26:36 | 000,148,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\appidpolicyconverter.exe

[2016/04/21 20:26:36 | 000,141,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rpchttp.dll

[2016/04/21 20:26:36 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll

[2016/04/21 20:26:36 | 000,112,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\smss.exe

[2016/04/21 20:26:36 | 000,063,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\setbcdlocale.dll

[2016/04/21 20:26:36 | 000,059,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\appidapi.dll

[2016/04/21 20:26:36 | 000,050,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\appidapi.dll

[2016/04/21 20:26:36 | 000,050,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srclient.dll

[2016/04/21 20:26:36 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll

[2016/04/21 20:26:36 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptbase.dll

[2016/04/21 20:26:36 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll

[2016/04/21 20:26:36 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll

[2016/04/21 20:26:36 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll

[2016/04/21 20:26:36 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll

[2016/04/21 20:26:35 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\adtschema.dll

[2016/04/21 20:26:35 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\adtschema.dll

[2016/04/21 20:26:35 | 000,146,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msaudite.dll

[2016/04/21 20:26:35 | 000,146,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msaudite.dll

[2016/04/21 20:26:35 | 000,064,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\auditpol.exe

[2016/04/21 20:26:35 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msobjs.dll

[2016/04/21 20:26:35 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msobjs.dll

[2016/04/21 20:26:35 | 000,050,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\auditpol.exe

[2016/04/21 20:26:35 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe

[2016/04/21 20:26:35 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\appidcertstorecheck.exe

[2016/04/21 20:26:35 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll

[2016/04/21 20:26:35 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe

[2016/04/21 20:26:35 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\apisetschema.dll

[2016/04/21 20:26:35 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\apisetschema.dll

[2016/04/21 20:26:35 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll

[2016/04/21 20:26:35 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll

[2016/04/21 20:26:35 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll

[2016/04/21 20:26:35 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll

[2016/04/21 20:26:35 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll

[2016/04/21 20:26:35 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll

[2016/04/21 20:26:35 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe

[2016/04/21 20:26:25 | 001,386,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\appraiser.dll

[2016/04/21 20:26:25 | 001,169,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aeinv.dll

[2016/04/21 20:26:25 | 000,698,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\generaltel.dll

[2016/04/21 20:26:25 | 000,499,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\devinv.dll

[2016/04/21 20:26:25 | 000,279,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\invagent.dll

[2016/04/21 20:26:25 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aepic.dll

[2016/04/21 20:26:25 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\acmigration.dll

[2016/04/21 20:26:25 | 000,038,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\CompatTelRunner.exe

[2016/04/21 20:26:23 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll

[2016/04/21 20:26:23 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll

[2016/04/21 20:25:15 | 000,396,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\webio.dll

[2016/04/21 20:25:15 | 000,316,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\webio.dll

[2016/04/21 20:25:09 | 000,275,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\InkEd.dll

[2016/04/21 20:25:09 | 000,216,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\InkEd.dll

[2016/04/21 20:25:07 | 000,760,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\samsrv.dll

[2016/04/21 20:25:06 | 000,106,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\samlib.dll

[2016/04/17 18:47:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype

[2016/04/12 21:07:54 | 000,000,000 | ---D | C] -- C:\Windows\pss

[2016/04/08 19:38:44 | 000,000,000 | ---D | C] -- C:\Users\Alvaro\AppData\Local\SHAREit

[2016/04/08 19:38:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LenovoSHAREit

[2016/04/03 21:04:49 | 000,000,000 | ---D | C] -- C:\Users\Alvaro\AppData\Local\CrashDumps

 

========== Files - Modified Within 30 Days ==========

 

[2016/04/28 07:03:00 | 000,032,208 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2016/04/28 07:03:00 | 000,032,208 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2016/04/28 06:59:56 | 000,781,782 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2016/04/28 06:59:56 | 000,654,138 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2016/04/28 06:59:56 | 000,122,010 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2016/04/28 06:57:45 | 000,001,032 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2016/04/28 06:57:33 | 000,192,216 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys

[2016/04/28 06:26:00 | 000,001,050 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1958321615-1833289119-3903013992-1000UA.job

[2016/04/28 06:25:08 | 000,001,036 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2016/04/28 03:34:30 | 000,437,576 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2016/04/28 03:34:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2016/04/28 03:34:13 | 2678,185,984 | -HS- | M] () -- C:\hiberfil.sys

[2016/04/28 03:33:04 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\spu_storage.bin

[2016/04/27 21:23:31 | 000,006,040 | ---- | M] () -- C:\Users\Alvaro\Documents\a2settings.ini

[2016/04/27 21:23:31 | 000,000,064 | ---- | M] () -- C:\Users\Alvaro\Documents\a2whitelist.ini

[2016/04/27 20:14:45 | 000,028,272 | ---- | M] () -- C:\Windows\SysNative\drivers\TrueSight.sys

[2016/04/27 20:14:00 | 000,000,869 | ---- | M] () -- C:\Users\Public\Desktop\RogueKiller.lnk

[2016/04/27 19:19:07 | 000,109,272 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\mbamchameleon.sys

[2016/04/27 18:58:25 | 000,000,336 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForAlvaro.job

[2016/04/27 18:45:44 | 000,001,117 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2016/04/21 18:55:05 | 000,000,998 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1958321615-1833289119-3903013992-1000Core.job

[2016/04/12 21:28:47 | 000,002,192 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[2016/04/08 19:38:41 | 000,001,121 | ---- | M] () -- C:\Users\Public\Desktop\SHAREit.lnk

[2016/04/04 12:14:06 | 000,038,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\CompatTelRunner.exe

[2016/04/04 12:02:17 | 001,169,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aeinv.dll

[2016/04/03 17:19:16 | 000,000,600 | ---- | M] () -- C:\Users\Alvaro\PUTTY.RND

[2016/04/02 07:08:13 | 001,386,496 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\appraiser.dll

[2016/03/30 18:40:26 | 000,004,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll

[2016/03/30 18:28:08 | 000,571,904 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll

[2016/03/30 18:28:00 | 000,066,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll

[2016/03/30 18:27:35 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll

[2016/03/30 18:27:33 | 000,417,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec

[2016/03/30 18:27:19 | 000,088,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll

[2016/03/30 18:25:33 | 006,052,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll

[2016/03/30 18:21:29 | 000,034,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll

[2016/03/30 18:19:04 | 000,615,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll

[2016/03/30 18:17:56 | 000,144,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe

[2016/03/30 18:17:56 | 000,114,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe

[2016/03/30 18:17:47 | 000,817,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll

[2016/03/30 18:17:39 | 000,814,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll

[2016/03/30 18:11:12 | 000,968,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe

[2016/03/30 18:08:07 | 000,489,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll

[2016/03/30 18:00:50 | 000,077,824 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll

[2016/03/30 17:59:38 | 000,107,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll

[2016/03/30 17:57:14 | 000,199,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll

[2016/03/30 17:56:41 | 000,092,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll

[2016/03/30 17:55:48 | 000,315,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll

[2016/03/30 17:53:18 | 000,152,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll

[2016/03/30 17:52:58 | 000,062,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll

[2016/03/30 17:52:36 | 000,047,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll

[2016/03/30 17:52:30 | 000,341,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec

[2016/03/30 17:52:15 | 000,064,000 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll

[2016/03/30 17:48:14 | 000,030,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll

[2016/03/30 17:46:41 | 000,476,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll

[2016/03/30 17:45:41 | 000,115,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe

[2016/03/30 17:45:40 | 000,663,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll

[2016/03/30 17:45:24 | 000,620,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll

[2016/03/30 17:43:29 | 000,725,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe

[2016/03/30 17:43:00 | 000,806,400 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll

[2016/03/30 17:42:16 | 002,131,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl

[2016/03/30 17:42:11 | 001,359,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll

[2016/03/30 17:34:28 | 000,060,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll

[2016/03/30 17:33:46 | 000,091,136 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll

[2016/03/30 17:31:51 | 000,168,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll

[2016/03/30 17:31:12 | 000,076,288 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll

[2016/03/30 17:29:26 | 000,130,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll

[2016/03/30 17:23:09 | 002,056,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl

[2016/03/30 17:22:53 | 001,155,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll

[2016/03/30 17:06:05 | 000,800,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll

[2016/03/30 17:00:46 | 000,710,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll

 

========== Files Created - No Company Name ==========

 

[2016/04/27 21:23:31 | 000,000,064 | ---- | C] () -- C:\Users\Alvaro\Documents\a2whitelist.ini

[2016/04/27 21:13:37 | 000,006,040 | ---- | C] () -- C:\Users\Alvaro\Documents\a2settings.ini

[2016/04/27 20:14:45 | 000,028,272 | ---- | C] () -- C:\Windows\SysNative\drivers\TrueSight.sys

[2016/04/27 20:14:00 | 000,000,869 | ---- | C] () -- C:\Users\Public\Desktop\RogueKiller.lnk

[2016/04/27 18:45:44 | 000,001,117 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2016/04/08 19:38:41 | 000,001,121 | ---- | C] () -- C:\Users\Public\Desktop\SHAREit.lnk

[2016/04/03 17:01:59 | 000,000,336 | ---- | C] () -- C:\Windows\tasks\HPCeeScheduleForAlvaro.job

[2016/02/21 19:18:54 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini

[2016/01/05 14:14:47 | 000,000,600 | ---- | C] () -- C:\Users\Alvaro\PUTTY.RND

[2015/12/19 17:46:43 | 000,000,000 | ---- | C] () -- C:\Windows\firstboot.dat

[2015/11/10 16:59:34 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2015/11/10 16:55:42 | 000,000,000 | -H-- | C] () -- C:\ProgramData\DP45977C.lfl

[2015/11/10 16:51:22 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe

[2015/11/10 16:51:22 | 000,048,856 | ---- | C] () -- C:\Windows\runSW.exe

[2015/11/10 16:47:27 | 001,924,608 | ---- | C] () -- C:\Windows\SysWow64\hsaservices.dll

[2015/11/10 16:47:27 | 000,339,968 | ---- | C] () -- C:\Windows\SysWow64\newhsacore.dll

[2015/11/10 16:47:27 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat

[2015/11/10 16:47:27 | 000,073,216 | ---- | C] () -- C:\Windows\SysWow64\hsaumd.dll

[2015/11/10 16:47:26 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat

[2015/11/10 16:47:24 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

[2015/11/10 16:47:22 | 000,995,342 | ---- | C] () -- C:\Windows\SysWow64\amdocl_as32.exe

[2015/11/10 16:47:22 | 000,798,734 | ---- | C] () -- C:\Windows\SysWow64\amdocl_ld32.exe

[2014/11/13 16:07:22 | 000,765,724 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2014/09/04 01:07:18 | 000,038,912 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll

 

========== ZeroAccess Check ==========

 

[2009/07/13 22:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2016/01/22 00:19:58 | 014,179,840 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2016/01/22 00:05:58 | 012,877,824 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 19:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 21:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 19:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 

< End of report >

OTL logfile created on: 28/04/2016 07:01:00 a.m. - Run 2

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Alvaro\Downloads

64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.18282)

Locale: 0000140A | Country: Costa Rica | Language: ESC | Date Format: dd/MM/yyyy

 

3,33 Gb Total Physical Memory | 1,68 Gb Available Physical Memory | 50,60% Memory free

6,65 Gb Paging File | 4,63 Gb Available in Paging File | 69,69% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 447,50 Gb Total Space | 379,22 Gb Free Space | 84,74% Space Free | Partition Type: NTFS

Drive Q: | 16,79 Gb Total Space | 0,01 Gb Free Space | 0,04% Space Free | Partition Type: NTFS

 

Computer Name: ALVARO-PC | User Name: Alvaro | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 

========== Processes (SafeList) ==========

 

PRC - [2016/04/27 21:25:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Alvaro\Downloads\OTL.exe

PRC - [2016/03/23 08:13:34 | 007,139,256 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\avastui.exe

PRC - [2016/03/10 14:07:30 | 001,136,608 | ---- | M] (Malwarebytes) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

PRC - [2016/03/10 14:07:28 | 001,514,464 | ---- | M] (Malwarebytes) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

PRC - [2016/03/10 14:07:20 | 009,926,112 | ---- | M] (Malwarebytes) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

PRC - [2016/02/09 12:15:32 | 000,237,096 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe

PRC - [2015/12/13 23:48:02 | 000,082,128 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2015/12/10 16:11:36 | 001,360,352 | ---- | M] (Lenovo) -- C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe

PRC - [2015/03/23 14:00:26 | 000,066,000 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Message Center Plus\MCPLaunch.exe

PRC - [2015/01/08 22:46:46 | 000,641,992 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe

PRC - [2014/12/11 02:47:00 | 000,111,048 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\micmute.exe

PRC - [2014/12/05 15:34:38 | 000,317,224 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\Lenovo\QuickControl\QuickControlService.exe

PRC - [2014/12/05 15:34:36 | 000,288,536 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\Lenovo\QuickControl\QuickControl.exe

PRC - [2014/11/13 15:07:00 | 001,668,848 | ---- | M] (Lenovo) -- C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe

PRC - [2014/11/13 15:07:00 | 000,127,216 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE

PRC - [2014/08/07 16:42:36 | 000,197,408 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe

PRC - [2014/08/07 16:42:30 | 000,295,712 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe

PRC - [2014/08/07 16:42:24 | 000,072,992 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe

PRC - [2014/08/07 16:42:00 | 000,059,168 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Communications Utility\CamMute.exe

PRC - [2014/04/01 00:45:20 | 000,126,512 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe

 

 

========== Modules (No Company Name) ==========

 

MOD - [2016/04/28 03:16:00 | 007,378,944 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\03e2061b19a18fb0f6498d2c37f355bf\System.Xml.ni.dll

MOD - [2016/04/28 03:15:03 | 000,974,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\74618fce57dc493df7103981ad60bd92\System.Configuration.ni.dll

MOD - [2016/04/28 03:14:41 | 007,518,208 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\e6b9d8e012319c21c74b503b972c7784\System.Core.ni.dll

MOD - [2016/04/28 03:14:32 | 009,981,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\c75082e107212b28aaab6d83dad9de97\System.ni.dll

MOD - [2016/04/28 03:14:23 | 018,111,488 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\affcb83bba04f782c2586a1788330891\mscorlib.ni.dll

MOD - [2016/04/27 18:32:10 | 000,157,376 | ---- | M] () -- C:\Program Files (x86)\Microsoft Office\root\Office16\JitV.dll

MOD - [2016/04/17 18:37:01 | 000,509,344 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\ffl2.dll

MOD - [2016/02/09 12:15:34 | 000,113,496 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\log.dll

MOD - [2016/02/09 12:15:32 | 000,133,768 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll

MOD - [2016/01/03 17:15:43 | 040,539,648 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\libcef.dll

 

 

========== Services (SafeList) ==========

 

SRV:64bit: - [2016/03/30 18:17:56 | 000,114,688 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)

SRV:64bit: - [2016/03/14 04:32:18 | 000,173,744 | ---- | M] (Lenovo.) [Auto | Running] -- C:\Windows\SysNative\ibmpmsvc.exe -- (IBMPMSVC)

SRV:64bit: - [2016/02/09 12:15:32 | 000,237,096 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)

SRV:64bit: - [2015/12/10 16:12:02 | 000,272,864 | ---- | M] (Lenovo) [On_Demand | Stopped] -- C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe -- (LSCWinService)

SRV:64bit: - [2015/07/22 18:02:54 | 001,390,592 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\diagtrack.dll -- (DiagTrack)

SRV:64bit: - [2014/12/11 02:47:00 | 000,111,048 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\micmute.exe -- (LENOVO.MICMUTE)

SRV:64bit: - [2014/11/06 01:00:16 | 000,087,384 | ---- | M] (Alps Electric Co., Ltd.) [Auto | Running] -- C:\Program Files\Apoint2K\HidMonitorSvc.exe -- (ApHidMonitorService)

SRV:64bit: - [2014/09/18 18:21:36 | 000,049,872 | ---- | M] (Lenovo.) [On_Demand | Stopped] -- C:\Windows\SysNative\TPHDEXLG64.exe -- (TPHDEXLGSVC)

SRV:64bit: - [2014/09/03 21:00:10 | 000,239,616 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV:64bit: - [2014/08/07 16:42:36 | 000,197,408 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe -- (LENOVO.TVTVCAM)

SRV:64bit: - [2014/08/07 16:42:24 | 000,072,992 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe -- (LENOVO.TPKNRSVC)

SRV:64bit: - [2014/08/07 16:42:00 | 000,059,168 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\Communications Utility\CamMute.exe -- (LENOVO.CAMMUTE)

SRV:64bit: - [2014/07/08 19:51:34 | 000,115,184 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe -- (Lenovo.VIRTSCRLSVC)

SRV:64bit: - [2014/06/09 20:15:44 | 000,124,400 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\tphkload.exe -- (TPHKLOAD)

SRV:64bit: - [2014/04/01 00:45:20 | 000,126,512 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe -- (TPHKSVC)

SRV:64bit: - [2014/03/31 20:39:34 | 009,954,096 | ---- | M] (DisplayLink Corp.) [Auto | Running] -- C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe -- (DisplayLinkService)

SRV:64bit: - [2014/02/21 17:30:46 | 000,021,552 | ---- | M] (Lenovo) [Auto | Running] -- C:\Program Files\Lenovo\Lenovo Peer Connect\LenovoDiscoverySvc.exe -- (lnvDiscoveryWinSvc)

SRV:64bit: - [2013/05/26 23:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV:64bit: - [2009/07/13 19:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)

