Solved Infected by CRYPTOLOCKER Virus (Post 1)

I was not paying due attention and foolishly opened an email which suddenly Hijacked all of my files etc.
I am posting the files form the Farbar Recovery Scan Tool as requested. However be aware that because I di not read the instructions before trying to remove the virus myself so I did download "Antimalwares" before downloading and running Farbar.
Will send in multiple posts due to size limitations in forum software.
.
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 31-08-2016
Ran by Workventures (administrator) on LENOVO (03-09-2016 10:51:49)
Running from C:\Users\Workventures\Desktop
Loaded Profiles: Workventures (Available Profiles: Workventures)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(Intel Corporation) C:\Program Files (x86)\Intel\AMT\LMS.exe
() C:\Program Files\Lenovo\Lenovo Mouse Suite\PelService.exe
() C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe
(Realtek Semiconductor Corp.) C:\Program Files (x86)\REALTEK\USB Wireless LAN Utility\RtlService.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpdsvc.exe
(Intel Corporation) C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Realtek Semiconductor Corp.) C:\Program Files (x86)\REALTEK\USB Wireless LAN Utility\RtWLan.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Primax Electronics Ltd.) C:\Program Files\Lenovo\Lenovo Mouse Suite\ICO.exe
(Sonix) C:\Windows\vsnp2uvc.exe
(Logitech Inc.) C:\Program Files\Logitech\Gaming Software\LWEMon.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Google Inc.) C:\Users\Workventures\AppData\Local\Google\Update\GoogleUpdate.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpsystray.exe
(Firetrust) C:\Program Files (x86)\Firetrust\MailWasher\MailWasherPro.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe
(Sonix Technology Co., Ltd.) C:\Program Files (x86)\Common Files\SNP2UVC\tsnp2uvc.exe
() C:\Program Files\Lenovo\Lenovo Mouse Suite\FSRremoS.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Program Files\Lenovo\Lenovo Mouse Suite\PelElvDm.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Wondershare) C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
(Lenovo) C:\Users\Workventures\AppData\Local\Apps\2.0\GOQDOVJJ.XLO\4W78N4H2.PVE\lsb...tion_2d7b41b05b24775e_0001.0006_6c5982beb50abfca\LSB.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_22_0_0_210_ActiveX.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(DivX, LLC) C:\Program Files (x86)\Common Files\DivX Shared\Qt4.8\DivXUpdate.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1340192 2016-01-29] (Microsoft Corporation)
HKLM\...\Run: [Daemon for Mouse Suite] => C:\Program Files\Lenovo\Lenovo Mouse Suite\ICO.EXE [87040 2013-03-26] (Primax Electronics Ltd.)
HKLM\...\Run: [snp2uvc] => C:\Windows\vsnp2uvc.exe [662016 2009-08-12] (Sonix)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2184520 2009-03-24] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [767312 2009-03-18] (CANON INC.)
HKLM\...\Run: [Start WingMan Profiler] => C:\Program Files\Logitech\Gaming Software\LWEMon.exe [190536 2010-06-14] (Logitech Inc.)
HKLM\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2010-08-10] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [421160 2010-09-01] (Apple Inc.)
HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [1010144 2016-06-21] (DivX, LLC)
HKLM-x32\...\Run: [snp2uvc] => C:\Windows\vsnp2uvc.exe
HKLM-x32\...\Run: [tsnp2uvc] => C:\Program Files (x86)\Common Files\SNP2UVC\tsnp2uvc.exe [318976 2011-12-02] (Sonix Technology Co., Ltd.)
HKLM-x32\...\Run: [Microsoft Works Update Detection] => C:\Program Files (x86)\Common Files\Microsoft Shared\Works Shared\WkUFind.exe [28672 2002-07-25] (Microsoft® Corporation)
HKLM-x32\...\Run: [TkBellExe] => C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [293768 2016-06-17] (RealNetworks, Inc.)
HKLM-x32\...\Run: [RealDownloader] => C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe [714992 2016-07-05] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe "
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2131344 2016-06-20] (Wondershare)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1926230946-431629159-532477852-1001\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
HKU\S-1-5-21-1926230946-431629159-532477852-1001\...\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1840424 2008-06-24] (Nero AG)
HKU\S-1-5-21-1926230946-431629159-532477852-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2857248 2016-08-24] (Valve Corporation)
HKU\S-1-5-21-1926230946-431629159-532477852-1001\...\Run: [Google Update] => C:\Users\Workventures\AppData\Local\Google\Update\GoogleUpdate.exe [153752 2016-08-02] (Google Inc.)
HKU\S-1-5-21-1926230946-431629159-532477852-1001\...\MountPoints2: {6ac4f4a0-495f-11e6-b3f9-50e549703148} - E:\AutoRun.exe
HKU\S-1-5-21-1926230946-431629159-532477852-1001\...\MountPoints2: {e5adbb69-6649-11e6-b880-50e549703148} - E:\AutoRun.exe
HKU\S-1-5-21-1926230946-431629159-532477852-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Mystify.scr [242688 2010-11-21] (Microsoft Corporation)
HKU\S-1-5-18\...\Run: [ooVoo.exe] => C:\Program Files (x86)\ooVoo\oovoo.exe [35910688 2016-03-07] (ooVoo LLC)
ShellIconOverlayIdentifiers: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\ProgramData\MEGAsync\ShellExtX64.dll No File
ShellIconOverlayIdentifiers: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\ProgramData\MEGAsync\ShellExtX64.dll No File
ShellIconOverlayIdentifiers: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\ProgramData\MEGAsync\ShellExtX64.dll No File
ShellIconOverlayIdentifiers-x32: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\ProgramData\MEGAsync\ShellExtX32.dll No File
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\ProgramData\MEGAsync\ShellExtX32.dll No File
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\ProgramData\MEGAsync\ShellExtX32.dll No File
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RealTimes.lnk [2016-06-17]
ShortcutTarget: RealTimes.lnk -> C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpsystray.exe (RealNetworks, Inc.)
Startup: C:\Users\Workventures\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MailWasherPro.lnk [2016-05-09]
ShortcutTarget: MailWasherPro.lnk -> C:\Program Files (x86)\Firetrust\MailWasher\MailWasherPro.exe (Firetrust)
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{680770D4-B5F8-4606-BE4B-1411A2BFBD8D}: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{8CF474B3-E82A-4227-8D13-F3AE51B65C61}: [DhcpNameServer] 10.0.0.138

Internet Explorer:
==================
HKU\S-1-5-21-1926230946-431629159-532477852-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bigpond.com/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1926230946-431629159-532477852-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-9c6f31ca&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1926230946-431629159-532477852-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-9c6f31ca&q={searchTerms}
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin64.dll [2016-05-13] (RealDownloader)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2016-05-13] (RealDownloader)
BHO-x32: Wondershare Video Converter Ultimate 7.1.0 -> {451C804F-C205-4F03-B48E-537EC94937BF} -> C:\ProgramData\Wondershare\Video Converter Ultimate\WSBrowserAppMgr.dll [2016-06-12] (Wondershare)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\ssv.dll [2016-07-24] (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: WOT Helper -> {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} -> C:\Program Files (x86)\WOT\WOT.dll [2010-08-30] ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-07-24] (Oracle Corporation)
Toolbar: HKLM-x32 - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files (x86)\WOT\WOT.dll [2010-08-30] ()
Toolbar: HKU\S-1-5-21-1926230946-431629159-532477852-1001 -> No Name - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - No File
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-05-25] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-05-25] (Microsoft Corporation)
Handler-x32: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files (x86)\WOT\WOT.dll [2010-08-30] ()
Handler: WSWSVCUchrome - {1CA93FF0-A218-44F1 - No File
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2010-07-23] ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL [2009-03-27] (CANON INC.)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll [2014-05-22] (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll [2016-06-22] (DivX, LLC)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-07-24] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-07-24] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=18.1.4.135 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll [2016-06-17] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=18.1.4.135 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll [2016-06-17] (RealPlayer)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-02] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-02] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-02] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-06-30] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1926230946-431629159-532477852-1001: @talk.google.com/GoogleTalkPlugin -> C:\Users\Workventures\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
FF Plugin HKU\S-1-5-21-1926230946-431629159-532477852-1001: @talk.google.com/O1DPlugin -> C:\Users\Workventures\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-12-08] (Google)
FF Plugin HKU\S-1-5-21-1926230946-431629159-532477852-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Workventures\AppData\Local\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-02] (Google Inc.)
FF Plugin HKU\S-1-5-21-1926230946-431629159-532477852-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Workventures\AppData\Local\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-02] (Google Inc.)
FF Plugin HKU\S-1-5-21-1926230946-431629159-532477852-1001: SkypePlugin -> C:\Users\Workventures\AppData\Local\SkypePlugin\7.23.0.54\npGatewayNpapi.dll [2016-08-11] (Skype Technologies S.A.)
FF Plugin HKU\S-1-5-21-1926230946-431629159-532477852-1001: SkypePlugin64 -> C:\Users\Workventures\AppData\Local\SkypePlugin\7.23.0.54\npGatewayNpapi-x64.dll [2016-08-11] (Skype Technologies S.A.)
FF Plugin ProgramFiles/Appdata: C:\Users\Workventures\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Workventures\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-12-08] (Google)
FF HKLM-x32\...\Firefox\Extensions: [WSVCU@Wondershare.com] - C:\ProgramData\Wondershare\Video Converter Ultimate\WSVCU@Wondershare.com_xpi => not found