SRV - [2016/03/10 14:07:30 | 001,136,608 | ---- | M] (Malwarebytes) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2016/03/10 14:07:28 | 001,514,464 | ---- | M] (Malwarebytes) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)

SRV - [2016/02/18 01:02:06 | 000,026,680 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe -- (HPSupportSolutionsFrameworkService)

SRV - [2016/01/29 16:11:22 | 000,327,296 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2016/01/20 21:09:16 | 000,031,176 | ---- | M] (SHAREit Technologies Co.Ltd) [On_Demand | Stopped] -- C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.Service.exe -- (ShareItSvc)

SRV - [2016/01/13 18:36:00 | 000,021,536 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\Lenovo\System Update\SUService.exe -- (SUService)

SRV - [2015/12/13 23:48:02 | 000,082,128 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2015/11/05 20:36:48 | 000,105,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2015/01/09 12:18:28 | 000,293,416 | ---- | M] (Aviata, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Lenovo Registration\EngageService.exe -- (LenovoProdRegManager)

SRV - [2014/12/05 19:49:10 | 000,619,776 | ---- | M] (Lenovo) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\LENOVO\easyplussdk\bin\EPHotspot64.exe -- (Lenovo EasyPlus Hotspot)

SRV - [2014/12/05 15:34:38 | 000,317,224 | ---- | M] (Lenovo Group Limited) [On_Demand | Running] -- C:\Program Files (x86)\Lenovo\QuickControl\QuickControlService.exe -- (QuickControlService)

SRV - [2014/12/05 15:34:32 | 000,061,232 | ---- | M] (Lenovo Group Limited) [Auto | Stopped] -- C:\Program Files (x86)\Lenovo\QuickControl\QuickControlMasterSvc.exe -- (QuickControlMasterSvc)

SRV - [2014/11/13 15:07:00 | 001,668,848 | ---- | M] (Lenovo) [On_Demand | Running] -- C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe -- (Power Manager DBC Service)

SRV - [2014/11/13 15:07:00 | 001,664,752 | ---- | M] (Lenovo Group Limited) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.exe -- (PwmEWSvc)

SRV - [2014/07/03 11:22:24 | 000,101,592 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTDevMgr.exe -- (BTDevManager)

SRV - [2014/07/03 11:22:24 | 000,050,392 | ---- | M] (Realtek Semiconductor Corporation) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek Bluetooth\RtkBleServ.exe -- (RtkBleServ)

SRV - [2014/07/03 11:22:24 | 000,043,224 | ---- | M] (Realtek Semiconductor Corporation) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek Bluetooth\AvrcpService.exe -- (AvrcpService)

SRV - [2014/03/20 16:49:18 | 000,067,224 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

 

 

========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2016/04/28 06:57:33 | 000,192,216 | ---- | M] (Malwarebytes) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys -- (MBAMSwissArmy)

DRV:64bit: - [2016/04/27 20:14:45 | 000,028,272 | ---- | M] () [Kernel | On_Demand | Unknown] -- C:\Windows\SysNative\drivers\TrueSight.sys -- (TrueSight)

DRV:64bit: - [2016/03/22 10:51:39 | 000,037,144 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswKbd.sys -- (aswKbd)

DRV:64bit: - [2016/03/14 04:32:18 | 000,072,784 | ---- | M] (Lenovo.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ibmpmdrv.sys -- (IBMPMDRV)

DRV:64bit: - [2016/03/10 14:09:06 | 000,064,896 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mwac.sys -- (MBAMWebAccessControl)

DRV:64bit: - [2016/03/10 14:08:54 | 000,027,008 | ---- | M] (Malwarebytes) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2016/03/09 18:16:26 | 001,070,904 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswsnx.sys -- (aswSnx)

DRV:64bit: - [2016/03/09 18:16:25 | 000,107,792 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswmonflt.sys -- (aswMonFlt)

DRV:64bit: - [2016/02/29 08:25:16 | 000,463,744 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswsp.sys -- (aswSP)

DRV:64bit: - [2016/02/13 16:26:44 | 000,287,016 | ---- | M] (AVAST Software) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswvmm.sys -- (aswVmm)

DRV:64bit: - [2016/02/09 12:15:38 | 000,165,344 | ---- | M] (AVAST Software) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aswStm.sys -- (aswStm)

DRV:64bit: - [2016/02/09 12:15:38 | 000,103,064 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)

DRV:64bit: - [2016/02/09 12:15:38 | 000,074,544 | ---- | M] (AVAST Software) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswRvrt.sys -- (aswRvrt)

DRV:64bit: - [2016/02/09 12:15:38 | 000,037,656 | ---- | M] (AVAST Software) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aswHwid.sys -- (aswHwid)

DRV:64bit: - [2016/02/05 13:03:08 | 000,147,904 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)

DRV:64bit: - [2015/05/19 01:30:54 | 001,709,320 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)

DRV:64bit: - [2014/11/13 15:07:00 | 000,020,736 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\TPPWR64V.SYS -- (TPPWRIF)

DRV:64bit: - [2014/09/29 23:27:28 | 000,571,696 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Apfiltr.sys -- (ApfiltrService)

DRV:64bit: - [2014/09/26 02:45:50 | 000,580,312 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtkBtfilter.sys -- (RtkBtFilter)

DRV:64bit: - [2014/09/18 18:21:36 | 000,155,856 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ApsX64.sys -- (Shockprf)

DRV:64bit: - [2014/09/18 18:21:36 | 000,029,392 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ApsHM64.sys -- (TPDIGIMN)

DRV:64bit: - [2014/09/11 10:59:04 | 002,599,128 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtsuvc.sys -- (rtsuvc)

DRV:64bit: - [2014/09/03 21:15:56 | 015,952,896 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)

DRV:64bit: - [2014/09/03 20:56:00 | 000,557,056 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)

DRV:64bit: - [2014/08/04 06:24:06 | 003,502,296 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtwlane.sys -- (RTWlanE)

DRV:64bit: - [2014/06/21 11:01:22 | 000,094,720 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)

DRV:64bit: - [2014/02/16 10:23:54 | 000,060,640 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)

DRV:64bit: - [2014/01/14 00:17:20 | 000,466,136 | ---- | M] (Realsil Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsPer.sys -- (RTSPER)

DRV:64bit: - [2013/11/05 21:40:46 | 000,083,176 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_sata.sys -- (amd_sata)

DRV:64bit: - [2013/11/05 21:40:46 | 000,043,240 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_xata.sys -- (amd_xata)

DRV:64bit: - [2013/10/01 20:22:20 | 000,056,832 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2013/08/27 00:08:42 | 000,883,928 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2013/05/27 13:09:38 | 000,227,648 | ---- | M] (Advanced Micro Devices, INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdxhc.sys -- (amdxhc)

DRV:64bit: - [2013/05/27 13:09:38 | 000,106,816 | ---- | M] (Advanced Micro Devices, INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdhub30.sys -- (amdhub30)

DRV:64bit: - [2012/08/23 08:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV:64bit: - [2012/08/23 08:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)

DRV:64bit: - [2012/03/01 00:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2011/12/26 03:10:44 | 000,040,248 | ---- | M] (Lenovo Information Product(ShenZhen China) Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\psadd.sys -- (psadd)

DRV:64bit: - [2011/05/29 04:48:04 | 000,040,248 | ---- | M] (Lenovo Information Product(ShenZhen China) Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tvti2c.sys -- (TVTI2C)

DRV:64bit: - [2011/03/11 00:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011/03/11 00:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010/11/20 21:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)

DRV:64bit: - [2010/11/20 21:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2009/07/13 19:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009/07/13 19:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009/07/13 19:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009/07/13 18:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)

DRV:64bit: - [2009/07/13 18:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)

DRV:64bit: - [2009/06/10 14:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009/06/10 14:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009/06/10 14:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009/06/10 14:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV - [2009/07/13 19:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 

========== Standard Registry (SafeList) ==========

 

 

========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {5FEA6CD4-231C-4B7C-9C0E-58E1F21F3D4A}

IE:64bit: - HKLM\..\SearchScopes\{5FEA6CD4-231C-4B7C-9C0E-58E1F21F3D4A}: "URL" = http://www.bing.com/...=IE11TR&pc=LCTE

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {5FEA6CD4-231C-4B7C-9C0E-58E1F21F3D4A}

IE - HKLM\..\SearchScopes\{5FEA6CD4-231C-4B7C-9C0E-58E1F21F3D4A}: "URL" = http://www.bing.com/...=IE11TR&pc=LCTE

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo13.msn.com/?pc=LCTE

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://mystart.lenovo.com[binary data]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/

IE - HKCU\..\SearchScopes,DefaultScope = {B67E77CA-4525-4139-B855-6C6843F0D796}

IE - HKCU\..\SearchScopes\{B67E77CA-4525-4139-B855-6C6843F0D796}: "URL" = https://www.google.c...utputEncoding?}

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

========== FireFox ==========

 

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@microsoft.com/Lync,version=15.0: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Alvaro\AppData\Local\Google\Update\1.3.29.5\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Alvaro\AppData\Local\Google\Update\1.3.29.5\npGoogleUpdate3.dll (Google Inc.)

 

64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF [2016/02/11 13:46:02 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2016/02/11 13:46:02 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016/02/11 13:46:02 | 000,000,000 | ---D | M]

 

 

========== Chrome  ==========

 

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd\15.1120.0.4_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\cnciopoikihiagdjbjpnocolokfelagl\2.16.427.0_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.60_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\elicpjhcidhpjomhibiffojpinpmmpil\1.97.51_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiiaigjnkhngdbnoookogelabohpglmd\2.6.45_0\

CHR - Extension: No name found = C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\

 

O1 HOSTS File: ([2009/06/10 15:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O4:64bit: - HKLM..\Run: [BtServer] C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe (Realtek Semiconductor Corporation)

O4:64bit: - HKLM..\Run: [LENOVO.TPKNRRES] C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe (Lenovo Group Limited)

O4:64bit: - HKLM..\Run: [RtsCM] C:\Windows\RtsCM64.exe (Realtek Semiconductor Corp.)

O4:64bit: - HKLM..\Run: [TpShocks] C:\Windows\SysNative\TpShocks.exe (Lenovo.)

O4 - HKLM..\Run: [AvastUI.exe] C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)

O4 - HKLM..\Run: [PWMTRV] C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL (Lenovo Group Limited)

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe (Advanced Micro Devices, Inc.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 186.177.66.3 186.177.65.3

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{002DE976-64C2-4AEA-8FEA-96579DCC11D1}: DhcpNameServer = 192.168.1.1 186.177.66.3 186.177.65.3

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{90B3B6C7-B5AC-409E-B3D0-D1EC6E421D75}: DhcpNameServer = 172.16.80.99 172.16.48.147 172.16.48.146

O18:64bit: - Protocol\Handler\mso-minsb.16 - No CLSID value found

O18:64bit: - Protocol\Handler\mso-minsb-roaming.16 - No CLSID value found

O18:64bit: - Protocol\Handler\osf.16 - No CLSID value found

O18:64bit: - Protocol\Handler\osf-roaming.16 - No CLSID value found

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2014/05/19 00:43:30 | 000,000,049 | -HS- | M] () - Q:\AUTORUN.INF -- [ NTFS ]

O33 - MountPoints2\{894f0fc6-87f7-11e5-90be-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{894f0fc6-87f7-11e5-90be-806e6f6e6963}\Shell\AutoRun\command - "" = Q:\LenovoQDrive.cmd -- [2014/06/05 02:27:20 | 000,000,065 | -HS- | M] ()

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

========== Files/Folders - Created Within 30 Days ==========

 

[2016/04/28 03:12:49 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2016/04/27 21:23:03 | 000,000,000 | ---D | C] -- C:\Users\Alvaro\Documents\Reports

[2016/04/27 21:13:39 | 000,000,000 | ---D | C] -- C:\Users\Alvaro\Documents\Quarantine

[2016/04/27 21:13:38 | 000,000,000 | ---D | C] -- C:\Users\Alvaro\Documents\Logs

[2016/04/27 21:10:48 | 003,723,376 | ---- | C] (Emsisoft Ltd) -- C:\Users\Alvaro\Documents\Start Emergency Kit Scanner.exe

[2016/04/27 21:10:48 | 003,723,376 | ---- | C] (Emsisoft Ltd) -- C:\Users\Alvaro\Documents\Start Commandline Scanner.exe

[2016/04/27 21:10:47 | 000,000,000 | ---D | C] -- C:\Users\Alvaro\Documents\bin64

[2016/04/27 21:10:47 | 000,000,000 | ---D | C] -- C:\Users\Alvaro\Documents\bin32

[2016/04/27 20:14:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller

[2016/04/27 20:13:51 | 000,000,000 | ---D | C] -- C:\Program Files\RogueKiller

[2016/04/27 20:13:44 | 000,000,000 | ---D | C] -- C:\ProgramData\RogueKiller

[2016/04/27 19:26:32 | 000,000,000 | ---D | C] -- C:\Program Files\HitmanPro

[2016/04/27 19:25:25 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro

[2016/04/27 19:20:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes' Anti-Malware (portable)

[2016/04/27 19:18:58 | 000,000,000 | ---D | C] -- C:\Users\Alvaro\Desktop\mbar

[2016/04/27 19:09:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER

[2016/04/27 18:47:10 | 000,192,216 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys

[2016/04/27 18:45:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

[2016/04/27 18:45:36 | 000,109,272 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\mbamchameleon.sys

[2016/04/27 18:45:36 | 000,064,896 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mwac.sys

[2016/04/27 18:45:36 | 000,027,008 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\mbam.sys

[2016/04/27 18:45:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes Anti-Malware

[2016/04/27 18:45:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2016/04/21 20:27:16 | 000,114,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe

[2016/04/21 20:27:16 | 000,091,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll

[2016/04/21 20:27:16 | 000,076,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll

[2016/04/21 20:27:16 | 000,064,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll

[2016/04/21 20:27:16 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll

[2016/04/21 20:27:16 | 000,047,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll

[2016/04/21 20:27:16 | 000,034,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll

[2016/04/21 20:27:16 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll

[2016/04/21 20:27:15 | 000,725,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe

[2016/04/21 20:27:15 | 000,130,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll

[2016/04/21 20:27:15 | 000,107,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll

[2016/04/21 20:27:15 | 000,077,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll

[2016/04/21 20:27:15 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll

[2016/04/21 20:27:13 | 000,710,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll

[2016/04/21 20:27:13 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll

[2016/04/21 20:27:13 | 000,062,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll

[2016/04/21 20:27:12 | 002,056,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl

[2016/04/21 20:27:11 | 000,968,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe

[2016/04/21 20:27:11 | 000,663,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll

[2016/04/21 20:27:11 | 000,620,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll

[2016/04/21 20:27:11 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll

[2016/04/21 20:27:10 | 000,806,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll

[2016/04/21 20:27:10 | 000,476,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll

[2016/04/21 20:27:10 | 000,315,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll

[2016/04/21 20:27:10 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll

[2016/04/21 20:27:09 | 002,131,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl

[2016/04/21 20:27:09 | 000,800,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll

[2016/04/21 20:27:08 | 001,155,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll

[2016/04/21 20:27:08 | 000,571,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll

[2016/04/21 20:27:08 | 000,115,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe

[2016/04/21 20:27:07 | 000,615,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll

[2016/04/21 20:27:07 | 000,489,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll

[2016/04/21 20:27:07 | 000,341,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec

[2016/04/21 20:27:07 | 000,168,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll

[2016/04/21 20:27:06 | 001,359,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll

[2016/04/21 20:27:06 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe

[2016/04/21 20:27:06 | 000,092,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll

[2016/04/21 20:27:05 | 006,052,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll

[2016/04/21 20:27:05 | 000,817,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll

[2016/04/21 20:27:05 | 000,814,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll

[2016/04/21 20:27:04 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec

[2016/04/21 20:27:04 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll

[2016/04/21 20:27:04 | 000,088,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll

[2016/04/21 20:26:52 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mtxoci.dll

[2016/04/21 20:26:51 | 000,176,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msorcl32.dll

[2016/04/21 20:26:51 | 000,111,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mtxoci.dll

[2016/04/21 20:26:42 | 002,084,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ole32.dll

[2016/04/21 20:26:42 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll

[2016/04/21 20:26:41 | 003,943,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe

[2016/04/21 20:26:41 | 000,631,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winresume.efi

[2016/04/21 20:26:40 | 003,998,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe

[2016/04/21 20:26:37 | 005,551,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe

[2016/04/21 20:26:37 | 001,732,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll

[2016/04/21 20:26:37 | 001,212,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rpcrt4.dll

[2016/04/21 20:26:37 | 000,706,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winload.efi

[2016/04/21 20:26:37 | 000,463,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certcli.dll

[2016/04/21 20:26:37 | 000,342,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certcli.dll

[2016/04/21 20:26:36 | 001,163,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll

[2016/04/21 20:26:36 | 000,880,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\advapi32.dll

[2016/04/21 20:26:36 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll

[2016/04/21 20:26:36 | 000,419,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll

[2016/04/21 20:26:36 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll

[2016/04/21 20:26:36 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe

[2016/04/21 20:26:36 | 000,312,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll

[2016/04/21 20:26:36 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rstrui.exe

[2016/04/21 20:26:36 | 000,243,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll

[2016/04/21 20:26:36 | 000,215,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll

[2016/04/21 20:26:36 | 000,190,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rpchttp.dll

[2016/04/21 20:26:36 | 000,148,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\appidpolicyconverter.exe

[2016/04/21 20:26:36 | 000,141,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rpchttp.dll

[2016/04/21 20:26:36 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll

[2016/04/21 20:26:36 | 000,112,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\smss.exe