Chrome:
=======
CHR Profile: C:\Users\Workventures\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Workventures\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-04-22]
CHR Extension: (Google Docs) - C:\Users\Workventures\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-04-22]
CHR Extension: (Google Drive) - C:\Users\Workventures\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-04-22]
CHR Extension: (YouTube) - C:\Users\Workventures\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-04-22]
CHR Extension: (Google Sheets) - C:\Users\Workventures\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-04-22]
CHR Extension: (Google Docs Offline) - C:\Users\Workventures\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-04-25]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Workventures\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-22]
CHR Extension: (Gmail) - C:\Users\Workventures\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-04-22]
CHR Extension: (Chrome Media Router) - C:\Users\Workventures\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-08-30]
CHR Extension: (Skype Calling) - C:\Users\Workventures\AppData\Local\Google\Chrome\User Data\Default\Extensions\poghlonenmjdkfghdpfomojhhfggildk [2016-05-12]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\LENOVO\easyplussdk\bin\EPHotspot64.exe [619776 2015-01-15] (Lenovo)
R2 LMS; C:\Program Files (x86)\Intel\AMT\LMS.exe [174616 2009-10-07] (Intel Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2016-01-29] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [374344 2016-01-29] (Microsoft Corporation)
R3 NMIndexingService; C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe [537896 2008-06-24] (Nero AG)
R2 PelService; C:\Program Files\Lenovo\Lenovo Mouse Suite\PelService.exe [178688 2012-03-13] () [File not signed]
S3 PrintNotify; C:\Windows\system32\spool\DRIVERS\x64\3\PrintConfig.dll [2899968 2014-08-16] (Microsoft Corporation) [File not signed]
R2 RealPlayerUpdateSvc; C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe [32544 2016-05-13] ()
R2 RealtekCU; C:\Program Files (x86)\REALTEK\USB Wireless LAN Utility\RtlService.exe [36864 2012-05-10] (Realtek Semiconductor Corp.) [File not signed]
R2 RealTimes Desktop Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [1095440 2016-06-17] (RealNetworks, Inc.)
R2 UNS; C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe [2066968 2009-10-07] (Intel Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-11] (Broadcom Corporation)
S3 massfilter_hs; C:\Windows\system32\drivers\massfilter_hs.sys [20232 2012-06-20] (HandSet Incorporated)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [289120 2015-11-13] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133816 2015-11-13] (Microsoft Corporation)
S3 pelmouse; C:\Windows\System32\DRIVERS\pelmouse.sys [23040 2012-11-28] (TPMX Electronics Ltd.)
S3 pelusblf; C:\Windows\System32\DRIVERS\pelusblf.sys [34816 2013-03-19] (TPMX Electronics Ltd.)
S3 RtlWlanu; C:\Windows\System32\DRIVERS\rtwlanu.sys [1525904 2012-11-07] (Realtek Semiconductor Corporation )
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3567488 2011-10-17] ()
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [28272 2016-08-29] ()
U5 UnlockerDriver5; C:\Program Files (x86)\Unlocker\UnlockerDriver5.sys [4096 2010-07-05] () [File not signed]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-09-03 10:51 - 2016-09-03 10:52 - 00022569 _____ C:\Users\Workventures\Desktop\FRST.txt
2016-09-03 10:51 - 2016-09-03 10:51 - 02397696 _____ (Farbar) C:\Users\Workventures\Desktop\FRST64.exe
2016-09-03 10:51 - 2016-09-03 10:51 - 00000000 ____D C:\FRST
2016-08-31 09:30 - 2016-08-31 09:30 - 00000000 ____D C:\Users\Workventures\AppData\Local\CrashDumps
2016-08-31 06:40 - 2016-08-31 06:40 - 00000000 ____D C:\Users\Workventures\Downloads\RB 0820adupree11
2016-08-31 05:58 - 2016-08-31 07:29 - 00000000 ____D C:\Users\Workventures\Downloads\QS 0730
2016-08-30 21:08 - 2016-08-30 21:08 - 00000000 ____D C:\Users\Workventures\Desktop\TeslacryptDecryptor 1.0.1569 MUI
2016-08-30 21:05 - 2016-08-30 21:05 - 00000000 ____D C:\Users\Workventures\Desktop\RansomwareFileDecryptor 1.0.1635 MUI
2016-08-30 19:57 - 2016-08-30 19:57 - 18163566 _____ C:\Users\Workventures\Desktop\TeslacryptDecryptor 1.0.1569 MUI.zip
2016-08-30 19:56 - 2016-08-30 19:57 - 11125709 _____ C:\Users\Workventures\Desktop\RansomwareFileDecryptor 1.0.1635 MUI.zip
2016-08-30 19:40 - 2016-08-31 09:29 - 00000000 ____D C:\Program Files\Plumbytes Software
2016-08-30 19:40 - 2016-08-30 20:36 - 00000000 ____D C:\Users\Workventures\AppData\Local\{698D0BA5-6E4B-44BD-9F9A-AA32F2E98D9A}
2016-08-30 19:38 - 2016-08-30 19:38 - 00582416 _____ (Plumbytes Software) C:\Users\Workventures\Desktop\antimalwaresetup.exe
2016-08-30 18:58 - 2016-08-30 19:24 - 00000000 ____D C:\AdwCleaner
2016-08-29 13:29 - 2016-08-29 13:29 - 00000000 ____D C:\Users\Workventures\AppData\Roaming\Malwarebytes
2016-08-25 13:51 - 2016-08-29 13:02 - 00028272 _____ C:\Windows\system32\Drivers\TrueSight.sys
2016-08-25 13:50 - 2016-08-25 13:50 - 00000000 ____D C:\ProgramData\RogueKiller
2016-08-25 12:32 - 2016-08-30 09:19 - 00191302 _____ C:\Windows\ntbtlog.txt
2016-08-23 06:57 - 2016-08-23 06:57 - 00003644 _____ C:\Users\Workventures\Documents\HOW_TO_RESTORE_FILES.html
2016-08-23 06:57 - 2016-08-23 06:57 - 00001126 _____ C:\Users\Workventures\Documents\HOW_TO_RESTORE_FILES.txt
2016-08-23 06:55 - 2016-08-23 07:16 - 00003644 _____ C:\Users\Workventures\Desktop\HOW_TO_RESTORE_FILES.html
2016-08-23 06:55 - 2016-08-23 07:16 - 00001126 _____ C:\Users\Workventures\Desktop\HOW_TO_RESTORE_FILES.txt
2016-08-23 06:55 - 2016-08-23 06:55 - 00003644 _____ C:\Users\Workventures\AppData\LocalLow\HOW_TO_RESTORE_FILES.html
2016-08-23 06:55 - 2016-08-23 06:55 - 00001126 _____ C:\Users\Workventures\AppData\LocalLow\HOW_TO_RESTORE_FILES.txt
2016-08-23 06:54 - 2016-08-23 06:55 - 00000000 ____D C:\ProgramData\ewywybatajeluxot
2016-08-23 06:54 - 2016-08-23 06:54 - 00003644 _____ C:\Users\Lenovo share\HOW_TO_RESTORE_FILES.html
2016-08-23 06:54 - 2016-08-23 06:54 - 00003644 _____ C:\Users\Default\HOW_TO_RESTORE_FILES.html
2016-08-23 06:54 - 2016-08-23 06:54 - 00001126 _____ C:\Users\Lenovo share\HOW_TO_RESTORE_FILES.txt
2016-08-23 06:54 - 2016-08-23 06:54 - 00001126 _____ C:\Users\Default\HOW_TO_RESTORE_FILES.txt
2016-08-20 13:33 - 2016-08-30 18:56 - 00000000 ____D C:\Users\Workventures\Desktop\Phone pics
2016-08-19 12:19 - 2016-08-23 06:55 - 00509524 _____ C:\Users\Workventures\Desktop\ZTE Blade A462 User Guide.pdf.enc
2016-08-18 06:38 - 2016-08-22 06:45 - 00003372 _____ C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1926230946-431629159-532477852-1001
2016-08-18 06:38 - 2016-08-22 06:45 - 00003252 _____ C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1926230946-431629159-532477852-1001
2016-08-18 03:45 - 2016-07-08 01:36 - 01896168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2016-08-18 03:45 - 2016-07-08 01:36 - 00377576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2016-08-18 03:45 - 2016-07-08 01:36 - 00287976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2016-08-18 03:45 - 2016-07-08 01:08 - 00046080 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys
2016-08-18 03:45 - 2016-07-02 01:31 - 00976896 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2016-08-18 03:45 - 2016-07-02 01:31 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll
2016-08-18 03:45 - 2016-07-02 01:13 - 00741888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2016-08-18 03:45 - 2016-07-02 01:13 - 00084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\INETRES.dll
2016-08-18 03:45 - 2016-07-02 00:56 - 00464896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2016-08-18 03:45 - 2016-07-02 00:56 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2016-08-18 03:45 - 2016-07-02 00:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2016-08-17 07:56 - 2016-07-09 01:32 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2016-08-17 07:56 - 2016-07-09 01:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2016-08-16 08:00 - 2016-08-23 06:55 - 00279587 _____ C:\Users\Workventures\Desktop\Telstra payment-2290560129.pdf.enc
2016-08-14 19:21 - 2016-08-23 06:54 - 00000000 ____D C:\Users\Lenovo share\Some On Samsung
2016-08-12 16:14 - 2016-08-12 16:14 - 00003924 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926230946-431629159-532477852-1001UA
2016-08-12 16:14 - 2016-08-12 16:14 - 00003528 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926230946-431629159-532477852-1001Core
2016-08-12 16:14 - 2016-08-12 16:14 - 00000000 ____D C:\Users\Workventures\AppData\Roaming\Mozilla
2016-08-11 09:22 - 2016-08-30 21:24 - 00000000 ____D C:\Users\Workventures\AppData\LocalLow\BitTorrent
2016-08-10 07:47 - 2016-06-07 02:50 - 01483264 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2016-08-10 07:47 - 2016-06-07 02:50 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2016-08-10 07:47 - 2016-06-07 02:50 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2016-08-10 07:47 - 2016-06-07 02:50 - 00141824 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2016-08-10 07:47 - 2016-06-07 01:23 - 01176064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2016-08-10 07:47 - 2016-06-07 01:23 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2016-08-10 07:47 - 2016-06-07 01:23 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2016-08-10 07:47 - 2016-06-07 01:23 - 00106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2016-08-10 07:37 - 2016-08-03 00:54 - 00394440 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-08-10 07:37 - 2016-08-03 00:08 - 00346312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-08-10 07:37 - 2016-08-02 16:54 - 25808384 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-08-10 07:37 - 2016-08-02 16:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-08-10 07:37 - 2016-08-02 16:47 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2016-08-10 07:37 - 2016-08-02 16:32 - 02894336 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-08-10 07:37 - 2016-08-02 16:32 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-08-10 07:37 - 2016-08-02 16:31 - 00572416 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-08-10 07:37 - 2016-08-02 16:31 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-08-10 07:37 - 2016-08-02 16:31 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2016-08-10 07:37 - 2016-08-02 16:31 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2016-08-10 07:37 - 2016-08-02 16:24 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-08-10 07:37 - 2016-08-02 16:23 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-08-10 07:37 - 2016-08-02 16:20 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-08-10 07:37 - 2016-08-02 16:19 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-08-10 07:37 - 2016-08-02 16:19 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2016-08-10 07:37 - 2016-08-02 16:18 - 06047744 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-08-10 07:37 - 2016-08-02 16:18 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-08-10 07:37 - 2016-08-02 16:18 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2016-08-10 07:37 - 2016-08-02 16:11 - 00969216 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2016-08-10 07:37 - 2016-08-02 16:08 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-08-10 07:37 - 2016-08-02 16:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2016-08-10 07:37 - 2016-08-02 16:00 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-08-10 07:37 - 2016-08-02 15:59 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2016-08-10 07:37 - 2016-08-02 15:56 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2016-08-10 07:37 - 2016-08-02 15:55 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-08-10 07:37 - 2016-08-02 15:54 - 20343808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-08-10 07:37 - 2016-08-02 15:53 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-08-10 07:37 - 2016-08-02 15:51 - 00497664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-08-10 07:37 - 2016-08-02 15:51 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2016-08-10 07:37 - 2016-08-02 15:51 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2016-08-10 07:37 - 2016-08-02 15:51 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2016-08-10 07:37 - 2016-08-02 15:51 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2016-08-10 07:37 - 2016-08-02 15:50 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2016-08-10 07:37 - 2016-08-02 15:47 - 02286592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-08-10 07:37 - 2016-08-02 15:45 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2016-08-10 07:37 - 2016-08-02 15:44 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2016-08-10 07:37 - 2016-08-02 15:42 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2016-08-10 07:37 - 2016-08-02 15:41 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-08-10 07:37 - 2016-08-02 15:41 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2016-08-10 07:37 - 2016-08-02 15:41 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2016-08-10 07:37 - 2016-08-02 15:40 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-08-10 07:37 - 2016-08-02 15:38 - 00806400 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-08-10 07:37 - 2016-08-02 15:38 - 00724992 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-08-10 07:37 - 2016-08-02 15:37 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2016-08-10 07:37 - 2016-08-02 15:36 - 02131456 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-08-10 07:37 - 2016-08-02 15:33 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2016-08-10 07:37 - 2016-08-02 15:29 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2016-08-10 07:37 - 2016-08-02 15:28 - 15412224 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-08-10 07:37 - 2016-08-02 15:28 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2016-08-10 07:37 - 2016-08-02 15:26 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2016-08-10 07:37 - 2016-08-02 15:25 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2016-08-10 07:37 - 2016-08-02 15:24 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2016-08-10 07:37 - 2016-08-02 15:23 - 02868224 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-08-10 07:37 - 2016-08-02 15:22 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2016-08-10 07:37 - 2016-08-02 15:21 - 04608000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-08-10 07:37 - 2016-08-02 15:16 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2016-08-10 07:37 - 2016-08-02 15:15 - 00692736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-08-10 07:37 - 2016-08-02 15:14 - 02055680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-08-10 07:37 - 2016-08-02 15:14 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2016-08-10 07:37 - 2016-08-02 15:11 - 13808128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-08-10 07:37 - 2016-08-02 15:10 - 01550848 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-08-10 07:37 - 2016-08-02 14:59 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-08-10 07:37 - 2016-08-02 14:56 - 02393088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-08-10 07:37 - 2016-08-02 14:53 - 01316352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-08-10 07:37 - 2016-08-02 14:51 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-08-10 07:37 - 2016-07-09 01:37 - 00154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-08-10 07:37 - 2016-07-09 01:37 - 00095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-08-10 07:37 - 2016-07-09 01:32 - 01464320 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00730624 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00343552 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-08-10 07:37 - 2016-07-09 01:17 - 00666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2016-08-10 07:37 - 2016-07-09 01:17 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00260608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00251392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2016-08-10 07:37 - 2016-07-09 01:03 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2016-08-10 07:37 - 2016-07-09 01:01 - 03218944 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-08-10 07:37 - 2016-07-09 00:57 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-08-10 07:37 - 2016-07-09 00:56 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-08-10 07:37 - 2016-07-09 00:56 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-08-10 07:37 - 2016-07-09 00:55 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2016-08-10 07:37 - 2016-07-09 00:55 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-08-10 07:37 - 2016-07-09 00:50 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2016-08-05 09:12 - 2016-08-05 09:12 - 00000000 ____D C:\Users\Workventures\.MCTranscodingSDK
2016-08-05 07:56 - 2016-08-05 07:56 - 00000000 ____D C:\Program Files (x86)\Boilsoft Video Converter
2016-08-04 19:03 - 2016-08-04 19:04 - 00000000 ____D C:\Users\Workventures\Documents\Wondershare Video Converter Ultimate
2016-08-04 19:03 - 2016-08-04 19:03 - 00000000 ____D C:\Users\Workventures\AppData\Roaming\Wondershare Video Converter Ultimate
2016-08-04 19:03 - 2016-08-04 19:03 - 00000000 ____D C:\Users\Workventures\AppData\Roaming\{950EB46C-6AC7-4ACC-AB36-9A6A77C08B6A}
2016-08-04 18:58 - 2016-08-04 18:58 - 00000000 ____D C:\Users\Workventures\Documents\Wondershare MediaServer
2016-08-04 18:57 - 2016-08-04 19:08 - 00000000 ____D C:\Program Files (x86)\Wondershare
2016-08-04 18:57 - 2016-08-04 19:04 - 00000000 ____D C:\ProgramData\Wondershare Video Converter Ultimate
2016-08-04 16:21 - 2016-08-05 09:28 - 00002870 _____ C:\Users\Workventures\Documents\starburn.txt
2016-08-04 16:21 - 2016-08-04 18:57 - 00000000 ____D C:\ProgramData\Wondershare
2016-08-04 16:21 - 2016-08-04 16:21 - 00000000 ____D C:\Users\Workventures\AppData\Local\Wondershare
2016-08-04 16:20 - 2016-08-04 19:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare
2016-08-04 16:19 - 2016-08-04 18:02 - 00000000 ____D C:\Users\Workventures\Documents\Wondershare Filmora
2016-08-04 16:19 - 2016-08-04 16:19 - 00000000 ____D C:\ProgramData\Wondershare Video Editor
2016-08-04 16:19 - 2016-08-04 16:19 - 00000000 ____D C:\Program Files\Wondershare
2016-08-04 16:18 - 2016-08-23 06:54 - 00000000 ____D C:\Users\Public\Documents\Wondershare
2016-08-04 12:50 - 2016-08-23 06:54 - 328290950 _____ C:\Users\Lenovo share\PT_0803 - Kiki 2c5.mp4.enc