[2016/04/21 20:26:36 | 000,063,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\setbcdlocale.dll

[2016/04/21 20:26:36 | 000,059,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\appidapi.dll

[2016/04/21 20:26:36 | 000,050,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\appidapi.dll

[2016/04/21 20:26:36 | 000,050,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srclient.dll

[2016/04/21 20:26:36 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll

[2016/04/21 20:26:36 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptbase.dll

[2016/04/21 20:26:36 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll

[2016/04/21 20:26:36 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll

[2016/04/21 20:26:36 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll

[2016/04/21 20:26:36 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll

[2016/04/21 20:26:35 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\adtschema.dll

[2016/04/21 20:26:35 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\adtschema.dll

[2016/04/21 20:26:35 | 000,146,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msaudite.dll

[2016/04/21 20:26:35 | 000,146,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msaudite.dll

[2016/04/21 20:26:35 | 000,064,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\auditpol.exe

[2016/04/21 20:26:35 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msobjs.dll

[2016/04/21 20:26:35 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msobjs.dll

[2016/04/21 20:26:35 | 000,050,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\auditpol.exe

[2016/04/21 20:26:35 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe

[2016/04/21 20:26:35 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\appidcertstorecheck.exe

[2016/04/21 20:26:35 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll

[2016/04/21 20:26:35 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe

[2016/04/21 20:26:35 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\apisetschema.dll

[2016/04/21 20:26:35 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\apisetschema.dll

[2016/04/21 20:26:35 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll

[2016/04/21 20:26:35 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll

[2016/04/21 20:26:35 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll

[2016/04/21 20:26:35 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll

[2016/04/21 20:26:35 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll

[2016/04/21 20:26:35 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll

[2016/04/21 20:26:35 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll

[2016/04/21 20:26:35 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll

[2016/04/21 20:26:35 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe

[2016/04/21 20:26:25 | 001,386,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\appraiser.dll

[2016/04/21 20:26:25 | 001,169,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aeinv.dll

[2016/04/21 20:26:25 | 000,698,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\generaltel.dll

[2016/04/21 20:26:25 | 000,499,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\devinv.dll

[2016/04/21 20:26:25 | 000,279,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\invagent.dll

[2016/04/21 20:26:25 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aepic.dll

[2016/04/21 20:26:25 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\acmigration.dll

[2016/04/21 20:26:25 | 000,038,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\CompatTelRunner.exe

[2016/04/21 20:26:23 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll

[2016/04/21 20:26:23 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll

[2016/04/21 20:25:15 | 000,396,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\webio.dll

[2016/04/21 20:25:15 | 000,316,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\webio.dll

[2016/04/21 20:25:09 | 000,275,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\InkEd.dll

[2016/04/21 20:25:09 | 000,216,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\InkEd.dll

[2016/04/21 20:25:07 | 000,760,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\samsrv.dll

[2016/04/21 20:25:06 | 000,106,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\samlib.dll

[2016/04/17 18:47:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype

[2016/04/12 21:07:54 | 000,000,000 | ---D | C] -- C:\Windows\pss

[2016/04/08 19:38:44 | 000,000,000 | ---D | C] -- C:\Users\Alvaro\AppData\Local\SHAREit

[2016/04/08 19:38:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LenovoSHAREit

[2016/04/03 21:04:49 | 000,000,000 | ---D | C] -- C:\Users\Alvaro\AppData\Local\CrashDumps

 

========== Files - Modified Within 30 Days ==========

 

[2016/04/28 07:03:00 | 000,032,208 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2016/04/28 07:03:00 | 000,032,208 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2016/04/28 06:59:56 | 000,781,782 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2016/04/28 06:59:56 | 000,654,138 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2016/04/28 06:59:56 | 000,122,010 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2016/04/28 06:57:45 | 000,001,032 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2016/04/28 06:57:33 | 000,192,216 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys

[2016/04/28 06:26:00 | 000,001,050 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1958321615-1833289119-3903013992-1000UA.job

[2016/04/28 06:25:08 | 000,001,036 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2016/04/28 03:34:30 | 000,437,576 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2016/04/28 03:34:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2016/04/28 03:34:13 | 2678,185,984 | -HS- | M] () -- C:\hiberfil.sys

[2016/04/28 03:33:04 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\spu_storage.bin

[2016/04/27 21:23:31 | 000,006,040 | ---- | M] () -- C:\Users\Alvaro\Documents\a2settings.ini

[2016/04/27 21:23:31 | 000,000,064 | ---- | M] () -- C:\Users\Alvaro\Documents\a2whitelist.ini

[2016/04/27 20:14:45 | 000,028,272 | ---- | M] () -- C:\Windows\SysNative\drivers\TrueSight.sys

[2016/04/27 20:14:00 | 000,000,869 | ---- | M] () -- C:\Users\Public\Desktop\RogueKiller.lnk

[2016/04/27 19:19:07 | 000,109,272 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\mbamchameleon.sys

[2016/04/27 18:58:25 | 000,000,336 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForAlvaro.job

[2016/04/27 18:45:44 | 000,001,117 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2016/04/21 18:55:05 | 000,000,998 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1958321615-1833289119-3903013992-1000Core.job

[2016/04/12 21:28:47 | 000,002,192 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[2016/04/08 19:38:41 | 000,001,121 | ---- | M] () -- C:\Users\Public\Desktop\SHAREit.lnk

[2016/04/04 12:14:06 | 000,038,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\CompatTelRunner.exe

[2016/04/04 12:02:17 | 001,169,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aeinv.dll

[2016/04/03 17:19:16 | 000,000,600 | ---- | M] () -- C:\Users\Alvaro\PUTTY.RND

[2016/04/02 07:08:13 | 001,386,496 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\appraiser.dll

[2016/03/30 18:40:26 | 000,004,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll

[2016/03/30 18:28:08 | 000,571,904 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll

[2016/03/30 18:28:00 | 000,066,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll

[2016/03/30 18:27:35 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll

[2016/03/30 18:27:33 | 000,417,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec

[2016/03/30 18:27:19 | 000,088,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll

[2016/03/30 18:25:33 | 006,052,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll

[2016/03/30 18:21:29 | 000,034,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll

[2016/03/30 18:19:04 | 000,615,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll

[2016/03/30 18:17:56 | 000,144,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe

[2016/03/30 18:17:56 | 000,114,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe

[2016/03/30 18:17:47 | 000,817,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll

[2016/03/30 18:17:39 | 000,814,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll

[2016/03/30 18:11:12 | 000,968,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe

[2016/03/30 18:08:07 | 000,489,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll

[2016/03/30 18:00:50 | 000,077,824 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll

[2016/03/30 17:59:38 | 000,107,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll

[2016/03/30 17:57:14 | 000,199,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll

[2016/03/30 17:56:41 | 000,092,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll

[2016/03/30 17:55:48 | 000,315,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll

[2016/03/30 17:53:18 | 000,152,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll

[2016/03/30 17:52:58 | 000,062,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll

[2016/03/30 17:52:36 | 000,047,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll

[2016/03/30 17:52:30 | 000,341,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec

[2016/03/30 17:52:15 | 000,064,000 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll

[2016/03/30 17:48:14 | 000,030,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll

[2016/03/30 17:46:41 | 000,476,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll

[2016/03/30 17:45:41 | 000,115,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe

[2016/03/30 17:45:40 | 000,663,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll

[2016/03/30 17:45:24 | 000,620,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll

[2016/03/30 17:43:29 | 000,725,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe

[2016/03/30 17:43:00 | 000,806,400 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll

[2016/03/30 17:42:16 | 002,131,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl

[2016/03/30 17:42:11 | 001,359,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll

[2016/03/30 17:34:28 | 000,060,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll

[2016/03/30 17:33:46 | 000,091,136 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll

[2016/03/30 17:31:51 | 000,168,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll

[2016/03/30 17:31:12 | 000,076,288 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll

[2016/03/30 17:29:26 | 000,130,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll

[2016/03/30 17:23:09 | 002,056,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl

[2016/03/30 17:22:53 | 001,155,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll

[2016/03/30 17:06:05 | 000,800,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll

[2016/03/30 17:00:46 | 000,710,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll

 

========== Files Created - No Company Name ==========

 

[2016/04/27 21:23:31 | 000,000,064 | ---- | C] () -- C:\Users\Alvaro\Documents\a2whitelist.ini

[2016/04/27 21:13:37 | 000,006,040 | ---- | C] () -- C:\Users\Alvaro\Documents\a2settings.ini

[2016/04/27 20:14:45 | 000,028,272 | ---- | C] () -- C:\Windows\SysNative\drivers\TrueSight.sys

[2016/04/27 20:14:00 | 000,000,869 | ---- | C] () -- C:\Users\Public\Desktop\RogueKiller.lnk

[2016/04/27 18:45:44 | 000,001,117 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2016/04/08 19:38:41 | 000,001,121 | ---- | C] () -- C:\Users\Public\Desktop\SHAREit.lnk

[2016/04/03 17:01:59 | 000,000,336 | ---- | C] () -- C:\Windows\tasks\HPCeeScheduleForAlvaro.job

[2016/02/21 19:18:54 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini

[2016/01/05 14:14:47 | 000,000,600 | ---- | C] () -- C:\Users\Alvaro\PUTTY.RND

[2015/12/19 17:46:43 | 000,000,000 | ---- | C] () -- C:\Windows\firstboot.dat

[2015/11/10 16:59:34 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2015/11/10 16:55:42 | 000,000,000 | -H-- | C] () -- C:\ProgramData\DP45977C.lfl

[2015/11/10 16:51:22 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe

[2015/11/10 16:51:22 | 000,048,856 | ---- | C] () -- C:\Windows\runSW.exe

[2015/11/10 16:47:27 | 001,924,608 | ---- | C] () -- C:\Windows\SysWow64\hsaservices.dll

[2015/11/10 16:47:27 | 000,339,968 | ---- | C] () -- C:\Windows\SysWow64\newhsacore.dll

[2015/11/10 16:47:27 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat

[2015/11/10 16:47:27 | 000,073,216 | ---- | C] () -- C:\Windows\SysWow64\hsaumd.dll

[2015/11/10 16:47:26 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat

[2015/11/10 16:47:24 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

[2015/11/10 16:47:22 | 000,995,342 | ---- | C] () -- C:\Windows\SysWow64\amdocl_as32.exe

[2015/11/10 16:47:22 | 000,798,734 | ---- | C] () -- C:\Windows\SysWow64\amdocl_ld32.exe

[2014/11/13 16:07:22 | 000,765,724 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2014/09/04 01:07:18 | 000,038,912 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll

 

========== ZeroAccess Check ==========

 

[2009/07/13 22:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2016/01/22 00:19:58 | 014,179,840 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2016/01/22 00:05:58 | 012,877,824 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 19:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 21:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 19:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 

< End of report >

 

 

[Advertisements]

Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions!

Everything gets download to the desktop and tools are "Run as administrator."

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
[list]

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.
• Please copy and paste log back here.
• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.
  
  
  Also post the Rogue killer log file

[zep516]

Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions!

Everything gets download to the desktop and tools are "Run as administrator."

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
[list]

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.
• Please copy and paste log back here.
• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.
  
  
  Also post the Rogue killer log file

[almapa]

Hi zep516! Thanks for your Help. 

 

Here is the result for FARBAR. This is not the first time I run it, so I dont know if the Addition.txt is worth of something. However, I attach it. 

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:27-04-2016

Ran by Alvaro (administrator) on ALVARO-PC (28-04-2016 16:08:14)

Running from C:\Users\Alvaro\Downloads

Loaded Profiles: Alvaro (Available Profiles: Alvaro)

Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe

(AMD) C:\Windows\System32\atiesrxx.exe

(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe

(AMD) C:\Windows\System32\atieclxx.exe

(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\HidMonitorSvc.exe

(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\AvrcpService.exe

() C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTDevMgr.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe

(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\RtkBleServ.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe

(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\QuickControl\QuickControlService.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe

(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe

(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe

(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\QuickControl\QuickControl.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe

(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe

(Lenovo) C:\Program Files\Lenovo\Lenovo Peer Connect\LenovoDiscoverySvc.exe

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe

(Realtek Semiconductor Corp.) C:\Windows\RtsCM64.exe

() C:\Program Files (x86)\Realtek\Realtek Bluetooth\SkypePlugin.exe

(Lenovo.) C:\Windows\System32\TpShocks.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe

(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE

(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe

(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTServer.exe

(Lenovo) C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe

(Lenovo) C:\Program Files (x86)\Lenovo\Message Center Plus\MCPLaunch.exe

(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Farbar) C:\Users\Alvaro\Downloads\FRST64 (1).exe

 

 

==================== Registry (Whitelisted) ===========================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [RtsCM] => C:\Windows\RTSCM64.EXE [168152 2014-09-11] (Realtek Semiconductor Corp.)

HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [226008 2014-07-03] (Realtek Semiconductor Corporation)

HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [317240 2014-12-12] (Alps Electric Co., Ltd.)

HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [555760 2014-12-08] (Lenovo.)

HKLM\...\Run: [LENOVO.TPKNRRES] => C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [295712 2014-08-07] (Lenovo Group Limited)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-09-04] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [PWMTRV] => rundll32 "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7139256 2016-03-23] (AVAST Software)

HKU\S-1-5-21-1958321615-1833289119-3903013992-1000\...\MountPoints2: {894f0fc6-87f7-11e5-90be-806e6f6e6963} - Q:\LenovoQDrive.cmd

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-02-09] (AVAST Software)

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

Tcpip\Parameters: [DhcpNameServer] 208.67.222.222 208.67.220.220

Tcpip\..\Interfaces\{002DE976-64C2-4AEA-8FEA-96579DCC11D1}: [DhcpNameServer] 208.67.222.222 208.67.220.220

 

Internet Explorer:

==================

HKU\S-1-5-21-1958321615-1833289119-3903013992-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

HKU\S-1-5-21-1958321615-1833289119-3903013992-1000\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://mystart.lenovo.com

SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-1958321615-1833289119-3903013992-1000 -> DefaultScope {B67E77CA-4525-4139-B855-6C6843F0D796} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}

SearchScopes: HKU\S-1-5-21-1958321615-1833289119-3903013992-1000 -> {5FEA6CD4-231C-4B7C-9C0E-58E1F21F3D4A} URL = 

SearchScopes: HKU\S-1-5-21-1958321615-1833289119-3903013992-1000 -> {B67E77CA-4525-4139-B855-6C6843F0D796} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2016-04-27] (Microsoft Corporation)

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-02-09] (AVAST Software)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\URLREDIR.DLL [2016-04-27] (Microsoft Corporation)

BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2016-04-03] (Microsoft Corporation)

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2016-04-27] (Microsoft Corporation)

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-02-09] (AVAST Software)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\URLREDIR.DLL [2016-04-03] (Microsoft Corporation)

BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2016-04-03] (Microsoft Corporation)

Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-04-03] (Microsoft Corporation)

Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-04-03] (Microsoft Corporation)

Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-04-03] (Microsoft Corporation)

Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-04-03] (Microsoft Corporation)

 

FireFox:

========

FF Plugin: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-04-03] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-04-03] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-05] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-05] (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2016-02-27] (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-1958321615-1833289119-3903013992-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Alvaro\AppData\Local\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-05] (Google Inc.)

FF Plugin HKU\S-1-5-21-1958321615-1833289119-3903013992-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Alvaro\AppData\Local\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-05] (Google Inc.)

FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-02-11]

FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\SafePrice\FF

FF Extension: Avast SafePrice - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-02-11]

 

Chrome: 

=======

CHR Profile: C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Presentaciones de Google) - C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-12-20]

CHR Extension: (Google Docs) - C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-12-20]

CHR Extension: (Google Drive) - C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-12-20]

CHR Extension: (YouTube) - C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-12-20]

CHR Extension: (Google Cast) - C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2016-03-28]

CHR Extension: (Videostream for Google Chromecast™) - C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\cnciopoikihiagdjbjpnocolokfelagl [2016-04-28]

CHR Extension: (Búsqueda de Google) - C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-12-20]

CHR Extension: (Video Downloader professional) - C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\elicpjhcidhpjomhibiffojpinpmmpil [2016-04-28]

CHR Extension: (Hojas de cálculo de Google) - C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-12-20]

CHR Extension: (Documentos de Google sin conexión) - C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-21]

CHR Extension: (Sistema de pagos de Chrome Web Store) - C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-03]

CHR Extension: (HubSpot Sales) - C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiiaigjnkhngdbnoookogelabohpglmd [2016-04-28]

CHR Extension: (Gmail) - C:\Users\Alvaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-12-20]

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2016-02-09]

 

==================== Services (Whitelisted) ========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 ApHidMonitorService; C:\Program Files\Apoint2K\HidMonitorSvc.exe [87384 2014-11-06] (Alps Electric Co., Ltd.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [237096 2016-02-09] (AVAST Software)

R2 AvrcpService; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\AvrcpService.exe [43224 2014-07-03] (Realtek Semiconductor Corporation)

R2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [101592 2014-07-03] ()

R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [2838768 2016-04-03] (Microsoft Corporation)

R2 DisplayLinkService; C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe [9954096 2014-03-31] (DisplayLink Corp.)

R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [26680 2016-02-18] (Hewlett-Packard Company)

S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [619776 2014-12-05] (Lenovo)

R2 LENOVO.TVTVCAM; C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [197408 2014-08-07] (Lenovo Group Limited)

R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [115184 2014-07-08] (Lenovo Group Limited)

S3 LenovoProdRegManager; C:\Program Files (x86)\Lenovo Registration\EngageService.exe [293416 2015-01-09] (Aviata, Inc.)