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-09-03 10:51 - 2015-09-24 13:44 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-09-03 10:49 - 2009-07-14 14:45 - 00029808 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-09-03 10:49 - 2009-07-14 14:45 - 00029808 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-09-03 10:44 - 2016-05-28 05:52 - 00003476 _____ C:\Windows\System32\Tasks\Secunia PSI Logon Task
2016-09-03 10:44 - 2015-08-19 11:22 - 00000000 ____D C:\Users\Workventures\AppData\Local\Deployment
2016-09-03 10:42 - 2016-05-08 20:05 - 00000000 ____D C:\Program Files (x86)\Steam
2016-09-03 10:42 - 2016-04-22 19:54 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-09-03 10:41 - 2009-07-14 15:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-08-31 09:11 - 2016-04-22 19:54 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-08-31 08:58 - 2009-07-14 15:13 - 00781782 _____ C:\Windows\system32\PerfStringBackup.INI
2016-08-31 08:58 - 2009-07-14 13:20 - 00000000 ____D C:\Windows\inf
2016-08-31 07:43 - 2016-05-02 22:02 - 00000000 ____D C:\Users\Workventures\AppData\Roaming\Skype
2016-08-31 07:33 - 2016-04-22 19:35 - 00000000 ____D C:\Users\Workventures\AppData\Local\JDownloader v2.0
2016-08-30 21:52 - 2016-04-22 19:15 - 00000000 ____D C:\Users\Workventures\AppData\Roaming\BitTorrent
2016-08-29 13:28 - 2016-04-23 07:43 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-08-23 08:23 - 2015-08-03 14:10 - 00000000 ____D C:\Users\Workventures\AppData\Local\ElevatedDiagnostics
2016-08-23 08:23 - 2009-07-14 13:20 - 00000000 ____D C:\Windows\system32\NDF
2016-08-23 07:16 - 2016-04-23 07:39 - 00000000 ____D C:\Users\Workventures\Tracing
2016-08-23 06:57 - 2016-04-06 11:12 - 00014503 _____ C:\Users\Workventures\Documents\Tree Trimmming.docx.enc
2016-08-23 06:57 - 2016-02-20 17:50 - 00011938 _____ C:\Users\Workventures\Documents\torrent.docx.enc
2016-08-23 06:57 - 2016-01-13 12:10 - 00013427 _____ C:\Users\Workventures\Documents\steam.docx.enc
2016-08-23 06:57 - 2015-12-21 14:27 - 01663827 _____ C:\Users\Workventures\Documents\Wellplan EAT_Final_1015.pdf.enc
2016-08-23 06:57 - 2015-12-08 12:28 - 00013090 _____ C:\Users\Workventures\Documents\Seniors Card Member Number.docx.enc
2016-08-23 06:57 - 2015-12-05 10:23 - 02392460 _____ C:\Users\Workventures\Documents\Uniden Phone DECT2035_1.pdf.enc
2016-08-23 06:57 - 2015-12-05 10:12 - 00013313 _____ C:\Users\Workventures\Documents\uniden.docx.enc
2016-08-23 06:57 - 2015-10-24 10:20 - 00000000 ____D C:\Users\Workventures\Documents\SelfMV
2016-08-23 06:57 - 2015-08-19 08:03 - 00000000 ____D C:\Users\Workventures\Documents\Story of O Book
2016-08-23 06:57 - 2015-08-14 11:01 - 01152465 _____ C:\Users\Workventures\Documents\Your energy plan.pdf.enc
2016-08-23 06:57 - 2015-08-05 08:14 - 00056087 _____ C:\Users\Workventures\Documents\win 10 rewind.docx.enc
2016-08-23 06:57 - 2015-07-29 10:07 - 00142349 _____ C:\Users\Workventures\Documents\WSC-Request-for-Service-Form.doc.enc
2016-08-23 06:57 - 2015-05-26 18:11 - 00000000 ___RD C:\Users\Workventures\Documents\Scanned Documents
2016-08-23 06:57 - 2015-01-06 14:25 - 14465529 _____ C:\Users\Workventures\Documents\Seniors Directory- C Coast.pdf.enc
2016-08-23 06:56 - 2016-07-01 13:34 - 00278050 _____ C:\Users\Workventures\Documents\Dome Steam Iron ETA-17D Instruction Manual Rev 1.pdf.enc
2016-08-23 06:56 - 2016-06-23 15:24 - 00220901 _____ C:\Users\Workventures\Documents\Ramsay Health Zarb_Jerald_1435483.pdf.enc
2016-08-23 06:56 - 2016-05-09 05:50 - 00000000 ____D C:\Users\Workventures\Documents\Flight Simulator X Files
2016-08-23 06:56 - 2016-04-24 09:13 - 00011959 _____ C:\Users\Workventures\Documents\mail washer key.docx.enc
2016-08-23 06:56 - 2016-04-22 08:01 - 00000000 ____D C:\Users\Workventures\Documents\New folder
2016-08-23 06:56 - 2016-04-13 21:48 - 00016106 _____ C:\Users\Workventures\Documents\Meatloaf.docx.enc
2016-08-23 06:56 - 2016-04-08 12:23 - 00000000 ____D C:\Users\Workventures\Documents\CASA
2016-08-23 06:56 - 2016-03-19 08:31 - 00000000 ____D C:\Users\Workventures\Documents\NBN
2016-08-23 06:56 - 2016-03-09 15:39 - 00013539 _____ C:\Users\Workventures\Documents\007 music films.docx.enc
2016-08-23 06:56 - 2016-02-16 15:36 - 00132230 _____ C:\Users\Workventures\Documents\Australian Unity Claim Form.pdf.enc
2016-08-23 06:56 - 2016-01-27 20:27 - 00336713 _____ C:\Users\Workventures\Documents\kink calendar.pdf.enc
2016-08-23 06:56 - 2016-01-13 15:46 - 02359821 _____ C:\Users\Workventures\Documents\My Money.mny.enc
2016-08-23 06:56 - 2015-12-31 08:21 - 00826859 _____ C:\Users\Workventures\Documents\OneTripPDS.pdf.enc
2016-08-23 06:56 - 2015-12-26 15:28 - 00013910 _____ C:\Users\Workventures\Documents\flightsimulator.docx.enc
2016-08-23 06:56 - 2015-12-25 20:13 - 00000000 ____D C:\Users\Workventures\Documents\Flight Simulator X Demo Files
2016-08-23 06:56 - 2015-12-19 10:23 - 00013632 _____ C:\Users\Workventures\Documents\rarbg torrents.docx.enc
2016-08-23 06:56 - 2015-12-18 11:02 - 00149100 _____ C:\Users\Workventures\Documents\737 2016.pdf.enc
2016-08-23 06:56 - 2015-12-08 11:33 - 00342221 _____ C:\Users\Workventures\Documents\2016-NRL-FullDraw.pdf.enc
2016-08-23 06:56 - 2015-11-28 07:02 - 00000000 ____D C:\Users\Workventures\Documents\Remote Assistance Logs
2016-08-23 06:56 - 2015-11-27 12:42 - 00024077 _____ C:\Users\Workventures\Documents\Owner''s Details.Open if found.doc.enc
2016-08-23 06:56 - 2015-11-03 15:51 - 01887945 _____ C:\Users\Workventures\Documents\mobile ph Telstra Buzz.pdf.enc
2016-08-23 06:56 - 2015-10-24 08:47 - 00000000 ____D C:\Users\Workventures\Documents\NativeFus_Log
2016-08-23 06:56 - 2015-10-07 15:52 - 01041627 _____ C:\Users\Workventures\Documents\Bulldogs2016_Member_Certificate.pdf.enc
2016-08-23 06:56 - 2015-09-24 09:26 - 00030857 _____ C:\Users\Workventures\Documents\i pod lock.JPG.enc
2016-08-23 06:56 - 2015-09-24 09:25 - 00029996 _____ C:\Users\Workventures\Documents\i pod Repeat.JPG.enc
2016-08-23 06:56 - 2015-09-24 08:59 - 01837641 _____ C:\Users\Workventures\Documents\iPod_shuffle_4thgen_User_Guide.pdf.enc
2016-08-23 06:56 - 2015-09-23 08:36 - 00013412 _____ C:\Users\Workventures\Documents\Flybuys.docx.enc
2016-08-23 06:56 - 2015-09-11 08:20 - 00000000 ____D C:\Users\Workventures\Documents\2016 Cruise
2016-08-23 06:56 - 2015-08-14 11:01 - 00240878 _____ C:\Users\Workventures\Documents\Market contract terms and conditions.pdf.enc
2016-08-23 06:56 - 2015-08-08 14:12 - 00000000 ____D C:\Users\Workventures\Documents\Bond docs
2016-08-23 06:56 - 2015-07-01 18:04 - 00798459 _____ C:\Users\Workventures\Documents\Bulldogs.jpeg.enc
2016-08-23 06:56 - 2015-07-01 18:04 - 00046093 _____ C:\Users\Workventures\Documents\Letter to Chairman Bulldogs.doc.enc
2016-08-23 06:56 - 2015-06-25 09:49 - 00000000 ____D C:\Users\Workventures\Documents\Croquet
2016-08-23 06:56 - 2015-06-24 16:12 - 00026372 _____ C:\Users\Workventures\Documents\Pasta Frittata.docx.enc
2016-08-23 06:56 - 2015-06-17 18:36 - 01853666 _____ C:\Users\Workventures\Documents\HTC_Desire_300_User_Guide.pdf.enc
2016-08-23 06:56 - 2015-06-12 11:16 - 00028685 _____ C:\Users\Workventures\Documents\Narelle Reference.doc.enc
2016-08-23 06:56 - 2015-06-12 11:06 - 00028685 _____ C:\Users\Workventures\Documents\PERSONAL LETTERHEAD.doc.enc
2016-08-23 06:56 - 2015-05-13 14:46 - 00028817 _____ C:\Users\Workventures\Documents\Paintoy sites.docx.enc
2016-08-23 06:56 - 2015-04-30 10:06 - 00014207 _____ C:\Users\Workventures\Documents\fetlife rope.docx.enc
2016-08-23 06:56 - 2015-04-03 05:06 - 00015814 _____ C:\Users\Workventures\Documents\Fetlife Gangbangersdocx.docx.enc
2016-08-23 06:56 - 2015-03-26 04:30 - 00043563 _____ C:\Users\Workventures\Documents\Capture1 (2).JPG.enc
2016-08-23 06:56 - 2015-03-23 10:43 - 00016670 _____ C:\Users\Workventures\Documents\BDSM Vids.docx.enc
2016-08-23 06:56 - 2015-03-19 04:45 - 00000000 ____D C:\Users\Workventures\Documents\BJ Loan
2016-08-23 06:56 - 2015-02-27 07:45 - 00015348 _____ C:\Users\Workventures\Documents\BUS -Stops.docx.enc
2016-08-23 06:56 - 2014-08-16 14:36 - 02309133 _____ C:\Users\Workventures\Documents\Diary of a slave.doc.enc
2016-08-23 06:56 - 2014-06-05 19:12 - 00020493 _____ C:\Users\Workventures\Documents\Passwwords.doc.enc
2016-08-23 06:56 - 2014-01-23 07:16 - 00029220 _____ C:\Users\Workventures\Documents\LFL.JPG.enc
2016-08-23 06:56 - 2014-01-04 05:25 - 00024077 _____ C:\Users\Workventures\Documents\Pet Girls Site Rip.doc.enc
2016-08-23 06:56 - 2014-01-02 07:41 - 00019981 _____ C:\Users\Workventures\Documents\Passwords for outlook and yahoo.doc.enc
2016-08-23 06:56 - 2013-10-17 18:33 - 00000000 ____D C:\Users\Workventures\Documents\LG Manuals
2016-08-23 06:56 - 2013-02-07 10:17 - 00024589 _____ C:\Users\Workventures\Documents\id.doc.enc
2016-08-23 06:55 - 2016-08-02 16:15 - 00004038 _____ C:\Users\Workventures\AppData\LocalLow\lpm.dat.enc
2016-08-23 06:55 - 2016-07-18 16:20 - 00049884 _____ C:\Users\Workventures\Desktop\RMS_Tolling_Update.pdf.enc
2016-08-23 06:55 - 2016-06-22 12:29 - 00000687 ____H C:\Users\Workventures\Desktop\~$ster Jez.docx.enc
2016-08-23 06:54 - 2016-08-03 14:55 - 452625419 _____ C:\Users\Lenovo share\PT_0727 - Mercy.mp4.enc
2016-08-23 06:54 - 2016-06-24 16:26 - 00000000 ____D C:\Users\Lenovo share\New folder
2016-08-23 06:54 - 2016-06-21 08:16 - 00012205 _____ C:\Users\Lenovo share\le cor.docx.enc
2016-08-23 06:54 - 2016-06-15 12:34 - 00000000 ___RD C:\Users\Lenovo share\Steam
2016-08-23 06:54 - 2016-05-18 13:27 - 00012028 _____ C:\Users\Lenovo share\DELETE Temp Files.docx.enc
2016-08-23 06:54 - 2016-04-27 06:31 - 02598413 _____ C:\Users\Lenovo share\RARE_PHOTOS_YATES.pps.enc
2016-08-23 06:54 - 2016-04-26 07:48 - 00000000 ____D C:\Users\Workventures\Desktop\Croquet
2016-08-23 06:54 - 2016-04-25 08:34 - 00000000 ____D C:\Users\Workventures\.oracle_jre_usage
2016-08-23 06:54 - 2016-04-20 12:24 - 00000000 ____D C:\Users\Lenovo share
2016-08-23 06:54 - 2016-03-25 12:45 - 525945912 _____ C:\Users\Lenovo share\SSM - Jul 17, 2015 - Sasha Knox.mp4.enc
2016-08-23 06:54 - 2016-02-16 17:27 - 2838447028 _____ C:\Users\Lenovo share\IR_0205csartre.mp4.enc
2016-08-23 06:54 - 2016-02-01 18:25 - 807264599 _____ C:\Users\Lenovo share\13202_juliette_hi.mp4.enc
2016-08-23 06:54 - 2016-01-08 09:51 - 00000000 ____D C:\Users\Lenovo share\Temp Paintoy
2016-08-23 06:54 - 2015-09-30 09:10 - 118402671 _____ C:\Users\Lenovo share\KU - Sep 07, 2010 - Jade Indica and Bella Rossi (6404).wmv.enc
2016-08-23 06:54 - 2015-09-16 10:51 - 00000000 ____D C:\BurnInTest7 Pro
2016-08-23 06:54 - 2015-08-25 11:46 - 07051937 _____ C:\Users\Lenovo share\Zipper.rm.enc
2016-08-23 06:54 - 2015-04-30 07:23 - 07256077 _____ C:\Users\Lenovo share\Gimnastics.pps.enc
2016-08-23 06:54 - 2015-03-19 07:49 - 01969677 _____ C:\Users\Lenovo share\ForBusyMen.pps.enc
2016-08-23 06:54 - 2015-03-11 09:16 - 07355405 _____ C:\Users\Lenovo share\Gimnastica-Primeleexercitii.pps.enc
2016-08-23 06:54 - 2009-07-14 13:20 - 00000000 __RHD C:\Users\Public\Libraries
2016-08-21 12:30 - 2016-04-20 12:25 - 00932864 ___SH C:\Users\Lenovo share\Thumbs.db
2016-08-18 11:27 - 2016-05-12 07:10 - 00000000 ____D C:\Users\Workventures\AppData\Local\SkypePlugin
2016-08-17 15:10 - 2016-04-30 09:12 - 00000069 _____ C:\Windows\NeroDigital.ini
2016-08-17 12:36 - 2009-07-14 13:20 - 00000000 ____D C:\Windows\rescache
2016-08-16 21:27 - 2009-07-14 15:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-08-14 06:44 - 2016-05-02 22:02 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-08-14 06:44 - 2016-05-02 22:02 - 00000000 ____D C:\ProgramData\Skype
2016-08-12 16:14 - 2016-04-22 19:27 - 00000000 ____D C:\Users\Workventures\AppData\Local\Google
2016-08-10 08:18 - 2009-07-14 14:45 - 00427960 _____ C:\Windows\system32\FNTCACHE.DAT
2016-08-10 08:01 - 2015-07-31 12:16 - 00000000 ____D C:\Windows\system32\MRT
2016-08-10 07:53 - 2015-07-31 12:16 - 147640136 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-08-09 08:12 - 2016-04-22 19:55 - 00002195 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-08-05 16:50 - 2016-04-21 18:36 - 00000000 ___RD C:\Users\Workventures\Desktop\Icons
2016-08-05 14:26 - 2015-08-04 09:33 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-08-05 09:12 - 2015-07-31 10:32 - 00000000 ____D C:\Users\Workventures
2016-08-05 07:56 - 2016-04-23 08:09 - 00000000 ____D C:\Users\Workventures\AppData\Roaming\Boilsoft
2016-08-05 07:56 - 2016-04-23 08:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Boilsoft
2016-08-04 18:20 - 2016-04-23 07:27 - 00000000 ____D C:\Users\Workventures\AppData\Local\Windows Live
2016-08-04 16:21 - 2015-08-03 15:21 - 00117296 _____ C:\Users\Workventures\AppData\Local\GDIPFONTCACHEV1.DAT

==================== Files in the root of some directories =======

2016-04-30 09:14 - 2016-06-13 13:28 - 0000042 _____ () C:\Users\Workventures\AppData\Roaming\default.pls
2016-04-22 20:27 - 2016-04-22 20:27 - 0000042 _____ () C:\Users\Workventures\AppData\Roaming\WB.CFG
2016-07-09 06:54 - 2016-07-09 06:54 - 0000000 _____ () C:\Users\Workventures\AppData\Local\{27291B01-FB87-464F-90F0-7AA8E0668D5E}

Files to move or delete:
====================
C:\Users\Lenovo share\KiesSetup.exe
C:\Users\Lenovo share\TeamViewer_Setup_en-kne.exe


Some files in TEMP:
====================
C:\Users\Workventures\AppData\Local\Temp\dllnt_dump.dll
C:\Users\Workventures\AppData\Local\Temp\jre-8u101-windows-au.exe
C:\Users\Workventures\AppData\Local\Temp\proxy_vole3800657365457486452.dll
C:\Users\Workventures\AppData\Local\Temp\proxy_vole5334679189104124043.dll
C:\Users\Workventures\AppData\Local\Temp\proxy_vole6661911521869575591.dll
C:\Users\Workventures\AppData\Local\Temp\proxy_vole8324244955139250638.dll
C:\Users\Workventures\AppData\Local\Temp\proxy_vole8652840889805646073.dll
C:\Users\Workventures\AppData\Local\Temp\Quarantine.exe
C:\Users\Workventures\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-08-29 14:56

==================== End of FRST.txt ============================

 

I was not paying due attention and foolishly opened an email which suddenly Hijacked all of my files etc.
I am posting the files form the Farbar Recovery Scan Tool as requested. However be aware that because I di not read the instructions before trying to remove the virus myself so I did download "Antimalwares" before downloading and running Farbar.
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-08-2016
Ran by Workventures (03-09-2016 10:53:11)
Running from C:\Users\Workventures\Desktop
Windows 7 Professional Service Pack 1 (X64) (2015-07-31 00:32:45)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1926230946-431629159-532477852-500 - Administrator - Disabled)
Guest (S-1-5-21-1926230946-431629159-532477852-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-1926230946-431629159-532477852-1006 - Limited - Enabled)
Workventures (S-1-5-21-1926230946-431629159-532477852-1001 - Administrator - Enabled) => C:\Users\Workventures