R2 lnvDiscoveryWinSvc; C:\Program Files\Lenovo\Lenovo Peer Connect\LenovoDiscoverySvc.exe [21552 2014-02-21] (Lenovo)

S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [272864 2015-12-10] (Lenovo)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)

S2 QuickControlMasterSvc; C:\Program Files (x86)\Lenovo\QuickControl\QuickControlMasterSvc.exe [61232 2014-12-05] (Lenovo Group Limited)

R3 QuickControlService; C:\Program Files (x86)\Lenovo\QuickControl\QuickControlService.exe [317224 2014-12-05] (Lenovo Group Limited)

R2 RtkBleServ; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\RtkBleServ.exe [50392 2014-07-03] (Realtek Semiconductor Corporation)

S3 ShareItSvc; C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe [31176 2016-01-20] (SHAREit Technologies Co.Ltd)

S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [21536 2016-01-13] ()

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)

 

===================== Drivers (Whitelisted) ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-02-09] (AVAST Software)

R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-03-22] (AVAST Software)

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [107792 2016-03-09] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-02-09] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-02-09] (AVAST Software)

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1070904 2016-03-09] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [463744 2016-02-29] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [165344 2016-02-09] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [287016 2016-02-13] (AVAST Software)

S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-04-28] (Malwarebytes)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64896 2016-03-10] (Malwarebytes Corporation)

S3 RtkBtFilter; C:\Windows\System32\DRIVERS\RtkBtfilter.sys [580312 2014-09-26] (Realtek Semiconductor Corporation)

R3 RTSPER; C:\Windows\System32\DRIVERS\RtsPer.sys [466136 2014-01-14] (Realsil Semiconductor Corporation)

R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [2599128 2014-09-11] (Realtek Semiconductor Corp.)

R3 RTWlanE; C:\Windows\System32\DRIVERS\rtwlane.sys [3502296 2014-08-04] (Realtek Semiconductor Corporation                           )

U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [28272 2016-04-28] ()

R3 TVTI2C; C:\Windows\System32\DRIVERS\Tvti2c.sys [40248 2011-05-29] (Lenovo Information Product(ShenZhen China) Inc.)

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One Month Created files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2016-04-28 16:07 - 2016-04-28 16:07 - 02376704 _____ (Farbar) C:\Users\Alvaro\Downloads\FRST64 (1).exe

2016-04-28 16:00 - 2016-04-28 16:01 - 00002024 _____ C:\Users\Alvaro\Downloads\Add_Take_Ownership_to_context_menu.reg

2016-04-28 14:54 - 2016-04-28 15:15 - 00000000 ____D C:\Users\Alvaro\Documents\Antivirus

2016-04-28 12:13 - 2016-04-28 13:34 - 00240118 _____ C:\Windows\ntbtlog.txt

2016-04-28 10:30 - 2016-04-28 10:38 - 00000000 ____D C:\AdwCleaner

2016-04-28 09:00 - 2016-04-28 09:01 - 00036793 _____ C:\Users\Alvaro\Downloads\Addition.txt

2016-04-28 08:58 - 2016-04-28 16:08 - 00019437 _____ C:\Users\Alvaro\Downloads\FRST.txt

2016-04-28 08:58 - 2016-04-28 16:08 - 00000000 ____D C:\FRST

2016-04-28 08:57 - 2016-04-28 08:57 - 02376704 _____ (Farbar) C:\Users\Alvaro\Downloads\FRST64.exe

2016-04-28 08:41 - 2016-04-28 08:41 - 01728000 _____ (Farbar) C:\Users\Alvaro\Downloads\FRST.exe

2016-04-27 21:43 - 2016-04-27 21:43 - 00061486 _____ C:\Users\Alvaro\Downloads\Extras.Txt

2016-04-27 21:42 - 2016-04-28 07:10 - 00131984 _____ C:\Users\Alvaro\Downloads\OTL.Txt

2016-04-27 21:25 - 2016-04-27 21:26 - 03581504 _____ C:\Users\Alvaro\Downloads\AdwCleaner.exe

2016-04-27 21:25 - 2016-04-27 21:25 - 00602112 _____ (OldTimer Tools) C:\Users\Alvaro\Downloads\OTL.exe

2016-04-27 20:14 - 2016-04-28 12:18 - 00028272 _____ C:\Windows\system32\Drivers\TrueSight.sys

2016-04-27 20:14 - 2016-04-27 20:14 - 00000869 _____ C:\Users\Public\Desktop\RogueKiller.lnk

2016-04-27 20:14 - 2016-04-27 20:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller

2016-04-27 20:13 - 2016-04-28 12:08 - 00000000 ____D C:\ProgramData\RogueKiller

2016-04-27 20:13 - 2016-04-27 20:14 - 00000000 ____D C:\Program Files\RogueKiller

2016-04-27 19:31 - 2016-04-27 19:39 - 229446776 _____ C:\Users\Alvaro\Downloads\EmsisoftEmergencyKit.exe

2016-04-27 19:26 - 2016-04-27 19:26 - 00000000 ____D C:\Program Files\HitmanPro

2016-04-27 19:25 - 2016-04-27 20:13 - 00000000 ____D C:\ProgramData\HitmanPro

2016-04-27 19:20 - 2016-04-27 20:13 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2016-04-27 19:18 - 2016-04-27 20:13 - 00000000 ____D C:\Users\Alvaro\Desktop\mbar

2016-04-27 18:50 - 2016-04-27 18:51 - 28868264 _____ (Adlice Software ) C:\Users\Alvaro\Downloads\setup.exe

2016-04-27 18:47 - 2016-04-28 13:38 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2016-04-27 18:46 - 2016-04-27 18:47 - 11441168 _____ (SurfRight B.V.) C:\Users\Alvaro\Downloads\hitmanpro_x64 (1).exe

2016-04-27 18:45 - 2016-04-27 19:19 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys

2016-04-27 18:45 - 2016-04-27 18:46 - 11441168 _____ (SurfRight B.V.) C:\Users\Alvaro\Downloads\hitmanpro_x64.exe

2016-04-27 18:45 - 2016-04-27 18:45 - 00001117 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2016-04-27 18:45 - 2016-04-27 18:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2016-04-27 18:45 - 2016-04-27 18:45 - 00000000 ____D C:\ProgramData\Malwarebytes

2016-04-27 18:45 - 2016-04-27 18:45 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2016-04-27 18:45 - 2016-03-10 14:09 - 00064896 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2016-04-27 18:45 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys

2016-04-27 18:44 - 2016-04-27 18:44 - 00000022 _____ C:\Users\Alvaro\Downloads\ESETPoweliksCleaner.exe_20160427.184420.3272.zip

2016-04-27 18:43 - 2016-04-27 18:44 - 00224968 _____ (ESET) C:\Users\Alvaro\Downloads\ESETPoweliksCleaner.exe

2016-04-27 18:39 - 2016-04-27 18:42 - 22851472 _____ (Malwarebytes ) C:\Users\Alvaro\Downloads\mbam-setup-2.2.1.1043.exe

2016-04-27 18:37 - 2016-04-27 18:42 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Alvaro\Downloads\mbar-1.09.3.1001.exe

2016-04-21 20:27 - 2016-03-31 13:25 - 00394952 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2016-04-21 20:27 - 2016-03-31 12:41 - 00346320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2016-04-21 20:27 - 2016-03-30 18:54 - 25817600 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2016-04-21 20:27 - 2016-03-30 18:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2016-04-21 20:27 - 2016-03-30 18:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2016-04-21 20:27 - 2016-03-30 18:31 - 02892800 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2016-04-21 20:27 - 2016-03-30 18:28 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2016-04-21 20:27 - 2016-03-30 18:28 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2016-04-21 20:27 - 2016-03-30 18:27 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec

2016-04-21 20:27 - 2016-03-30 18:27 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2016-04-21 20:27 - 2016-03-30 18:27 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2016-04-21 20:27 - 2016-03-30 18:25 - 06052352 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2016-04-21 20:27 - 2016-03-30 18:22 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2016-04-21 20:27 - 2016-03-30 18:21 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2016-04-21 20:27 - 2016-03-30 18:19 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2016-04-21 20:27 - 2016-03-30 18:17 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2016-04-21 20:27 - 2016-03-30 18:17 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2016-04-21 20:27 - 2016-03-30 18:17 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2016-04-21 20:27 - 2016-03-30 18:17 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2016-04-21 20:27 - 2016-03-30 18:11 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2016-04-21 20:27 - 2016-03-30 18:08 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2016-04-21 20:27 - 2016-03-30 18:03 - 20352512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2016-04-21 20:27 - 2016-03-30 18:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2016-04-21 20:27 - 2016-03-30 18:00 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2016-04-21 20:27 - 2016-03-30 17:59 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll

2016-04-21 20:27 - 2016-03-30 17:57 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2016-04-21 20:27 - 2016-03-30 17:56 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2016-04-21 20:27 - 2016-03-30 17:55 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2016-04-21 20:27 - 2016-03-30 17:53 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2016-04-21 20:27 - 2016-03-30 17:53 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll

2016-04-21 20:27 - 2016-03-30 17:52 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec

2016-04-21 20:27 - 2016-03-30 17:52 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2016-04-21 20:27 - 2016-03-30 17:52 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2016-04-21 20:27 - 2016-03-30 17:52 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2016-04-21 20:27 - 2016-03-30 17:51 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2016-04-21 20:27 - 2016-03-30 17:48 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2016-04-21 20:27 - 2016-03-30 17:48 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2016-04-21 20:27 - 2016-03-30 17:46 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2016-04-21 20:27 - 2016-03-30 17:45 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2016-04-21 20:27 - 2016-03-30 17:45 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2016-04-21 20:27 - 2016-03-30 17:45 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll

2016-04-21 20:27 - 2016-03-30 17:45 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2016-04-21 20:27 - 2016-03-30 17:43 - 00806400 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2016-04-21 20:27 - 2016-03-30 17:43 - 00725504 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2016-04-21 20:27 - 2016-03-30 17:42 - 02131968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2016-04-21 20:27 - 2016-03-30 17:42 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2016-04-21 20:27 - 2016-03-30 17:39 - 15415808 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2016-04-21 20:27 - 2016-03-30 17:38 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2016-04-21 20:27 - 2016-03-30 17:34 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2016-04-21 20:27 - 2016-03-30 17:33 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll

2016-04-21 20:27 - 2016-03-30 17:31 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2016-04-21 20:27 - 2016-03-30 17:31 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2016-04-21 20:27 - 2016-03-30 17:30 - 04611072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2016-04-21 20:27 - 2016-03-30 17:30 - 02596864 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2016-04-21 20:27 - 2016-03-30 17:30 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2016-04-21 20:27 - 2016-03-30 17:29 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll

2016-04-21 20:27 - 2016-03-30 17:24 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll

2016-04-21 20:27 - 2016-03-30 17:23 - 02056192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2016-04-21 20:27 - 2016-03-30 17:23 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2016-04-21 20:27 - 2016-03-30 17:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2016-04-21 20:27 - 2016-03-30 17:21 - 13811712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2016-04-21 20:27 - 2016-03-30 17:18 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2016-04-21 20:27 - 2016-03-30 17:06 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2016-04-21 20:27 - 2016-03-30 17:05 - 02121216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2016-04-21 20:27 - 2016-03-30 17:02 - 01311744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2016-04-21 20:27 - 2016-03-30 17:00 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2016-04-21 20:26 - 2016-04-04 12:14 - 00038120 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe

2016-04-21 20:26 - 2016-04-04 12:02 - 01169408 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2016-04-21 20:26 - 2016-04-02 07:08 - 01386496 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2016-04-21 20:26 - 2016-03-29 11:53 - 03216896 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2016-04-21 20:26 - 2016-03-23 08:02 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll

2016-04-21 20:26 - 2016-03-17 17:04 - 05551336 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2016-04-21 20:26 - 2016-03-17 17:04 - 00706280 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi

2016-04-21 20:26 - 2016-03-17 17:04 - 00154344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2016-04-21 20:26 - 2016-03-17 17:04 - 00095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2016-04-21 20:26 - 2016-03-17 17:01 - 01732864 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2016-04-21 20:26 - 2016-03-17 17:01 - 00631176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi

2016-04-21 20:26 - 2016-03-17 16:58 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll

2016-04-21 20:26 - 2016-03-17 16:58 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll

2016-04-21 20:26 - 2016-03-17 16:58 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2016-04-21 20:26 - 2016-03-17 16:58 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll

2016-04-21 20:26 - 2016-03-17 16:58 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2016-04-21 20:26 - 2016-03-17 16:58 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2016-04-21 20:26 - 2016-03-17 16:58 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2016-04-21 20:26 - 2016-03-17 16:58 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll

2016-04-21 20:26 - 2016-03-17 16:58 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2016-04-21 20:26 - 2016-03-17 16:58 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2016-04-21 20:26 - 2016-03-17 16:57 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2016-04-21 20:26 - 2016-03-17 16:57 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2016-04-21 20:26 - 2016-03-17 16:57 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll

2016-04-21 20:26 - 2016-03-17 16:57 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll

2016-04-21 20:26 - 2016-03-17 16:57 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2016-04-21 20:26 - 2016-03-17 16:56 - 02084864 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll

2016-04-21 20:26 - 2016-03-17 16:56 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2016-04-21 20:26 - 2016-03-17 16:54 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2016-04-21 20:26 - 2016-03-17 16:54 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2016-04-21 20:26 - 2016-03-17 16:54 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll

2016-04-21 20:26 - 2016-03-17 16:54 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll

2016-04-21 20:26 - 2016-03-17 16:53 - 01464320 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2016-04-21 20:26 - 2016-03-17 16:53 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2016-04-21 20:26 - 2016-03-17 16:53 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2016-04-21 20:26 - 2016-03-17 16:53 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:36 - 03998952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2016-04-21 20:26 - 2016-03-17 16:36 - 03943144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2016-04-21 20:26 - 2016-03-17 16:33 - 01314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2016-04-21 20:26 - 2016-03-17 16:31 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2016-04-21 20:26 - 2016-03-17 16:31 - 00666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

2016-04-21 20:26 - 2016-03-17 16:31 - 00275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2016-04-21 20:26 - 2016-03-17 16:31 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2016-04-21 20:26 - 2016-03-17 16:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2016-04-21 20:26 - 2016-03-17 16:30 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2016-04-21 20:26 - 2016-03-17 16:30 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2016-04-21 20:26 - 2016-03-17 16:30 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll

2016-04-21 20:26 - 2016-03-17 16:29 - 00251392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2016-04-21 20:26 - 2016-03-17 16:29 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll

2016-04-21 20:26 - 2016-03-17 16:29 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2016-04-21 20:26 - 2016-03-17 16:28 - 01414144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll

2016-04-21 20:26 - 2016-03-17 16:27 - 00260608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2016-04-21 20:26 - 2016-03-17 16:27 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2016-04-21 20:26 - 2016-03-17 16:27 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll

2016-04-21 20:26 - 2016-03-17 16:27 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll

2016-04-21 20:26 - 2016-03-17 16:26 - 00553984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2016-04-21 20:26 - 2016-03-17 16:25 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 16:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 15:53 - 00148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe

2016-04-21 20:26 - 2016-03-17 15:52 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys

2016-04-21 20:26 - 2016-03-17 15:52 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe

2016-04-21 20:26 - 2016-03-17 15:51 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe

2016-04-21 20:26 - 2016-03-17 15:44 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe

2016-04-21 20:26 - 2016-03-17 15:43 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe

2016-04-21 20:26 - 2016-03-17 15:41 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe

2016-04-21 20:26 - 2016-03-17 15:38 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys

2016-04-21 20:26 - 2016-03-17 15:37 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys

2016-04-21 20:26 - 2016-03-17 15:37 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys

2016-04-21 20:26 - 2016-03-17 15:35 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe

2016-04-21 20:26 - 2016-03-17 15:35 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2016-04-21 20:26 - 2016-03-17 15:30 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2016-04-21 20:26 - 2016-03-17 15:30 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2016-04-21 20:26 - 2016-03-17 15:30 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2016-04-21 20:26 - 2016-03-17 15:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2016-04-21 20:26 - 2016-03-17 15:29 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll

2016-04-21 20:26 - 2016-03-17 15:29 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 15:29 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 15:29 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 15:29 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll

2016-04-21 20:26 - 2016-03-17 12:04 - 00698368 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2016-04-21 20:26 - 2016-03-17 12:04 - 00499200 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2016-04-21 20:26 - 2016-03-17 12:04 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2016-04-21 20:26 - 2016-03-17 12:04 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll

2016-04-21 20:26 - 2016-03-16 12:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\system32\mtxoci.dll

2016-04-21 20:26 - 2016-03-16 12:28 - 00176128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msorcl32.dll

2016-04-21 20:26 - 2016-03-16 12:28 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mtxoci.dll

2016-04-21 20:26 - 2016-03-06 12:53 - 01885696 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2016-04-21 20:26 - 2016-03-06 12:53 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2016-04-21 20:26 - 2016-03-06 12:38 - 01240576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2016-04-21 20:26 - 2016-03-06 12:38 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2016-04-21 20:25 - 2016-03-15 18:16 - 00760320 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll

2016-04-21 20:25 - 2016-03-15 18:16 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll

2016-04-21 20:25 - 2016-03-15 17:53 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samlib.dll

2016-04-21 20:25 - 2016-03-11 12:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2016-04-21 20:25 - 2016-03-11 12:35 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

2016-04-21 20:25 - 2016-03-09 13:00 - 00444416 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll

2016-04-21 20:25 - 2016-03-09 13:00 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\webio.dll

2016-04-21 20:25 - 2016-03-09 12:54 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll

2016-04-21 20:25 - 2016-03-09 12:40 - 00351744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll

2016-04-21 20:25 - 2016-03-09 12:40 - 00316416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webio.dll

2016-04-21 20:25 - 2016-03-09 12:34 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll

2016-04-17 18:47 - 2016-04-17 18:47 - 00003108 _____ C:\Windows\System32\Tasks\{5172E3EF-3EBF-4EE8-8E85-626586CFEF65}

2016-04-12 21:07 - 2016-04-12 21:07 - 00000000 ____D C:\Windows\pss

2016-04-08 19:38 - 2016-04-08 19:38 - 00001121 _____ C:\Users\Public\Desktop\SHAREit.lnk

2016-04-08 19:38 - 2016-04-08 19:38 - 00000000 ____D C:\Users\Alvaro\Downloads\SHAREit

2016-04-08 19:38 - 2016-04-08 19:38 - 00000000 ____D C:\Users\Alvaro\AppData\Local\SHAREit

2016-04-08 19:38 - 2016-04-08 19:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LenovoSHAREit

2016-04-03 21:04 - 2016-04-03 21:04 - 00000000 ____D C:\Users\Alvaro\AppData\Local\CrashDumps

2016-04-03 17:02 - 2016-04-27 18:58 - 00003192 _____ C:\Windows\System32\Tasks\HPCeeScheduleForAlvaro

2016-04-03 17:01 - 2016-04-27 18:58 - 00000336 _____ C:\Windows\Tasks\HPCeeScheduleForAlvaro.job

 

==================== One Month Modified files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2016-04-28 16:01 - 2009-07-13 23:13 - 00781782 _____ C:\Windows\system32\PerfStringBackup.INI

2016-04-28 16:01 - 2009-07-13 21:20 - 00000000 ____D C:\Windows\inf

2016-04-28 15:52 - 2009-07-13 22:45 - 00032208 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2016-04-28 15:52 - 2009-07-13 22:45 - 00032208 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2016-04-28 15:26 - 2015-12-20 22:01 - 00001050 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1958321615-1833289119-3903013992-1000UA.job

2016-04-28 15:25 - 2015-12-20 21:55 - 00001036 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2016-04-28 14:53 - 2015-12-19 17:46 - 00000000 ____D C:\Users\Alvaro

2016-04-28 14:37 - 2016-01-20 19:34 - 00000000 ____D C:\Program Files\WinRAR

2016-04-28 14:37 - 2016-01-20 19:32 - 00001129 _____ C:\ProgramData\Microsoft\Windows\Start Menu\WinRAR.lnk

2016-04-28 14:37 - 2016-01-20 19:32 - 00000000 ____D C:\Users\Alvaro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR

2016-04-28 14:37 - 2016-01-20 19:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR

2016-04-28 13:38 - 2015-12-20 21:55 - 00001032 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2016-04-28 13:35 - 2009-07-13 23:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2016-04-28 12:13 - 2015-11-10 16:59 - 00065536 _____ C:\Windows\system32\spu_storage.bin

2016-04-28 11:07 - 2016-01-03 17:15 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update

2016-04-28 10:45 - 2016-01-03 17:14 - 00000000 ____D C:\Users\Alvaro\Documents\El Negociador

2016-04-28 04:12 - 2009-07-13 21:20 - 00000000 ____D C:\Windows\rescache

2016-04-28 03:34 - 2009-07-13 22:45 - 00437576 _____ C:\Windows\system32\FNTCACHE.DAT

2016-04-28 03:32 - 2015-12-20 08:31 - 00000000 ____D C:\Windows\system32\appraiser

2016-04-28 03:09 - 2015-12-19 23:11 - 00000000 ____D C:\Windows\system32\MRT

2016-04-28 03:02 - 2015-12-19 23:11 - 135176864 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2016-04-27 19:11 - 2015-11-10 17:09 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft

2016-04-27 19:02 - 2015-11-10 17:09 - 00000000 ____D C:\Program Files (x86)\Microsoft Office

2016-04-27 18:08 - 2016-01-18 12:17 - 00000000 ____D C:\Users\Alvaro\AppData\Roaming\sidekick

2016-04-27 18:07 - 2015-12-20 21:54 - 00000000 ____D C:\Users\Alvaro\AppData\Local\Deployment

2016-04-21 18:55 - 2015-12-20 22:01 - 00000998 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1958321615-1833289119-3903013992-1000Core.job

2016-04-21 15:05 - 2010-11-20 21:27 - 00453288 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2016-04-17 18:51 - 2016-01-11 18:34 - 00000000 ____D C:\Users\Alvaro\AppData\Roaming\Skype

2016-04-17 18:47 - 2016-01-11 18:34 - 00000000 ___RD C:\Program Files (x86)\Skype

2016-04-17 18:47 - 2016-01-11 18:33 - 00000000 ____D C:\ProgramData\Skype

2016-04-12 21:28 - 2015-12-20 21:57 - 00002204 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2016-04-12 21:28 - 2015-12-20 21:57 - 00002192 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2016-04-08 19:38 - 2015-11-10 16:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo

2016-04-08 19:38 - 2015-11-10 15:21 - 00000000 ____D C:\ProgramData\Lenovo

2016-04-08 19:36 - 2015-11-10 17:11 - 00000000 ____D C:\Windows\System32\Tasks\TVT

2016-04-08 19:36 - 2015-11-10 17:01 - 00000000 ___HD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo ThinkVantage Tools

2016-04-08 19:36 - 2015-11-10 16:40 - 00000000 ____D C:\Program Files (x86)\Lenovo

2016-04-03 17:19 - 2016-01-05 14:14 - 00000600 _____ C:\Users\Alvaro\PUTTY.RND

 

==================== Files in the root of some directories =======

 

2015-12-19 17:47 - 2016-04-28 13:38 - 0467919 _____ () C:\Users\Alvaro\AppData\Local\BTServer.log

2016-02-21 19:18 - 2016-02-21 19:18 - 0000057 _____ () C:\ProgramData\Ament.ini

2015-11-10 16:55 - 2015-11-10 16:55 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

 

Some files in TEMP:

====================

C:\Users\Alvaro\AppData\Local\Temp\dllnt_dump.dll

 

 

Some zero byte size files/folders:

==========================

C:\Windows\SysWOW64\dlumd10.dll

C:\Windows\SysWOW64\dlumd11.dll

C:\Windows\SysWOW64\dlumd9.dll

C:\Windows\System32\dlumd10.dll

C:\Windows\System32\dlumd11.dll

C:\Windows\System32\dlumd9.dll

 

==================== Bamital & volsnap =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\dnsapi.dll => File is digitally signed

C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2016-04-28 00:42

 

==================== End of FRST.txt ============================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version:27-04-2016

Ran by Alvaro (2016-04-28 09:00:04)

Running from C:\Users\Alvaro\Downloads

Windows 7 Professional Service Pack 1 (X64) (2015-12-19 23:46:16)

Boot Mode: Normal

==========================================================

 

 

==================== Accounts: =============================

 

Administrator (S-1-5-21-1958321615-1833289119-3903013992-500 - Administrator - Disabled)

Alvaro (S-1-5-21-1958321615-1833289119-3903013992-1000 - Administrator - Enabled) => C:\Users\Alvaro

Guest (S-1-5-21-1958321615-1833289119-3903013992-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-1958321615-1833289119-3903013992-1002 - Limited - Enabled)

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

 

==================== Installed Programs ======================

 

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 20.0.0.260 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.15)  MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.15 - Adobe Systems Incorporated)

AMD Catalyst Install Manager (HKLM\...\{78BA0442-610B-FD5E-20C8-1098C4687249}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)

Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 11.1.2253 - AVAST Software)

ChromecastApp (HKU\S-1-5-21-1958321615-1833289119-3903013992-1000\...\{079ede36-133d-44b0-8053-c7c1fa8d2e0d}_is1) (Version: 1.5.1693.0 - Google Inc.)

Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)

Cisco LEAP Module (HKLM-x32\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)

Cisco PEAP Module (HKLM-x32\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)

Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.65.55.62 - Conexant)

Create Recovery Media (HKLM-x32\...\{50DC5136-21E8-48BC-97E5-1AD055F6B0B6}) (Version: 1.20.0.00 - Lenovo Group Limited)

DisplayLink Core Software (HKLM\...\{58F4C39B-D946-4A45-A314-DEFC2AFDF397}) (Version: 7.5.54609.0 - DisplayLink Corp.)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 49.0.2623.112 - Google Inc.)

Google Update Helper (x32 Version: 1.3.29.5 - Google Inc.) Hidden

HP Deskjet 3050 J610 series Basic Device Software (HKLM\...\{6457BD83-98CF-4267-93D7-F173FF3E7C25}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)

HP Support Assistant (HKLM-x32\...\{79C54A05-F146-4EA0-8A70-D4EFE6181E52}) (Version: 8.2.8.25 - Hewlett-Packard Company)

HP Support Solutions Framework (HKLM-x32\...\{21925AE1-929D-4222-B38B-80BC30BBE09C}) (Version: 12.2.8.17 - HP)

Integrated Camera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10291 - Realtek Semiconductor Corp.)

Lenovo Auto Scroll Utility (HKLM\...\LenovoAutoScrollUtility) (Version: 2.12 - )

Lenovo Communications Utility (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 3.1.16.0 - Lenovo)

Lenovo Peer Connect SDK (HKLM\...\{75C87855-9CBB-4892-B1A9-74C73A19CACA}_is1) (Version: 1.0.0.7 - Lenovo)

Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.12.07 - Lenovo)

Lenovo PowerENGAGE (HKLM-x32\...\{15B15395-FF53-44E1-ADAD-FCC279E3CA10}) (Version: 2.51.0040 - Lenovo Inc.)

Lenovo QuickControl (HKLM-x32\...\{04128C8C-7812-4DCC-816E-9C8AB1D6EECE}) (Version: 2.40 - Lenovo Group Limited)

Lenovo Solution Center (HKLM\...\{4386A5EF-BD23-49F4-9DAD-CD76B4F6A8BF}) (Version: 2.8.006.00 - Lenovo Group Limited)

Lenovo System Update (HKLM-x32\...\{25C64847-B900-48AD-A164-1B4F9B774650}) (Version: 5.07.0022 - Lenovo)

Lenovo USB Graphics (HKLM\...\{E6B1FE9A-CB1E-4096-A0AF-163419CB971C}) (Version: 7.5.54614.0 - Lenovo)

Lenovo USB3.0 to DVI VGA Monitor Adapter (HKLM-x32\...\{454D32AD-C149-49BE-9F2E-8C089C3D6620}) (Version: 1.07.17 - Lenovo)

Lenovo User Guide (HKLM-x32\...\{13F59938-C595-479C-B479-F171AB9AF64F}) (Version: 1.0.0009.00 - Lenovo Group Limited)

Lenovo Warranty Information (HKLM-x32\...\{FD4EC278-C1B1-4496-99ED-C0BE1B0AA521}) (Version: 1.0.0011.00 - Lenovo)

Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)

Message Center Plus (HKLM\...\{EE4D9822-C7F3-4386-8703-889CDDA22FAA}) (Version: 3.4.0001.00 - Lenovo Group Limited)

Metric Collection SDK (x32 Version: 1.1.0012.00 - Lenovo Group Limited) Hidden

Metric Collection SDK 35 (x32 Version: 1.2.0006.00 - Lenovo Group Limited) Hidden

Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)

Microsoft Office Profesional Plus 2016 - es-es (HKLM\...\ProPlusRetail - es-es) (Version: 16.0.6769.2017 - Microsoft Corporation)

Microsoft OneDrive (HKU\S-1-5-21-1958321615-1833289119-3903013992-1000\...\OneDriveSetup.exe) (Version: 17.3.4604.0120 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)

OEM Application Profile (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden

Office 16 Click-to-Run Extensibility Component (x32 Version: 16.0.6729.1014 - Microsoft Corporation) Hidden

Office 16 Click-to-Run Licensing Component (Version: 16.0.6729.1014 - Microsoft Corporation) Hidden

Office 16 Click-to-Run Localization Component (x32 Version: 16.0.6729.1014 - Microsoft Corporation) Hidden

On Screen Display (HKLM\...\OnScreenDisplay) (Version: 8.51.00 - )

Power Manager (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 6.67.2 - Lenovo Group Limited)

PowerXpressHybrid (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden

REACHit (HKLM-x32\...\{4532E4C5-C84D-4040-A044-ECFCC5C6995B}) (Version: 2.5.003.11 - Lenovo)

REALTEK Bluetooth Driver (HKLM-x32\...\{9D3D8C60-A5EF-4123-B2B9-172095903AB}) (Version: 3.833.833.012015 - REALTEK Semiconductor Corp.)

Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.21247 - Realtek Semiconductor Corp.)

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.75.827.2013 - Realtek)

REALTEK Wireless LAN Driver (HKLM-x32\...\{9DAABC60-A5EF-41FF-B2B9-17329590CD5}) (Version: 1.20.243 - REALTEK Semiconductor Corp.)

RogueKiller version 12 (HKLM\...\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 12 - Adlice Software)

SafeZone Stable 1.48.2066.44 (x32 Version: 1.48.2066.44 - Avast Software) Hidden

SHAREit (HKLM-x32\...\SHAREit_is1) (Version: 3.2.0.543 - Lenovo)

Sidekick for Outlook (HKU\S-1-5-21-1958321615-1833289119-3903013992-1000\...\18545B70DA3FCDA141D2E3E5306ED621A7F563BB) (Version: 2.0.3.71 - HubSpot, Inc.)

Sidekick for Windows (HKU\S-1-5-21-1958321615-1833289119-3903013992-1000\...\285de52403df7519) (Version: 1.0.0.50 - Hubspot)

Skype™ 7.21 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.21.100 - Skype Technologies S.A.)

ThinkPad OneLink Dock (HKLM-x32\...\{8E1CACF5-2493-4950-9AD5-189903FE57E7}) (Version: 1.08.30 - Lenovo)

ThinkPad UltraNav Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 8.216.1616.115 - ALPS ELECTRIC CO., LTD.)

Thinkpad USB 3.0 Ethernet Adapter Driver (HKLM-x32\...\{D8102684-7BA1-4948-88B9-535F84E6E588}) (Version: 7.4.911.2013 - Lenovo)

ThinkVantage Active Protection System (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.80.03.00 - Lenovo)

Windows Driver Package - AMD (amd_sata) HDC  (06/27/2013 1.2.001.0349) (HKLM\...\28E72C324EF56B433A4D881F8BF593862D140CB4) (Version: 06/27/2013 1.2.001.0349 - AMD)

Windows Driver Package - AMD (amd_sata) HDC  (11/06/2013 1.2.001.0359) (HKLM\...\93495051580686B19DA4CFEEB0A75F6B08981B30) (Version: 11/06/2013 1.2.001.0359 - AMD)

Windows Driver Package - Lenovo 1.67.09.03 (11/07/2014 1.67.09.03) (HKLM\...\FA3F6F3D6E8958FDDEE1E09CC77DFA71B0D7835A) (Version: 11/07/2014 1.67.09.03 - Lenovo)

WinRAR 5.30 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.30.0 - win.rar GmbH)

WinRAR 5.30 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.30.0 - win.rar GmbH)

 

==================== Custom CLSID (Whitelisted): ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

CustomCLSID: HKU\S-1-5-21-1958321615-1833289119-3903013992-1000_Classes\CLSID\{793EE463-1304-471C-ADF1-68C2FFB01247}\InprocServer32 -> C:\Users\Alvaro\AppData\Local\Google\Update\1.3.29.5\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-1958321615-1833289119-3903013992-1000_Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2}\InprocServer32 -> C:\Users\Alvaro\AppData\Local\Google\Update\1.3.29.1\psuser_64.dll => No File

CustomCLSID: HKU\S-1-5-21-1958321615-1833289119-3903013992-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Alvaro\AppData\Local\Google\Update\1.3.29.5\psuser_64.dll (Google Inc.)

 

==================== Scheduled Tasks (Whitelisted) =============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

Task: {01243A69-4591-47C0-A30D-E3AF0A9AA95F} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-04-03] (Microsoft Corporation)

Task: {037F8335-A4E1-40F6-B0E0-AC3BDE4CCF5B} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\App\LSCService.exe [2015-12-10] (Lenovo)

Task: {082B2102-94C4-4DE5-A916-36B6EE870549} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-02-18] (Hewlett-Packard Company)

Task: {1271F761-9876-484A-BAC0-242CA8AFE0FA} - System32\Tasks\Lenovo\Message Center Plus Launcher => C:\Program Files (x86)\Lenovo\message center plus\mcplaunch.exe [2015-03-23] (Lenovo)

Task: {14BED273-A56F-4FC1-BCFA-7DA7DDEB255D} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2016-03-02] (Hewlett-Packard)

Task: {1E3ADF3E-A47D-432E-80A6-F624113FC341} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2015-07-01] (Lenovo)

Task: {21BCF5DC-6455-4E68-9827-31990F89B586} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-03-07] (Hewlett-Packard)

Task: {37F8FAAD-537A-4F0D-B394-9EF27E8FACBC} - System32\Tasks\TVT\LaunchFR => C:\Program Files (x86)\Lenovo\Factory Recovery\FRReminder.exe [2014-08-20] (TODO: <Company name>)

Task: {48E3B3EA-CAF1-4178-A39C-F3C09FB723F4} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1958321615-1833289119-3903013992-1000UA => C:\Users\Alvaro\AppData\Local\Google\Update\GoogleUpdate.exe [2015-12-20] (Google Inc.)