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {768124D7-F5F7-6D2F-DDC2-94DFA4017C95}
AS: Microsoft Security Essentials (Enabled - Up to date) {CDE0C533-D3CD-62A1-E772-AFADDF863628}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.017.20053 - Adobe Systems Incorporated)
Adobe Flash Player 22 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 22.0.0.210 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}) (Version: 1.3.2 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{C41300B9-185D-475E-BFEC-39EF732F19B1}) (Version: 2.1.2.120 - Apple Inc.)
BitTorrent (HKU\S-1-5-21-1926230946-431629159-532477852-1001\...\BitTorrent) (Version: 7.9.8.42450 - BitTorrent Inc.)
Boilsoft Video Converter 3.01 (HKLM-x32\...\{4822DF0D-087B-435C-843D-ADAB239CCA13}_is1) (Version: - Boilsoft. Inc.)
Boilsoft Video Joiner 6.57 (HKLM-x32\...\{FD39EF4B-0B5C-4B33-8D57-2EE865A80EB1}_is1) (Version: - Boilsoft, Inc.)
Bonjour (HKLM\...\{41BF0DE4-5BAE-4B88-AFD3-86A30B222186}) (Version: 2.0.3.0 - Apple Inc.)
Canon MP Navigator EX 3.0 (HKLM-x32\...\MP Navigator EX 3.0) (Version: - )
Canon MP270 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP270_series) (Version: - )
Canon Utilities Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version: - )
Canon Utilities My Printer (HKLM-x32\...\CanonMyPrinter) (Version: - )
Canon Utilities Solution Menu (HKLM-x32\...\CanonSolutionMenu) (Version: - )
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DivX Setup (HKLM\...\DivX Setup) (Version: 3.0.0.68 - DivX, LLC)
Foxtel GO (HKU\S-1-5-21-1926230946-431629159-532477852-1001\...\Foxtel GO 1.84) (Version: 1.84 - Foxtel)
Foxtel GO (x32 Version: 1.84 - Foxtel) Hidden
Free RAR Extract Frog (HKLM-x32\...\Free RAR Extract Frog) (Version: 7 - Philipp Winterberg)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 52.0.2743.116 - Google Inc.)
Google Earth (HKLM-x32\...\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)
Google Talk Plugin (HKLM-x32\...\{F9B579C2-D854-300A-BE62-A09EB9D722E4}) (Version: 5.41.3.0 - Google)
Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)
Intel(R) Management Engine Interface (HKLM\...\HECI) (Version: - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 14.2 - Intel)
Intel® Active Management Technology (HKLM\...\MESOL) (Version: - Intel Corporation)
iTunes (HKLM\...\{5F02C14D-A630-4771-8409-0BA89FCCA8D6}) (Version: 10.0.0.68 - Apple Inc.)
Java 8 Update 101 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180101F0}) (Version: 8.0.1010.13 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
K-Lite Codec Pack 12.1.0 Full (HKLM-x32\...\KLiteCodecPack_is1) (Version: 12.1.0 - KLCP)
Lenovo Mouse Suite (HKLM\...\MouseSuite98) (Version: 6.66 - Lenovo)
Lenovo Service Bridge (HKU\S-1-5-21-1926230946-431629159-532477852-1001\...\dda9ca0b023f4c56) (Version: 1.6.3.5 - Lenovo)
Logitech Gaming Software 5.10 (HKLM\...\{1444D2EE-C7AD-44A8-844F-2634B49353D1}) (Version: 5.10.127 - Logitech)
MailWasherPro (HKLM-x32\...\{A5901025-525B-4B2A-ACF4-E742D989D008}) (Version: 7.8 - Firetrust)
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Metric Collection SDK (x32 Version: 1.1.0005.00 - Lenovo Group Limited) Hidden
Metric Collection SDK 35 (x32 Version: 1.2.0006.00 - Lenovo Group Limited) Hidden
Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft Flight Simulator SimConnect Client v10.0.61259.0 (HKLM-x32\...\{D61CA184-3F6D-4A50-B2CC-7A18447D6A8D}) (Version: 10.0.61259.0 - Microsoft Corporation)
Microsoft Flight Simulator SimConnect Client v10.0.62615.0 (HKLM-x32\...\{33D89314-361A-4495-A1E1-0ACBCE08F78D}) (Version: 10.0.62615.0 - Microsoft Corporation)
Microsoft Flight Simulator X: Steam Edition (HKLM\...\Steam App 314160) (Version: - Microsoft Game Studios)
Microsoft Office Home and Business 2010 (HKLM\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1926230946-431629159-532477852-1001\...\OneDriveSetup.exe) (Version: 17.0.4035.0328 - Microsoft Corporation)
Microsoft Outlook Hotmail Connector 64-bit (HKLM\...\{95140000-007A-0409-1000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 64-bit (HKLM\...\{95140000-007D-0409-1000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Picture It! Photo Standard 7.0 (HKLM-x32\...\{369B36BE-3D64-4641-9AEA-808D436FE133}) (Version: 7.0.0.0000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.9.218.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{4FFA2088-8317-3B14-93CD-4C699DB37843}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{CA8A885F-E95B-3FC6-BB91-F4D9377C7686}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
Music Recorder (HKLM-x32\...\{F50CC230-EE79-4931-B72D-8E4D195DFFB0}) (Version: 14.1.500.0 - Audials AG)
Nero 8 Essentials (HKLM-x32\...\{7E8FF4A8-10EE-4C95-83B2-73856BFE1033}) (Version: 8.3.428 - Nero AG)
ooVoo (HKLM-x32\...\{FAA7F8FF-3C05-4A61-8F14-D8A6E9ED6623}) (Version: 3.7.1001 - ooVoo LLC.)
QuickTime (HKLM-x32\...\{EB900AF8-CC61-4E15-871B-98D1EA3E8025}) (Version: 7.67.75.0 - Apple Inc.)
RealDownloader (x32 Version: 18.1.4.137 - RealNetworks, Inc.) Hidden
RealDownloader (x32 Version: 18.1.4.144 - RealNetworks) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (RealTimes) (HKLM-x32\...\RealPlayer 18.1) (Version: 18.1.4 - RealNetworks)
REALTEK Wireless LAN Driver and Utility (HKLM-x32\...\{9C049509-055C-4CFF-A116-1D12312225EB}) (Version: 1.00.0199 - REALTEK Semiconductor Corp.)
RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version: - Microsoft) Hidden
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 8.3.0.9150 - Microsoft Corporation)
Skype Web Plugin (HKLM-x32\...\{0A95D1F2-BF33-43E7-A32B-E8089182EAE7}) (Version: 7.23.0.54 - Skype Technologies S.A.)
Skype™ 7.26 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.26.101 - Skype Technologies S.A.)
SoundMAX (HKLM-x32\...\{F0A37341-D692-11D4-A984-009027EC0A9C}) (Version: 6.10.2.6595 - Analog Devices)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Unlocker 1.9.0 (HKLM-x32\...\Unlocker) (Version: 1.9.0 - Cedrick Collomb)
UpdateService (x32 Version: 1.0.0 - RealNetworks, Inc.) Hidden
USB Video Device (HKLM-x32\...\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 9.15 - Ecom)
vc2012_redist (x32 Version: 1.0.0.0 - Realnetworks) Hidden
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
Video Downloader (x32 Version: 1.2.0 - RealNetworks) Hidden
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Wondershare Filmora(Build 7.5.0) (HKLM\...\Wondershare Filmora_is1) (Version: - Wondershare Software)
Wondershare Helper Compact 2.5.0 (HKLM-x32\...\{5363CE84-5F09-48A1-8B6C-6BB590FFEDF2}_is1) (Version: 2.5.0 - Wondershare)
WOT for Internet Explorer (HKLM-x32\...\{F99520C7-7EE6-472E-8DD8-E60003A9292F}) (Version: 10.8.30.0 - WOT Services Oy)
ZTE Handset USB Driver (HKLM\...\{01D42BF0-ED08-463f-8A28-99EB6FEE962B}) (Version: - ZTE Corporation)
ZTE Handset USB Driver (HKLM\...\{D2D77DC2-8299-11D1-8949-444553540000}_is1) (Version: 5.2104.1.02B04 - ZTE Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1926230946-431629159-532477852-1001_Classes\CLSID\{49ACECA8-A1DF-467E-8FED-CCC810B1434E}\localserver32 -> C:\Users\Workventures\AppData\Local\SkypePlugin\7.23.0.54\GatewayVersion-x64.exe (Skype Technologies S.A.)
CustomCLSID: HKU\S-1-5-21-1926230946-431629159-532477852-1001_Classes\CLSID\{59B55F04-DE14-4BB8-92FF-C4A22EF2E5F4}\InprocServer32 -> C:\Users\Workventures\AppData\Local\Google\Update\1.3.31.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1926230946-431629159-532477852-1001_Classes\CLSID\{CBF9CD8C-2714-4F36-B76A-43E6C7547BC2}\localserver32 -> C:\Users\Workventures\AppData\Local\SkypePlugin\7.23.0.54\EdgeCalling.exe (Skype Technologies S.A.)
CustomCLSID: HKU\S-1-5-21-1926230946-431629159-532477852-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Workventures\AppData\Local\Google\Update\1.3.31.5\psuser_64.dll (Google Inc.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0254D2CB-0A5B-4E8F-B60B-F6FB171CEC8A} - System32\Tasks\Secunia PSI Logon Task => C:\Users\Workventures\Desktop\Icons\pc SCANS\Icons\psi.exe [2010-07-21] (Secunia)
Task: {126BBDBD-1A7C-43DB-BDE2-D20EA78882E2} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1926230946-431629159-532477852-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2016-05-13] (RealNetworks, Inc.)
Task: {13542815-4834-4F9E-B573-34BF70FF99E2} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe [2014-09-10] (Lenovo)
Task: {1A2E5FDF-DC5E-444D-83D5-B4C09D63B547} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-07-15] (Adobe Systems Incorporated)
Task: {1ABF67F7-D920-44F3-BD9E-0E093FA4774C} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926230946-431629159-532477852-1001Core => C:\Users\Workventures\AppData\Local\Google\Update\GoogleUpdate.exe [2016-08-02] (Google Inc.)
Task: {25A9C0AA-5291-49AB-8538-91E2E6FDE289} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1926230946-431629159-532477852-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2016-05-13] (RealNetworks, Inc.)
Task: {38113228-FF62-4A6C-A6B5-DF3EF9C28950} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {48154690-7857-4870-9472-58BBBEEFDADB} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926230946-431629159-532477852-1001UA => C:\Users\Workventures\AppData\Local\Google\Update\GoogleUpdate.exe [2016-08-02] (Google Inc.)
Task: {63DA75DB-42E7-4F4F-91C7-E233DD967B9D} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {64A80AD1-F1B8-481A-9132-BDAAFCFD36BD} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {6BAF2CB2-BBBD-49E2-8D8A-22AB31A2956A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-04-22] (Google Inc.)
Task: {6FF09F4B-D0BA-4996-AB80-5A44985D7BF1} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-04-22] (Google Inc.)
Task: {80CB1730-9207-4D12-B56F-F38436A6707E} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2015-07-01] (Lenovo)
Task: {85760F23-1F51-4D8E-AA3A-1A6F4FE232D0} - System32\Tasks\DivXUpdate => C:\Program Files (x86)\Common Files\DivX Shared\Qt4.8\DivXUpdate.exe [2016-06-04] (DivX, LLC)
Task: {88A24FA3-4E02-4AA7-9C44-4D4A46E256CC} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> No File <==== ATTENTION
Task: {89A6F8E5-3B82-4E90-8410-324C80D0C349} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {A2363C14-AD02-4E1B-B9C9-E5BACC22AD83} - System32\Tasks\RealDownloader Update Check => C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe [2016-07-05] ()
Task: {C356C191-FCE5-48B9-A67C-1272CC41C022} - System32\Tasks\klcp_update => C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool.exe [2016-04-18] ()
Task: {CEC0F339-2C07-41FD-AF56-B6AA051BE647} - System32\Tasks\Lenovo\Lenovo Service Bridge\S-1-5-21-1926230946-431629159-532477852-1001 => Rundll32.exe dfshim.dll,ShOpenVerbShortcut C:\Users\Workventures\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo\Lenovo Service Bridge.appref-ms
Task: {D9DCBC7E-892C-4539-800F-0E33C5551DA5} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {FCAB4987-234C-4DBC-B452-B82AEF07BE6E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-06-25] (Adobe Systems Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

Shortcut: C:\Users\Workventures\Favorites\NCH Software Download Site.lnk -> hxxp://www.nch.com.au/index.html
Shortcut: C:\Users\Workventures\Desktop\Icons\Tools\Favorites\Helpful Websites\NCH Audio and Telephony Software.lnk -> hxxp://www.nch.com.au/index.html
Shortcut: C:\Users\Workventures\Desktop\Icons\Tools\Favorites\Helpful Websites\NCH Software Download.lnk -> hxxp://www.nchsoftware.com/index.html
Shortcut: C:\Users\Workventures\Desktop\Icons\Favorites\Helpful Websites\NCH Audio and Telephony Software.lnk -> hxxp://www.nch.com.au/index.html
Shortcut: C:\Users\Workventures\Desktop\Icons\Favorites\Helpful Websites\NCH Software Download.lnk -> hxxp://www.nchsoftware.com/index.html

==================== Loaded Modules (Whitelisted) ==============

2015-09-29 13:16 - 2012-03-13 10:46 - 00178688 ____N () C:\Program Files\Lenovo\Lenovo Mouse Suite\PelService.exe
2016-05-13 15:13 - 2016-05-13 15:13 - 00032544 _____ () C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe
2015-09-29 13:16 - 2008-11-27 16:16 - 00018432 ____N () C:\Program Files\Lenovo\Lenovo Mouse Suite\FSRremoS.EXE
2015-09-29 13:16 - 2010-06-02 11:37 - 00228352 ____N () C:\Program Files\Lenovo\Lenovo Mouse Suite\PelElvDm.exe
2016-07-05 18:18 - 2016-07-05 18:18 - 00714992 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe
2016-05-13 15:13 - 2016-05-13 15:13 - 00037688 _____ () C:\Program Files (x86)\Real\UpdateService\DL2UpdatePlugin.dll
2016-05-13 15:13 - 2016-05-13 15:13 - 00039224 _____ () C:\Program Files (x86)\Real\UpdateService\RealDownloaderUpdatePlugin.dll
2016-05-13 15:13 - 2016-05-13 15:13 - 00037192 _____ () C:\Program Files (x86)\Real\UpdateService\VideoDLUpdatePlugin.dll
2015-09-29 13:19 - 2009-10-07 16:47 - 00077824 _____ () C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\DTMessageLib.dll
2016-05-20 16:21 - 2012-11-06 09:47 - 00114688 _____ () C:\Program Files (x86)\REALTEK\USB Wireless LAN Utility\EnumDevLib.dll
2016-05-08 20:08 - 2016-08-09 09:27 - 00785920 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2016-05-08 20:08 - 2015-07-02 08:06 - 04962816 _____ () C:\Program Files (x86)\Steam\v8.dll
2016-05-08 20:08 - 2015-07-02 08:06 - 01556992 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2016-05-08 20:08 - 2015-07-02 08:06 - 01187840 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2016-05-08 20:08 - 2016-08-24 05:33 - 02321184 _____ () C:\Program Files (x86)\Steam\video.dll
2016-05-08 20:08 - 2016-01-27 17:49 - 02549760 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2016-05-08 20:08 - 2016-01-27 17:49 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2016-05-08 20:08 - 2016-01-27 17:49 - 00491008 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2016-05-08 20:08 - 2016-01-27 17:49 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2016-05-08 20:08 - 2016-01-27 17:49 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2016-05-08 20:08 - 2016-08-24 05:33 - 00835360 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2016-05-08 20:08 - 2016-07-05 08:17 - 00266560 _____ () C:\Program Files (x86)\Steam\openvr_api.dll
2016-06-17 06:50 - 2016-06-17 06:50 - 00022800 _____ () c:\program files (x86)\real\realplayer\RPDS\Tools\ffmpeg\mediautil.dll
2016-04-13 14:56 - 2016-04-13 14:56 - 00061952 _____ () C:\Program Files (x86)\Firetrust\MailWasher\MWPBridgeDLL.dll
2016-04-13 14:56 - 2016-04-13 14:56 - 05999616 _____ () C:\Program Files (x86)\Firetrust\MailWasher\MWPappDLL.dll
2016-04-18 13:14 - 2016-04-18 13:14 - 00069272 _____ () C:\Program Files (x86)\Firetrust\MailWasher\FTBridge.dll
2016-04-18 13:14 - 2016-04-18 13:14 - 00279704 _____ () C:\Program Files (x86)\Firetrust\MailWasher\FTClientNode.dll
2016-03-23 22:07 - 2016-03-23 22:07 - 00324608 _____ () C:\Program Files (x86)\Firetrust\MailWasher\MWPHeaderParser.dll
2010-08-10 00:01 - 2010-08-10 00:01 - 00067872 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2016-05-08 20:08 - 2016-08-05 06:56 - 49825056 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2016-05-13 14:20 - 2016-05-13 14:20 - 01382048 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\cpprest100_1_2.dll
2016-06-17 06:49 - 2016-06-17 06:49 - 00654608 _____ () c:\program files (x86)\real\realplayer\RPDS\Lib\r1api.dll
2016-08-04 16:21 - 2016-06-20 14:48 - 01506304 _____ () C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\DAQExp.dll
2016-08-04 16:21 - 2014-05-19 17:19 - 00137728 _____ () C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSCreateVC.dll
2010-08-30 14:51 - 2010-08-30 14:51 - 01671328 _____ () C:\Program Files (x86)\WOT\WOT.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Workventures\Documents\Bulldogs.jpeg.enc:3or4kl4x13tuuug3Byamue2s4b [83]
AlternateDataStreams: C:\Users\Workventures\Documents\Bulldogs.jpeg.enc:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} [0]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 12:34 - 2009-06-11 07:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1926230946-431629159-532477852-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Workventures\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 10.0.0.138
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{C9E81D59-F0CC-4643-805A-DA4EDB94D9DD}] => (Allow) C:\Program Files (x86)\REALTEK\USB Wireless LAN Utility\RtWLan.exe
FirewallRules: [{F237A21E-8C6C-46C1-AE36-A4A22BDC1712}] => (Allow) C:\Program Files (x86)\REALTEK\USB Wireless LAN Utility\RtWLan.exe
FirewallRules: [{679D78BF-F7CA-42A3-B28B-3C59A66374B9}] => (Allow) LPort=1542
FirewallRules: [{C8669D51-4AF8-49F1-A6FE-2C2D70791CCB}] => (Allow) LPort=1542
FirewallRules: [{7441C320-97B7-41DF-99BD-8DD91766CBD5}] => (Allow) LPort=53
FirewallRules: [{C58E008C-727F-46B0-9C17-98C54F7C8D8F}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{A3DEA719-6DF8-430D-B2E5-39C3ABE8DF45}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{BB7DB8B9-6FDA-42AB-954C-A798BBDBD2C1}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [{A5F3AA9C-4567-4C16-85B4-9CD707A9EA02}] => (Allow) C:\Users\Workventures\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{D9D3CB7A-1AD8-402D-99C0-07C3E9F2BCDE}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{98413C45-18E3-448C-8FDF-3338AD933774}] => (Allow) LPort=2869
FirewallRules: [{0995CBB1-2E67-41D3-B889-5853EF388409}] => (Allow) LPort=1900
FirewallRules: [{F33FD1C4-F321-44A5-B08D-146C020CEF6B}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{622018D0-B2CF-46A0-81F4-B179AF768EBC}] => (Allow) C:\Users\Workventures\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{B7CF2E1B-BCF0-491F-AA88-79E825D2D328}] => (Allow) C:\Users\Workventures\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{BE9A0C86-32EE-4531-8828-3893B956A676}] => (Allow) C:\Users\Workventures\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{DB527125-06EB-45B7-98EE-22030EAB2F51}] => (Allow) C:\Users\Workventures\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{D6CB07D3-8B41-4167-96A6-964395D74C4D}] => (Allow) C:\Users\Workventures\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{AFA2C2C8-B9CC-456B-8697-78228A011024}] => (Allow) C:\Users\Workventures\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{5B409339-E922-4375-9EEA-E6421ADEAEFE}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{F8B3C482-DDD3-4FA7-85D0-21416EF3927B}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{F3C1AE5D-5283-4053-9B00-8A42B9BF187B}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{EFCC1813-10AF-4709-AB45-0F8C78C3C396}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{1D2EE9AC-A0D8-458A-A555-8B1761B8267D}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{4A384C51-FBEA-46AC-9751-9488409164B1}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\FSX\fsx.exe
FirewallRules: [{75CC1F2A-80E5-4071-811E-1BB84F929EBD}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\FSX\fsx.exe
FirewallRules: [TCP Query User{A90310FC-F27E-44D4-9840-56532D68B880}C:\users\workventures\appdata\local\skypeplugin\7.18.0.51\pluginhost.exe] => (Allow) C:\users\workventures\appdata\local\skypeplugin\7.18.0.51\pluginhost.exe
FirewallRules: [UDP Query User{F1D66C57-25F0-4555-B1CC-572082A01598}C:\users\workventures\appdata\local\skypeplugin\7.18.0.51\pluginhost.exe] => (Allow) C:\users\workventures\appdata\local\skypeplugin\7.18.0.51\pluginhost.exe
FirewallRules: [{B62EE58A-ED81-4472-97F0-ECD4500C9797}] => (Allow) C:\Program Files (x86)\REALTEK\USB Wireless LAN Utility\RtWLan.exe
FirewallRules: [{EAB8E841-0012-494F-8558-E52CBAEF21FD}] => (Allow) C:\Program Files (x86)\REALTEK\USB Wireless LAN Utility\RtWLan.exe
FirewallRules: [{808B671A-3479-4809-8AC6-402E9D92D981}] => (Allow) LPort=1542
FirewallRules: [{CB442C10-BE34-42DB-8A34-1BEEC64C9003}] => (Allow) LPort=1542
FirewallRules: [{3C68AB9F-7E28-4EBF-B78E-395E61EAB518}] => (Allow) LPort=67
FirewallRules: [{3410323E-D01D-4364-B3B4-EE54E7CD0193}] => (Allow) LPort=68
FirewallRules: [{29920B5D-37B5-40E4-B061-5218F81E3A95}] => (Allow) LPort=53
FirewallRules: [{4A547304-CAF6-4419-A4B9-4C1A91612706}] => (Allow) LPort=53
FirewallRules: [{D91AD47B-663C-4F7E-913A-62B88366CC78}] => (Allow) C:\Program Files (x86)\REALTEK\USB Wireless LAN Utility\Rtldhcp.exe
FirewallRules: [{EB5F2129-D915-40DA-AF68-3BD7573E2A27}] => (Allow) C:\Program Files (x86)\Music Recorder\Music Recorder 2016\Audials.exe
FirewallRules: [{AA001EC9-15DF-45EF-84B6-E56217F148F3}] => (Allow) LPort=12972
FirewallRules: [{2AC17A2F-BDB8-45D6-9394-2751EDF84074}] => (Allow) LPort=14714
FirewallRules: [{F8BD5A38-1925-48AE-A8C9-B1DC010202E7}] => (Allow) LPort=31931
FirewallRules: [TCP Query User{23D9F465-1506-4D9B-8520-741403EFD7C6}C:\users\workventures\appdata\local\jdownloader v2.0\jdownloader2.exe] => (Allow) C:\users\workventures\appdata\local\jdownloader v2.0\jdownloader2.exe
FirewallRules: [UDP Query User{5E214168-DB5A-45EF-A91D-2D74C2D0AF44}C:\users\workventures\appdata\local\jdownloader v2.0\jdownloader2.exe] => (Allow) C:\users\workventures\appdata\local\jdownloader v2.0\jdownloader2.exe
FirewallRules: [TCP Query User{6DD71F42-B67E-435C-A608-64FFC3DF139B}C:\users\workventures\appdata\local\jdownloader v2.0\jdownloader2.exe] => (Allow) C:\users\workventures\appdata\local\jdownloader v2.0\jdownloader2.exe
FirewallRules: [UDP Query User{45A682B4-D739-419A-95C7-C0B29EAC7718}C:\users\workventures\appdata\local\jdownloader v2.0\jdownloader2.exe] => (Allow) C:\users\workventures\appdata\local\jdownloader v2.0\jdownloader2.exe
FirewallRules: [{6086610B-E13E-4DFC-ADA9-182483D93469}] => (Allow) c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe
FirewallRules: [TCP Query User{83A96E7A-E99F-4752-90C6-474650798764}C:\users\workventures\appdata\local\skypeplugin\pluginhost.exe] => (Allow) C:\users\workventures\appdata\local\skypeplugin\pluginhost.exe
FirewallRules: [UDP Query User{126F8BD1-2509-4F6A-93E8-AB37C5E9D996}C:\users\workventures\appdata\local\skypeplugin\pluginhost.exe] => (Allow) C:\users\workventures\appdata\local\skypeplugin\pluginhost.exe
FirewallRules: [{E7DA6322-58B0-4ECD-B45D-3D21BBFB56E6}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