Task: {4A2AABF0-480D-44E2-98B8-3B5FCC28B6D4} - System32\Tasks\Remediation\AntimalwareMigrationTask => C:\Program Files\Common Files\AV\Norton Internet Security\Upgrade.exe [2015-11-23] (Symantec Corporation)

Task: {4AF8047F-CD5F-42B3-A27D-5C0D06CB0002} - System32\Tasks\Lenovo\REACHit Agent Update => C:\Program Files (x86)\Lenovo\REACHit\REACHitAgent.exe [2016-02-22] (Lenovo)

Task: {571CBC25-1C09-49B1-9CAD-D22633F37E6A} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2015-12-10] (Lenovo)

Task: {57D7B8CB-706F-4787-8C4F-E87A133DDC12} - System32\Tasks\Lenovo\Lenovo PowerENGAGE => C:\Program Files (x86)\Lenovo Registration\lenovoreg.exe [2015-01-09] (Aviata Inc)

Task: {61F8742F-FE11-4955-BA24-C6C7295EC116} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-02-18] (Hewlett-Packard Company)

Task: {6484C10D-44EA-4E6C-B396-8F069618B9C5} - System32\Tasks\HPCeeScheduleForAlvaro => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-16] (Hewlett-Packard)

Task: {72D26132-399E-47F6-BA9A-8CBD7A566D27} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-13] (Adobe Systems Incorporated)

Task: {852B29A8-A546-44B3-97D0-27A63BC32089} - System32\Tasks\Lenovo\REACHit Agent Startup => C:\Program Files (x86)\Lenovo\REACHit\REACHitAgent.exe [2016-02-22] (Lenovo)

Task: {89E7FEBF-A522-4928-8E69-7991EC8855AC} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-02-09] (AVAST Software)

Task: {8C606583-4680-4480-8637-9E6ADCB46822} - System32\Tasks\{5172E3EF-3EBF-4EE8-8E85-626586CFEF65} => Chrome.exe hxxp://ui.skype.com/ui/0/7.21.85.100/es/abandoninstall?page=tsProgressBar

Task: {91D96DB3-E211-43BE-B03F-9FC44376D28C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2016-04-05] (HP Inc.)

Task: {94D6C569-71CD-4E1A-AE53-798989FBF79E} - System32\Tasks\PMTask => C:\Program Files (x86)\ThinkPad\Utilities\PwmIdTsv.exe [2014-11-13] (Lenovo Group Limited)

Task: {A4079AA7-5B66-47F9-B22B-21B394A867DE} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2016-01-13] ()

Task: {AC4382B0-5951-4EE2-A9B4-E3BCA5EEF868} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-12-20] (Google Inc.)

Task: {B7C4C8A3-966A-4FD1-8BB0-7A7C94A5FA53} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2016-04-03] (Microsoft Corporation)

Task: {BD5EA1A3-176E-4C6D-9DE2-66E6C11AE78D} - System32\Tasks\SafeZone scheduled Autoupdate 1458665534 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-02-01] (Avast Software)

Task: {C039AA20-2653-4C76-B8FD-733B038EBDCF} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe

Task: {CCCD5FC6-A038-41A6-96F9-FD2876ABDA73} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-03-04] (AVAST Software)

Task: {D4C70766-A3BF-4F99-8CE7-BAADF56460A6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2016-03-11] (Hewlett-Packard)

Task: {D9778F9E-1869-4411-85F9-EF51925A8E4F} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-04-03] (Microsoft Corporation)

Task: {DD7183A7-37F7-4971-AF02-81DEBBC78FF6} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1958321615-1833289119-3903013992-1000Core => C:\Users\Alvaro\AppData\Local\Google\Update\GoogleUpdate.exe [2015-12-20] (Google Inc.)

Task: {DF9DD880-3E37-4B8D-9D0B-3D84DEB9B1C9} - System32\Tasks\DiskUpdate => C:\SWTOOLS\OSFIXES\DISKUPDT\DiskUpdate.exe [2009-02-09] ()

Task: {E450D49E-D31A-44D5-9816-DD2BF0858CA2} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-12-20] (Google Inc.)

Task: {E59049E5-EB01-475A-A098-2FC20C92BE51} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Active Health Launcher => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2016-03-02] (Hewlett-Packard)

Task: {F1CD74CA-D8A2-4A03-A679-F3437D7BD9DD} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2016-04-03] (Microsoft Corporation)

Task: {F965CFE3-8ADF-4333-BD3C-E720EBE525EC} - System32\Tasks\Lenovo\Lenovo PowerENGAGE Update => C:\Program Files (x86)\Lenovo Registration\lenovoreg.exe [2015-01-09] (Aviata Inc)

Task: {FB87DE28-3769-4FD5-AD5E-351E5D237604} - System32\Tasks\Lenovo\LSC\Lenovo Solution Center Notifications => C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe [2015-12-10] (Lenovo)

Task: {FE533EBE-7C0C-440F-834F-8A367A50DB4D} - System32\Tasks\Lenovo\LSC\LSCHardwareScanPostpone => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2015-12-10] (Lenovo)

 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

 

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1958321615-1833289119-3903013992-1000Core.job => C:\Users\Alvaro\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1958321615-1833289119-3903013992-1000UA.job => C:\Users\Alvaro\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\HPCeeScheduleForAlvaro.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

 

==================== Shortcuts =============================

 

(The entries could be listed to be restored or removed.)

 

==================== Loaded Modules (Whitelisted) ==============

 

2015-11-10 16:52 - 2014-07-03 11:22 - 00101592 _____ () C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe

2015-12-20 21:24 - 2016-04-03 04:34 - 00172224 _____ () C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ApiClient.dll

2015-11-10 17:01 - 2014-11-13 15:07 - 00105472 ____N () C:\Program Files (x86)\ThinkPad\Utilities\US\PWMRT64V.DLL

2015-11-10 16:52 - 2014-07-03 11:22 - 00277720 _____ () C:\Program Files (x86)\Realtek\Realtek Bluetooth\SkypePlugin.exe

2016-02-09 12:15 - 2016-02-09 12:15 - 00113496 _____ () C:\Program Files\AVAST Software\Avast\log.dll

2016-02-09 12:15 - 2016-02-09 12:15 - 00133768 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll

2016-04-27 17:52 - 2016-04-27 17:52 - 02891264 _____ () C:\Program Files\AVAST Software\Avast\defs\16042704\algo.dll

2016-04-17 18:37 - 2016-04-17 18:37 - 00509344 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll

2015-11-10 17:02 - 2011-08-02 22:58 - 02201088 _____ () C:\Program Files\Lenovo\Communications Utility\cxcore210.dll

2015-11-10 17:02 - 2011-08-02 22:58 - 02085888 _____ () C:\Program Files\Lenovo\Communications Utility\cv210.dll

2016-01-03 17:15 - 2016-01-03 17:15 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

2016-04-12 21:28 - 2016-04-06 04:04 - 01675928 _____ () C:\Program Files (x86)\Google\Chrome\Application\49.0.2623.112\libglesv2.dll

2016-04-12 21:28 - 2016-04-06 04:04 - 00086168 _____ () C:\Program Files (x86)\Google\Chrome\Application\49.0.2623.112\libegl.dll

 

==================== Alternate Data Streams (Whitelisted) =========

 

(If an entry is included in the fixlist, only the ADS will be removed.)

 

 

==================== Safe Mode (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

 

==================== EXE Association (Whitelisted) ===============

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

 

 

==================== Internet Explorer trusted/restricted ===============

 

(If an entry is included in the fixlist, it will be removed from the registry.)

 

 

==================== Hosts content: ===============================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2009-07-13 20:34 - 2009-06-10 15:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

 

 

==================== Other Areas ============================

 

(Currently there is no automatic fix for this section.)

 

HKU\S-1-5-21-1958321615-1833289119-3903013992-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Alvaro\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 208.67.222.222 - 208.67.220.220

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

 

==================== MSCONFIG/TASK MANAGER disabled items ==

 

(Currently there is no automatic fix for this section.)

 

MSCONFIG\startupfolder: C:^Users^Alvaro^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Monitor Ink Alerts - HP Deskjet 3050 J610 series (Network).lnk => C:\Windows\pss\Monitor Ink Alerts - HP Deskjet 3050 J610 series (Network).lnk.Startup

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

MSCONFIG\startupreg: Google Update => "C:\Users\Alvaro\AppData\Local\Google\Update\GoogleUpdate.exe" /c

MSCONFIG\startupreg: GoogleChromeAutoLaunch_0EFCB674B5E569C24DAE26F3BB89ED91 => "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window /prefetch:5

MSCONFIG\startupreg: HP Deskjet 3050 J610 series (NET) => "C:\Program Files\HP\HP Deskjet 3050 J610 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN13U393D505HX:NW" -scfn "HP Deskjet 3050 J610 series (NET)" -AutoStart 1

MSCONFIG\startupreg: SidekickTrayApp => C:\Users\Alvaro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Hubspot\Sidekick for Windows.appref-ms

MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

 

==================== FirewallRules (Whitelisted) ===============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe

FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe

FirewallRules: [{958F2598-B9CD-4745-A731-6DC949654E1F}] => (Allow) C:\Program Files (x86)\Lenovo\QuickControl\QuickControlService.exe

FirewallRules: [{1FB905E3-7693-43B5-BC2F-328F7AFC441D}] => (Allow) C:\Program Files (x86)\Lenovo\QuickControl\QuickControlService.exe

FirewallRules: [{8765D908-FA7C-4662-AAB0-76D65DBAA051}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe

FirewallRules: [{2900355C-CD11-4850-928D-87AD90F8E5E6}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe

FirewallRules: [{E9300D6C-109E-441A-A517-9C58B017F9EF}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe

FirewallRules: [{A342EA81-DD4D-4799-B286-BB4656D0345E}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe

FirewallRules: [{AFA5A4D0-5C1C-4ED1-AA0F-213EFC170F57}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe

FirewallRules: [{B7500653-F226-46BA-963F-FAF1875D194C}] => (Allow) C:\Users\Alvaro\AppData\Local\Microsoft\OneDrive\OneDrive.exe

FirewallRules: [{B6010C10-B17F-4842-895A-0CB221933BBF}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe

FirewallRules: [{63D87C6A-5743-4A4A-B48D-2B2E91D3D520}] => (Allow) C:\Program Files\HP\HP Deskjet 3050 J610 series\Bin\DeviceSetup.exe

FirewallRules: [{B2A4EE67-799D-4E13-877D-D78726AE7EBB}] => (Allow) C:\Program Files\HP\HP Deskjet 3050 J610 series\Bin\HPNetworkCommunicator.exe

FirewallRules: [{C8487CFC-76DC-4C51-A78F-9456A85F45D6}] => (Allow) C:\Program Files\HP\HP Deskjet 3050 J610 series\Bin\HPNetworkCommunicatorCom.exe

FirewallRules: [TCP Query User{66B67C5B-8B6C-4429-AA6D-7276C11DD013}C:\users\alvaro\appdata\local\temp\temp2_u (1).zipᔄ.exe] => (Allow) C:\users\alvaro\appdata\local\temp\temp2_u (1).zipᔄ.exe

FirewallRules: [UDP Query User{70152156-C502-4FF8-BAF5-391B3B365267}C:\users\alvaro\appdata\local\temp\temp2_u (1).zipᔄ.exe] => (Allow) C:\users\alvaro\appdata\local\temp\temp2_u (1).zipᔄ.exe

FirewallRules: [TCP Query User{D52FFF5C-2903-41CA-9F27-6E9314413C0F}C:\users\alvaro\appdata\local\temp\temp3_u (1).zipᔄ.exe] => (Block) C:\users\alvaro\appdata\local\temp\temp3_u (1).zipᔄ.exe

FirewallRules: [UDP Query User{99DF5460-DCB1-49C6-93D8-654C1FEE86B3}C:\users\alvaro\appdata\local\temp\temp3_u (1).zipᔄ.exe] => (Block) C:\users\alvaro\appdata\local\temp\temp3_u (1).zipᔄ.exe

FirewallRules: [{37C2BC46-017B-4EE4-AAE9-7EBCD4CDB3F5}] => (Allow) C:\Program Files (x86)\Lenovo\System Update\uncserver.exe

FirewallRules: [{2B2C6519-72C8-40C8-8D3A-220995A29581}] => (Allow) C:\Program Files (x86)\Lenovo\System Update\uncserver.exe

FirewallRules: [{7858AA24-4F7A-4E6C-8D1D-C1E9B16CD3B1}] => (Allow) C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.exe

FirewallRules: [{F0D535D8-8149-436C-BFDC-6F5BF3424805}] => (Allow) C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.exe

FirewallRules: [{8049FE25-2976-4F7C-820B-A1D5E1BAB553}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

 

==================== Restore Points =========================

 

05-04-2016 18:25:52 Windows Update

17-04-2016 18:46:19 Windows Backup

17-04-2016 19:00:14 Windows Backup

21-04-2016 20:29:17 Windows Update

27-04-2016 18:00:55 Windows Backup

27-04-2016 21:13:23 Windows Update

28-04-2016 03:00:31 Windows Update

 

==================== Faulty Device Manager Devices =============

 

Name: Lenovo Connect Device 1.0

Description: Lenovo Connect Device 1.0

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

 

 

==================== Event log errors: =========================

 

Application errors:

==================

Error: (04/28/2016 07:00:28 AM) (Source: SideBySide) (EventID: 35) (User: )

Description: Activation context generation failed for "UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"1".Error in manifest or policy file "UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"2" on line UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"3.

Component identity found in manifest does not match the identity of the component requested.

Reference is UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0".

Definition is UccApi,processorArchitecture="x86",type="win32",version="16.0.0.0".

Please use sxstrace.exe for detailed diagnosis.

 

Error: (04/28/2016 07:00:28 AM) (Source: SideBySide) (EventID: 35) (User: )

Description: Activation context generation failed for "UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"1".Error in manifest or policy file "UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"2" on line UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"3.

Component identity found in manifest does not match the identity of the component requested.

Reference is UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0".

Definition is UccApi,processorArchitecture="x86",type="win32",version="16.0.0.0".

Please use sxstrace.exe for detailed diagnosis.

 

Error: (04/28/2016 03:35:45 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

Error: (04/27/2016 07:11:10 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

Error: (04/27/2016 06:45:51 PM) (Source: SideBySide) (EventID: 35) (User: )

Description: Activation context generation failed for "UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"1".Error in manifest or policy file "UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"2" on line UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"3.

Component identity found in manifest does not match the identity of the component requested.

Reference is UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0".

Definition is UccApi,processorArchitecture="x86",type="win32",version="16.0.0.0".

Please use sxstrace.exe for detailed diagnosis.

 

Error: (04/27/2016 06:45:51 PM) (Source: SideBySide) (EventID: 35) (User: )

Description: Activation context generation failed for "UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"1".Error in manifest or policy file "UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"2" on line UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"3.

Component identity found in manifest does not match the identity of the component requested.

Reference is UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0".

Definition is UccApi,processorArchitecture="x86",type="win32",version="16.0.0.0".

Please use sxstrace.exe for detailed diagnosis.

 

Error: (04/27/2016 06:45:46 PM) (Source: SideBySide) (EventID: 35) (User: )

Description: Activation context generation failed for "UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"1".Error in manifest or policy file "UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"2" on line UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"3.

Component identity found in manifest does not match the identity of the component requested.

Reference is UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0".

Definition is UccApi,processorArchitecture="x86",type="win32",version="16.0.0.0".

Please use sxstrace.exe for detailed diagnosis.

 

Error: (04/27/2016 06:45:45 PM) (Source: SideBySide) (EventID: 35) (User: )

Description: Activation context generation failed for "UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"1".Error in manifest or policy file "UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"2" on line UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"3.

Component identity found in manifest does not match the identity of the component requested.

Reference is UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0".

Definition is UccApi,processorArchitecture="x86",type="win32",version="16.0.0.0".

Please use sxstrace.exe for detailed diagnosis.

 

Error: (04/27/2016 06:16:12 PM) (Source: SideBySide) (EventID: 35) (User: )

Description: Activation context generation failed for "UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"1".Error in manifest or policy file "UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"2" on line UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"3.

Component identity found in manifest does not match the identity of the component requested.

Reference is UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0".

Definition is UccApi,processorArchitecture="x86",type="win32",version="16.0.0.0".

Please use sxstrace.exe for detailed diagnosis.

 

Error: (04/27/2016 06:16:12 PM) (Source: SideBySide) (EventID: 35) (User: )

Description: Activation context generation failed for "UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"1".Error in manifest or policy file "UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"2" on line UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0"3.

Component identity found in manifest does not match the identity of the component requested.

Reference is UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0".

Definition is UccApi,processorArchitecture="x86",type="win32",version="16.0.0.0".

Please use sxstrace.exe for detailed diagnosis.

 

 

System errors:

=============

Error: (04/28/2016 03:34:37 AM) (Source: EventLog) (EventID: 6008) (User: )

Description: The previous system shutdown at 03:32:14 a.m. on ‎28/‎04/‎2016 was unexpected.

 

Error: (04/28/2016 01:11:55 AM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the IPBusEnum service.

 

Error: (04/27/2016 11:11:52 PM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the DisplayLinkService service.

 

Error: (04/12/2016 09:05:04 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the Lenovo Virtual Camera Controller service to connect.

 

Error: (04/08/2016 07:35:53 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The System Update service terminated unexpectedly.  It has done this 1 time(s).

 

Error: (04/05/2016 06:17:32 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Windows Presentation Foundation Font Cache 3.0.0.0 service failed to start due to the following error: 

%%1053

 

Error: (04/05/2016 06:17:32 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the Windows Presentation Foundation Font Cache 3.0.0.0 service to connect.

 

Error: (04/03/2016 09:18:48 PM) (Source: DCOM) (EventID: 10010) (User: )

Description: {009BB704-DF12-4539-8B0E-672749B82CCB}

 

Error: (04/03/2016 09:04:54 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)

Description: The following fatal alert was received: 20.

 

Error: (04/03/2016 08:14:23 PM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the DisplayLinkService service.

 

 

==================== Memory info =========================== 

 

Processor: AMD A6-7000 Radeon R4, 5 Compute Cores 2C+3G 

Percentage of memory in use: 74%

Total physical RAM: 3405.49 MB

Available physical RAM: 858.12 MB

Total Virtual: 6809.17 MB

Available Virtual: 3499.37 MB

 

==================== Drives ================================

 

Drive c: (Windows7_OS) (Fixed) (Total:447.5 GB) (Free:379.03 GB) NTFS ==>[system with boot components (obtained from drive)]

Drive q: (Lenovo_Recovery) (Fixed) (Total:16.79 GB) (Free:0.01 GB) NTFS

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (Size: 465.8 GB) (Disk ID: 1FAAD65F)

Partition 1: (Active) - (Size=1.5 GB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=447.5 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=16.8 GB) - (Type=07 NTFS)

 

==================== End of Addition.txt ============================

[zep516]

Do you have the associated log reports for these scans,

RogueKiller
ESETPoweliksCleaner

[almapa]

Here is ESET:

 

[2016.04.27 18:44:20.578] - Begin

[2016.04.27 18:44:20.578] - 

[2016.04.27 18:44:20.609] -     ....................................

[2016.04.27 18:44:20.609] -   ..::::::::::::::::::....................

[2016.04.27 18:44:20.609] -   .::EEEEEE:::SSSSSS::..EEEEEE..TTTTTTTT..    Win32/Poweliks

[2016.04.27 18:44:20.625] -  .::EE::::EE:SS:::::::.EE....EE....TT......   Version: 1.0.0.5

[2016.04.27 18:44:20.625] -  .::EEEEEEEE::SSSSSS::.EEEEEEEE....TT......   Built: Jun 30 2015

[2016.04.27 18:44:20.625] -  .::EE:::::::::::::SS:.EE..........TT......

[2016.04.27 18:44:20.625] -   .::EEEEEE:::SSSSSS::..EEEEEE.....TT.....    Copyright © ESET, spol. s r.o.

[2016.04.27 18:44:20.625] -   ..::::::::::::::::::....................    1992-2015. All rights reserved.

[2016.04.27 18:44:20.625] -     ....................................

[2016.04.27 18:44:20.625] - 

[2016.04.27 18:44:20.625] - --------------------------------------------------------------------------------

[2016.04.27 18:44:20.625] - 

[2016.04.27 18:44:20.640] - INFO: OS: 6.1.7601 SP1

[2016.04.27 18:44:20.640] - INFO: Product Type: Workstation

[2016.04.27 18:44:20.640] - INFO: WoW64: True

[2016.04.27 18:44:20.640] - INFO: Machine guid: 4E162DDA-CCE3-48DC-81A5-AF9E9D2E8B86 

[2016.04.27 18:44:20.640] - 

[2016.04.27 18:44:27.414] - INFO: Scanning for system infection...

[2016.04.27 18:44:27.414] - --------------------------------------------------------------------------------

[2016.04.27 18:44:27.414] - 

[2016.04.27 18:44:27.414] - INFO: Processing [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]...

[2016.04.27 18:44:27.445] - INFO: Processing [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]...

[2016.04.27 18:44:27.445] - INFO: Processing [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]...

[2016.04.27 18:44:27.445] - INFO: Processing [HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce]...

[2016.04.27 18:44:27.445] - INFO: Processing [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]...

[2016.04.27 18:44:27.445] - INFO: Processing [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]...

[2016.04.27 18:44:27.445] - INFO: Processing classes...

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{793EE463-1304-471C-ADF1-68C2FFB01247}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{8F8A6364-843F-4F23-8A53-9A9920A58C21}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{E927F493-B8A8-49C5-B4AB-CD6C376BAF7D}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{793EE463-1304-471C-ADF1-68C2FFB01247}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{8F8A6364-843F-4F23-8A53-9A9920A58C21}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{E927F493-B8A8-49C5-B4AB-CD6C376BAF7D}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]

[2016.04.27 18:44:27.445] - INFO: Processing clsid [\Registry\User\S-1-5-21-1958321615-1833289119-3903013992-1000\SOFTWARE\Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}]

[2016.04.27 18:44:27.445] - INFO: Processing [HKLM\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32]...

[2016.04.27 18:44:27.492] - INFO: Processing value [] = [%systemroot%\sysWOW64\wbem\wmiprvse.exe]

[2016.04.27 18:44:27.492] - INFO: Processing value [] = [%systemroot%\system32\wbem\wmiprvse.exe]

[2016.04.27 18:44:27.492] - INFO: Processing invalid values in [HKLM\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32]...

[2016.04.27 18:44:27.492] - INFO: Processing value [] = [%systemroot%\sysWOW64\wbem\wmiprvse.exe]

[2016.04.27 18:44:27.492] - INFO: Processing value [ServerExecutable] = [%systemroot%\sysWOW64\wbem\wmiprvse.exe]

[2016.04.27 18:44:27.492] - INFO: Processing value [] = [%systemroot%\system32\wbem\wmiprvse.exe]

[2016.04.27 18:44:27.492] - INFO: Processing value [ServerExecutable] = [%systemroot%\system32\wbem\wmiprvse.exe]

[2016.04.27 18:44:27.492] - INFO: Processing invalid subkeys in [HKLM\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32]...

[2016.04.27 18:44:27.492] - INFO: Processing [HKLM\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}]...

[2016.04.27 18:44:27.507] - INFO: Processing subkey [\Registry\Machine\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32]

[2016.04.27 18:44:27.507] - INFO: Processing subkey [\Registry\Machine\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32]

[2016.04.27 18:44:27.507] - INFO: (XSW) Scanning for XSW variant...

[2016.04.27 18:44:27.741] - INFO: (XSW) Processing users subkeys...

[2016.04.27 18:44:27.741] - INFO: Win32/Poweliks not found

[2016.04.27 18:44:44.472] - End

 

And here is latest Rogue...i have like 13 things on quarantine. 

RogueKiller V12.1.4.0 (x64) [Apr 25 2016] (Free) by Adlice Software

correo : http://www.adlice.com/contact/

Feedback : http://forum.adlice.com

Sitio web : http://www.adlice.co...re/roguekiller/

Blog : http://www.adlice.com

 

Sistema Operativo : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Iniciado en : Modo Normal

Usuario : Alvaro [Administrador]

Started from : C:\Program Files\RogueKiller\RogueKiller64.exe

Modo : Escanear -- Fecha : 04/28/2016 17:14:41

 

¤¤¤ Procesos : 0 ¤¤¤

 

¤¤¤ Registro : 0 ¤¤¤

 

¤¤¤ Tareas : 0 ¤¤¤

 

¤¤¤ Archivos : 0 ¤¤¤

 

¤¤¤ Archivo de hosts : 0 ¤¤¤

 

¤¤¤ Antirootkit : 0 (Driver: Cargado) ¤¤¤

 

¤¤¤ Navegadores Web : 0 ¤¤¤

 

¤¤¤ Chequeo MBR : ¤¤¤

+++++ PhysicalDrive0: WDC WD50 00LPVX-08V0TT5 SATA Disk Device +++++

--- User ---

[MBR] baef4bd18b710a8488ccb19ba749c4ee

[BSP] 3427059af2e53289c8be0f68302205d4 : Lenovo|VT.Unknown MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 1500 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]

1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 3074048 | Size: 458240 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]

2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 941549568 | Size: 17198 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]

User = LL1 ... OK

User = LL2 ... OK

 

[zep516]

Hello,

Poweliks not found, I thought too it could have been that, but not the case as far as i can see.

Nothing in the rouge report to be concerned with.

Lets look at a combofix scan,

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

• Link 1
  Link 2
  Link 3
• 
  

1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer



Please post the Log from Combofix

[almapa]

Hi, 

Its taking over 40 minutes...is this normal? Got stucked at "Completed Stage 4"

[zep516]

Let it continue for a bit more. I don't necessarily want to interrupt Combofix unless its absolutely necessary.

[zep516]

OK,

If it's still stuck at stage 4,

Open Task Manager and look for the following ComboFix related processes (some have a .3XE extension):

PEV.exe
NirCmd.3XE
PEV.3XE
SED
GREP
any file that has the extension *.3XE except CF*****.3XE <- do not end this process

One at a time, right-click and select End Process. If doing that did not free ComboFix and allow it to continue, then you will need to reboot the computer manually.

Make sure your anti virus is disabled and try running it again.

Thanks'
Joe

[almapa]

After 3 hours, here it is: 

 

ComboFix 16-04-29.01 - Alvaro 28/04/2016  18:13:53.2.2 - x64

Microsoft Windows 7 Professional   6.1.7601.1.1252.506.1033.18.3405.1251 [GMT -6:00]

Running from: c:\users\Alvaro\Downloads\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}

SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\Alvaro\AppData\Local\assembly\tmp

c:\users\Alvaro\AppData\Local\assembly\tmp\LX6WDSFH\__AssemblyInfo__.ini

c:\users\Alvaro\AppData\Local\assembly\tmp\LX6WDSFH\Newtonsoft.Json.DLL

c:\users\Alvaro\AppData\Local\assembly\tmp\VBU77BK5\__AssemblyInfo__.ini

c:\users\Alvaro\AppData\Local\assembly\tmp\VBU77BK5\Newtonsoft.Json.DLL

c:\users\Alvaro\AppData\Local\Microsoft\Windows\Temporary Internet Files\{302439B5-F7A8-4BA6-908A-1F58BD662C99}.xps

c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744BA0000000010\11.0.0\eula.ini

c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744BA0000000010\11.0.0\eula.ini2

Q:\AUTORUN.INF

.

.

(((((((((((((((((((((((((   Files Created from 2016-03-28 to 2016-04-29  )))))))))))))))))))))))))))))))

.

.

2016-04-29 02:01 . 2016-04-29 02:01 -------- d-----w- c:\users\Default\AppData\Local\temp

2016-04-28 20:37 . 2016-04-28 20:37 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5011D0CD-D360-4630-BFD7-F15283965226}\offreg.4784.dll

2016-04-28 16:30 . 2016-04-28 16:38 -------- d-----w- C:\AdwCleaner

2016-04-28 14:58 . 2016-04-28 22:10 -------- d-----w- C:\FRST

2016-04-28 11:48 . 2016-04-28 11:48 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5011D0CD-D360-4630-BFD7-F15283965226}\offreg.1312.dll

2016-04-28 09:16 . 2016-04-28 09:16 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5011D0CD-D360-4630-BFD7-F15283965226}\offreg.3860.dll

2016-04-28 03:14 . 2016-03-17 01:45 11686560 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5011D0CD-D360-4630-BFD7-F15283965226}\mpengine.dll

2016-04-28 02:14 . 2016-04-28 22:44 28272 ----a-w- c:\windows\system32\drivers\TrueSight.sys

2016-04-28 02:13 . 2016-04-28 02:14 -------- d-----w- c:\program files\RogueKiller

2016-04-28 02:13 . 2016-04-28 18:08 -------- d-----w- c:\programdata\RogueKiller

2016-04-28 01:26 . 2016-04-28 01:26 -------- d-----w- c:\program files\HitmanPro

2016-04-28 01:25 . 2016-04-28 02:13 -------- d-----w- c:\programdata\HitmanPro

2016-04-28 01:20 . 2016-04-28 02:13 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)

2016-04-28 00:47 . 2016-04-28 19:38 192216 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys

2016-04-28 00:45 . 2016-04-28 01:19 109272 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys

2016-04-28 00:45 . 2016-03-10 20:09 64896 ----a-w- c:\windows\system32\drivers\mwac.sys

2016-04-28 00:45 . 2016-03-10 20:08 27008 ----a-w- c:\windows\system32\drivers\mbam.sys

2016-04-28 00:45 . 2016-04-28 00:45 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware

2016-04-28 00:45 . 2016-04-28 00:45 -------- d-----w- c:\programdata\Malwarebytes

2016-04-22 02:27 . 2016-03-31 00:40 2724864 ----a-w- c:\windows\system32\mshtml.tlb

2016-04-22 02:26 . 2016-03-16 18:50 156672 ----a-w- c:\windows\system32\mtxoci.dll

2016-04-22 02:25 . 2016-03-09 19:00 444416 ----a-w- c:\windows\system32\winhttp.dll

2016-04-18 00:47 . 2016-04-18 00:47 -------- d-----w- c:\program files (x86)\Common Files\Skype

2016-04-09 01:38 . 2016-04-09 01:38 -------- d-----w- c:\users\Alvaro\AppData\Local\SHAREit

2016-04-04 03:04 . 2016-04-04 03:04 -------- d-----w- c:\users\Alvaro\AppData\Local\CrashDumps

2016-04-03 13:42 . 2016-04-03 13:42 211160 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

2016-04-03 13:41 . 2016-04-03 13:41 368928 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE

2016-04-03 13:41 . 2016-04-03 13:41 25344 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll

.

.

.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2016-04-28 18:13 . 2015-11-10 22:59 65536 ----a-w- c:\windows\system32\spu_storage.bin

2016-04-28 09:02 . 2015-12-20 05:11 135176864 ----a-w- c:\windows\system32\MRT.exe

2016-04-21 21:05 . 2010-11-21 03:27 453288 ------w- c:\windows\system32\MpSigStub.exe

2016-04-03 10:41 . 2015-12-21 03:39 2533152 ----a-w- c:\programdata\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe

2016-03-22 16:51 . 2016-03-22 16:51 37144 ----a-w- c:\windows\system32\drivers\aswKbd.sys

2016-03-17 22:24 . 2016-04-22 02:26 44032 ----a-w- c:\windows\apppatch\acwow64.dll

2016-03-14 10:32 . 2016-03-14 10:32 50864 ----a-w- c:\windows\system32\tpinspm.dll

2016-03-14 10:32 . 2016-03-14 10:32 72784 ----a-w- c:\windows\system32\drivers\ibmpmdrv.sys

2016-03-14 10:32 . 2016-03-14 10:32 173744 ----a-w- c:\windows\system32\ibmpmsvc.exe

2016-03-14 10:32 . 2016-03-14 10:32 81072 ----a-w- c:\windows\system32\ibmpmctl.exe

2016-03-10 00:16 . 2016-01-03 23:15 1070904 ----a-w- c:\windows\system32\drivers\aswsnx.sys

2016-03-10 00:16 . 2016-01-03 23:15 107792 ----a-w- c:\windows\system32\drivers\aswmonflt.sys

2016-02-29 14:25 . 2016-01-03 23:15 463744 ----a-w- c:\windows\system32\drivers\aswsp.sys

2016-02-13 22:26 . 2016-01-03 23:15 287016 ----a-w- c:\windows\system32\drivers\aswvmm.sys

2016-02-12 18:52 . 2016-03-02 03:25 98816 ----a-w- c:\windows\system32\wudriver.dll

2016-02-12 18:52 . 2016-03-02 03:25 3169792 ----a-w- c:\windows\system32\wucltux.dll

2016-02-12 18:52 . 2016-03-02 03:25 192512 ----a-w- c:\windows\system32\wuwebv.dll

2016-02-12 18:44 . 2016-03-02 03:25 91136 ----a-w- c:\windows\system32\WinSetupUI.dll

2016-02-12 18:39 . 2016-03-02 03:25 174080 ----a-w- c:\windows\SysWow64\wuwebv.dll

2016-02-12 18:22 . 2016-03-02 03:25 2610688 ----a-w- c:\windows\system32\wuaueng.dll

2016-02-12 18:19 . 2016-03-02 03:25 709120 ----a-w- c:\windows\system32\wuapi.dll

2016-02-12 18:18 . 2016-03-02 03:25 37888 ----a-w- c:\windows\system32\wuapp.exe

2016-02-12 18:18 . 2016-03-02 03:25 140288 ----a-w- c:\windows\system32\wuauclt.exe

2016-02-12 18:18 . 2016-03-02 03:25 36864 ----a-w- c:\windows\system32\wups.dll

2016-02-12 18:18 . 2016-03-02 03:25 37888 ----a-w- c:\windows\system32\wups2.dll

2016-02-12 18:18 . 2016-03-02 03:25 12288 ----a-w- c:\windows\system32\wu.upgrade.ps.dll

2016-02-12 18:06 . 2016-03-02 03:25 573440 ----a-w- c:\windows\SysWow64\wuapi.dll

2016-02-12 18:05 . 2016-03-02 03:25 93696 ----a-w- c:\windows\SysWow64\wudriver.dll

2016-02-12 18:05 . 2016-03-02 03:25 30208 ----a-w- c:\windows\SysWow64\wups.dll

2016-02-12 18:05 . 2016-03-02 03:25 35328 ----a-w- c:\windows\SysWow64\wuapp.exe

2016-02-09 18:15 . 2016-02-09 18:15 398152 ----a-w- c:\windows\system32\aswBoot.exe

2016-02-09 18:15 . 2016-01-03 23:15 74544 ----a-w- c:\windows\system32\drivers\aswRvrt.sys

2016-02-09 18:15 . 2016-01-03 23:15 165344 ----a-w- c:\windows\system32\drivers\aswStm.sys

2016-02-09 18:15 . 2016-01-03 23:15 37656 ----a-w- c:\windows\system32\drivers\aswHwid.sys

2016-02-09 18:15 . 2016-01-03 23:15 103064 ----a-w- c:\windows\system32\drivers\aswRdr2.sys

2016-02-09 18:15 . 2016-02-09 18:15 52184 ----a-w- c:\windows\avastSS.scr

2016-02-09 09:57 . 2016-03-10 01:15 12625920 ----a-w- c:\windows\system32\wmploc.DLL

2016-02-09 09:57 . 2016-03-10 01:15 14634496 ----a-w- c:\windows\system32\wmp.dll