29-08-2016 15:03:06 Scheduled Checkpoint
30-08-2016 20:00:47 Windows Update

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/03/2016 10:43:14 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (08/31/2016 09:31:08 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (08/31/2016 09:30:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: NMIndexStoreSvr.exe, version: 3.3.8.0, time stamp: 0x4860cce5
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x00000100
Faulting process id: 0xd14
Faulting application start time: 0x01d203166ee98cd2
Faulting application path: C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe
Faulting module path: unknown
Report Id: bbc90791-6f09-11e6-ba4a-50e549703148

Error: (08/31/2016 09:23:09 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (08/31/2016 09:19:39 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program Plumbytes.exe version 1.0.0.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: e80

Start Time: 01d20314bc7d2596

Termination Time: 15

Application Path: C:\Program Files\Plumbytes Software\Plumbytes Anti-Malware\Plumbytes.exe

Report Id: 2e5f34af-6f08-11e6-b3c9-50e549703148

Error: (08/31/2016 09:19:13 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (08/31/2016 09:09:22 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (08/31/2016 08:49:32 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (08/31/2016 06:48:17 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program iexplore.exe version 11.0.9600.18427 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: d60

Start Time: 01d202fae1d27d5c

Termination Time: 0

Application Path: C:\Program Files\Internet Explorer\iexplore.exe

Report Id:

Error: (08/31/2016 05:38:08 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.


System errors:
=============
Error: (08/31/2016 09:20:18 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Security Center service terminated with the following error:
The authentication service is unknown.

Error: (08/31/2016 09:19:08 AM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 70.

Error: (08/31/2016 08:51:18 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Steam Client Service service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Error: (08/31/2016 08:51:18 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.

Error: (08/31/2016 08:50:46 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the LanmanServer service.

Error: (08/31/2016 07:43:22 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: The server {F9717507-6651-4EDB-BFF7-AE615179BCCF} did not register with DCOM within the required timeout.

Error: (08/31/2016 06:41:36 AM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.

Error: (08/31/2016 06:41:34 AM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.

Error: (08/30/2016 09:02:20 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Windows Update service hung on starting.

Error: (08/30/2016 09:00:13 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Steam Client Service service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.


==================== Memory info ===========================

Processor: Intel(R) Core(TM)2 Duo CPU E8400 @ 3.00GHz
Percentage of memory in use: 73%
Total physical RAM: 3551.18 MB
Available physical RAM: 946.02 MB
Total Virtual: 7100.54 MB
Available Virtual: 4563.54 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.66 GB) (Free:353.53 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: E18B4DB5)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

 

It told me that my picture video word and .pdf files were encrypted I could not open any of them refer to this:-
WARNING

we have encrypted your files with Crypt0L0cker virus
Your important files (including those on the network disks, USB, etc): photos, videos, documents, etc. were encrypted with our Crypt0L0cker virus. The only way to get your files back is to pay us. Otherwise, your files will be lost.

Caution: Removing of Crypt0L0cker will not restore access to your encrypted files.
To recover your files you have to pay.


In order to restore the files open our website hxxp://vrympoqs5ra34nfo.bigclear.at/mzkqtwtq.php?user_code=1m3l679&user_pass=0386 and follow the instructions.

If the website is not available please follow these steps:
1. Download and install TOR-browser from this link: hxxps://www.torproject.org/download/download-easy.html.en
2. After installation run the browser and enter the address: hxxp://vrympoqs5ra34nfo.onion/mzkqtwtq.php?user_code=1m3l679&user_pass=0386
3. Follow the instructions on the website.

The files were renamed as per following examples I have copied the new names of the files here for you
Cessna.jpg.enc
ZTE Blade A462 User Guide.pdf.enc
I can not send renames of picture and video files as I have deleted them all

Is that enough information for now?
Ta Jerry

 

I am not concerned about recovering the files as I have backed them up before the Virus struck. I would like to try to remove the infection to save me having to reformat the hard drive completely. Thank You.

 

Log from Rogue Killer:-
RogueKiller V12.5.2.0 (x64) [Aug 29 2016] (Free) by Adlice Software
mail : Contact - Adlice Software
Feedback : Adlice forum
Website : RogueKiller Anti-Malware Free Download - Official Website
Blog : Adlice Software

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Workventures [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Delete -- Date : 09/05/2016 09:06:40 (Duration : 00:38:48)

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 8 ¤¤¤
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-1926230946-431629159-532477852-1001\Software\Microsoft\Internet Explorer\Main | Start Page : Telstra Media - Video, Sport, Music and Entertainment -> Replaced (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-1926230946-431629159-532477852-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.bigpond.com/ -> Replaced (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([]) -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([]) -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([]) -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{8CF474B3-E82A-4227-8D13-F3AE51B65C61} | DhcpNameServer : 10.0.0.138 ([]) -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{8CF474B3-E82A-4227-8D13-F3AE51B65C61} | DhcpNameServer : 10.0.0.138 ([]) -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{8CF474B3-E82A-4227-8D13-F3AE51B65C61} | DhcpNameServer : 10.0.0.138 ([]) -> Replaced ()

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 1 ¤¤¤
[PUP][Folder] C:\Users\Workventures\AppData\Local\{698D0BA5-6E4B-44BD-9F9A-AA32F2E98D9A} -> Deleted
[PUP][File] C:\Users\Workventures\AppData\Local\{698D0BA5-6E4B-44BD-9F9A-AA32F2E98D9A}\ScanLogs.xml -> Deleted

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: TOSHIBA DT01ACA050 ATA Device +++++
--- User ---
[MBR] 39aed45b3e111287b34b915c2e91b2d0
[BSP] 4186b2da73a1b9159fb40007e1595e4f : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 476837 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

 

Malwarebytes Anti-Malware
www.malwarebytes.org


Update, 5/09/2016 10:01 AM, SYSTEM, LENOVO, Manual, Rootkit Database, 2016.2.8.1, 2016.8.15.1,
Update, 5/09/2016 10:01 AM, SYSTEM, LENOVO, Manual, Remediation Database, 2016.2.12.1, 2016.8.31.1,
Update, 5/09/2016 10:01 AM, SYSTEM, LENOVO, Manual, IP Database, 2016.2.8.1, 2016.9.2.1,
Update, 5/09/2016 10:01 AM, SYSTEM, LENOVO, Manual, Domain Database, 2016.2.16.8, 2016.9.2.5,
Update, 5/09/2016 10:01 AM, SYSTEM, LENOVO, Manual, Malware Database, 2016.2.16.6, 2016.9.4.8,
Scan, 5/09/2016 10:19 AM, SYSTEM, LENOVO, Manual, Start:5/09/2016 10:03 AM, Duration:14 min 15 sec, Threat Scan, Completed, 0 Malware Detections, 3 Non-Malware Detections,

(end)

 

ADW Cleaner Log "-

# AdwCleaner v6.010 - Logfile created 05/09/2016 at 10:44:17
# Updated on 12/08/2016 by ToolsLib
# Database : 2016-09-03.2 [Server]
# Operating System : Windows 7 Professional Service Pack 1 (X64)
# Username : Workventures - LENOVO
# Running from : C:\Users\Workventures\Desktop\adwcleaner_6.010.exe
# Mode: Clean
# Support : ToolsLib



***** [ Services ] *****



***** [ Folders ] *****



***** [ Files ] *****

[-] File deleted: C:\Windows\adb.exe


***** [ DLL ] *****



***** [ WMI ] *****



***** [ Shortcuts ] *****



***** [ Scheduled Tasks ] *****



***** [ Registry ] *****

[-] Key deleted: HKLM\SOFTWARE\Classes\OCComSDK.ComSDK
[-] Key deleted: HKLM\SOFTWARE\Classes\OCComSDK.ComSDK.1
[-] Key deleted: [x64] HKLM\SOFTWARE\Classes\Interface\{FA7B2795-C0C8-4A58-8672-3F8D80CC0270}
[-] Key deleted: [x64] HKLM\SOFTWARE\Classes\Interface\{47A1DF02-BCE4-40C3-AE47-E3EA09A65E4A}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{B9D64D3B-BE75-4FA2-B94A-C4AE772A0146}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{47A1DF02-BCE4-40C3-AE47-E3EA09A65E4A}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{FA7B2795-C0C8-4A58-8672-3F8D80CC0270}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{47A1DF02-BCE4-40C3-AE47-E3EA09A65E4A}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{1112F282-7099-4624-A439-DB29D6551552}
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\researchnow.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\survey-d.researchnow.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\surveymyopinion.researchnow.com


***** [ Web browsers ] *****

[-] [searchgol.com] [Search Provider] Deleted: searchgol.com


*************************

:: "Tracing" keys deleted
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [1886 Bytes] - [05/09/2016 10:44:17]
C:\AdwCleaner\AdwCleaner[R0].txt - [2210 Bytes] - [30/08/2016 18:58:43]
C:\AdwCleaner\AdwCleaner[S0].txt - [2301 Bytes] - [30/08/2016 19:24:37]
C:\AdwCleaner\AdwCleaner[S1].txt - [2306 Bytes] - [05/09/2016 10:39:32]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [2178 Bytes] ##########

 

Sorry I forgot to unquote after system reboot
JRT Log :-
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.7 (07.03.2016)
Operating System: Windows 7 Professional x64
Ran by Workventures (Administrator) on Mon 05/09/2016 at 10:56:10.17
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 32

Successfully deleted: C:\Users\Workventures\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Workventures\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0ZJFNV3W (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Workventures\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2JB279JL (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Workventures\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4VM9RYEQ (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Workventures\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5RD204S7 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Workventures\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Workventures\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9H8440T4 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Workventures\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Workventures\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GIPZGW3G (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Workventures\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I4U6AEMC (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Workventures\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KGDJ8EA6 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Workventures\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LIXMVQOA (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Workventures\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PHCV73O2 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Workventures\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SV197FOG (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Workventures\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SVL274W6 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Workventures\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TLC2PNUT (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0ZJFNV3W (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2JB279JL (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4VM9RYEQ (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5RD204S7 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9H8440T4 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GIPZGW3G (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I4U6AEMC (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KGDJ8EA6 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LIXMVQOA (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PHCV73O2 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SV197FOG (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SVL274W6 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TLC2PNUT (Temporary Internet Files Folder)



Registry: 0





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 05/09/2016 at 11:02:00.52
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

C:\ComboFix.txt is below:-
ComboFix 16-09-05.01 - Workventures 06/09/2016 8:46.1.2 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.61.1033.18.3551.2030 [GMT 10:00]
Running from: c:\users\Workventures\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {768124D7-F5F7-6D2F-DDC2-94DFA4017C95}
SP: Microsoft Security Essentials *Disabled/Updated* {CDE0C533-D3CD-62A1-E772-AFADDF863628}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\ntuser.pol
.
.
((((((((((((((((((((((((( Files Created from 2016-08-05 to 2016-09-05 )))))))))))))))))))))))))))))))
.
.
2016-09-05 22:53 . 2016-09-05 22:53 -------- d-----w- c:\users\Default\AppData\Local\temp
2016-09-05 22:39 . 2016-09-05 22:39 75888 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A9F0A525-DEEA-4642-B0C6-56FEAEFD8968}\offreg.860.dll
2016-09-05 21:57 . 2016-09-05 21:57 -------- d-----w- c:\users\Workventures\AppData\Local\Diagnostics
2016-09-05 21:12 . 2016-08-02 22:36 11847048 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A9F0A525-DEEA-4642-B0C6-56FEAEFD8968}\mpengine.dll
2016-09-04 23:58 . 2016-09-05 00:29 192216 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2016-09-04 23:58 . 2016-03-10 04:08 140672 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2016-09-04 23:58 . 2016-03-10 04:08 27008 ----a-w- c:\windows\system32\drivers\mbam.sys
2016-09-04 23:02 . 2016-09-04 23:02 -------- d-----w- c:\program files\RogueKiller
2016-09-04 20:30 . 2016-08-02 22:36 11847048 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2016-09-03 00:58 . 2016-05-11 10:52 1167568 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{688C1066-F0F3-45D3-BA4F-B019F490554C}\gapaengine.dll
2016-09-03 00:51 . 2016-09-03 00:55 -------- d-----w- C:\FRST
2016-08-30 23:30 . 2016-09-05 10:54 -------- d-----w- c:\users\Workventures\AppData\Local\CrashDumps
2016-08-30 09:40 . 2016-08-30 23:29 -------- d-----w- c:\program files\Plumbytes Software
2016-08-30 08:58 . 2016-09-05 00:44 -------- d-----w- C:\AdwCleaner
2016-08-29 03:29 . 2016-08-29 03:29 -------- d-----w- c:\users\Workventures\AppData\Roaming\Malwarebytes
2016-08-25 03:51 . 2016-09-04 23:06 28272 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2016-08-25 03:50 . 2016-08-25 03:50 -------- d-----w- c:\programdata\RogueKiller
2016-08-22 20:54 . 2016-08-22 20:55 -------- d-----w- c:\programdata\ewywybatajeluxot
2016-08-17 17:45 . 2016-07-07 15:36 1896168 ----a-w- c:\windows\system32\drivers\tcpip.sys
2016-08-17 17:45 . 2016-07-07 15:36 377576 ----a-w- c:\windows\system32\drivers\netio.sys
2016-08-17 17:45 . 2016-07-01 15:31 976896 ----a-w- c:\windows\system32\inetcomm.dll
2016-08-17 17:45 . 2016-07-07 15:36 287976 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2016-08-17 17:45 . 2016-07-07 15:08 46080 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2016-08-17 17:45 . 2016-07-01 15:13 741888 ----a-w- c:\windows\SysWow64\inetcomm.dll
2016-08-17 17:45 . 2016-07-01 14:56 405504 ----a-w- c:\windows\system32\drivers\srv2.sys
2016-08-17 17:45 . 2016-07-01 14:56 168960 ----a-w- c:\windows\system32\drivers\srvnet.sys
2016-08-17 17:45 . 2016-07-01 15:31 84480 ----a-w- c:\windows\system32\INETRES.dll
2016-08-17 17:45 . 2016-07-01 15:13 84480 ----a-w- c:\windows\SysWow64\INETRES.dll
2016-08-17 17:45 . 2016-07-01 14:56 464896 ----a-w- c:\windows\system32\drivers\srv.sys
2016-08-16 21:56 . 2016-07-08 15:32 2048 ----a-w- c:\windows\system32\tzres.dll
2016-08-16 21:56 . 2016-07-08 15:16 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2016-08-14 09:21 . 2016-08-22 20:54 -------- d-----w- c:\users\Lenovo share\Some On Samsung
2016-08-09 21:47 . 2016-06-06 16:50 1483264 ----a-w- c:\windows\system32\crypt32.dll
2016-08-09 21:47 . 2016-06-06 16:50 228864 ----a-w- c:\windows\system32\wintrust.dll
2016-08-09 21:47 . 2016-06-06 16:50 190976 ----a-w- c:\windows\system32\cryptsvc.dll
2016-08-09 21:47 . 2016-06-06 15:23 1176064 ----a-w- c:\windows\SysWow64\crypt32.dll
2016-08-09 21:47 . 2016-06-06 16:50 141824 ----a-w- c:\windows\system32\cryptnet.dll
2016-08-09 21:47 . 2016-06-06 15:23 145920 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2016-08-09 21:47 . 2016-06-06 15:23 179200 ----a-w- c:\windows\SysWow64\wintrust.dll
2016-08-09 21:47 . 2016-06-06 15:23 106496 ----a-w- c:\windows\SysWow64\cryptnet.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2016-08-09 21:53 . 2015-07-31 02:16 147640136 -c--a-w- c:\windows\system32\MRT.exe
2016-07-27 19:25 . 2010-11-21 03:27 504488 ------w- c:\windows\system32\MpSigStub.exe
2016-07-24 01:42 . 2016-04-24 22:34 97856 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2016-07-15 06:51 . 2015-09-24 03:44 796352 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2016-07-15 06:51 . 2015-09-24 03:44 142528 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2016-07-06 20:07 . 2012-07-17 04:37 24800 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2016-06-26 00:35 . 2016-07-13 03:49 41704 ----a-w- c:\windows\system32\CompatTelRunner.exe
2016-06-26 00:27 . 2016-07-13 03:49 756736 ----a-w- c:\windows\system32\win32spl.dll
2016-06-26 00:27 . 2016-07-13 03:49 344576 ----a-w- c:\windows\system32\ntprint.dll
2016-06-26 00:27 . 2016-07-13 03:49 970240 ----a-w- c:\windows\system32\localspl.dll
2016-06-26 00:27 . 2016-07-13 03:49 22528 ----a-w- c:\windows\system32\inetppui.dll
2016-06-26 00:27 . 2016-07-13 03:49 166400 ----a-w- c:\windows\system32\inetpp.dll
2016-06-26 00:27 . 2016-07-13 03:49 1208320 ----a-w- c:\windows\system32\aeinv.dll
2016-06-25 19:54 . 2016-07-13 03:49 497152 ----a-w- c:\windows\SysWow64\win32spl.dll
2016-06-25 19:53 . 2016-07-13 03:49 297472 ----a-w- c:\windows\SysWow64\ntprint.dll
2016-06-25 19:53 . 2016-07-13 03:49 48640 ----a-w- c:\windows\system32\wpnpinst.exe
2016-06-25 19:53 . 2016-07-13 03:49 61952 ----a-w- c:\windows\system32\ntprint.exe
2016-06-25 19:41 . 2016-07-13 03:49 61952 ----a-w- c:\windows\SysWow64\ntprint.exe
2016-06-22 13:06 . 2016-07-13 03:49 268800 ----a-w- c:\windows\system32\centel.dll
2016-06-17 18:24 . 2016-07-13 03:49 571904 ----a-w- c:\windows\system32\generaltel.dll
2016-06-17 18:24 . 2016-07-13 03:49 544256 ----a-w- c:\windows\system32\devinv.dll
2016-06-17 18:24 . 2016-07-13 03:49 294912 ----a-w- c:\windows\system32\invagent.dll
2016-06-17 18:24 . 2016-07-13 03:49 1490432 ----a-w- c:\windows\system32\appraiser.dll
2016-06-17 18:24 . 2016-07-13 03:49 76800 ----a-w- c:\windows\system32\acmigration.dll
2016-06-17 18:24 . 2016-07-13 03:49 219136 ----a-w- c:\windows\system32\aepic.dll
2016-06-16 20:49 . 2016-06-16 20:49 512392 ----a-w- c:\windows\SysWow64\msvcp71.dll
2016-06-16 20:49 . 2016-06-16 20:49 360840 ----a-w- c:\windows\SysWow64\msvcr71.dll
2016-06-14 15:21 . 2016-07-13 03:49 2560 ----a-w- c:\windows\apppatch\AcRes.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@= "{F241C880-6982-4CE5-8CF7-7085BA96DA5A} "
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2016-04-22 21:29 223432 ----a-w- c:\users\Workventures\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@= "{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} "
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2016-04-22 21:29 223432 ----a-w- c:\users\Workventures\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@= "{BBACC218-34EA-4666-9D7A-C78F2274A524} "
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2016-04-22 21:29 223432 ----a-w- c:\users\Workventures\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} "= "c:\program files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]
"Steam "= "c:\program files (x86)\Steam\steam.exe" [2016-08-23 2857248]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task "= "c:\program files (x86)\QuickTime\QTTask.exe" [2010-08-09 421888]
"iTunesHelper "= "c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-08-31 421160]
"DivXMediaServer "= "c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2016-06-21 1010144]
"snp2uvc "= "c:\windows\vsnp2uvc.exe" [2009-08-12 662016]
"tsnp2uvc "= "c:\program files (x86)\Common Files\SNP2UVC\tsnp2uvc.exe" [2011-12-01 318976]
"Microsoft Works Update Detection "= "c:\program files (x86)\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-25 28672]
"TkBellExe "= "c:\program files (x86)\Real\RealPlayer\update\realsched.exe" [2016-06-16 293768]
"RealDownloader "= "c:\program files (x86)\RealNetworks\RealDownloader\downloader2.exe" [2016-07-05 714992]
"SunJavaUpdateSched "= "c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2016-06-21 598552]
"Wondershare Helper Compact.exe "= "c:\program files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe" [2016-06-20 2131344]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ooVoo.exe "= "c:\program files (x86)\ooVoo\oovoo.exe" [2016-03-07 35910688]
.
c:\users\Workventures\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
MailWasherPro.lnk - c:\program files (x86)\Firetrust\MailWasher\MailWasherPro.exe -nosplash [2016-4-18 6305944]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
RealTimes.lnk - c:\program files (x86)\Real\RealPlayer\RPDS\Bin\rpsystray.exe [2016-6-17 7500048]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 5 (0x5)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableUIADesktopToggle "= 0 (0x0)
"PromptOnSecureDesktop "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs "=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@= "Service "
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 Lenovo EasyPlus Hotspot;Lenovo EasyPlus Hotspot;c:\program files (x86)\Common Files\LENOVO\easyplussdk\bin\EPHotspot64.exe;c:\program files (x86)\Common Files\LENOVO\easyplussdk\bin\EPHotspot64.exe [x]
R3 massfilter_hs;HS HandSet Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter_hs.sys;c:\windows\SYSNATIVE\drivers\massfilter_hs.sys [x]
R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys;c:\windows\SYSNATIVE\Drivers\nx6000.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 PrintNotify;Printer Extensions and Notifications;c:\windows\system32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RtlWlanu;Realtek Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\rtwlanu.sys;c:\windows\SYSNATIVE\DRIVERS\rtwlanu.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 PelService;Session Launcher Service;c:\program files\Lenovo\Lenovo Mouse Suite\PelService.exe;c:\program files\Lenovo\Lenovo Mouse Suite\PelService.exe [x]
S2 RealPlayerUpdateSvc;RealPlayer Update Service;c:\program files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe;c:\program files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe [x]
S2 RealtekCU;RealtekCU;c:\program files (x86)\REALTEK\USB Wireless LAN Utility\RtlService.exe;c:\program files (x86)\REALTEK\USB Wireless LAN Utility\RtlService.exe [x]
S2 RealTimes Desktop Service;RealTimes Desktop Service;c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe;c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe;c:\program files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe [x]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1k62x64.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr QWAVE wcncsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2016-08-08 22:11 1262408 ----a-w- c:\program files (x86)\Google\Chrome\Application\52.0.2743.116\Installer\chrmstp.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{A6EADE66-0000-0000-484E-7E8A45000000}]
2016-06-30 11:55 322232 ----a-w- c:\program files (x86)\Adobe\Acrobat Reader DC\Esl\AiodLite.dll
.
Contents of the 'Scheduled Tasks' folder
.
2016-09-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-09-24 06:51]
.
2016-09-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2016-04-22 09:54]
.
2016-09-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2016-04-22 09:54]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@= "{F241C880-6982-4CE5-8CF7-7085BA96DA5A} "
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2016-04-22 21:29 262344 ----a-w- c:\users\Workventures\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@= "{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} "
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2016-04-22 21:29 262344 ----a-w- c:\users\Workventures\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@= "{BBACC218-34EA-4666-9D7A-C78F2274A524} "
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2016-04-22 21:29 262344 ----a-w- c:\users\Workventures\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC "= "c:\program files\Microsoft Security Client\msseces.exe" [2016-01-29 1340192]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2011-02-11 162328]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2011-02-11 386584]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2011-02-11 417304]
"Daemon for Mouse Suite "= "c:\program files\Lenovo\Lenovo Mouse Suite\ICO.EXE" [2013-03-25 87040]
"snp2uvc "= "c:\windows\vsnp2uvc.exe" [2009-08-12 662016]
"CanonMyPrinter "= "c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-03-24 2184520]
"CanonSolutionMenu "= "c:\program files (x86)\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312]
"Start WingMan Profiler "= "c:\program files\Logitech\Gaming Software\LWEMon.exe" [2010-06-14 190536]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 10.0.0.138
.
- - - - ORPHANS REMOVED - - - -
.
ShellIconOverlayIdentifiers-{056D528D-CE28-4194-9BA3-BA2E9197FF8C} - c:\programdata\MEGAsync\ShellExtX32.dll
ShellIconOverlayIdentifiers-{05B38830-F4E9-4329-978B-1DD28605D202} - c:\programdata\MEGAsync\ShellExtX32.dll
ShellIconOverlayIdentifiers-{0596C850-7BDD-4C9D-AFDF-873BE6890637} - c:\programdata\MEGAsync\ShellExtX32.dll
Wow6432Node-HKCU-Run-LightScribe Control Panel - c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
ShellIconOverlayIdentifiers-{056D528D-CE28-4194-9BA3-BA2E9197FF8C} - c:\programdata\MEGAsync\ShellExtX64.dll
ShellIconOverlayIdentifiers-{05B38830-F4E9-4329-978B-1DD28605D202} - c:\programdata\MEGAsync\ShellExtX64.dll
ShellIconOverlayIdentifiers-{0596C850-7BDD-4C9D-AFDF-873BE6890637} - c:\programdata\MEGAsync\ShellExtX64.dll
HKLM-Run-Wondershare Helper Compact.exe - c:\program files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
AddRemove-RealPlayer 18.1 - c:\program files (x86)\real\realplayer\Update\r1puninst.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_22_0_0_210_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@= "c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_22_0_0_210_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker6 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_22_0_0_210_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_22_0_0_210_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Shockwave Flash Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_22_0_0_210.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@= "0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@= "ShockwaveFlash.ShockwaveFlash.22 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_22_0_0_210.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "ShockwaveFlash.ShockwaveFlash "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Macromedia Flash Factory Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_22_0_0_210.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@= "FlashFactory.FlashFactory.1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_22_0_0_210.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "FlashFactory.FlashFactory "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker6 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2016-09-06 08:55:31
ComboFix-quarantined-files.txt 2016-09-05 22:55
.
Pre-Run: 373,204,094,976 bytes free
Post-Run: 372,911,452,160 bytes free
.
- - End Of File - - 927BC2AD31394623EB3F3E4CCD0A456B
A36C5E4F47E84449FF07ED3517B43A31

 