2016-02-09 09:56 . 2016-03-10 01:15 5120 ----a-w- c:\windows\system32\msdxm.ocx

2016-02-09 09:56 . 2016-03-10 01:15 5120 ----a-w- c:\windows\system32\dxmasf.dll

2016-02-09 09:55 . 2016-03-10 01:15 30720 ----a-w- c:\windows\system32\seclogon.dll

2016-02-09 09:54 . 2016-03-10 01:15 9728 ----a-w- c:\windows\system32\spwmp.dll

2016-02-09 09:51 . 2016-03-10 01:15 12625408 ----a-w- c:\windows\SysWow64\wmploc.DLL

2016-02-09 09:13 . 2016-03-10 01:15 4096 ----a-w- c:\windows\SysWow64\msdxm.ocx

2016-02-09 09:13 . 2016-03-10 01:15 4096 ----a-w- c:\windows\SysWow64\dxmasf.dll

2016-02-09 09:13 . 2016-03-10 01:15 8192 ----a-w- c:\windows\SysWow64\spwmp.dll

2016-02-05 19:03 . 2016-03-18 23:21 147904 ----a-w- c:\windows\system32\drivers\tpm.sys

2016-02-05 18:56 . 2016-03-18 23:21 20480 ----a-w- c:\windows\system32\tbs.dll

2016-02-05 18:54 . 2016-03-10 01:15 41472 ----a-w- c:\windows\system32\lpk.dll

2016-02-05 18:54 . 2016-03-18 23:21 109568 ----a-w- c:\windows\system32\fveapibase.dll

2016-02-05 18:54 . 2016-03-10 01:15 100864 ----a-w- c:\windows\system32\fontsub.dll

2016-02-05 18:53 . 2016-03-10 01:15 14336 ----a-w- c:\windows\system32\dciman32.dll

2016-02-05 18:53 . 2016-03-10 01:15 46080 ----a-w- c:\windows\system32\atmlib.dll

2016-02-05 18:50 . 2016-03-10 01:15 25600 ----a-w- c:\windows\SysWow64\lpk.dll

2016-02-05 18:44 . 2016-03-10 01:15 70656 ----a-w- c:\windows\SysWow64\fontsub.dll

2016-02-05 18:42 . 2016-03-10 01:15 10240 ----a-w- c:\windows\SysWow64\dciman32.dll

2016-02-05 17:48 . 2016-03-10 01:15 372736 ----a-w- c:\windows\system32\atmfd.dll

2016-02-05 17:43 . 2016-03-10 01:15 299520 ----a-w- c:\windows\SysWow64\atmfd.dll

2016-02-05 17:43 . 2016-03-10 01:15 34304 ----a-w- c:\windows\SysWow64\atmlib.dll

2016-02-05 17:33 . 2016-03-18 23:21 15360 ----a-w- c:\windows\SysWow64\tbs.dll

2016-02-05 01:19 . 2016-03-10 01:15 381440 ----a-w- c:\windows\system32\mfds.dll

2016-02-04 18:41 . 2016-03-10 01:15 296448 ----a-w- c:\windows\SysWow64\mfds.dll

2016-02-03 18:58 . 2016-03-10 01:19 862208 ----a-w- c:\windows\system32\oleaut32.dll

2016-02-03 18:52 . 2016-03-10 01:19 84992 ----a-w- c:\windows\system32\asycfilt.dll

2016-02-03 18:49 . 2016-03-10 01:19 572416 ----a-w- c:\windows\SysWow64\oleaut32.dll

2016-02-03 18:43 . 2016-03-10 01:19 67584 ----a-w- c:\windows\SysWow64\asycfilt.dll

2016-02-03 18:07 . 2016-03-10 01:19 91648 ----a-w- c:\windows\system32\drivers\USBSTOR.SYS

2016-02-02 18:57 . 2016-03-18 23:21 511488 ----a-w- c:\windows\system32\rpcss.dll

2016-02-01 19:08 . 2016-03-18 23:22 114624 ----a-w- c:\windows\system32\consent.exe

2016-02-01 18:59 . 2016-03-18 23:22 504320 ----a-w- c:\windows\system32\msihnd.dll

2016-02-01 18:59 . 2016-03-18 23:22 3243008 ----a-w- c:\windows\system32\msi.dll

2016-02-01 18:59 . 2016-03-18 23:22 25088 ----a-w- c:\windows\system32\msimsg.dll

2016-02-01 18:56 . 2016-03-18 23:22 1940992 ----a-w- c:\windows\system32\authui.dll

2016-02-01 18:56 . 2016-03-18 23:22 70144 ----a-w- c:\windows\system32\appinfo.dll

2016-02-01 18:49 . 2016-03-18 23:22 337408 ----a-w- c:\windows\SysWow64\msihnd.dll

2016-02-01 18:49 . 2016-03-18 23:22 25088 ----a-w- c:\windows\SysWow64\msimsg.dll

2016-02-01 18:49 . 2016-03-18 23:22 2364928 ----a-w- c:\windows\SysWow64\msi.dll

2016-02-01 18:45 . 2016-03-18 23:22 1805824 ----a-w- c:\windows\SysWow64\authui.dll

.

.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive1]

@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"

[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]

2015-12-21 04:03 329376 ----a-w- c:\users\Alvaro\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive2]

@="{5AB7172C-9C11-405C-8DD5-AF20F3606282}"

[HKEY_CLASSES_ROOT\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}]

2015-12-21 04:03 329376 ----a-w- c:\users\Alvaro\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive3]

@="{A78ED123-AB77-406B-9962-2A5D9D2F7F30}"

[HKEY_CLASSES_ROOT\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}]

2015-12-21 04:03 329376 ----a-w- c:\users\Alvaro\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive4]

@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"

[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]

2015-12-21 04:03 329376 ----a-w- c:\users\Alvaro\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive5]

@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"

[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]

2015-12-21 04:03 329376 ----a-w- c:\users\Alvaro\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]

@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"

[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]

2016-04-03 10:41 1538864 ----a-w- c:\program files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]

@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"

[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]

2016-04-03 10:41 1538864 ----a-w- c:\program files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]

@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"

[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]

2016-04-03 10:41 1538864 ----a-w- c:\program files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2014-09-04 767176]

"PWMTRV"="c:\program files (x86)\ThinkPad\Utilities\PWMTR64V.DLL" [2014-11-13 6371568]

"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2016-03-23 7139256]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"SoftwareSASGeneration"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]

@=""

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 QuickControlMasterSvc;Lenovo QuickControl Master Service;c:\program files (x86)\Lenovo\QuickControl\QuickControlMasterSvc.exe;c:\program files (x86)\Lenovo\QuickControl\QuickControlMasterSvc.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R3 Lenovo EasyPlus Hotspot;Lenovo EasyPlus Hotspot;c:\program files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe;c:\program files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [x]

R3 LenovoProdRegManager;PowerENGAGE Maintenance Service;c:\program files (x86)\Lenovo Registration\EngageService.exe;c:\program files (x86)\Lenovo Registration\EngageService.exe [x]

R3 LSCWinService;LSCWinService;c:\program files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe;c:\program files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [x]

R3 PwmEWSvc;Cisco EnergyWise Enabler;c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE;c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]

R3 RtkBtFilter;Realtek Bluetooth Filter Driver;c:\windows\system32\DRIVERS\RtkBtfilter.sys;c:\windows\SYSNATIVE\DRIVERS\RtkBtfilter.sys [x]

R3 ShareItSvc;ShareItSvc;c:\program files (x86)\Lenovo\SHAREit\Shareit.Service.exe;c:\program files (x86)\Lenovo\SHAREit\Shareit.Service.exe [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]

S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_sata.sys [x]

S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_xata.sys [x]

S0 aswRvrt;avast! Revert; [x]

S0 aswVmm;avast! VM Monitor; [x]

S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM64.sys;c:\windows\SYSNATIVE\DRIVERS\ApsHM64.sys [x]

S1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys;c:\windows\SYSNATIVE\drivers\aswKbd.sys [x]

S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]

S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]

S2 ApHidMonitorService;Alps HID Monitor Service;c:\program files\Apoint2K\HidMonitorSvc.exe;c:\program files\Apoint2K\HidMonitorSvc.exe [x]

S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]

S2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]

S2 AvrcpService;AvrcpService;c:\program files (x86)\REALTEK\Realtek Bluetooth\AvrcpService.exe;c:\program files (x86)\REALTEK\Realtek Bluetooth\AvrcpService.exe [x]

S2 BTDevManager;BTDevManager;c:\program files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe;c:\program files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [x]

S2 ClickToRunSvc;Servicio Hacer clic y ejecutar de Microsoft Office;c:\program files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe;c:\program files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [x]

S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]

S2 DisplayLinkService;DisplayLinkManager;c:\program files\DisplayLink Core Software\DisplayLinkManager.exe;c:\program files\DisplayLink Core Software\DisplayLinkManager.exe [x]

S2 HPSupportSolutionsFrameworkService;HP Support Solutions Framework Service;c:\program files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe;c:\program files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [x]

S2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe [x]

S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\LENOVO\HOTKEY\MICMUTE.exe;c:\program files\LENOVO\HOTKEY\MICMUTE.exe [x]

S2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction;c:\program files\Lenovo\Communications Utility\TPKNRSVC.exe;c:\program files\Lenovo\Communications Utility\TPKNRSVC.exe [x]

S2 LENOVO.TVTVCAM;Lenovo Virtual Camera Controller;c:\program files\Lenovo\Communications Utility\vcamsvc.exe;c:\program files\Lenovo\Communications Utility\vcamsvc.exe [x]

S2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe [x]

S2 lnvDiscoveryWinSvc;lnvDiscoveryWinSvc;c:\program files\Lenovo\Lenovo Peer Connect\LenovoDiscoverySvc.exe;c:\program files\Lenovo\Lenovo Peer Connect\LenovoDiscoverySvc.exe [x]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [x]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]

S2 RtkBleServ;RtkBleServ;c:\program files (x86)\REALTEK\Realtek Bluetooth\RtkBleServ.exe;c:\program files (x86)\REALTEK\Realtek Bluetooth\RtkBleServ.exe [x]

S2 TPHKLOAD;Lenovo Hotkey Client Loader;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe [x]

S2 TPHKSVC;On Screen Display;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe [x]

S3 amdhub30;AMD USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\amdhub30.sys;c:\windows\SYSNATIVE\DRIVERS\amdhub30.sys [x]

S3 amdxhc;AMD USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\amdxhc.sys;c:\windows\SYSNATIVE\DRIVERS\amdxhc.sys [x]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]

S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]

S3 Power Manager DBC Service;Power Manager Service;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [x]

S3 QuickControlService;Lenovo QuickControl Service;c:\program files (x86)\Lenovo\QuickControl\QuickControlService.exe;c:\program files (x86)\Lenovo\QuickControl\QuickControlService.exe [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

S3 RTSPER;Realtek PCIE Card Reader - PER;c:\windows\system32\DRIVERS\RtsPer.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPer.sys [x]

S3 rtsuvc;Integrated Camera;c:\windows\system32\DRIVERS\rtsuvc.sys;c:\windows\SYSNATIVE\DRIVERS\rtsuvc.sys [x]

S3 RTWlanE;Realtek Wireless LAN 802.11n PCI-E Network Adapter;c:\windows\system32\DRIVERS\rtwlane.sys;c:\windows\SYSNATIVE\DRIVERS\rtwlane.sys [x]

S3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\DRIVERS\Tvti2c.sys;c:\windows\SYSNATIVE\DRIVERS\Tvti2c.sys [x]

S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]

.

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - MBAMSWISSARMY

*Deregistered* - TrueSight

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ   SSDPSRV upnphost SCardSvr QWAVE wcncsvc

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2016-04-13 03:27 1106072 ----a-w- c:\program files (x86)\Google\Chrome\Application\49.0.2623.112\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2016-04-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-12-21 03:55]

.

2016-04-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-12-21 03:55]

.

2016-04-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1958321615-1833289119-3903013992-1000Core.job

- c:\users\Alvaro\AppData\Local\Google\Update\GoogleUpdate.exe [2015-12-21 04:01]

.

2016-04-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1958321615-1833289119-3903013992-1000UA.job

- c:\users\Alvaro\AppData\Local\Google\Update\GoogleUpdate.exe [2015-12-21 04:01]

.

2016-04-28 c:\windows\Tasks\HPCeeScheduleForAlvaro.job

- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-16 15:51]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive1]

@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"

[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]

2015-12-21 04:03 358064 ----a-w- c:\users\Alvaro\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive2]

@="{5AB7172C-9C11-405C-8DD5-AF20F3606282}"

[HKEY_CLASSES_ROOT\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}]

2015-12-21 04:03 358064 ----a-w- c:\users\Alvaro\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive3]

@="{A78ED123-AB77-406B-9962-2A5D9D2F7F30}"

[HKEY_CLASSES_ROOT\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}]

2015-12-21 04:03 358064 ----a-w- c:\users\Alvaro\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive4]

@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"

[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]

2015-12-21 04:03 358064 ----a-w- c:\users\Alvaro\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive5]

@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"

[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]

2015-12-21 04:03 358064 ----a-w- c:\users\Alvaro\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]

@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"

[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]

2016-04-03 11:34 2095408 ----a-w- c:\program files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]

@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"

[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]

2016-04-03 11:34 2095408 ----a-w- c:\program files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]

@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"

[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]

2016-04-03 11:34 2095408 ----a-w- c:\program files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2016-02-09 18:15 905248 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtsCM"="RTSCM64.EXE" [2014-09-11 168152]

"BtServer"="c:\program files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe" [2014-07-03 226008]

"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2014-12-12 317240]

"TpShocks"="TpShocks.exe" [2014-12-09 555760]

"LENOVO.TPKNRRES"="c:\program files\Lenovo\Communications Utility\TPKNRRES.exe" [2014-08-07 295712]

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.com/

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: E&xport to Microsoft Excel - c:\program files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\program files (x86)\Microsoft Office\Root\Office16\ONBttnIE.dll/105

TCP: DhcpNameServer = 192.168.1.1 186.177.66.3 186.177.65.3

Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - c:\program files (x86)\Microsoft Office\root\Office16\MSOSB.DLL

Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - c:\program files (x86)\Microsoft Office\root\Office16\MSOSB.DLL

Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - c:\program files (x86)\Microsoft Office\root\Office16\MSOSB.DLL

Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - c:\program files (x86)\Microsoft Office\root\Office16\MSOSB.DLL

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

Toolbar-Locked - (no file)

AddRemove-{79C54A05-F146-4EA0-8A70-D4EFE6181E52} - c:\program files (x86)\InstallShield Installation Information\{79C54A05-F146-4EA0-8A70-D4EFE6181E52}\setup.exe

.

.

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2016-04-28  20:06:58

ComboFix-quarantined-files.txt  2016-04-29 02:06

.

Pre-Run: 413.332.582.400 bytes free

Post-Run: 413.666.324.480 bytes free

.

- - End Of File - - 1AFD18F0EEB1949D827CF1D5E10C4605

8A93098AE4C351115B719B9F5B573FC0

[zep516]

I need to call it a day and tend to some things for work

How is the computer ? Any difference after Combofix ?

Please run this scan ESET it may take a bit, I'd start it when your done with the computer and just let it run.

ESET Online Scanner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

• Please go >>HERE<< then click on:
  
  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on the icon to install.
  
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
• Select the option YES, I accept the Terms of Use then click on:
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
• Now click on Advanced Settings and select the following:
  • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology

• Now click on:
• The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed make sure you first copy the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt
• Copy and paste that log as a reply to this topic.
• Now click on:
  (Selecting Uninstall application on close if you so wish)

NOTE: In some instances if no malware is found there will be no log produced.

[almapa]

Hey Joe, 

 

After the ComboFix, is working the same: over 10 chrome processes. If its helpful, this processes only start when I open the Chrome.   

This is the ESET online log: 

 

C:\Users\Alvaro\Downloads\u (1).zip a variant of Win32/UltraReach potentially unsafe application

C:\Users\Alvaro\Downloads\u.zip a variant of Win32/UltraReach potentially unsafe application

C:\Users\Alvaro\Downloads\uጄ.exe a variant of Win32/UltraReach potentially unsafe application

Q:\ALVARO-PC\Backup Set 2016-01-03 184957\Backup Files 2016-01-11 183701\Backup files 1.zip a variant of Win32/UltraReach potentially unsafe application

Q:\ALVARO-PC\Backup Set 2016-01-03 184957\Backup Files 2016-01-11 183701\Backup files 3.zip a variant of Win32/UltraReach potentially unsafe application

Q:\ALVARO-PC\Backup Set 2016-02-01 102321\Backup Files 2016-02-01 102321\Backup files 2.zip a variant of Win32/UltraReach potentially unsafe application

Q:\ALVARO-PC\Backup Set 2016-02-01 102321\Backup Files 2016-02-01 102321\Backup files 4.zip a variant of Win32/UltraReach potentially unsafe application

Q:\ALVARO-PC\Backup Set 2016-02-01 102321\Backup Files 2016-02-14 190005\Backup files 1.zip JS/Iframe.MO trojan

Edited by almapa, 29 April 2016 - 10:59 AM.

[zep516]

Hello,

If you’ve ever taken a peek in Task Manager while running Google Chrome, you may have been surprised to see that the number of chrome.exe entries radically exceeded the number of actual Chrome windows you had open. What’s the deal with all those processes?

See here
http://www.howtogeek...open-processes/

Also see post # 9 here,
http://www.bleepingc...n-task-manager/

Your logs are clean, I don't see any Malware.

Thanks
Joe

[almapa]

Ok, lets give it a shot. 

 

Thanks a lot for your time and patience. 

 

Best, 

 

A 

[zep516]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Thanks
Joe