ComboFix 16-09-05.01 - Workventures 06/09/2016 8:46.1.2 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.61.1033.18.3551.2030 [GMT 10:00]
Running from: c:\users\Workventures\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {768124D7-F5F7-6D2F-DDC2-94DFA4017C95}
SP: Microsoft Security Essentials *Disabled/Updated* {CDE0C533-D3CD-62A1-E772-AFADDF863628}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\ntuser.pol
.
.
((((((((((((((((((((((((( Files Created from 2016-08-05 to 2016-09-05 )))))))))))))))))))))))))))))))
.
.
2016-09-05 22:53 . 2016-09-05 22:53 -------- d-----w- c:\users\Default\AppData\Local\temp
2016-09-05 22:39 . 2016-09-05 22:39 75888 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A9F0A525-DEEA-4642-B0C6-56FEAEFD8968}\offreg.860.dll
2016-09-05 21:57 . 2016-09-05 21:57 -------- d-----w- c:\users\Workventures\AppData\Local\Diagnostics
2016-09-05 21:12 . 2016-08-02 22:36 11847048 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A9F0A525-DEEA-4642-B0C6-56FEAEFD8968}\mpengine.dll
2016-09-04 23:58 . 2016-09-05 00:29 192216 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2016-09-04 23:58 . 2016-03-10 04:08 140672 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2016-09-04 23:58 . 2016-03-10 04:08 27008 ----a-w- c:\windows\system32\drivers\mbam.sys
2016-09-04 23:02 . 2016-09-04 23:02 -------- d-----w- c:\program files\RogueKiller
2016-09-04 20:30 . 2016-08-02 22:36 11847048 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2016-09-03 00:58 . 2016-05-11 10:52 1167568 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{688C1066-F0F3-45D3-BA4F-B019F490554C}\gapaengine.dll
2016-09-03 00:51 . 2016-09-03 00:55 -------- d-----w- C:\FRST
2016-08-30 23:30 . 2016-09-05 10:54 -------- d-----w- c:\users\Workventures\AppData\Local\CrashDumps
2016-08-30 09:40 . 2016-08-30 23:29 -------- d-----w- c:\program files\Plumbytes Software
2016-08-30 08:58 . 2016-09-05 00:44 -------- d-----w- C:\AdwCleaner
2016-08-29 03:29 . 2016-08-29 03:29 -------- d-----w- c:\users\Workventures\AppData\Roaming\Malwarebytes
2016-08-25 03:51 . 2016-09-04 23:06 28272 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2016-08-25 03:50 . 2016-08-25 03:50 -------- d-----w- c:\programdata\RogueKiller
2016-08-22 20:54 . 2016-08-22 20:55 -------- d-----w- c:\programdata\ewywybatajeluxot
2016-08-17 17:45 . 2016-07-07 15:36 1896168 ----a-w- c:\windows\system32\drivers\tcpip.sys
2016-08-17 17:45 . 2016-07-07 15:36 377576 ----a-w- c:\windows\system32\drivers\netio.sys
2016-08-17 17:45 . 2016-07-01 15:31 976896 ----a-w- c:\windows\system32\inetcomm.dll
2016-08-17 17:45 . 2016-07-07 15:36 287976 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2016-08-17 17:45 . 2016-07-07 15:08 46080 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2016-08-17 17:45 . 2016-07-01 15:13 741888 ----a-w- c:\windows\SysWow64\inetcomm.dll
2016-08-17 17:45 . 2016-07-01 14:56 405504 ----a-w- c:\windows\system32\drivers\srv2.sys
2016-08-17 17:45 . 2016-07-01 14:56 168960 ----a-w- c:\windows\system32\drivers\srvnet.sys
2016-08-17 17:45 . 2016-07-01 15:31 84480 ----a-w- c:\windows\system32\INETRES.dll
2016-08-17 17:45 . 2016-07-01 15:13 84480 ----a-w- c:\windows\SysWow64\INETRES.dll
2016-08-17 17:45 . 2016-07-01 14:56 464896 ----a-w- c:\windows\system32\drivers\srv.sys
2016-08-16 21:56 . 2016-07-08 15:32 2048 ----a-w- c:\windows\system32\tzres.dll
2016-08-16 21:56 . 2016-07-08 15:16 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2016-08-14 09:21 . 2016-08-22 20:54 -------- d-----w- c:\users\Lenovo share\Some On Samsung
2016-08-09 21:47 . 2016-06-06 16:50 1483264 ----a-w- c:\windows\system32\crypt32.dll
2016-08-09 21:47 . 2016-06-06 16:50 228864 ----a-w- c:\windows\system32\wintrust.dll
2016-08-09 21:47 . 2016-06-06 16:50 190976 ----a-w- c:\windows\system32\cryptsvc.dll
2016-08-09 21:47 . 2016-06-06 15:23 1176064 ----a-w- c:\windows\SysWow64\crypt32.dll
2016-08-09 21:47 . 2016-06-06 16:50 141824 ----a-w- c:\windows\system32\cryptnet.dll
2016-08-09 21:47 . 2016-06-06 15:23 145920 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2016-08-09 21:47 . 2016-06-06 15:23 179200 ----a-w- c:\windows\SysWow64\wintrust.dll
2016-08-09 21:47 . 2016-06-06 15:23 106496 ----a-w- c:\windows\SysWow64\cryptnet.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2016-08-09 21:53 . 2015-07-31 02:16 147640136 -c--a-w- c:\windows\system32\MRT.exe
2016-07-27 19:25 . 2010-11-21 03:27 504488 ------w- c:\windows\system32\MpSigStub.exe
2016-07-24 01:42 . 2016-04-24 22:34 97856 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2016-07-15 06:51 . 2015-09-24 03:44 796352 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2016-07-15 06:51 . 2015-09-24 03:44 142528 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2016-07-06 20:07 . 2012-07-17 04:37 24800 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2016-06-26 00:35 . 2016-07-13 03:49 41704 ----a-w- c:\windows\system32\CompatTelRunner.exe
2016-06-26 00:27 . 2016-07-13 03:49 756736 ----a-w- c:\windows\system32\win32spl.dll
2016-06-26 00:27 . 2016-07-13 03:49 344576 ----a-w- c:\windows\system32\ntprint.dll
2016-06-26 00:27 . 2016-07-13 03:49 970240 ----a-w- c:\windows\system32\localspl.dll
2016-06-26 00:27 . 2016-07-13 03:49 22528 ----a-w- c:\windows\system32\inetppui.dll
2016-06-26 00:27 . 2016-07-13 03:49 166400 ----a-w- c:\windows\system32\inetpp.dll
2016-06-26 00:27 . 2016-07-13 03:49 1208320 ----a-w- c:\windows\system32\aeinv.dll
2016-06-25 19:54 . 2016-07-13 03:49 497152 ----a-w- c:\windows\SysWow64\win32spl.dll
2016-06-25 19:53 . 2016-07-13 03:49 297472 ----a-w- c:\windows\SysWow64\ntprint.dll
2016-06-25 19:53 . 2016-07-13 03:49 48640 ----a-w- c:\windows\system32\wpnpinst.exe
2016-06-25 19:53 . 2016-07-13 03:49 61952 ----a-w- c:\windows\system32\ntprint.exe
2016-06-25 19:41 . 2016-07-13 03:49 61952 ----a-w- c:\windows\SysWow64\ntprint.exe
2016-06-22 13:06 . 2016-07-13 03:49 268800 ----a-w- c:\windows\system32\centel.dll
2016-06-17 18:24 . 2016-07-13 03:49 571904 ----a-w- c:\windows\system32\generaltel.dll
2016-06-17 18:24 . 2016-07-13 03:49 544256 ----a-w- c:\windows\system32\devinv.dll
2016-06-17 18:24 . 2016-07-13 03:49 294912 ----a-w- c:\windows\system32\invagent.dll
2016-06-17 18:24 . 2016-07-13 03:49 1490432 ----a-w- c:\windows\system32\appraiser.dll
2016-06-17 18:24 . 2016-07-13 03:49 76800 ----a-w- c:\windows\system32\acmigration.dll
2016-06-17 18:24 . 2016-07-13 03:49 219136 ----a-w- c:\windows\system32\aepic.dll
2016-06-16 20:49 . 2016-06-16 20:49 512392 ----a-w- c:\windows\SysWow64\msvcp71.dll
2016-06-16 20:49 . 2016-06-16 20:49 360840 ----a-w- c:\windows\SysWow64\msvcr71.dll
2016-06-14 15:21 . 2016-07-13 03:49 2560 ----a-w- c:\windows\apppatch\AcRes.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@= "{F241C880-6982-4CE5-8CF7-7085BA96DA5A} "
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2016-04-22 21:29 223432 ----a-w- c:\users\Workventures\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@= "{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} "
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2016-04-22 21:29 223432 ----a-w- c:\users\Workventures\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@= "{BBACC218-34EA-4666-9D7A-C78F2274A524} "
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2016-04-22 21:29 223432 ----a-w- c:\users\Workventures\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} "= "c:\program files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]
"Steam "= "c:\program files (x86)\Steam\steam.exe" [2016-08-23 2857248]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task "= "c:\program files (x86)\QuickTime\QTTask.exe" [2010-08-09 421888]
"iTunesHelper "= "c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-08-31 421160]
"DivXMediaServer "= "c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2016-06-21 1010144]
"snp2uvc "= "c:\windows\vsnp2uvc.exe" [2009-08-12 662016]
"tsnp2uvc "= "c:\program files (x86)\Common Files\SNP2UVC\tsnp2uvc.exe" [2011-12-01 318976]
"Microsoft Works Update Detection "= "c:\program files (x86)\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-25 28672]
"TkBellExe "= "c:\program files (x86)\Real\RealPlayer\update\realsched.exe" [2016-06-16 293768]
"RealDownloader "= "c:\program files (x86)\RealNetworks\RealDownloader\downloader2.exe" [2016-07-05 714992]
"SunJavaUpdateSched "= "c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2016-06-21 598552]
"Wondershare Helper Compact.exe "= "c:\program files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe" [2016-06-20 2131344]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ooVoo.exe "= "c:\program files (x86)\ooVoo\oovoo.exe" [2016-03-07 35910688]
.
c:\users\Workventures\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
MailWasherPro.lnk - c:\program files (x86)\Firetrust\MailWasher\MailWasherPro.exe -nosplash [2016-4-18 6305944]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
RealTimes.lnk - c:\program files (x86)\Real\RealPlayer\RPDS\Bin\rpsystray.exe [2016-6-17 7500048]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 5 (0x5)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableUIADesktopToggle "= 0 (0x0)
"PromptOnSecureDesktop "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs "=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@= "Service "
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 Lenovo EasyPlus Hotspot;Lenovo EasyPlus Hotspot;c:\program files (x86)\Common Files\LENOVO\easyplussdk\bin\EPHotspot64.exe;c:\program files (x86)\Common Files\LENOVO\easyplussdk\bin\EPHotspot64.exe [x]
R3 massfilter_hs;HS HandSet Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter_hs.sys;c:\windows\SYSNATIVE\drivers\massfilter_hs.sys [x]
R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys;c:\windows\SYSNATIVE\Drivers\nx6000.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 PrintNotify;Printer Extensions and Notifications;c:\windows\system32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RtlWlanu;Realtek Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\rtwlanu.sys;c:\windows\SYSNATIVE\DRIVERS\rtwlanu.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 PelService;Session Launcher Service;c:\program files\Lenovo\Lenovo Mouse Suite\PelService.exe;c:\program files\Lenovo\Lenovo Mouse Suite\PelService.exe [x]
S2 RealPlayerUpdateSvc;RealPlayer Update Service;c:\program files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe;c:\program files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe [x]
S2 RealtekCU;RealtekCU;c:\program files (x86)\REALTEK\USB Wireless LAN Utility\RtlService.exe;c:\program files (x86)\REALTEK\USB Wireless LAN Utility\RtlService.exe [x]
S2 RealTimes Desktop Service;RealTimes Desktop Service;c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe;c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe;c:\program files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe [x]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1k62x64.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr QWAVE wcncsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2016-08-08 22:11 1262408 ----a-w- c:\program files (x86)\Google\Chrome\Application\52.0.2743.116\Installer\chrmstp.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{A6EADE66-0000-0000-484E-7E8A45000000}]
2016-06-30 11:55 322232 ----a-w- c:\program files (x86)\Adobe\Acrobat Reader DC\Esl\AiodLite.dll
.
Contents of the 'Scheduled Tasks' folder
.
2016-09-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-09-24 06:51]
.
2016-09-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2016-04-22 09:54]
.
2016-09-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2016-04-22 09:54]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@= "{F241C880-6982-4CE5-8CF7-7085BA96DA5A} "
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2016-04-22 21:29 262344 ----a-w- c:\users\Workventures\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@= "{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} "
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2016-04-22 21:29 262344 ----a-w- c:\users\Workventures\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@= "{BBACC218-34EA-4666-9D7A-C78F2274A524} "
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2016-04-22 21:29 262344 ----a-w- c:\users\Workventures\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC "= "c:\program files\Microsoft Security Client\msseces.exe" [2016-01-29 1340192]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2011-02-11 162328]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2011-02-11 386584]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2011-02-11 417304]
"Daemon for Mouse Suite "= "c:\program files\Lenovo\Lenovo Mouse Suite\ICO.EXE" [2013-03-25 87040]
"snp2uvc "= "c:\windows\vsnp2uvc.exe" [2009-08-12 662016]
"CanonMyPrinter "= "c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-03-24 2184520]
"CanonSolutionMenu "= "c:\program files (x86)\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312]
"Start WingMan Profiler "= "c:\program files\Logitech\Gaming Software\LWEMon.exe" [2010-06-14 190536]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 10.0.0.138
.
- - - - ORPHANS REMOVED - - - -
.
ShellIconOverlayIdentifiers-{056D528D-CE28-4194-9BA3-BA2E9197FF8C} - c:\programdata\MEGAsync\ShellExtX32.dll
ShellIconOverlayIdentifiers-{05B38830-F4E9-4329-978B-1DD28605D202} - c:\programdata\MEGAsync\ShellExtX32.dll
ShellIconOverlayIdentifiers-{0596C850-7BDD-4C9D-AFDF-873BE6890637} - c:\programdata\MEGAsync\ShellExtX32.dll
Wow6432Node-HKCU-Run-LightScribe Control Panel - c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
ShellIconOverlayIdentifiers-{056D528D-CE28-4194-9BA3-BA2E9197FF8C} - c:\programdata\MEGAsync\ShellExtX64.dll
ShellIconOverlayIdentifiers-{05B38830-F4E9-4329-978B-1DD28605D202} - c:\programdata\MEGAsync\ShellExtX64.dll
ShellIconOverlayIdentifiers-{0596C850-7BDD-4C9D-AFDF-873BE6890637} - c:\programdata\MEGAsync\ShellExtX64.dll
HKLM-Run-Wondershare Helper Compact.exe - c:\program files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
AddRemove-RealPlayer 18.1 - c:\program files (x86)\real\realplayer\Update\r1puninst.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_22_0_0_210_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@= "c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_22_0_0_210_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker6 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_22_0_0_210_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_22_0_0_210_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Shockwave Flash Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_22_0_0_210.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@= "0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@= "ShockwaveFlash.ShockwaveFlash.22 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_22_0_0_210.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "ShockwaveFlash.ShockwaveFlash "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Macromedia Flash Factory Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_22_0_0_210.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@= "FlashFactory.FlashFactory.1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_22_0_0_210.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "FlashFactory.FlashFactory "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker6 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2016-09-06 08:55:31
ComboFix-quarantined-files.txt 2016-09-05 22:55
.
Pre-Run: 373,204,094,976 bytes free
Post-Run: 372,911,452,160 bytes free
.
- - End Of File - - 927BC2AD31394623EB3F3E4CCD0A456B
A36C5E4F47E84449FF07ED3517B43A31

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 31-08-2016
Ran by Workventures (administrator) on LENOVO (06-09-2016 15:41:34)
Running from C:\Users\Workventures\Desktop\Clean UP
Loaded Profiles: Workventures (Available Profiles: Workventures)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(Intel Corporation) C:\Program Files (x86)\Intel\AMT\LMS.exe
() C:\Program Files\Lenovo\Lenovo Mouse Suite\PelService.exe
() C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe
(Realtek Semiconductor Corp.) C:\Program Files (x86)\REALTEK\USB Wireless LAN Utility\RtlService.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpdsvc.exe
(Intel Corporation) C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Primax Electronics Ltd.) C:\Program Files\Lenovo\Lenovo Mouse Suite\ICO.exe
(Realtek Semiconductor Corp.) C:\Program Files (x86)\REALTEK\USB Wireless LAN Utility\RtWLan.exe
(Sonix) C:\Windows\vsnp2uvc.exe
(Logitech Inc.) C:\Program Files\Logitech\Gaming Software\LWEMon.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpsystray.exe
(Firetrust) C:\Program Files (x86)\Firetrust\MailWasher\MailWasherPro.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Sonix Technology Co., Ltd.) C:\Program Files (x86)\Common Files\SNP2UVC\tsnp2uvc.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Program Files\Lenovo\Lenovo Mouse Suite\FSRremoS.EXE
(Primax Electronics Ltd.) C:\Program Files\Lenovo\Lenovo Mouse Suite\PELMICED.EXE
() C:\Program Files\Lenovo\Lenovo Mouse Suite\PelElvDm.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Wondershare) C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
(Lenovo) C:\Users\Workventures\AppData\Local\Apps\2.0\8L5HTKR8.GXJ\L5W2Z56J.8XM\lsb...tion_2d7b41b05b24775e_0001.0006_6e55c1acac1ba44a\LSB.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\SnippingTool.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1340192 2016-01-29] (Microsoft Corporation)
HKLM\...\Run: [Daemon for Mouse Suite] => C:\Program Files\Lenovo\Lenovo Mouse Suite\ICO.EXE [87040 2013-03-26] (Primax Electronics Ltd.)
HKLM\...\Run: [snp2uvc] => C:\Windows\vsnp2uvc.exe [662016 2009-08-12] (Sonix)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2184520 2009-03-24] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [767312 2009-03-18] (CANON INC.)
HKLM\...\Run: [Start WingMan Profiler] => C:\Program Files\Logitech\Gaming Software\LWEMon.exe [190536 2010-06-14] (Logitech Inc.)
HKLM\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2010-08-10] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [421160 2010-09-01] (Apple Inc.)
HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [1009632 2016-08-08] (DivX, LLC)
HKLM-x32\...\Run: [snp2uvc] => C:\Windows\vsnp2uvc.exe
HKLM-x32\...\Run: [tsnp2uvc] => C:\Program Files (x86)\Common Files\SNP2UVC\tsnp2uvc.exe [318976 2011-12-02] (Sonix Technology Co., Ltd.)
HKLM-x32\...\Run: [Microsoft Works Update Detection] => C:\Program Files (x86)\Common Files\Microsoft Shared\Works Shared\WkUFind.exe [28672 2002-07-25] (Microsoft® Corporation)
HKLM-x32\...\Run: [TkBellExe] => C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [293768 2016-06-17] (RealNetworks, Inc.)
HKLM-x32\...\Run: [RealDownloader] => C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe [714992 2016-07-05] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe "
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2131344 2016-06-20] (Wondershare)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1926230946-431629159-532477852-1001\...\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1840424 2008-06-24] (Nero AG)
HKU\S-1-5-21-1926230946-431629159-532477852-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2857248 2016-08-24] (Valve Corporation)
HKU\S-1-5-21-1926230946-431629159-532477852-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Mystify.scr [242688 2010-11-21] (Microsoft Corporation)
HKU\S-1-5-18\...\Run: [ooVoo.exe] => C:\Program Files (x86)\ooVoo\oovoo.exe [35910688 2016-03-07] (ooVoo LLC)
ShellIconOverlayIdentifiers: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => No File
ShellIconOverlayIdentifiers: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => No File
ShellIconOverlayIdentifiers: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => No File
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RealTimes.lnk [2016-06-17]
ShortcutTarget: RealTimes.lnk -> C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpsystray.exe (RealNetworks, Inc.)
Startup: C:\Users\Workventures\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MailWasherPro.lnk [2016-05-09]
ShortcutTarget: MailWasherPro.lnk -> C:\Program Files (x86)\Firetrust\MailWasher\MailWasherPro.exe (Firetrust)
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{680770D4-B5F8-4606-BE4B-1411A2BFBD8D}: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{8CF474B3-E82A-4227-8D13-F3AE51B65C61}: [DhcpNameServer] 10.0.0.138

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-1926230946-431629159-532477852-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1926230946-431629159-532477852-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1926230946-431629159-532477852-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-9c6f31ca&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1926230946-431629159-532477852-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-9c6f31ca&q={searchTerms}
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin64.dll [2016-05-13] (RealDownloader)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2016-05-13] (RealDownloader)
BHO-x32: Wondershare Video Converter Ultimate 7.1.0 -> {451C804F-C205-4F03-B48E-537EC94937BF} -> C:\ProgramData\Wondershare\Video Converter Ultimate\WSBrowserAppMgr.dll [2016-06-12] (Wondershare)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\ssv.dll [2016-07-24] (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: WOT Helper -> {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} -> C:\Program Files (x86)\WOT\WOT.dll [2010-08-30] ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-07-24] (Oracle Corporation)
Toolbar: HKLM-x32 - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files (x86)\WOT\WOT.dll [2010-08-30] ()
Toolbar: HKU\S-1-5-21-1926230946-431629159-532477852-1001 -> No Name - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - No File
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-05-25] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-05-25] (Microsoft Corporation)
Handler-x32: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files (x86)\WOT\WOT.dll [2010-08-30] ()
Handler: WSWSVCUchrome - {1CA93FF0-A218-44F1 - No File

 

FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2010-07-23] ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL [2009-03-27] (CANON INC.)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll [2014-05-22] (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll [2016-08-09] (DivX, LLC)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-07-24] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-07-24] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=18.1.4.135 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll [2016-06-17] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=18.1.4.135 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll [2016-06-17] (RealPlayer)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-02] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-02] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-02] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-06-30] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1926230946-431629159-532477852-1001: @talk.google.com/GoogleTalkPlugin -> C:\Users\Workventures\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
FF Plugin HKU\S-1-5-21-1926230946-431629159-532477852-1001: @talk.google.com/O1DPlugin -> C:\Users\Workventures\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-12-08] (Google)
FF Plugin HKU\S-1-5-21-1926230946-431629159-532477852-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Workventures\AppData\Local\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-02] (Google Inc.)
FF Plugin HKU\S-1-5-21-1926230946-431629159-532477852-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Workventures\AppData\Local\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-02] (Google Inc.)
FF Plugin HKU\S-1-5-21-1926230946-431629159-532477852-1001: SkypePlugin -> C:\Users\Workventures\AppData\Local\SkypePlugin\7.24.0.53\npGatewayNpapi.dll [2016-08-25] (Skype Technologies S.A.)
FF Plugin HKU\S-1-5-21-1926230946-431629159-532477852-1001: SkypePlugin64 -> C:\Users\Workventures\AppData\Local\SkypePlugin\7.24.0.53\npGatewayNpapi-x64.dll [2016-08-25] (Skype Technologies S.A.)
FF Plugin ProgramFiles/Appdata: C:\Users\Workventures\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Workventures\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-12-08] (Google)
FF HKLM-x32\...\Firefox\Extensions: [WSVCU@Wondershare.com] - C:\ProgramData\Wondershare\Video Converter Ultimate\WSVCU@Wondershare.com_xpi => not found

Chrome:
=======
CHR Profile: C:\Users\Workventures\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Workventures\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-04-22]
CHR Extension: (Google Docs) - C:\Users\Workventures\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-04-22]
CHR Extension: (Google Drive) - C:\Users\Workventures\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-04-22]
CHR Extension: (YouTube) - C:\Users\Workventures\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-04-22]
CHR Extension: (Google Sheets) - C:\Users\Workventures\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-04-22]
CHR Extension: (Google Docs Offline) - C:\Users\Workventures\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-04-25]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Workventures\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-22]
CHR Extension: (Gmail) - C:\Users\Workventures\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-04-22]
CHR Extension: (Chrome Media Router) - C:\Users\Workventures\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-08-30]
CHR Extension: (Skype Calling) - C:\Users\Workventures\AppData\Local\Google\Chrome\User Data\Default\Extensions\poghlonenmjdkfghdpfomojhhfggildk [2016-05-12]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\LENOVO\easyplussdk\bin\EPHotspot64.exe [619776 2015-01-15] (Lenovo)
R2 LMS; C:\Program Files (x86)\Intel\AMT\LMS.exe [174616 2009-10-07] (Intel Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2016-01-29] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [374344 2016-01-29] (Microsoft Corporation)
R3 NMIndexingService; C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe [537896 2008-06-24] (Nero AG)
R2 PelService; C:\Program Files\Lenovo\Lenovo Mouse Suite\PelService.exe [178688 2012-03-13] () [File not signed]
S3 PrintNotify; C:\Windows\system32\spool\DRIVERS\x64\3\PrintConfig.dll [2899968 2014-08-16] (Microsoft Corporation) [File not signed]
R2 RealPlayerUpdateSvc; C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe [32544 2016-05-13] ()
R2 RealtekCU; C:\Program Files (x86)\REALTEK\USB Wireless LAN Utility\RtlService.exe [36864 2012-05-10] (Realtek Semiconductor Corp.) [File not signed]
R2 RealTimes Desktop Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [1095440 2016-06-17] (RealNetworks, Inc.)
R2 UNS; C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe [2066968 2009-10-07] (Intel Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-11] (Broadcom Corporation)
S3 massfilter_hs; C:\Windows\system32\drivers\massfilter_hs.sys [20232 2012-06-20] (HandSet Incorporated)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [289120 2015-11-13] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133816 2015-11-13] (Microsoft Corporation)
S3 pelmouse; C:\Windows\System32\DRIVERS\pelmouse.sys [23040 2012-11-28] (TPMX Electronics Ltd.)
S3 pelusblf; C:\Windows\System32\DRIVERS\pelusblf.sys [34816 2013-03-19] (TPMX Electronics Ltd.)
S3 RtlWlanu; C:\Windows\System32\DRIVERS\rtwlanu.sys [1525904 2012-11-07] (Realtek Semiconductor Corporation )
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3567488 2011-10-17] ()
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [28272 2016-09-05] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-09-06 08:55 - 2016-09-06 08:55 - 00024045 _____ C:\ComboFix.txt
2016-09-06 08:44 - 2016-09-06 08:55 - 00000000 ____D C:\Qoobox
2016-09-06 08:44 - 2011-06-26 16:45 - 00256000 _____ C:\Windows\PEV.exe
2016-09-06 08:44 - 2010-11-08 03:20 - 00208896 _____ C:\Windows\MBR.exe
2016-09-06 08:44 - 2009-04-20 14:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2016-09-06 08:44 - 2000-08-31 10:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2016-09-06 08:44 - 2000-08-31 10:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2016-09-06 08:44 - 2000-08-31 10:00 - 00098816 _____ C:\Windows\sed.exe
2016-09-06 08:44 - 2000-08-31 10:00 - 00080412 _____ C:\Windows\grep.exe
2016-09-06 08:44 - 2000-08-31 10:00 - 00068096 _____ C:\Windows\zip.exe
2016-09-06 08:43 - 2016-09-06 08:53 - 00000000 ____D C:\Windows\erdnt
2016-09-06 08:37 - 2016-09-06 08:38 - 05658674 _____ (Swearware) C:\Users\Workventures\Downloads\ComboFix.exe
2016-09-06 07:21 - 2016-09-06 07:30 - 00000000 ____D C:\Users\Workventures\Downloads\Home Made
2016-09-05 16:07 - 2016-09-05 16:07 - 00232281 _____ C:\Users\Workventures\Desktop\20160905-59302-3.pdf
2016-09-05 16:07 - 2016-09-05 16:07 - 00232268 _____ C:\Users\Workventures\Desktop\20160905-59302-2.pdf
2016-09-05 16:07 - 2016-09-05 16:07 - 00232266 _____ C:\Users\Workventures\Desktop\20160905-59302-1.pdf
2016-09-05 12:01 - 2016-09-06 09:06 - 00000000 ____D C:\Users\Workventures\Desktop\Clean UP
2016-09-05 09:58 - 2016-09-05 10:29 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-09-05 09:58 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-09-05 09:58 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-09-05 09:02 - 2016-09-05 09:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
2016-09-05 09:02 - 2016-09-05 09:02 - 00000000 ____D C:\Program Files\RogueKiller
2016-09-04 21:09 - 2016-09-04 21:09 - 00000000 ____D C:\Users\Workventures\Desktop\Cryptolock Virus
2016-09-04 21:00 - 2016-09-04 22:03 - 00000000 ____D C:\Users\Workventures\Desktop\Bond docs
2016-09-04 09:07 - 2016-09-04 09:08 - 31930936 _____ (Adlice Software ) C:\Users\Workventures\Downloads\setup (1).exe
2016-09-03 10:51 - 2016-09-06 15:41 - 00000000 ____D C:\FRST
2016-08-31 09:30 - 2016-09-05 20:54 - 00000000 ____D C:\Users\Workventures\AppData\Local\CrashDumps
2016-08-31 06:40 - 2016-09-06 07:21 - 00000000 ____D C:\Users\Workventures\Downloads\RB 0820adupree11
2016-08-31 05:58 - 2016-08-31 07:29 - 00000000 ____D C:\Users\Workventures\Downloads\QS 0730
2016-08-30 19:40 - 2016-08-31 09:29 - 00000000 ____D C:\Program Files\Plumbytes Software
2016-08-30 18:58 - 2016-09-05 10:44 - 00000000 ____D C:\AdwCleaner
2016-08-29 13:29 - 2016-08-29 13:29 - 00000000 ____D C:\Users\Workventures\AppData\Roaming\Malwarebytes
2016-08-25 13:51 - 2016-09-05 09:06 - 00028272 _____ C:\Windows\system32\Drivers\TrueSight.sys
2016-08-25 13:50 - 2016-08-25 13:50 - 00000000 ____D C:\ProgramData\RogueKiller
2016-08-25 12:32 - 2016-08-30 09:19 - 00191302 _____ C:\Windows\ntbtlog.txt
2016-08-23 06:57 - 2016-08-23 06:57 - 00003644 _____ C:\Users\Workventures\Documents\HOW_TO_RESTORE_FILES.html
2016-08-23 06:57 - 2016-08-23 06:57 - 00001126 _____ C:\Users\Workventures\Documents\HOW_TO_RESTORE_FILES.txt
2016-08-23 06:55 - 2016-08-23 06:55 - 00003644 _____ C:\Users\Workventures\AppData\LocalLow\HOW_TO_RESTORE_FILES.html
2016-08-23 06:55 - 2016-08-23 06:55 - 00001126 _____ C:\Users\Workventures\AppData\LocalLow\HOW_TO_RESTORE_FILES.txt
2016-08-23 06:54 - 2016-08-23 06:55 - 00000000 ____D C:\ProgramData\ewywybatajeluxot
2016-08-23 06:54 - 2016-08-23 06:54 - 00003644 _____ C:\Users\Lenovo share\HOW_TO_RESTORE_FILES.html
2016-08-23 06:54 - 2016-08-23 06:54 - 00003644 _____ C:\Users\Default\HOW_TO_RESTORE_FILES.html
2016-08-23 06:54 - 2016-08-23 06:54 - 00001126 _____ C:\Users\Lenovo share\HOW_TO_RESTORE_FILES.txt
2016-08-23 06:54 - 2016-08-23 06:54 - 00001126 _____ C:\Users\Default\HOW_TO_RESTORE_FILES.txt
2016-08-18 06:38 - 2016-08-22 06:45 - 00003372 _____ C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1926230946-431629159-532477852-1001
2016-08-18 06:38 - 2016-08-22 06:45 - 00003252 _____ C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1926230946-431629159-532477852-1001
2016-08-18 03:45 - 2016-07-08 01:36 - 01896168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2016-08-18 03:45 - 2016-07-08 01:36 - 00377576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2016-08-18 03:45 - 2016-07-08 01:36 - 00287976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2016-08-18 03:45 - 2016-07-08 01:08 - 00046080 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys
2016-08-18 03:45 - 2016-07-02 01:31 - 00976896 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2016-08-18 03:45 - 2016-07-02 01:31 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll
2016-08-18 03:45 - 2016-07-02 01:13 - 00741888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2016-08-18 03:45 - 2016-07-02 01:13 - 00084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\INETRES.dll
2016-08-18 03:45 - 2016-07-02 00:56 - 00464896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2016-08-18 03:45 - 2016-07-02 00:56 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2016-08-18 03:45 - 2016-07-02 00:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2016-08-17 07:56 - 2016-07-09 01:32 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2016-08-17 07:56 - 2016-07-09 01:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2016-08-14 19:21 - 2016-08-23 06:54 - 00000000 ____D C:\Users\Lenovo share\Some On Samsung
2016-08-12 16:14 - 2016-08-12 16:14 - 00003924 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926230946-431629159-532477852-1001UA
2016-08-12 16:14 - 2016-08-12 16:14 - 00003528 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1926230946-431629159-532477852-1001Core
2016-08-12 16:14 - 2016-08-12 16:14 - 00000000 ____D C:\Users\Workventures\AppData\Roaming\Mozilla
2016-08-11 09:22 - 2016-08-30 21:24 - 00000000 ____D C:\Users\Workventures\AppData\LocalLow\BitTorrent
2016-08-10 07:47 - 2016-06-07 02:50 - 01483264 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2016-08-10 07:47 - 2016-06-07 02:50 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2016-08-10 07:47 - 2016-06-07 02:50 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2016-08-10 07:47 - 2016-06-07 02:50 - 00141824 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2016-08-10 07:47 - 2016-06-07 01:23 - 01176064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2016-08-10 07:47 - 2016-06-07 01:23 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2016-08-10 07:47 - 2016-06-07 01:23 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2016-08-10 07:47 - 2016-06-07 01:23 - 00106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2016-08-10 07:37 - 2016-08-03 00:54 - 00394440 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-08-10 07:37 - 2016-08-03 00:08 - 00346312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-08-10 07:37 - 2016-08-02 16:54 - 25808384 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-08-10 07:37 - 2016-08-02 16:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-08-10 07:37 - 2016-08-02 16:47 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2016-08-10 07:37 - 2016-08-02 16:32 - 02894336 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-08-10 07:37 - 2016-08-02 16:32 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-08-10 07:37 - 2016-08-02 16:31 - 00572416 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-08-10 07:37 - 2016-08-02 16:31 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-08-10 07:37 - 2016-08-02 16:31 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2016-08-10 07:37 - 2016-08-02 16:31 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2016-08-10 07:37 - 2016-08-02 16:24 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-08-10 07:37 - 2016-08-02 16:23 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-08-10 07:37 - 2016-08-02 16:20 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-08-10 07:37 - 2016-08-02 16:19 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-08-10 07:37 - 2016-08-02 16:19 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2016-08-10 07:37 - 2016-08-02 16:18 - 06047744 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-08-10 07:37 - 2016-08-02 16:18 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-08-10 07:37 - 2016-08-02 16:18 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2016-08-10 07:37 - 2016-08-02 16:11 - 00969216 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2016-08-10 07:37 - 2016-08-02 16:08 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-08-10 07:37 - 2016-08-02 16:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2016-08-10 07:37 - 2016-08-02 16:00 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-08-10 07:37 - 2016-08-02 15:59 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2016-08-10 07:37 - 2016-08-02 15:56 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2016-08-10 07:37 - 2016-08-02 15:55 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-08-10 07:37 - 2016-08-02 15:54 - 20343808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-08-10 07:37 - 2016-08-02 15:53 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-08-10 07:37 - 2016-08-02 15:51 - 00497664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-08-10 07:37 - 2016-08-02 15:51 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2016-08-10 07:37 - 2016-08-02 15:51 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2016-08-10 07:37 - 2016-08-02 15:51 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2016-08-10 07:37 - 2016-08-02 15:51 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2016-08-10 07:37 - 2016-08-02 15:50 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2016-08-10 07:37 - 2016-08-02 15:47 - 02286592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-08-10 07:37 - 2016-08-02 15:45 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2016-08-10 07:37 - 2016-08-02 15:44 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2016-08-10 07:37 - 2016-08-02 15:42 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2016-08-10 07:37 - 2016-08-02 15:41 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-08-10 07:37 - 2016-08-02 15:41 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2016-08-10 07:37 - 2016-08-02 15:41 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2016-08-10 07:37 - 2016-08-02 15:40 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-08-10 07:37 - 2016-08-02 15:38 - 00806400 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-08-10 07:37 - 2016-08-02 15:38 - 00724992 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-08-10 07:37 - 2016-08-02 15:37 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2016-08-10 07:37 - 2016-08-02 15:36 - 02131456 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-08-10 07:37 - 2016-08-02 15:33 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2016-08-10 07:37 - 2016-08-02 15:29 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2016-08-10 07:37 - 2016-08-02 15:28 - 15412224 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-08-10 07:37 - 2016-08-02 15:28 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2016-08-10 07:37 - 2016-08-02 15:26 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2016-08-10 07:37 - 2016-08-02 15:25 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2016-08-10 07:37 - 2016-08-02 15:24 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2016-08-10 07:37 - 2016-08-02 15:23 - 02868224 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-08-10 07:37 - 2016-08-02 15:22 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2016-08-10 07:37 - 2016-08-02 15:21 - 04608000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-08-10 07:37 - 2016-08-02 15:16 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2016-08-10 07:37 - 2016-08-02 15:15 - 00692736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-08-10 07:37 - 2016-08-02 15:14 - 02055680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-08-10 07:37 - 2016-08-02 15:14 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2016-08-10 07:37 - 2016-08-02 15:11 - 13808128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-08-10 07:37 - 2016-08-02 15:10 - 01550848 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-08-10 07:37 - 2016-08-02 14:59 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-08-10 07:37 - 2016-08-02 14:56 - 02393088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-08-10 07:37 - 2016-08-02 14:53 - 01316352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-08-10 07:37 - 2016-08-02 14:51 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-08-10 07:37 - 2016-07-09 01:37 - 00154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-08-10 07:37 - 2016-07-09 01:37 - 00095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-08-10 07:37 - 2016-07-09 01:32 - 01464320 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00730624 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00343552 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-08-10 07:37 - 2016-07-09 01:32 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-08-10 07:37 - 2016-07-09 01:17 - 00666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2016-08-10 07:37 - 2016-07-09 01:17 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00260608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00251392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2016-08-10 07:37 - 2016-07-09 01:16 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2016-08-10 07:37 - 2016-07-09 01:03 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2016-08-10 07:37 - 2016-07-09 01:01 - 03218944 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-08-10 07:37 - 2016-07-09 00:57 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-08-10 07:37 - 2016-07-09 00:56 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-08-10 07:37 - 2016-07-09 00:56 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-08-10 07:37 - 2016-07-09 00:55 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2016-08-10 07:37 - 2016-07-09 00:55 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-08-10 07:37 - 2016-07-09 00:50 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll