1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Need help with extremely slow laptop

Discussion in 'Malware and Virus Removal' started by BillB, 2016/12/02.

Page 2 of 2
  1. 2016/12/12
    BillB Lifetime Subscription

    BillB Well-Known Member Thread Starter

    Joined:
    2003/03/18
    Messages:
    750
    Likes Received:
    0
    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-11-2016
    Ran by graymassie (12-12-2016 11:23:54)
    Running from C:\Users\graymassie\Desktop
    Windows 7 Home Premium Service Pack 1 (X64) (2010-02-10 23:45:30)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-4153870025-4142338956-1366997006-500 - Administrator - Disabled)
    graymassie (S-1-5-21-4153870025-4142338956-1366997006-1000 - Administrator - Enabled) => C:\Users\graymassie
    Guest (S-1-5-21-4153870025-4142338956-1366997006-501 - Limited - Disabled)

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Norton Internet Security (Disabled - Out of date) {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
    AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
    AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
    AS: Norton Internet Security (Disabled - Up to date) {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
    FW: Norton Internet Security (Disabled) {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}
    FW: avast! Antivirus (Disabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    Adobe Connect 9 Add-in (HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\...\Adobe Connect 9 Add-in) (Version: 11,9,974,205 - Adobe Systems Incorporated)
    Adobe Flash Player 23 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 23.0.0.207 - Adobe Systems Incorporated)
    Adobe Flash Player 23 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 23.0.0.207 - Adobe Systems Incorporated)
    Adobe Reader XI (11.0.18) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.18 - Adobe Systems Incorporated)
    Adobe Shockwave Player 11.5 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.5.8.612 - Adobe Systems, Inc.)
    Amazon Links (HKLM-x32\...\{3135D885-9D9A-4B4D-8D45-9DB05DA115CA}) (Version: 2.02 - TOSHIBA Corporation)
    AOL Toolbar (HKLM-x32\...\AOL Toolbar) (Version: - )
    AOL Toolbar (HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\...\AOL Toolbar) (Version: - )
    AOL Uninstaller (Choose which Products to Remove) (HKLM-x32\...\AOL Uninstaller) (Version: - AOL Inc.)
    Apple Application Support (32-bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
    Apple Application Support (64-bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)
    Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
    Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
    Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.10 - Atheros Communications Inc.)
    ATI Catalyst Install Manager (HKLM\...\{15BEAEBD-74D6-C40A-0089-5BFD0E689BFE}) (Version: 3.0.732.0 - ATI Technologies, Inc.)
    Avast Pro Antivirus (HKLM-x32\...\avast) (Version: 10.4.2233 - AVAST Software)
    Bejeweled 2 Deluxe (x32 Version: 2.2.0.82 - WildTangent) Hidden
    Blackhawk Striker 2 (x32 Version: 2.2.0.82 - WildTangent) Hidden
    Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
    ccc-core-static (x32 Version: 2009.0729.2238.38827 - ATI) Hidden
    CCleaner (HKLM\...\CCleaner) (Version: 4.06 - Piriform)
    Cisco NAC Agent (HKLM-x32\...\{0CB855E9-B05A-41C7-B743-C286A08433D0}) (Version: 4.9.2.8 - Cisco Systems, Inc.)
    Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
    Conexant Audio Driver For AMD HDMI Codec (HKLM\...\CNXT_AUDIO_HDA_HDMI) (Version: 4.98.12.0 - Conexant)
    Conexant HD Audio (HKLM\...\CNXT_AUDIO) (Version: 4.98.16.61 - Conexant)
    Dragon Ball (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Dropbox (HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\...\Dropbox) (Version: 15.4.22 - Dropbox, Inc.)
    Faerie Solitaire (x32 Version: 2.2.0.82 - WildTangent) Hidden
    FATE Undiscovered Realms (x32 Version: 2.2.0.82 - WildTangent) Hidden
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 54.0.2840.99 - Google Inc.)
    Google Earth (HKLM-x32\...\{A0C18B96-AB79-46BD-8321-6FA83E6D25B9}) (Version: 7.1.7.2606 - Google)
    Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
    Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden
    iTunes (HKLM\...\{93F2A022-6C37-48B8-B241-FFABD9F60C30}) (Version: 12.1.2.27 - Apple Inc.)
    Java(TM) 6 Update 14 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216014FF}) (Version: 6.0.140 - Sun Microsystems, Inc.)
    Junk Mail filter update (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
    Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
    Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
    Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
    Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
    Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
    Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
    Microsoft Office Ultimate 2007 (HKLM-x32\...\ULTIMATER) (Version: 12.0.6612.1000 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)
    Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Works (HKLM-x32\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation)
    Monopoly (x32 Version: 2.2.0.82 - WildTangent) Hidden
    Mozilla Firefox 39.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 39.0 (x86 en-US)) (Version: 39.0 - Mozilla)
    Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 35.0 - Mozilla)
    MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
    Music Oasis (HKLM-x32\...\{c6c214df-2922-4809-94aa-f4d67d4451ec}) (Version: 1.0.0 - W3i, LLC)
    Mystery P.I. - The Vegas Heist (x32 Version: 2.2.0.82 - WildTangent) Hidden
    NetZero Launcher (HKLM-x32\...\{9AEAF9CC-390B-49C0-8F7F-14092BF163B6}) (Version: 2.01 - TOSHIBA Corporation)
    PERRLA (HKLM-x32\...\{82AA957D-51B3-4A63-B974-2BFB5CA8A7CE}) (Version: 7.4.0 - PERRLA)
    PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
    Polar Bowler (x32 Version: 2.2.0.82 - WildTangent) Hidden
    Quickbooks Financial Center (HKLM-x32\...\{3B843B38-04B1-4CE6-8888-586273E0F289}) (Version: 2.02 - TOSHIBA Corporation)
    QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
    Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30105 - Realtek Semiconductor Corp.)
    Realtek WLAN Driver (HKLM-x32\...\{0FB630AB-7BD8-40AE-B223-60397D57C3C9}) (Version: 2.00.0006 - Realtek)
    Revo Uninstaller 2.0.1 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.1 - VS Revo Group, Ltd.)
    RogueKiller version 12.8.3.0 (HKLM\...\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 12.8.3.0 - Adlice Software)
    Skype Launcher (HKLM-x32\...\{DA84ECBF-4B79-47F2-B34C-95C38484C058}) (Version: 2.01 - TOSHIBA Corporation)
    Strongvault Online Backup (HKLM-x32\...\{59DB31A9-BCB0-4985-ACA6-F6477C7BE367}) (Version: 2.1.4.0 - Strongvault) <==== ATTENTION
    SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 5.6.1038 - SUPERAntiSpyware.com)
    Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 13.1.2.0 - Synaptics Incorporated)
    TOSHIBA Application Installer (HKLM-x32\...\{970472D0-F5F9-4158-A6E3-1AE49EFEF2D3}) (Version: 9.0.1.0 - TOSHIBA)
    TOSHIBA Assist (HKLM-x32\...\{1B87C40B-A60B-4EF3-9A68-706CF4B69978}) (Version: 3.00.09 - TOSHIBA)
    TOSHIBA Bulletin Board (HKLM-x32\...\InstallShield_{F64684A0-754B-4637-B7F9-6E8DAA8CD5CD}) (Version: 1.5.05.64 - TOSHIBA Corporation)
    TOSHIBA ConfigFree (HKLM-x32\...\{F3529665-D75E-4D6D-98F0-745C78C68E9B}) (Version: 8.0.25 - TOSHIBA Corporation)
    TOSHIBA Disc Creator (HKLM\...\{5DA0E02F-970B-424B-BF41-513A5018E4C0}) (Version: 2.1.0.2 for x64 - TOSHIBA Corporation)
    TOSHIBA eco Utility (HKLM-x32\...\InstallShield_{B3FF1CD9-B2F0-4D71-BB55-5F580401C48E}) (Version: 1.1.12.64 - TOSHIBA Corporation)
    TOSHIBA Extended Tiles for Windows Mobility Center (HKLM-x32\...\InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}) (Version: - )
    TOSHIBA Face Recognition (HKLM-x32\...\InstallShield_{F67FA545-D8E5-4209-86B1-AEE045D1003F}) (Version: 3.1.1.64 - TOSHIBA Corporation)
    TOSHIBA Hardware Setup (HKLM-x32\...\InstallShield_{C4FFA951-9678-4D51-84B4-AFD15D3C45AD}) (Version: - )
    TOSHIBA HDD Protection (HKLM\...\{94A90C69-71C1-470A-88F5-AA47ECC96B40}) (Version: 2.2.0.3 - TOSHIBA Corporation)
    TOSHIBA HDD/SSD Alert (HKLM-x32\...\InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}) (Version: 3.1.64.3 - TOSHIBA Corporation)
    TOSHIBA Media Controller (HKLM-x32\...\{983CD6FE-8320-4B80-A8F6-0D0366E0AA22}) (Version: 1.0.65 - TOSHIBA CORPORATION)
    Toshiba Online Backup (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.2.0.38 - Toshiba)
    TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.4.1.64 - TOSHIBA Corporation)
    TOSHIBA Quality Application (HKLM-x32\...\{E69992ED-A7F6-406C-9280-1C156417BC49}) (Version: 1.0.1 - TOSHIBA)
    TOSHIBA Recovery Media Creator (HKLM\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.1.0.4 for x64 - TOSHIBA Corporation)
    TOSHIBA ReelTime (HKLM-x32\...\InstallShield_{5BCC94A1-DEF1-4AB4-8046-BC13048E929A}) (Version: 1.5.07.64 - TOSHIBA Corporation)
    TOSHIBA Service Station (HKLM-x32\...\{AC6569FA-6919-442A-8552-073BE69E247A}) (Version: 2.1.40 - TOSHIBA)
    TOSHIBA Supervisor Password (HKLM-x32\...\InstallShield_{CBD6B23D-41D5-4A46-8019-6208516C9712}) (Version: - )
    TOSHIBA USB Sleep and Charge Utility (HKLM-x32\...\{E487EE7D-EAAA-4E2A-9116-E3B477D8A74F}) (Version: 1.2.3.0 - TOSHIBA Corporation)
    TOSHIBA Value Added Package (HKLM-x32\...\InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}) (Version: 1.2.26.64 - TOSHIBA Corporation)
    TOSHIBA Web Camera Application (HKLM-x32\...\{5E6F6CF3-BACC-4144-868C-E14622C658F3}) (Version: 1.1.1.7 - TOSHIBA Corporation)
    ToshibaRegistration (HKLM-x32\...\{5AF550B4-BB67-4E7E-82F1-2C4300279050}) (Version: 1.0.3 - Toshiba)
    Unchecky v1.0.1 (HKLM-x32\...\Unchecky) (Version: 1.0.1 - RaMMicHaeL)
    Uninstall AOL Emergency Connect Utility 1.0 (HKLM-x32\...\AOL Emergency Connect Utility 1.0) (Version: - )
    Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
    Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
    Vegas Penny Slots Pack (x32 Version: 2.2.0.98 - WildTangent) Hidden
    Virtual Families (x32 Version: 2.2.0.82 - WildTangent) Hidden
    Virtual Villagers - The Secret City (x32 Version: 2.2.0.82 - WildTangent) Hidden
    WildTangent Games (HKLM-x32\...\WildTangent toshiba Master Uninstall) (Version: 1.0.2.5 - WildTangent)
    WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.2.5 - WildTangent)
    WildTangent Games App (Toshiba Games) (x32 Version: 4.0.11.9 - WildTangent) Hidden
    WildTangent Games App (x32 Version: 4.0.5.14 - WildTangent) Hidden
    Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
    Windows Live Sign-in Assistant (HKLM-x32\...\{45338B07-A236-4270-9A77-EBB4115517B5}) (Version: 5.000.818.5 - Microsoft Corporation)
    Windows Live Sync (HKLM-x32\...\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation)
    Windows Live Upload Tool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)

    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {033F1F2E-B3DD-47BA-9198-45C650F4B40D} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-09-19] (Piriform Ltd)
    Task: {1AEEAB49-6171-4E08-B0AE-B56E74B8F44F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-16] (Google Inc.)
    Task: {1C31A4CE-E841-419C-93C3-376EF8DEB9F7} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-11-25] (Adobe Systems Incorporated)
    Task: {2703C912-476B-452A-AC8B-71AE82D1401E} - System32\Tasks\Symantec\Symantec Error Processor 17.6.0.32 => C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\SymErr.exe [2010-03-26] (Symantec Corporation)
    Task: {2B243EBB-5653-422E-94DD-22938BF18559} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-07-21] (AVAST Software)
    Task: {348D7DC0-5E96-4B63-ABAD-5AD0751419DA} - \Dregol fico -> No File <==== ATTENTION
    Task: {4C96BADF-7F5E-40CC-8AF7-E9E57BDAD1AD} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4153870025-4142338956-1366997006-1000Core => C:\Users\graymassie\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-04-16] (Dropbox, Inc.)
    Task: {4D535872-600B-4B39-8DCF-D132177EAFDF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-16] (Google Inc.)
    Task: {4E773ADA-D52F-4445-A782-654E6B53A6F7} - System32\Tasks\Games\UpdateCheck_S-1-5-21-4153870025-4142338956-1366997006-1000
    Task: {783AB8AE-766C-4941-B966-DB8E784FC929} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
    Task: {79FBB6ED-978C-4F39-B012-1636B43D4FEB} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-10-21] (Adobe Systems Incorporated)
    Task: {9DB68880-B71C-4260-92B6-1B9F39C89CAC} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4153870025-4142338956-1366997006-1000UA => C:\Users\graymassie\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-04-16] (Dropbox, Inc.)
    Task: {C7DFB647-5789-4258-9C5E-9B2F347EA27C} - System32\Tasks\{1F083CEC-DB67-4301-8C4F-CA56D04106C2} => pcalua.exe -a "C:\Program Files\DomaIQ Uninstaller\DomaIQUninstall.exe "
    Task: {D0DBBCB8-050D-4D47-86C2-31C2A3FA0663} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-20] (Microsoft Corporation)
    Task: {DDC658A3-9D5D-4AF5-BC13-777383D89E50} - System32\Tasks\Symantec\Symantec Error Analyzer 17.6.0.32 => C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\SymErr.exe [2010-03-26] (Symantec Corporation)
    Task: {DF7CAB51-4ADA-447B-B5A6-4E60607A736F} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-10-17] (AVAST Software)
    Task: {E84AF896-6270-4120-A693-82AC8BBF6D3E} - System32\Tasks\ConfigFree Startup Programs => C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe [2009-10-28] (TOSHIBA CORPORATION)

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

    Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-4153870025-4142338956-1366997006-1000Core.job => C:\Users\graymassie\AppData\Local\Dropbox\Update\DropboxUpdate.exe
    Task: C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-4153870025-4142338956-1366997006-1000UA.job => C:\Users\graymassie\AppData\Local\Dropbox\Update\DropboxUpdate.exe
    Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

    ==================== Shortcuts =============================

    (The entries could be listed to be restored or removed.)

    ==================== Loaded Modules (Whitelisted) ==============

    2015-03-20 17:12 - 2015-03-20 17:12 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
    2015-03-20 17:12 - 2015-03-20 17:12 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
    2009-07-16 18:27 - 2009-07-16 18:27 - 07244600 _____ () C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll
    2009-07-16 18:27 - 2009-07-16 18:27 - 00051512 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnZ.dll
    2009-11-11 20:57 - 2009-06-22 18:40 - 00022328 _____ () C:\Program Files\TOSHIBA\Toshiba Assist\NotifyX.dll
    2009-03-12 22:08 - 2009-03-12 22:08 - 00048640 _____ () C:\Program Files (x86)\Toshiba\PCDiag\NotifyPCD.dll
    2009-07-25 20:38 - 2009-07-25 20:38 - 00017800 _____ () C:\Program Files\TOSHIBA\TOSHIBA Disc Creator\NotifyTDC.dll
    2009-09-17 18:41 - 2009-09-17 18:41 - 00079192 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll
    2009-05-04 13:45 - 2009-05-04 13:45 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
    2009-12-08 09:10 - 2009-12-08 09:10 - 00270336 _____ () C:\windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
    2015-10-17 20:31 - 2015-10-17 20:31 - 00103376 _____ () C:\Program Files\AVAST Software\Avast\log.dll
    2015-10-17 20:30 - 2015-10-17 20:30 - 00123976 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
    2016-12-11 15:52 - 2016-12-11 15:52 - 03067904 _____ () C:\Program Files\AVAST Software\Avast\defs\16121100\algo.dll
    2016-12-12 11:08 - 2016-12-12 11:08 - 03067904 _____ () C:\Program Files\AVAST Software\Avast\defs\16121200\algo.dll
    2016-12-04 10:38 - 2016-10-28 18:50 - 00035792 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\_multiprocessing.pyd
    2016-12-04 10:37 - 2016-10-28 18:50 - 00145864 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\pyexpat.pyd
    2016-12-04 10:36 - 2016-10-28 18:51 - 00019408 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\faulthandler.pyd
    2016-12-04 10:37 - 2016-10-28 18:50 - 00116688 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\pywintypes27.dll
    2016-12-04 10:38 - 2016-10-28 18:50 - 00100296 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\_ctypes.pyd
    2016-12-04 10:38 - 2016-10-28 18:50 - 00018888 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\select.pyd
    2016-12-04 10:38 - 2016-11-28 09:17 - 00019760 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\tornado.speedups.pyd
    2016-12-04 10:38 - 2016-10-28 18:50 - 00694224 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\unicodedata.pyd
    2016-12-04 10:35 - 2016-11-28 09:16 - 00020816 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._constant_time.pyd
    2016-12-04 10:38 - 2016-10-28 18:51 - 00123856 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\_cffi_backend.pyd
    2016-12-04 10:35 - 2016-11-28 09:16 - 01682760 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._openssl.pyd
    2016-12-04 10:35 - 2016-11-28 09:16 - 00020808 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._padding.pyd
    2016-12-04 10:38 - 2016-10-28 18:53 - 00105928 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32api.pyd
    2016-12-04 10:38 - 2016-11-28 09:17 - 00021312 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\winffi.crt.compiled._winffi_crt.pyd
    2016-12-04 10:37 - 2016-11-28 09:16 - 00052024 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\psutil._psutil_windows.pyd
    2016-12-04 10:36 - 2016-11-28 09:16 - 00038696 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\fastpath.pyd
    2016-12-04 10:37 - 2016-10-28 18:50 - 00392144 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\pythoncom27.dll
    2016-12-04 10:36 - 2016-10-28 18:53 - 00020936 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\mmapfile.pyd
    2016-12-04 10:38 - 2016-10-28 18:53 - 00024528 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32event.pyd
    2016-12-04 10:38 - 2016-10-28 18:53 - 00116176 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32security.pyd
    2016-12-04 10:38 - 2016-11-28 09:17 - 00381752 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32com.shell.shell.pyd
    2016-12-04 10:38 - 2016-10-28 18:53 - 00124880 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32file.pyd
    2016-12-04 10:38 - 2016-11-28 09:17 - 00025424 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\winffi.kernel32.compiled._winffi_kernel32.pyd
    2016-12-04 10:38 - 2016-10-28 18:53 - 00024016 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32clipboard.pyd
    2016-12-04 10:38 - 2016-10-28 18:53 - 00175560 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32gui.pyd
    2016-12-04 10:38 - 2016-10-28 18:53 - 00030160 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32pipe.pyd
    2016-12-04 10:38 - 2016-10-28 18:53 - 00043472 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32process.pyd
    2016-12-04 10:38 - 2016-10-28 18:53 - 00048592 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32service.pyd
    2016-12-04 10:38 - 2016-10-28 18:53 - 00057808 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32evtlog.pyd
    2016-12-04 10:38 - 2016-10-28 18:53 - 00024016 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32profile.pyd
    2016-12-04 10:35 - 2016-11-28 09:16 - 00246592 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\breakpad.client.windows.handler.pyd
    2016-12-04 10:36 - 2016-11-28 09:16 - 00026456 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\dropbox.infinite.win.compiled._driverinstallation.pyd
    2016-12-04 10:38 - 2016-10-28 18:52 - 00241104 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\_jpegtran.pyd
    2016-12-04 10:35 - 2016-11-28 09:16 - 00020280 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\cpuid.compiled._cpuid.pyd
    2016-12-04 10:38 - 2016-10-28 18:53 - 00028616 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32ts.pyd
    2016-12-04 10:38 - 2016-11-28 09:17 - 00020800 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\winffi.iphlpapi._winffi_iphlpapi.pyd
    2016-12-04 10:38 - 2016-11-28 09:17 - 00019776 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\winffi.winerror._winffi_winerror.pyd
    2016-12-04 10:38 - 2016-11-28 09:17 - 00020800 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\winffi.wininet._winffi_wininet.pyd
    2016-12-04 10:38 - 2016-11-28 09:17 - 00023376 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\winscreenshot.compiled._CaptureScreenshot.pyd
    2016-12-04 10:38 - 2016-10-28 18:53 - 00350152 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\winxpgui.pyd
    2016-12-04 10:38 - 2016-11-28 09:17 - 00022352 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\winverifysignature.compiled._VerifySignature.pyd
    2016-12-04 10:36 - 2016-11-28 09:16 - 00024392 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\librsyncffi.compiled._librsyncffi.pyd
    2016-12-04 10:36 - 2016-10-28 18:49 - 00036296 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\librsync.dll
    2016-12-04 10:36 - 2016-11-28 09:16 - 00084280 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\dropbox_sqlite_ext.DLL
    2016-12-04 10:37 - 2016-11-28 09:16 - 01826096 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\PyQt5.QtCore.pyd
    2016-12-04 10:38 - 2016-10-28 18:51 - 00083912 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\sip.pyd
    2016-12-04 10:37 - 2016-11-28 09:16 - 00531248 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\PyQt5.QtNetwork.pyd
    2016-12-04 10:37 - 2016-11-28 09:17 - 03928880 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\PyQt5.QtWidgets.pyd
    2016-12-04 10:37 - 2016-11-28 09:16 - 01972528 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\PyQt5.QtGui.pyd
    2016-12-04 10:37 - 2016-11-28 09:16 - 00133424 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKit.pyd
    2016-12-04 10:37 - 2016-11-28 09:16 - 00224056 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKitWidgets.pyd
    2016-12-04 10:37 - 2016-11-28 09:16 - 00207672 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\PyQt5.QtPrintSupport.pyd
    2016-12-04 10:38 - 2016-11-28 09:17 - 00020288 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\winffi.user32._winffi_user32.pyd
    2016-12-04 10:36 - 2016-10-28 18:56 - 00017864 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\libEGL.dll
    2016-12-04 10:36 - 2016-10-28 18:56 - 01631184 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\libGLESv2.dll
    2016-12-04 10:37 - 2016-11-28 09:16 - 00042808 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\PyQt5.QtWebChannel.pyd
    2016-12-04 10:37 - 2016-11-28 09:16 - 00168760 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\PyQt5.QtWebEngineWidgets.pyd
    2016-12-04 10:37 - 2016-11-28 09:16 - 00357680 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\PyQt5.QtQml.pyd
    2016-12-04 10:38 - 2016-10-28 18:53 - 00060880 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\win32print.pyd
    2016-12-04 10:38 - 2016-11-28 09:17 - 00024904 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\winffi.winhttp.compiled._winffi_winhttp.pyd
    2016-12-04 10:37 - 2016-11-28 09:16 - 00546096 _____ () C:\Users\graymassie\AppData\Roaming\Dropbox\bin\PyQt5.QtQuick.pyd
    2015-10-17 20:32 - 2015-10-17 20:33 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)

    AlternateDataStreams: C:\ProgramData\TEMP:D1B5B4F1 [104]
    AlternateDataStreams: C:\ProgramData\TEMP:D346F792 [294]

    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


    ==================== Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)


    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)


    ==================== Hosts content: ==========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2009-07-13 21:34 - 2016-12-12 11:02 - 00001227 ____A C:\windows\system32\Drivers\etc\hosts

    127.0.0.1 localhost0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
    0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
    0.0.0.0 media.opencandy.com
    0.0.0.0 cdn.opencandy.com
    0.0.0.0 tracking.opencandy.com
    0.0.0.0 api.opencandy.com
    0.0.0.0 api.recommendedsw.com
    0.0.0.0 installer.betterinstaller.com
    0.0.0.0 installer.filebulldog.com
    0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
    0.0.0.0 inno.bisrv.com
    0.0.0.0 nsis.bisrv.com
    0.0.0.0 cdn.file2desktop.com
    0.0.0.0 cdn.goateastcach.us
    0.0.0.0 cdn.guttastatdk.us
    0.0.0.0 cdn.inskinmedia.com
    0.0.0.0 cdn.insta.oibundles2.com
    0.0.0.0 cdn.insta.playbryte.com
    0.0.0.0 cdn.llogetfastcach.us
    0.0.0.0 cdn.montiera.com
    0.0.0.0 cdn.msdwnld.com
    0.0.0.0 cdn.mypcbackup.com
    0.0.0.0 cdn.ppdownload.com
    0.0.0.0 cdn.riceateastcach.us
    0.0.0.0 cdn.shyapotato.us
    0.0.0.0 cdn.solimba.com
    0.0.0.0 cdn.tuto4pc.com
    0.0.0.0 cdn.appround.biz
    0.0.0.0 cdn.bigspeedpro.com
    0.0.0.0 cdn.bispd.com

    There are 4 more lines.


    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\graymassie\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
    DNS Servers: 192.168.1.1
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    MSCONFIG\startupreg: SMessaging => "C:\Users\graymassie\AppData\Local\Strongvault Online Backup\SMessaging.exe "

    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    FirewallRules: [{9DE4A928-2BCC-496D-A2F1-C9A234F1EC6F}] => C:\Program Files (x86)\Windows Live\Messenger\wlcsdk.exe
    FirewallRules: [{8915A9F5-E33A-4238-9785-F3857F1C7499}] => C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
    FirewallRules: [{204796BB-74D8-4B46-829C-0A965BF69D57}] => svchost.exe
    FirewallRules: [{21494F01-DB73-499E-A3A4-323D4EBEECB3}] => C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe
    FirewallRules: [{A900E7A6-72BC-4167-A818-954498744B32}] => C:\Program Files (x86)\Common Files\aol\acs\AOLDial.exe
    FirewallRules: [{EC5A3F31-27AA-4C33-A111-40448C4FE5F3}] => C:\Program Files (x86)\Common Files\aol\acs\AOLDial.exe
    FirewallRules: [{92B1C7C3-CB71-49C3-9E24-9988E8E154E8}] => C:\Program Files (x86)\Common Files\aol\acs\AOLacsd.exe
    FirewallRules: [{DD766E25-F212-4184-8ACB-A3F47EE549BE}] => C:\Program Files (x86)\Common Files\aol\acs\AOLacsd.exe
    FirewallRules: [{3D1B8870-25F8-4186-81CF-4A743B7DF960}] => C:\Program Files (x86)\Common Files\aol\1266376774\ee\aolsoftware.exe
    FirewallRules: [{4CC13A34-9208-46E0-8E11-3D0A9FD58DA2}] => C:\Program Files (x86)\Common Files\aol\1266376774\ee\aolsoftware.exe
    FirewallRules: [{06C4BA3E-B67C-452B-8DD0-4A5156376E2B}] => C:\Program Files (x86)\AOL 9.5\waol.exe
    FirewallRules: [{44B3699C-C1EA-4F88-A8D2-9E93BD3D6589}] => C:\Program Files (x86)\AOL 9.5\waol.exe
    FirewallRules: [{E3A178C0-A02A-43DC-8C69-DDCCECAE26C4}] => C:\Program Files (x86)\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe
    FirewallRules: [{4B859F7C-2F16-419D-ADD5-D112127D95C7}] => C:\Program Files (x86)\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe
    FirewallRules: [{D5C025B0-60A5-4031-879F-D48F67CAFA80}] => C:\Program Files (x86)\Common Files\aol\Loader\aolload.exe
    FirewallRules: [{A35F4B90-C55F-4035-B6E7-C00FD9B69A3E}] => C:\Program Files (x86)\Common Files\aol\Loader\aolload.exe
    FirewallRules: [{0E3481C7-A8E1-48FB-B383-4CA9264E92FC}] => C:\Program Files (x86)\Common Files\aol\System Information\sinf.exe
    FirewallRules: [{C578E393-DFD2-4BD4-8DAE-E4400553DC9F}] => C:\Program Files (x86)\Common Files\aol\System Information\sinf.exe
    FirewallRules: [{FEE19B29-34E2-4AAF-96F4-BC3C38A242CC}] => C:\Program Files (x86)\Common Files\aol\acs\AOLDial.exe
    FirewallRules: [{8B235874-8695-4803-9E94-DABEC285A2D6}] => C:\Program Files (x86)\Common Files\aol\acs\AOLDial.exe
    FirewallRules: [{ACF6ECE1-0A31-4557-BAA9-CB00F4D42EC9}] => C:\Program Files (x86)\Common Files\aol\acs\AOLacsd.exe
    FirewallRules: [{61B642A8-5A5D-4FCD-89C4-762A17A3028E}] => C:\Program Files (x86)\Common Files\aol\acs\AOLacsd.exe
    FirewallRules: [{2A51CE14-25B3-41B6-8F34-C7311D62D628}] => C:\Program Files (x86)\Common Files\aol\1266376774\ee\aolsoftware.exe
    FirewallRules: [{877F0C44-9495-4C75-BF62-01F2C2A45A08}] => C:\Program Files (x86)\Common Files\aol\1266376774\ee\aolsoftware.exe
    FirewallRules: [{565441FB-6440-48D6-AA72-FAA27C83C8DB}] => C:\Program Files (x86)\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe
    FirewallRules: [{8F8B1064-0D97-40C2-B931-0B0E8DB30B9C}] => C:\Program Files (x86)\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe
    FirewallRules: [TCP Query User{192081BE-155C-457F-A37B-5048B34F69C1}C:\program files (x86)\java\jre6\bin\javaw.exe] => C:\program files (x86)\java\jre6\bin\javaw.exe
    FirewallRules: [UDP Query User{28F198F7-2B94-4466-96DB-E6BC041B3869}C:\program files (x86)\java\jre6\bin\javaw.exe] => C:\program files (x86)\java\jre6\bin\javaw.exe
    FirewallRules: [TCP Query User{443AD249-6FE2-4433-9AD5-6750ACA0BF0D}C:\program files (x86)\internet explorer\iexplore.exe] => C:\program files (x86)\internet explorer\iexplore.exe
    FirewallRules: [UDP Query User{88A9D563-AE18-4277-8645-787FA28053F3}C:\program files (x86)\internet explorer\iexplore.exe] => C:\program files (x86)\internet explorer\iexplore.exe
    FirewallRules: [{411E3024-1022-4A1E-80C3-09E19922D123}] => C:\Program Files\Bonjour\mDNSResponder.exe
    FirewallRules: [{C843AA50-5A97-43DF-B4ED-46A762BBF1E8}] => C:\Program Files\Bonjour\mDNSResponder.exe
    FirewallRules: [{3C00B2FE-3D90-4E88-9D10-04AE6DB9127C}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    FirewallRules: [{12B531DB-ACC9-45B0-AA9F-3E5B997531B0}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    FirewallRules: [{D1F65838-171E-4D08-9309-55CA5E0CD190}] => C:\Users\graymassie\AppData\Roaming\Dropbox\bin\Dropbox.exe
    FirewallRules: [{6F99D0C1-8EB1-4410-B3DC-AAEB3F6391D1}] => C:\Users\graymassie\AppData\Roaming\Dropbox\bin\Dropbox.exe
    FirewallRules: [TCP Query User{CCBE0BEB-4FCA-4C45-9ED7-66FD442B68A2}C:\users\graymassie\appdata\roaming\dropbox\bin\dropbox.exe] => C:\users\graymassie\appdata\roaming\dropbox\bin\dropbox.exe
    FirewallRules: [UDP Query User{E3BB5564-95FE-4251-872A-B267F24A1589}C:\users\graymassie\appdata\roaming\dropbox\bin\dropbox.exe] => C:\users\graymassie\appdata\roaming\dropbox\bin\dropbox.exe
    FirewallRules: [{F08786B7-917A-4572-872A-C0150FAAA775}] => C:\Program Files (x86)\Mozilla FireFox\firefox.exe
    FirewallRules: [{8BECDDDE-59DE-4271-9766-6F1E1639D2E6}] => C:\Program Files (x86)\Mozilla FireFox\firefox.exe
    FirewallRules: [TCP Query User{953ADF8A-4BEC-4521-9AAA-AC2BDD9D2633}C:\program files (x86)\mozilla firefox\firefox.exe] => C:\program files (x86)\mozilla firefox\firefox.exe
    FirewallRules: [UDP Query User{D3D8BB10-2B1B-4596-8537-2EE72DC3483C}C:\program files (x86)\mozilla firefox\firefox.exe] => C:\program files (x86)\mozilla firefox\firefox.exe
    FirewallRules: [{AAFD3818-CCB5-473A-A3A3-EBCD3F239493}] => C:\Program Files\iTunes\iTunes.exe
    FirewallRules: [{D14E0B29-182A-4EFF-ACF1-0DD20B7A3D4D}] => C:\Users\graymassie\AppData\Local\Chromium\Application\chrome.exe
    FirewallRules: [{43A549F4-B465-43A7-9569-B9F9187227D3}] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    ==================== Restore Points =========================

    25-11-2016 21:20:28 Windows Update
    09-12-2016 12:24:02 JRT Pre-Junkware Removal
    11-12-2016 16:11:15 ComboFix created restore point

    ==================== Faulty Device Manager Devices =============

    Name: BHDrvx64
    Description: BHDrvx64
    Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Manufacturer:
    Service: BHDrvx64
    Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
    Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
    Devices stay in this state if they have been prepared for removal.
    After you remove the device, this error disappears.Remove the device, and this error should be resolved.

    Name: Symantec Iron Driver
    Description: Symantec Iron Driver
    Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Manufacturer:
    Service: SymIRON
    Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
    Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
    Devices stay in this state if they have been prepared for removal.
    After you remove the device, this error disappears.Remove the device, and this error should be resolved.

    Name: Avast! Firewall Driver
    Description: Avast! Firewall Driver
    Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Manufacturer:
    Service: aswNdisFlt
    Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
    Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
    Devices stay in this state if they have been prepared for removal.
    After you remove the device, this error disappears.Remove the device, and this error should be resolved.


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (12/12/2016 11:08:54 AM) (Source: Customer Experience Improvement Program) (EventID: 1006) (User: )
    Description: A problem prevented Customer Experience Improvement Program data from being consolidated into files that can be sent to Microsoft, (Error 80004005).

    Error: (12/11/2016 04:32:22 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: pev.3XE, version: 0.0.0.0, time stamp: 0x4e06cfe8
    Faulting module name: pev.3XE, version: 0.0.0.0, time stamp: 0x4e06cfe8
    Exception code: 0xc0000417
    Fault offset: 0x00081dc9
    Faulting process id: 0xf90
    Faulting application start time: 0x01d253f60e08196d
    Faulting application path: C:\ComboFix\pev.3XE
    Faulting module path: C:\ComboFix\pev.3XE
    Report Id: 4cb3578a-bfe9-11e6-9a5e-00038a000015

    Error: (12/11/2016 03:54:41 PM) (Source: Customer Experience Improvement Program) (EventID: 1006) (User: )
    Description: A problem prevented Customer Experience Improvement Program data from being consolidated into files that can be sent to Microsoft, (Error 80004005).

    Error: (12/09/2016 03:46:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 236669

    Error: (12/09/2016 03:46:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 236669

    Error: (12/09/2016 03:46:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: Continuously busy for more than a second

    Error: (12/09/2016 03:42:46 PM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 15959

    Error: (12/09/2016 03:42:46 PM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 15959

    Error: (12/09/2016 03:42:46 PM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: Continuously busy for more than a second

    Error: (12/09/2016 12:58:50 PM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 15944


    System errors:
    =============
    Error: (12/12/2016 11:07:52 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
    Description: The Windows Update service hung on starting.

    Error: (12/12/2016 11:02:52 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
    Description: The following boot-start or system-start driver(s) failed to load:
    aswNdisFlt
    BHDrvx64
    cdrom
    SymIRON

    Error: (12/12/2016 11:02:02 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The avast! Firewall service failed to start due to the following error:
    The service did not respond to the start or control request in a timely fashion.

    Error: (12/12/2016 11:02:02 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
    Description: A timeout was reached (30000 milliseconds) while waiting for the avast! Firewall service to connect.

    Error: (12/12/2016 11:01:33 AM) (Source: atikmdag) (EventID: 10261) (User: )
    Description: Display is not active

    Error: (12/12/2016 11:01:33 AM) (Source: atikmdag) (EventID: 19468) (User: )
    Description: CPLIB :: General - Invalid Parameter

    Error: (12/11/2016 04:48:20 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
    Description: The following boot-start or system-start driver(s) failed to load:
    aswNdisFlt
    BHDrvx64
    cdrom
    SymIRON

    Error: (12/11/2016 04:47:37 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The avast! Firewall service failed to start due to the following error:
    The service did not respond to the start or control request in a timely fashion.

    Error: (12/11/2016 04:47:37 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
    Description: A timeout was reached (30000 milliseconds) while waiting for the avast! Firewall service to connect.

    Error: (12/11/2016 04:47:11 PM) (Source: atikmdag) (EventID: 10261) (User: )
    Description: Display is not active


    CodeIntegrity:
    ===================================
    Date: 2016-12-11 16:36:07.249
    Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    Date: 2016-12-11 16:36:06.610
    Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    Date: 2013-10-01 21:18:15.953
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-10-01 21:09:30.566
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-10-01 21:01:36.062
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-10-01 20:18:06.132
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-10-01 19:14:20.473
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-10-01 15:56:26.051
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-09-30 13:45:36.583
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-09-30 13:12:46.618
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.


    ==================== Memory info ===========================

    Processor: AMD Athlon(tm) Neo X2 Dual Core Processor L325
    Percentage of memory in use: 92%
    Total physical RAM: 1790.36 MB
    Available physical RAM: 126.41 MB
    Total Virtual: 3580.72 MB
    Available Virtual: 1910.55 MB

    ==================== Drives ================================

    Drive c: (TI105238W0E) (Fixed) (Total:287.73 GB) (Free:173.29 GB) NTFS ==>[system with boot components (obtained from drive)]
    Drive d: (USB20FD) (Removable) (Total:119.19 GB) (Free:30.11 GB) FAT32

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298.1 GB) (Disk ID: B7784A6C)
    Partition 1: (Active) - (Size=1.5 GB) - (Type=27)
    Partition 2: (Not Active) - (Size=287.7 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=8.9 GB) - (Type=17)

    ========================================================
    Disk: 1 (Size: 119.2 GB) (Disk ID: 67B99DAF)
    Partition 1: (Not Active) - (Size=119.2 GB) - (Type=0B)

    ==================== End of Addition.txt ============================
     
    BillB,
    #21
  2. 2016/12/12
    BillB Lifetime Subscription

    BillB Well-Known Member Thread Starter

    Joined:
    2003/03/18
    Messages:
    750
    Likes Received:
    0
    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 30-11-2016
    Ran by graymassie (administrator) on GRAYMASSIE-PC (12-12-2016 11:19:07)
    Running from C:\Users\graymassie\Desktop
    Loaded Profiles: graymassie (Available Profiles: graymassie)
    Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
    Internet Explorer Version 11 (Default browser: FF)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (AMD) C:\Windows\System32\atiesrxx.exe
    (AMD) C:\Windows\System32\atieclxx.exe
    (Advanced Micro Devices, Inc.) C:\Windows\System32\atibtmon.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
    (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco NAC Agent\NACAgent.exe
    (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\ccsvchst.exe
    (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler.exe
    (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco NAC Agent\NACAgentUI.exe
    (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler64.exe
    (TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
    (TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
    (RaMMicHaeL) C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe
    (RaMMicHaeL) C:\Program Files (x86)\Unchecky\bin\unchecky_bg.exe
    (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
    (Microsoft Corporation) C:\Windows\System32\rundll32.exe
    (Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    (TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\Teco.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
    (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
    (SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
    (Dropbox, Inc.) C:\Users\graymassie\AppData\Roaming\Dropbox\bin\Dropbox.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
    (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
    (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    (AOL Inc.) C:\Program Files (x86)\Common Files\aol\1266376774\ee\aolsoftware.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
    (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
    (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
    (Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
    (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe


    ==================== Registry (Whitelisted) ====================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [508472 2009-10-09] (Conexant Systems, Inc.)
    HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2009-07-16] ()
    HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1794856 2009-05-29] (Synaptics Incorporated)
    HKLM\...\Run: [ThpSrv] => C:\windows\system32\thpsrv /logon
    HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [497504 2009-08-21] (TOSHIBA Corporation)
    HKLM\...\Run: [SmoothView] => C:\Program Files\Toshiba\SmoothView\SmoothView.exe [508216 2009-07-28] (TOSHIBA Corporation)
    HKLM\...\Run: [00TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [909624 2009-08-05] (TOSHIBA Corporation)
    HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [711000 2009-08-04] (TOSHIBA Corporation)
    HKLM\...\Run: [Teco] => C:\Program Files\TOSHIBA\TECO\Teco.exe [1482592 2009-09-28] (TOSHIBA Corporation)
    HKLM\...\Run: [ConexantAudioPatch] => C:\Program Files\ConexantAudioPatch\Audioreset.exe [284472 2009-09-02] ()
    HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2009-09-17] (TOSHIBA Corporation)
    HKLM\...\Run: [TosNC] => C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [595816 2009-10-28] (TOSHIBA Corporation)
    HKLM\...\Run: [TosReelTimeMonitor] => C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [34648 2009-10-28] (TOSHIBA Corporation)
    HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-06] (Apple Inc.)
    HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-07-30] (Advanced Micro Devices, Inc.)
    HKLM-x32\...\Run: [TWebCamera] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2446648 2009-11-05] (TOSHIBA CORPORATION.)
    HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe [529256 2009-08-10] (Toshiba)
    HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
    HKLM-x32\...\Run: [HostManager] => C:\Program Files (x86)\Common Files\AOL\1266376774\ee\AOLSoftware.exe [41800 2010-03-08] (AOL Inc.)
    HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-03-20] (Apple Inc.)
    HKLM-x32\...\Run: [NACAgentUI] => C:\Program Files (x86)\Cisco\Cisco NAC Agent\NACAgentUI.exe [610776 2012-12-03] (Cisco Systems, Inc.)
    HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [6133520 2015-11-26] (AVAST Software)
    HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
    HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7943072 2016-11-07] (SUPERAntiSpyware)
    HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\...\Run: [Dropbox Update] => C:\Users\graymassie\AppData\Local\Dropbox\Update\DropboxUpdate.exe [143144 2016-04-16] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-10-17] (AVAST Software)
    ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-11-28] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-11-28] (Dropbox, Inc.)
    ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\graymassie\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-11-28] (Dropbox, Inc.)
    Startup: C:\Users\graymassie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2016-12-04]
    ShortcutTarget: Dropbox.lnk -> C:\Users\graymassie\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
    CHR HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
    Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
    Tcpip\..\Interfaces\{DC620884-DD72-484B-AB30-4B52A0B0022E}: [DhcpNameServer] 192.168.1.1

    Internet Explorer:
    ==================
    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.com/?trackid=sp-006
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
    HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.com/?trackid=sp-006
    SearchScopes: HKLM -> DefaultScope {A34FF9F8-5169-44F8-8D60-DE66CAFE6E6C} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
    SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM -> {A34FF9F8-5169-44F8-8D60-DE66CAFE6E6C} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
    SearchScopes: HKLM -> {c9ab6446-7efc-47fe-966c-dc54324eff9f} URL =
    SearchScopes: HKLM-x32 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
    SearchScopes: HKLM-x32 -> {0CD0CEF1-C388-4E52-A24E-9A1B17237722} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
    SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
    SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
    SearchScopes: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
    SearchScopes: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000 -> {0CD0CEF1-C388-4E52-A24E-9A1B17237722} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
    SearchScopes: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000 -> {44816E91-C68A-2FF3-3D8F-8970062E5600} URL = hxxp://www.bing.com/search?q={searchTerms}&pc=ZUGO&form=ZGAIDF
    SearchScopes: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000 -> {65A73339-391B-401D-8AB4-4198673FA064} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
    SearchScopes: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA_enUS366
    SearchScopes: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
    BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-10-17] (AVAST Software)
    BHO-x32: No Name -> {3ef64538-8b54-4573-b48f-4d34b0238ab2} -> No File
    BHO-x32: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File
    BHO-x32: Symantec NCO BHO -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\coIEPlg.dll [2010-03-25] (Symantec Corporation)
    BHO-x32: Symantec Intrusion Prevention -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\IPSBHO.DLL [2010-02-03] (Symantec Corporation)
    BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
    BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-10-17] (AVAST Software)
    BHO-x32: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2009-11-11] (Sun Microsystems, Inc.)
    Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
    Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
    Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\coIEPlg.dll [2010-03-25] (Symantec Corporation)
    Toolbar: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
    Toolbar: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
    Toolbar: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000 -> No Name - {BA00B7B1-0351-477A-B948-23E3EE5A73D4} - No File
    DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
    DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: HKLM-x32 {76CBDDBA-3897-4EAC-A1D3-CCC47DE82EFB} hxxps://suri-ccas01.edmc.edu/auth/taweb.cab
    Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
    Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)

    FireFox:
    ========
    FF DefaultProfile: h79j4u84.default
    FF ProfilePath: C:\Users\graymassie\AppData\Roaming\Mozilla\Firefox\Profiles\h79j4u84.default [2016-12-11]
    FF Homepage: Mozilla\Firefox\Profiles\h79j4u84.default -> user_pref( "browser.startup.homepage ", "about:home "about:home);
    FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn
    FF Extension: (No Name) - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn [2013-10-01] [not signed]
    FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn
    FF Extension: (No Name) - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn [2013-10-01] [not signed]
    FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
    FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-12-16]
    FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_23_0_0_207.dll [2016-11-25] ()
    FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_207.dll [2016-11-25] ()
    FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\system32\Adobe\Director\np32dsw.dll [No File]
    FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
    FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2016-10-06] (Google)
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2009-07-10] (Microsoft Corporation)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-06] (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-06] (Google Inc.)
    FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll [2014-04-29] ()
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)
    StartMenuInternet: FIREFOX.EXE - firefox.exe

    Chrome:
    =======
    CHR DefaultProfile: Default
    CHR HomePage: Default -> hxxps://www.google.com/?trackid=sp-006
    CHR StartupUrls: Default -> "hxxps://www.google.com/?trackid=sp-006 "
    CHR DefaultSearchURL: Default -> hxxps://www.google.de/search?q={searchTerms}&trackid=sp-006
    CHR DefaultSuggestURL: Default -> hxxps://www.google.com/complete/search?client=chrome&q={searchTerms}
    CHR Profile: C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default [2016-12-09]
    CHR Extension: (Google Docs) - C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-08-06]
    CHR Extension: (Google Drive) - C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-07-27]
    CHR Extension: (YouTube) - C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-08-06]
    CHR Extension: (Google Docs Offline) - C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-08-06]
    CHR Extension: (Avast Online Security) - C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-02-09]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-08-06]
    CHR Extension: (Select-Links) - C:\Users\graymassie\AppData\Local\Google\Chrome\User Data\Default\Extensions\ppmbcfaniaaligobicejgielmnfcpbno [2015-02-09]
    CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-06-04]
    CHR HKLM-x32\...\Chrome\Extension: [ppmbcfaniaaligobicejgielmnfcpbno] - C:\Program Files (x86)\OApps\chrome-sl.crx <not found>

    ==================== Services (Whitelisted) ====================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-08-16] (SUPERAntiSpyware.com)
    R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
    R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [146600 2015-10-17] (AVAST Software)
    S2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [113704 2013-12-31] (AVAST Software)
    S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-04-24] (WildTangent)
    S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
    R2 NACAgent; C:\Program Files (x86)\Cisco\Cisco NAC Agent\NACAgent.exe [1270744 2012-12-03] (Cisco Systems, Inc.)
    R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\ccSvcHst.exe [126392 2010-02-25] (Symantec Corporation)
    R2 Unchecky; C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe [255256 2016-11-04] (RaMMicHaeL)
    R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

    ===================== Drivers (Whitelisted) ======================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    U5 AppMgmt; C:\windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
    R2 aswHwid; C:\windows\system32\drivers\aswHwid.sys [28656 2015-10-17] (AVAST Software)
    R1 aswKbd; C:\windows\system32\drivers\aswKbd.sys [28144 2015-10-17] (AVAST Software)
    R2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [90968 2015-10-17] (AVAST Software)
    S1 aswNdisFlt; C:\windows\System32\DRIVERS\aswNdisFlt.sys [439648 2014-01-21] (AVAST Software)
    R1 aswRdr; C:\windows\system32\drivers\aswRdr2.sys [93528 2015-10-17] (AVAST Software)
    R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65224 2015-10-17] (AVAST Software)
    R1 aswSnx; C:\windows\system32\drivers\aswSnx.sys [1059656 2015-11-26] (AVAST Software)
    R1 aswSP; C:\windows\system32\drivers\aswSP.sys [449992 2015-11-26] (AVAST Software)
    R2 aswStm; C:\windows\system32\drivers\aswStm.sys [153744 2015-10-17] (AVAST Software)
    R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [274808 2015-10-17] (AVAST Software)
    S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20100211.001\BHDrvx64.sys [676912 2010-02-11] (Symantec Corporation)
    R1 ccHP; C:\windows\system32\drivers\NISx64\1106000.020\ccHPx64.sys [615040 2010-02-25] (Symantec Corporation)
    R3 CnxtHdmiAudService; C:\windows\System32\drivers\CHDMI64.sys [688128 2009-08-18] (Conexant Systems Inc.)
    R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [475696 2010-02-18] (Symantec Corporation)
    R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100310.001\IDSvia64.sys [466992 2009-10-28] (Symantec Corporation)
    S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-22] (Realtek Semiconductor Corp.)
    R3 RTL8187Se; C:\windows\System32\DRIVERS\RTL8187Se.sys [403968 2008-08-22] (Realtek Semiconductor Corporation )
    R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
    R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
    S3 SRTSP; C:\windows\System32\Drivers\NISx64\1106000.020\SRTSP64.SYS [505392 2010-02-26] (Symantec Corporation)
    R1 SRTSPX; C:\windows\system32\drivers\NISx64\1106000.020\SRTSPX64.SYS [32304 2010-02-26] (Symantec Corporation)
    R0 SymDS; C:\windows\System32\drivers\NISx64\1106000.020\SYMDS64.SYS [433200 2009-08-29] (Symantec Corporation)
    R0 SymEFA; C:\windows\System32\drivers\NISx64\1106000.020\SYMEFA64.SYS [221232 2010-02-03] (Symantec Corporation)
    R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [173104 2010-02-18] (Symantec Corporation)
    S1 SymIRON; C:\windows\system32\drivers\NISx64\1106000.020\Ironx64.SYS [149552 2010-02-26] (Symantec Corporation)
    R1 SYMTDIv; C:\windows\System32\Drivers\NISx64\1106000.020\SYMTDIV.SYS [451120 2010-02-03] (Symantec Corporation)
    S3 catchme; \??\C:\ComboFix\catchme.sys [X]
    S3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100311.002\ENG64.SYS [X]
    S3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100311.002\EX64.SYS [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
     
    BillB,
    #22


  3. to hide this advert.

  4. 2016/12/12
    BillB Lifetime Subscription

    BillB Well-Known Member Thread Starter

    Joined:
    2003/03/18
    Messages:
    750
    Likes Received:
    0
    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2016-12-12 11:19 - 2016-12-12 11:22 - 00025800 _____ C:\Users\graymassie\Desktop\FRST.txt
    2016-12-11 16:43 - 2016-12-11 16:43 - 00025691 _____ C:\ComboFix.txt
    2016-12-11 16:10 - 2016-12-11 16:43 - 00000000 ____D C:\Qoobox
    2016-12-11 16:10 - 2011-06-26 01:45 - 00256000 _____ C:\windows\PEV.exe
    2016-12-11 16:10 - 2010-11-07 12:20 - 00208896 _____ C:\windows\MBR.exe
    2016-12-11 16:10 - 2009-04-19 23:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
    2016-12-11 16:10 - 2000-08-30 19:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
    2016-12-11 16:10 - 2000-08-30 19:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
    2016-12-11 16:10 - 2000-08-30 19:00 - 00098816 _____ C:\windows\sed.exe
    2016-12-11 16:10 - 2000-08-30 19:00 - 00080412 _____ C:\windows\grep.exe
    2016-12-11 16:10 - 2000-08-30 19:00 - 00068096 _____ C:\windows\zip.exe
    2016-12-11 16:04 - 2016-12-11 16:39 - 00000000 ____D C:\windows\erdnt
    2016-12-11 15:55 - 2016-12-11 15:39 - 05658636 ____R (Swearware) C:\Users\graymassie\Desktop\ComboFix.exe
    2016-12-09 12:37 - 2016-12-09 12:37 - 00004476 _____ C:\Users\graymassie\Desktop\JRT.txt
    2016-12-09 12:22 - 2016-12-04 08:40 - 01631928 _____ (Malwarebytes) C:\Users\graymassie\Desktop\JRT.exe
    2016-12-09 10:30 - 2016-12-09 11:05 - 00000000 ____D C:\AdwCleaner
    2016-12-09 10:29 - 2016-12-04 08:39 - 03968464 _____ C:\Users\graymassie\Desktop\AdwCleaner.exe
    2016-12-08 16:37 - 2016-12-08 16:37 - 00076366 _____ C:\Users\graymassie\Desktop\rkreport.txt
    2016-12-08 14:25 - 2016-12-08 14:25 - 00028272 _____ C:\windows\system32\Drivers\TrueSight.sys
    2016-12-08 14:23 - 2016-12-08 14:23 - 00000829 _____ C:\Users\Public\Desktop\RogueKiller.lnk
    2016-12-08 14:23 - 2016-12-08 14:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
    2016-12-08 14:22 - 2016-12-08 16:39 - 00000000 ____D C:\ProgramData\RogueKiller
    2016-12-08 14:22 - 2016-12-08 14:23 - 00000000 ____D C:\Program Files\RogueKiller
    2016-12-08 14:21 - 2016-12-04 08:37 - 34204400 _____ (Adlice Software ) C:\Users\graymassie\Desktop\setup.exe
    2016-12-07 18:39 - 2016-12-07 18:23 - 12019984 _____ (OPSWAT, Inc.) C:\Users\graymassie\Desktop\AppRemover.exe
    2016-12-07 15:31 - 2016-12-07 15:31 - 00001005 _____ C:\Users\Public\Desktop\Revo Uninstaller.lnk
    2016-12-07 15:31 - 2016-12-07 15:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
    2016-12-07 15:31 - 2016-12-07 15:31 - 00000000 ____D C:\Program Files\VS Revo Group
    2016-12-04 10:38 - 2016-12-04 10:39 - 00000000 ____D C:\Users\graymassie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
    2016-12-02 15:15 - 2016-12-12 11:19 - 00000000 ____D C:\FRST
    2016-12-02 15:14 - 2016-12-02 15:08 - 02411520 _____ (Farbar) C:\Users\graymassie\Desktop\FRST64.exe
    2016-11-25 18:54 - 2016-04-08 23:20 - 01230848 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
    2016-11-25 18:54 - 2016-04-08 22:52 - 01424896 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
    2016-11-25 18:54 - 2016-03-16 13:50 - 00156672 _____ (Microsoft Corporation) C:\windows\system32\mtxoci.dll
    2016-11-25 18:54 - 2016-03-16 13:28 - 00176128 _____ (Microsoft Corporation) C:\windows\SysWOW64\msorcl32.dll
    2016-11-25 18:54 - 2016-03-16 13:28 - 00111616 _____ (Microsoft Corporation) C:\windows\SysWOW64\mtxoci.dll
    2016-11-25 18:54 - 2016-03-09 14:00 - 00396800 _____ (Microsoft Corporation) C:\windows\system32\webio.dll
    2016-11-25 18:54 - 2016-03-09 13:40 - 00316416 _____ (Microsoft Corporation) C:\windows\SysWOW64\webio.dll
    2016-11-25 18:54 - 2016-02-09 04:55 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\seclogon.dll
    2016-11-25 18:54 - 2015-11-13 18:09 - 00091648 _____ (Microsoft Corporation) C:\windows\system32\mapistub.dll
    2016-11-25 18:54 - 2015-11-13 18:09 - 00091648 _____ (Microsoft Corporation) C:\windows\system32\mapi32.dll
    2016-11-25 18:54 - 2015-11-13 18:08 - 00017920 _____ (Microsoft Corporation) C:\windows\system32\fixmapi.exe
    2016-11-25 18:54 - 2015-11-13 17:50 - 00076800 _____ (Microsoft Corporation) C:\windows\SysWOW64\mapistub.dll
    2016-11-25 18:54 - 2015-11-13 17:50 - 00076800 _____ (Microsoft Corporation) C:\windows\SysWOW64\mapi32.dll
    2016-11-25 18:54 - 2015-11-13 17:49 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\fixmapi.exe
    2016-11-25 18:53 - 2016-03-17 17:56 - 02084864 _____ (Microsoft Corporation) C:\windows\system32\ole32.dll
    2016-11-25 18:53 - 2016-03-17 17:28 - 01414144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ole32.dll
    2016-11-25 18:53 - 2016-03-06 13:53 - 01885696 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
    2016-11-25 18:53 - 2016-03-06 13:53 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll
    2016-11-25 18:53 - 2016-03-06 13:38 - 01240576 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3.dll
    2016-11-25 18:53 - 2016-03-06 13:38 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3r.dll
    2016-11-25 18:53 - 2016-02-02 13:57 - 00511488 _____ (Microsoft Corporation) C:\windows\system32\rpcss.dll
    2016-11-25 18:52 - 2016-05-12 12:20 - 00154856 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
    2016-11-25 18:52 - 2016-05-12 12:20 - 00095464 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
    2016-11-25 18:52 - 2016-05-12 12:15 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
    2016-11-25 18:52 - 2016-05-12 12:15 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
    2016-11-25 18:52 - 2016-05-12 12:15 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
    2016-11-25 18:52 - 2016-05-12 12:15 - 00028672 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
    2016-11-25 18:52 - 2016-05-12 12:15 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 01464320 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 01212928 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00730624 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00690688 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00463872 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00344064 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00316416 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00312320 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00190464 _____ (Microsoft Corporation) C:\windows\system32\rpchttp.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\cryptbase.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
    2016-11-25 18:52 - 2016-05-12 12:14 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00666112 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00553472 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00342528 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00260608 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00251392 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00223232 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00141312 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpchttp.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
    2016-11-25 18:52 - 2016-05-12 10:18 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
    2016-11-25 18:52 - 2016-05-12 10:05 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
    2016-11-25 18:52 - 2016-05-12 09:58 - 00464896 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv.sys
    2016-11-25 18:52 - 2016-05-12 09:58 - 00405504 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv2.sys
    2016-11-25 18:52 - 2016-05-12 09:58 - 00291328 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys
    2016-11-25 18:52 - 2016-05-12 09:58 - 00168960 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srvnet.sys
    2016-11-25 18:52 - 2016-05-12 09:58 - 00159744 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys
    2016-11-25 18:52 - 2016-05-12 09:58 - 00129536 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
    2016-11-25 18:52 - 2016-05-12 09:57 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
    2016-11-25 18:52 - 2016-05-12 09:56 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe
    2016-11-25 18:52 - 2016-05-12 09:51 - 00036352 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptbase.dll
    2016-11-25 18:52 - 2016-05-12 08:05 - 00459640 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
    2016-11-25 18:52 - 2016-05-12 08:05 - 00297984 _____ (Microsoft Corporation) C:\windows\system32\bcryptprimitives.dll
    2016-11-25 18:52 - 2016-05-12 08:04 - 00249352 _____ (Microsoft Corporation) C:\windows\SysWOW64\bcryptprimitives.dll
    2016-11-25 18:52 - 2016-02-12 13:52 - 03169792 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
    2016-11-25 18:52 - 2016-02-12 13:52 - 00192512 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
    2016-11-25 18:52 - 2016-02-12 13:52 - 00098816 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
    2016-11-25 18:52 - 2016-02-12 13:44 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll
    2016-11-25 18:52 - 2016-02-12 13:39 - 00174080 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
    2016-11-25 18:52 - 2016-02-12 13:22 - 02610688 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
    2016-11-25 18:52 - 2016-02-12 13:19 - 00709120 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
    2016-11-25 18:52 - 2016-02-12 13:18 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
    2016-11-25 18:52 - 2016-02-12 13:18 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
    2016-11-25 18:52 - 2016-02-12 13:18 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
    2016-11-25 18:52 - 2016-02-12 13:18 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
    2016-11-25 18:52 - 2016-02-12 13:18 - 00012288 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll
    2016-11-25 18:52 - 2016-02-12 13:06 - 00573440 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
    2016-11-25 18:52 - 2016-02-12 13:05 - 00093696 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
    2016-11-25 18:52 - 2016-02-12 13:05 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
    2016-11-25 18:52 - 2016-02-12 13:05 - 00030208 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll
    2016-11-25 18:52 - 2016-01-20 19:51 - 00073664 _____ (Microsoft Corporation) C:\windows\system32\Drivers\disk.sys
    2016-11-25 18:52 - 2015-11-19 09:07 - 00994760 _____ (Microsoft Corporation) C:\windows\system32\ucrtbase.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00063840 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-private-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00020832 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-math-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00019808 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00017760 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-string-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00017760 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00016224 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00015712 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-convert-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00014176 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-time-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00014176 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-2-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00013664 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00012640 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-process-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00012640 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-heap-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00012640 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-conio-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00012128 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-utility-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00012128 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-locale-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00012128 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-environment-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00012128 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00012128 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00011616 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l2-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00011616 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-core-timezone-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00011616 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l2-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:07 - 00011616 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-2-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00922432 _____ (Microsoft Corporation) C:\windows\SysWOW64\ucrtbase.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00066400 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00022368 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00019808 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00017760 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00017760 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00016224 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00015712 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00014176 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00014176 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00013664 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00012640 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00012640 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00012640 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00012128 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00012128 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00012128 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00012128 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00012128 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00011616 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00011616 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00011616 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll
    2016-11-25 18:52 - 2015-11-19 09:06 - 00011616 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll
    2016-11-25 18:51 - 2016-04-09 02:01 - 00986344 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgkrnl.sys
    2016-11-25 18:51 - 2016-04-09 02:01 - 00264936 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgmms1.sys
    2016-11-25 18:51 - 2016-04-09 01:57 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\cdd.dll
    2016-11-25 18:51 - 2016-03-15 19:16 - 00760320 _____ (Microsoft Corporation) C:\windows\system32\samsrv.dll
    2016-11-25 18:51 - 2016-03-15 19:16 - 00106496 _____ (Microsoft Corporation) C:\windows\system32\samlib.dll
    2016-11-25 18:51 - 2016-03-15 18:53 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\samlib.dll
    2016-11-25 18:51 - 2016-02-05 13:56 - 00020480 _____ (Microsoft Corporation) C:\windows\system32\tbs.dll
    2016-11-25 18:51 - 2016-02-05 13:54 - 00109568 _____ (Microsoft Corporation) C:\windows\system32\fveapibase.dll
    2016-11-25 18:51 - 2016-02-05 12:33 - 00015360 _____ (Microsoft Corporation) C:\windows\SysWOW64\tbs.dll
    2016-11-25 18:51 - 2016-02-04 20:19 - 00381440 _____ (Microsoft Corporation) C:\windows\system32\mfds.dll
    2016-11-25 18:51 - 2016-02-04 13:41 - 00296448 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfds.dll
    2016-11-25 18:51 - 2016-02-03 13:58 - 00862208 _____ (Microsoft Corporation) C:\windows\system32\oleaut32.dll
    2016-11-25 18:51 - 2016-02-03 13:52 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\asycfilt.dll
    2016-11-25 18:51 - 2016-02-03 13:49 - 00572416 _____ (Microsoft Corporation) C:\windows\SysWOW64\oleaut32.dll
    2016-11-25 18:51 - 2016-02-03 13:43 - 00067584 _____ (Microsoft Corporation) C:\windows\SysWOW64\asycfilt.dll
    2016-11-25 18:51 - 2016-02-03 13:07 - 00091648 _____ (Microsoft Corporation) C:\windows\system32\Drivers\USBSTOR.SYS
    2016-11-25 18:51 - 2016-01-11 14:11 - 01684416 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ntfs.sys
    2016-11-25 18:51 - 2016-01-07 12:42 - 00141312 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxdav.sys
    2016-11-25 18:51 - 2015-11-05 14:05 - 00017408 _____ (Microsoft Corporation) C:\windows\system32\wshrm.dll
    2016-11-25 18:51 - 2015-11-05 14:02 - 00014848 _____ (Microsoft Corporation) C:\windows\SysWOW64\wshrm.dll
    2016-11-25 18:51 - 2015-11-05 04:53 - 00146944 _____ (Microsoft Corporation) C:\windows\system32\Drivers\rmcast.sys
    2016-11-25 18:51 - 2015-06-03 15:21 - 00451080 _____ (Microsoft Corporation) C:\windows\system32\fveapi.dll
    2016-11-25 18:50 - 2016-05-13 17:15 - 00382184 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll
    2016-11-25 18:50 - 2016-05-13 17:09 - 00100864 _____ (Microsoft Corporation) C:\windows\system32\fontsub.dll
    2016-11-25 18:50 - 2016-05-13 17:09 - 00046080 _____ (Adobe Systems) C:\windows\system32\atmlib.dll
    2016-11-25 18:50 - 2016-05-13 17:09 - 00041472 _____ (Microsoft Corporation) C:\windows\system32\lpk.dll
    2016-11-25 18:50 - 2016-05-13 17:09 - 00014336 _____ (Microsoft Corporation) C:\windows\system32\dciman32.dll
    2016-11-25 18:50 - 2016-05-13 16:54 - 00308456 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\atmfd.dll
    2016-11-25 18:50 - 2016-05-13 16:50 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\lpk.dll
    2016-11-25 18:50 - 2016-05-13 16:49 - 00070656 _____ (Microsoft Corporation) C:\windows\SysWOW64\fontsub.dll
    2016-11-25 18:50 - 2016-05-13 16:49 - 00010240 _____ (Microsoft Corporation) C:\windows\SysWOW64\dciman32.dll
    2016-11-25 18:50 - 2016-05-13 16:27 - 00034304 _____ (Adobe Systems) C:\windows\SysWOW64\atmlib.dll
    2016-11-25 18:50 - 2016-05-12 10:03 - 03217408 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
    2016-11-25 18:50 - 2016-05-11 12:02 - 00483840 _____ (Microsoft Corporation) C:\windows\system32\StructuredQuery.dll
    2016-11-25 18:50 - 2016-05-11 10:19 - 00363520 _____ (Microsoft Corporation) C:\windows\SysWOW64\StructuredQuery.dll
    2016-11-25 18:50 - 2016-04-14 08:49 - 00603648 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3d10level9.dll
    2016-11-25 18:50 - 2016-04-14 08:21 - 00647680 _____ (Microsoft Corporation) C:\windows\system32\d3d10level9.dll
    2016-11-25 18:50 - 2015-12-11 13:57 - 01164800 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
    2016-11-25 18:50 - 2015-12-08 16:54 - 02285056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msmpeg2vdec.dll
    2016-11-25 18:50 - 2015-12-08 16:54 - 01620992 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
    2016-11-25 18:50 - 2015-12-08 16:54 - 01568768 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVENCOD.DLL
    2016-11-25 18:50 - 2015-12-08 16:54 - 01325056 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMSPDMOE.DLL
    2016-11-25 18:50 - 2015-12-08 16:54 - 00902144 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMADMOD.DLL
    2016-11-25 18:50 - 2015-12-08 16:54 - 00815616 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMADMOE.DLL
    2016-11-25 18:50 - 2015-12-08 16:54 - 00740352 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmpmde.dll
    2016-11-25 18:50 - 2015-12-08 16:54 - 00739328 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMSPDMOD.DLL
    2016-11-25 18:50 - 2015-12-08 16:54 - 00665088 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVXENCD.DLL
    2016-11-25 18:50 - 2015-12-08 16:54 - 00541184 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVSDECD.DLL
    2016-11-25 18:50 - 2015-12-08 16:54 - 00358400 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVSENCD.DLL
    2016-11-25 18:50 - 2015-12-08 16:54 - 00154112 _____ (Microsoft Corporation) C:\windows\SysWOW64\VIDRESZR.DLL
    2016-11-25 18:50 - 2015-12-08 16:53 - 03209728 _____ (Microsoft Corporation) C:\windows\SysWOW64\mf.dll
    2016-11-25 18:50 - 2015-12-08 16:53 - 01329664 _____ (Microsoft Corporation) C:\windows\SysWOW64\quartz.dll
    2016-11-25 18:50 - 2015-12-08 16:53 - 00970240 _____ (Microsoft Corporation) C:\windows\SysWOW64\msmpeg2adec.dll
    2016-11-25 18:50 - 2015-12-08 16:53 - 00829952 _____ (Microsoft Corporation) C:\windows\SysWOW64\MSMPEG2ENC.DLL
    2016-11-25 18:50 - 2015-12-08 16:53 - 00609280 _____ (Microsoft Corporation) C:\windows\SysWOW64\MFWMAAEC.DLL
    2016-11-25 18:50 - 2015-12-08 16:53 - 00519680 _____ (Microsoft Corporation) C:\windows\SysWOW64\qdvd.dll
    2016-11-25 18:50 - 2015-12-08 16:53 - 00509952 _____ (Microsoft Corporation) C:\windows\SysWOW64\qedit.dll
    2016-11-25 18:50 - 2015-12-08 16:53 - 00489984 _____ (Microsoft Corporation) C:\windows\SysWOW64\evr.dll
    2016-11-25 18:50 - 2015-12-08 16:53 - 00415744 _____ (Microsoft Corporation) C:\windows\SysWOW64\MP4SDECD.DLL
    2016-11-25 18:50 - 2015-12-08 16:53 - 00354816 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfplat.dll
    2016-11-25 18:50 - 2015-12-08 16:53 - 00241152 _____ (Microsoft Corporation) C:\windows\SysWOW64\MPG4DECD.DLL
    2016-11-25 18:50 - 2015-12-08 16:53 - 00241152 _____ (Microsoft Corporation) C:\windows\SysWOW64\MP43DECD.DLL
    2016-11-25 18:50 - 2015-12-08 16:53 - 00206848 _____ (Microsoft Corporation) C:\windows\SysWOW64\RESAMPLEDMO.DLL
    2016-11-25 18:50 - 2015-12-08 16:53 - 00206848 _____ (Microsoft Corporation) C:\windows\SysWOW64\qasf.dll
    2016-11-25 18:50 - 2015-12-08 16:53 - 00193536 _____ (Microsoft Corporation) C:\windows\SysWOW64\ksproxy.ax
    2016-11-25 18:50 - 2015-12-08 16:53 - 00153600 _____ (Microsoft Corporation) C:\windows\SysWOW64\COLORCNV.DLL
    2016-11-25 18:50 - 2015-12-08 16:53 - 00103424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfps.dll
    2016-11-25 18:50 - 2015-12-08 16:53 - 00079872 _____ (Microsoft Corporation) C:\windows\SysWOW64\MP3DMOD.DLL
    2016-11-25 18:50 - 2015-12-08 16:53 - 00067584 _____ (Microsoft Corporation) C:\windows\SysWOW64\devenum.dll
    2016-11-25 18:50 - 2015-12-08 16:53 - 00053248 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfvdsp.dll
    2016-11-25 18:50 - 2015-12-08 16:53 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\rrinstaller.exe
    2016-11-25 18:50 - 2015-12-08 16:53 - 00023040 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfpmp.exe
    2016-11-25 18:50 - 2015-12-08 16:53 - 00004608 _____ (Microsoft Corporation) C:\windows\SysWOW64\ksuser.dll
    2016-11-25 18:50 - 2015-12-08 16:50 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\mferror.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 04121600 _____ (Microsoft Corporation) C:\windows\system32\mf.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 02777088 _____ (Microsoft Corporation) C:\windows\system32\msmpeg2vdec.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 01955328 _____ (Microsoft Corporation) C:\windows\system32\WMVENCOD.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 01888768 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 01575424 _____ (Microsoft Corporation) C:\windows\system32\WMSPDMOE.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 01573888 _____ (Microsoft Corporation) C:\windows\system32\quartz.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 01307136 _____ (Microsoft Corporation) C:\windows\system32\msmpeg2adec.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 01232896 _____ (Microsoft Corporation) C:\windows\system32\WMADMOD.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 01160192 _____ (Microsoft Corporation) C:\windows\system32\MSMPEG2ENC.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 01153024 _____ (Microsoft Corporation) C:\windows\system32\WMADMOE.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 01026048 _____ (Microsoft Corporation) C:\windows\system32\wmpmde.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 01010688 _____ (Microsoft Corporation) C:\windows\system32\mcmde.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 00978944 _____ (Microsoft Corporation) C:\windows\system32\WMSPDMOD.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00666112 _____ (Microsoft Corporation) C:\windows\system32\WMVSDECD.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00653824 _____ (Microsoft Corporation) C:\windows\system32\MP4SDECD.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00642048 _____ (Microsoft Corporation) C:\windows\system32\WMVXENCD.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00632320 _____ (Microsoft Corporation) C:\windows\system32\evr.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 00624640 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 00484864 _____ (Microsoft Corporation) C:\windows\system32\MFWMAAEC.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00447488 _____ (Microsoft Corporation) C:\windows\system32\WMVSENCD.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00432128 _____ (Microsoft Corporation) C:\windows\system32\mfplat.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 00378880 _____ (Microsoft Corporation) C:\windows\system32\SysFxUI.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 00371712 _____ (Microsoft Corporation) C:\windows\system32\qdvd.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 00292352 _____ (Microsoft Corporation) C:\windows\system32\VIDRESZR.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00254464 _____ (Microsoft Corporation) C:\windows\system32\qasf.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 00225792 _____ (Microsoft Corporation) C:\windows\system32\RESAMPLEDMO.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00224768 _____ (Microsoft Corporation) C:\windows\system32\MPG4DECD.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00223744 _____ (Microsoft Corporation) C:\windows\system32\MP43DECD.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00206848 _____ (Microsoft Corporation) C:\windows\system32\mfps.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 00189952 _____ (Microsoft Corporation) C:\windows\system32\COLORCNV.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00100864 _____ (Microsoft Corporation) C:\windows\system32\MP3DMOD.DLL
    2016-11-25 18:50 - 2015-12-08 14:07 - 00076288 _____ (Microsoft Corporation) C:\windows\system32\devenum.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 00070144 _____ (Microsoft Corporation) C:\windows\system32\mfvdsp.dll
    2016-11-25 18:50 - 2015-12-08 14:07 - 00055808 _____ (Microsoft Corporation) C:\windows\system32\rrinstaller.exe
    2016-11-25 18:50 - 2015-12-08 14:07 - 00005120 _____ (Microsoft Corporation) C:\windows\system32\ksuser.dll
    2016-11-25 18:50 - 2015-12-08 14:06 - 00250880 _____ (Microsoft Corporation) C:\windows\system32\ksproxy.ax
    2016-11-25 18:50 - 2015-12-08 14:06 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\mfpmp.exe
    2016-11-25 18:50 - 2015-12-08 14:04 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\mferror.dll
    2016-11-25 18:50 - 2015-12-08 13:54 - 00116736 _____ (Microsoft Corporation) C:\windows\system32\Drivers\drmk.sys
    2016-11-25 18:50 - 2015-12-08 13:12 - 00230400 _____ (Microsoft Corporation) C:\windows\system32\Drivers\portcls.sys
    2016-11-25 18:50 - 2015-12-08 13:11 - 00005632 _____ (Microsoft Corporation) C:\windows\system32\Drivers\drmkaud.sys
    2016-11-25 18:50 - 2015-11-16 15:17 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
    2016-11-25 18:49 - 2016-05-11 12:02 - 00444928 _____ (Microsoft Corporation) C:\windows\system32\winhttp.dll
    2016-11-25 18:49 - 2016-05-11 12:02 - 00327168 _____ (Microsoft Corporation) C:\windows\system32\mswsock.dll
    2016-11-25 18:49 - 2016-05-11 12:02 - 00296448 _____ (Microsoft Corporation) C:\windows\system32\ws2_32.dll
    2016-11-25 18:49 - 2016-05-11 10:19 - 00351744 _____ (Microsoft Corporation) C:\windows\SysWOW64\winhttp.dll
    2016-11-25 18:49 - 2016-05-11 10:19 - 00231424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mswsock.dll
    2016-11-25 18:49 - 2016-05-11 10:19 - 00206336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ws2_32.dll
    2016-11-25 18:49 - 2016-05-11 10:11 - 00025088 _____ (Microsoft Corporation) C:\windows\system32\netbtugc.exe
    2016-11-25 18:49 - 2016-05-11 10:01 - 00026624 _____ (Microsoft Corporation) C:\windows\SysWOW64\netbtugc.exe
    2016-11-25 18:49 - 2016-05-11 09:58 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netbt.sys
    2016-11-25 18:48 - 2016-01-22 01:18 - 00961024 _____ (Microsoft Corporation) C:\windows\system32\CPFilters.dll
    2016-11-25 18:48 - 2016-01-22 01:18 - 00723968 _____ (Microsoft Corporation) C:\windows\system32\EncDec.dll
    2016-11-25 18:48 - 2016-01-22 01:04 - 00642048 _____ (Microsoft Corporation) C:\windows\SysWOW64\CPFilters.dll
    2016-11-25 18:48 - 2016-01-22 01:04 - 00535040 _____ (Microsoft Corporation) C:\windows\SysWOW64\EncDec.dll
    2016-11-25 18:46 - 2016-05-18 11:10 - 00312832 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
    2016-11-25 18:46 - 2016-05-18 11:09 - 00405504 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
    2016-11-25 18:46 - 2016-05-12 12:15 - 00105472 _____ (Microsoft Corporation) C:\windows\system32\winipsec.dll
    2016-11-25 18:46 - 2016-05-12 12:14 - 00794624 _____ (Microsoft Corporation) C:\windows\system32\gpsvc.dll
    2016-11-25 18:46 - 2016-05-12 12:14 - 00502272 _____ (Microsoft Corporation) C:\windows\system32\IPSECSVC.DLL
    2016-11-25 18:46 - 2016-05-12 12:14 - 00373760 _____ (Microsoft Corporation) C:\windows\system32\polstore.dll
    2016-11-25 18:46 - 2016-05-12 12:14 - 00096256 _____ (Microsoft Corporation) C:\windows\system32\gpapi.dll
    2016-11-25 18:46 - 2016-05-12 12:14 - 00075776 _____ (Microsoft Corporation) C:\windows\system32\FwRemoteSvr.dll
    2016-11-25 18:46 - 2016-05-12 10:18 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\polstore.dll
    2016-11-25 18:46 - 2016-05-12 10:18 - 00079360 _____ (Microsoft Corporation) C:\windows\SysWOW64\gpapi.dll
    2016-11-25 18:46 - 2016-05-12 10:18 - 00070144 _____ (Microsoft Corporation) C:\windows\SysWOW64\winipsec.dll
    2016-11-25 18:46 - 2016-05-12 10:18 - 00044032 _____ (Microsoft Corporation) C:\windows\SysWOW64\FwRemoteSvr.dll
    2016-11-25 18:46 - 2016-04-06 10:27 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\jnwmon.dll
    2016-11-25 18:46 - 2016-03-09 13:54 - 00275456 _____ (Microsoft Corporation) C:\windows\system32\InkEd.dll
    2016-11-25 18:46 - 2016-03-09 13:34 - 00216064 _____ (Microsoft Corporation) C:\windows\SysWOW64\InkEd.dll
    2016-11-25 18:46 - 2016-02-09 04:57 - 14634496 _____ (Microsoft Corporation) C:\windows\system32\wmp.dll
    2016-11-25 18:46 - 2016-02-09 04:57 - 12625920 _____ (Microsoft Corporation) C:\windows\system32\wmploc.DLL
    2016-11-25 18:46 - 2016-02-09 04:56 - 00005120 _____ (Microsoft Corporation) C:\windows\system32\msdxm.ocx
    2016-11-25 18:46 - 2016-02-09 04:56 - 00005120 _____ (Microsoft Corporation) C:\windows\system32\dxmasf.dll
    2016-11-25 18:46 - 2016-02-09 04:54 - 00009728 _____ (Microsoft Corporation) C:\windows\system32\spwmp.dll
    2016-11-25 18:46 - 2016-02-09 04:51 - 12625408 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmploc.DLL
    2016-11-25 18:46 - 2016-02-09 04:51 - 11411456 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmp.dll
    2016-11-25 18:46 - 2016-02-09 04:13 - 00008192 _____ (Microsoft Corporation) C:\windows\SysWOW64\spwmp.dll
    2016-11-25 18:46 - 2016-02-09 04:13 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\msdxm.ocx
    2016-11-25 18:46 - 2016-02-09 04:13 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxmasf.dll
    2016-11-25 18:45 - 2016-04-09 02:02 - 00631176 _____ (Microsoft Corporation) C:\windows\system32\winresume.efi
    2016-11-25 18:45 - 2016-04-09 02:01 - 05546216 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
    2016-11-25 18:45 - 2016-04-09 02:01 - 00706280 _____ (Microsoft Corporation) C:\windows\system32\winload.efi
    2016-11-25 18:45 - 2016-04-09 01:59 - 03998952 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
    2016-11-25 18:45 - 2016-04-09 01:59 - 03943144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
    2016-11-25 18:45 - 2016-04-09 01:59 - 01732864 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
    2016-11-25 18:45 - 2016-04-09 01:58 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
    2016-11-25 18:45 - 2016-04-09 01:58 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll
    2016-11-25 18:45 - 2016-04-09 01:58 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
    2016-11-25 18:45 - 2016-04-09 01:58 - 00215552 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll
    2016-11-25 18:45 - 2016-04-09 01:58 - 00063488 _____ (Microsoft Corporation) C:\windows\system32\setbcdlocale.dll
    2016-11-25 18:45 - 2016-04-09 01:58 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
    2016-11-25 18:45 - 2016-04-09 01:58 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 01314112 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 01163264 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00880640 _____ (Microsoft Corporation) C:\windows\system32\advapi32.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00419840 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00059904 _____ (Microsoft Corporation) C:\windows\system32\appidapi.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00034816 _____ (Microsoft Corporation) C:\windows\system32\appidsvc.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:57 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00644096 _____ (Microsoft Corporation) C:\windows\SysWOW64\advapi32.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00275456 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00050688 _____ (Microsoft Corporation) C:\windows\SysWOW64\appidapi.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 01:54 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 00:52 - 00148480 _____ (Microsoft Corporation) C:\windows\system32\appidpolicyconverter.exe
    2016-11-25 18:45 - 2016-04-09 00:52 - 00062464 _____ (Microsoft Corporation) C:\windows\system32\Drivers\appid.sys
    2016-11-25 18:45 - 2016-04-09 00:52 - 00017920 _____ (Microsoft Corporation) C:\windows\system32\appidcertstorecheck.exe
    2016-11-25 18:45 - 2016-04-09 00:48 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
    2016-11-25 18:45 - 2016-04-09 00:47 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
    2016-11-25 18:45 - 2016-04-09 00:43 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
    2016-11-25 18:45 - 2016-04-09 00:38 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
    2016-11-25 18:45 - 2016-04-09 00:38 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
    2016-11-25 18:45 - 2016-04-09 00:38 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
    2016-11-25 18:45 - 2016-04-09 00:38 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
    2016-11-25 18:45 - 2016-04-09 00:37 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 00:37 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 00:37 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
    2016-11-25 18:45 - 2016-04-09 00:37 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
    2016-11-25 18:44 - 2016-04-14 11:46 - 00114408 _____ (Microsoft Corporation) C:\windows\system32\consent.exe
    2016-11-25 18:44 - 2016-04-14 11:42 - 03243520 _____ (Microsoft Corporation) C:\windows\system32\msi.dll
    2016-11-25 18:44 - 2016-04-14 11:42 - 01941504 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
    2016-11-25 18:44 - 2016-04-14 11:42 - 00504320 _____ (Microsoft Corporation) C:\windows\system32\msihnd.dll
    2016-11-25 18:44 - 2016-04-14 11:42 - 00070144 _____ (Microsoft Corporation) C:\windows\system32\appinfo.dll
    2016-11-25 18:44 - 2016-04-14 11:42 - 00025088 _____ (Microsoft Corporation) C:\windows\system32\msimsg.dll
    2016-11-25 18:44 - 2016-04-14 10:33 - 02365440 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll
    2016-11-25 18:44 - 2016-04-14 10:33 - 01806848 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
    2016-11-25 18:44 - 2016-04-14 10:33 - 00337408 _____ (Microsoft Corporation) C:\windows\SysWOW64\msihnd.dll
    2016-11-25 18:44 - 2016-04-14 10:33 - 00025088 _____ (Microsoft Corporation) C:\windows\SysWOW64\msimsg.dll
    2016-11-25 18:44 - 2016-04-14 10:19 - 00128000 _____ (Microsoft Corporation) C:\windows\system32\msiexec.exe
    2016-11-25 18:44 - 2016-04-14 10:11 - 00073216 _____ (Microsoft Corporation) C:\windows\SysWOW64\msiexec.exe
    2016-11-25 18:31 - 2016-05-23 18:37 - 00394960 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
    2016-11-25 18:31 - 2016-05-23 17:54 - 00346312 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
    2016-11-25 18:31 - 2016-05-21 12:28 - 25802752 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
    2016-11-25 18:31 - 2016-05-21 11:57 - 20341248 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
    2016-11-25 18:31 - 2016-05-20 17:27 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
    2016-11-25 18:31 - 2016-05-20 17:27 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
    2016-11-25 18:31 - 2016-05-20 17:14 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
    2016-11-25 18:31 - 2016-05-20 17:10 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
    2016-11-25 18:31 - 2016-05-20 17:09 - 00572416 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
    2016-11-25 18:31 - 2016-05-20 17:09 - 00417792 _____ (Microsoft Corporation) C:\windows\system32\html.iec
    2016-11-25 18:31 - 2016-05-20 17:09 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
    2016-11-25 18:31 - 2016-05-20 17:08 - 02895360 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
    2016-11-25 18:31 - 2016-05-20 17:08 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
    2016-11-25 18:31 - 2016-05-20 17:02 - 06051328 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
    2016-11-25 18:31 - 2016-05-20 17:00 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
    2016-11-25 18:31 - 2016-05-20 16:59 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
    2016-11-25 18:31 - 2016-05-20 16:57 - 00497664 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
    2016-11-25 18:31 - 2016-05-20 16:57 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
    2016-11-25 18:31 - 2016-05-20 16:57 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
    2016-11-25 18:31 - 2016-05-20 16:56 - 00615936 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
    2016-11-25 18:31 - 2016-05-20 16:56 - 00341504 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
    2016-11-25 18:31 - 2016-05-20 16:55 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
    2016-11-25 18:31 - 2016-05-20 16:54 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
    2016-11-25 18:31 - 2016-05-20 16:54 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
    2016-11-25 18:31 - 2016-05-20 16:54 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
     
    BillB,
    #23
  5. 2016/12/12
    BillB Lifetime Subscription

    BillB Well-Known Member Thread Starter

    Joined:
    2003/03/18
    Messages:
    750
    Likes Received:
    0
    2016-11-25 18:31 - 2016-05-20 16:50 - 02287104 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
    2016-11-25 18:31 - 2016-05-20 16:49 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
    2016-11-25 18:31 - 2016-05-20 16:48 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
    2016-11-25 18:31 - 2016-05-20 16:45 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
    2016-11-25 18:31 - 2016-05-20 16:45 - 00476160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
    2016-11-25 18:31 - 2016-05-20 16:44 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
    2016-11-25 18:31 - 2016-05-20 16:44 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
    2016-11-25 18:31 - 2016-05-20 16:43 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
    2016-11-25 18:31 - 2016-05-20 16:41 - 00489984 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
    2016-11-25 18:31 - 2016-05-20 16:33 - 00416256 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
    2016-11-25 18:31 - 2016-05-20 16:33 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
    2016-11-25 18:31 - 2016-05-20 16:32 - 00107520 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll
    2016-11-25 18:31 - 2016-05-20 16:29 - 13815808 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
    2016-11-25 18:31 - 2016-05-20 16:28 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
    2016-11-25 18:31 - 2016-05-20 16:27 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
    2016-11-25 18:31 - 2016-05-20 16:27 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
    2016-11-25 18:31 - 2016-05-20 16:26 - 00091136 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll
    2016-11-25 18:31 - 2016-05-20 16:25 - 00315392 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
    2016-11-25 18:31 - 2016-05-20 16:23 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
    2016-11-25 18:31 - 2016-05-20 16:23 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
    2016-11-25 18:31 - 2016-05-20 16:22 - 00152064 _____ (Microsoft Corporation) C:\windows\system32\occache.dll
    2016-11-25 18:31 - 2016-05-20 16:21 - 00279040 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
    2016-11-25 18:31 - 2016-05-20 16:19 - 00130048 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll
    2016-11-25 18:31 - 2016-05-20 16:14 - 04610048 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
    2016-11-25 18:31 - 2016-05-20 16:12 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
    2016-11-25 18:31 - 2016-05-20 16:11 - 15420928 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
    2016-11-25 18:31 - 2016-05-20 16:11 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
    2016-11-25 18:31 - 2016-05-20 16:09 - 00725504 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
    2016-11-25 18:31 - 2016-05-20 16:09 - 00693248 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
    2016-11-25 18:31 - 2016-05-20 16:08 - 02055680 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
    2016-11-25 18:31 - 2016-05-20 16:08 - 00806400 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
    2016-11-25 18:31 - 2016-05-20 16:07 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
    2016-11-25 18:31 - 2016-05-20 16:07 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
    2016-11-25 18:31 - 2016-05-20 16:06 - 02131968 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
    2016-11-25 18:31 - 2016-05-20 15:46 - 02597888 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
    2016-11-25 18:31 - 2016-05-20 15:42 - 02121216 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
    2016-11-25 18:31 - 2016-05-20 15:38 - 01310208 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
    2016-11-25 18:31 - 2016-05-20 15:38 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
    2016-11-25 18:31 - 2016-05-20 15:34 - 01544192 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
    2016-11-25 18:31 - 2016-05-20 15:23 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
    2016-11-24 16:39 - 2016-12-09 15:17 - 00192216 _____ (Malwarebytes) C:\windows\system32\Drivers\MBAMSwissArmy.sys
    2016-11-24 16:39 - 2016-11-24 16:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
    2016-11-24 16:38 - 2016-11-24 16:39 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
    2016-11-24 16:38 - 2016-03-10 14:09 - 00064896 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
    2016-11-24 16:38 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\windows\system32\Drivers\mbamchameleon.sys
    2016-11-24 16:34 - 2016-11-24 16:34 - 00004476 _____ C:\windows\System32\Tasks\Adobe Acrobat Update Task
    2016-11-24 13:54 - 2016-11-24 17:54 - 00002109 _____ C:\Users\Public\Desktop\Google Earth.lnk
    2016-11-24 13:54 - 2016-11-24 13:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2016-12-12 11:14 - 2009-07-13 23:45 - 00018736 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2016-12-12 11:14 - 2009-07-13 23:45 - 00018736 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2016-12-12 11:09 - 2015-06-30 11:52 - 00000938 _____ C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-4153870025-4142338956-1366997006-1000UA.job
    2016-12-12 11:07 - 2014-04-16 17:23 - 00000000 ___RD C:\Users\graymassie\Dropbox
    2016-12-12 11:05 - 2013-10-03 08:16 - 00004182 _____ C:\windows\System32\Tasks\avast! Emergency Update
    2016-12-12 11:02 - 2016-05-12 10:40 - 00000894 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    2016-12-12 11:02 - 2009-07-14 00:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
    2016-12-11 16:43 - 2009-07-14 00:09 - 00000000 ____D C:\windows\System32\Tasks\WPD
    2016-12-11 16:39 - 2010-02-16 20:16 - 00000898 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    2016-12-11 16:37 - 2009-07-13 21:34 - 00000215 _____ C:\windows\system.ini
    2016-12-11 16:33 - 2011-05-02 10:43 - 00000000 ____D C:\Users\graymassie\AppData\Local\CrashDumps
    2016-12-11 16:31 - 2012-08-05 00:24 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
    2016-12-08 15:09 - 2015-06-30 11:52 - 00000886 _____ C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-4153870025-4142338956-1366997006-1000Core.job
    2016-12-04 10:41 - 2014-04-08 18:37 - 00000000 ____D C:\Users\graymassie\AppData\Roaming\Dropbox
    2016-12-02 15:17 - 2009-07-14 00:13 - 00006206 _____ C:\windows\system32\PerfStringBackup.INI
    2016-12-02 15:04 - 2015-06-30 11:52 - 00003918 _____ C:\windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4153870025-4142338956-1366997006-1000UA
    2016-12-02 15:04 - 2015-06-30 11:52 - 00003522 _____ C:\windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-4153870025-4142338956-1366997006-1000Core
    2016-11-25 23:05 - 2009-07-13 23:45 - 00416792 _____ C:\windows\system32\FNTCACHE.DAT
    2016-11-25 23:02 - 2009-07-13 22:20 - 00000000 ____D C:\windows\inf
    2016-11-25 23:01 - 2009-07-14 02:45 - 00000000 ____D C:\Program Files\Windows Journal
    2016-11-25 22:58 - 2013-03-15 09:23 - 00000000 ____D C:\Program Files\Microsoft Silverlight
    2016-11-25 22:58 - 2013-03-15 09:23 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
    2016-11-25 22:18 - 2013-03-15 09:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
    2016-11-25 15:31 - 2012-08-05 00:24 - 00796352 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
    2016-11-25 15:31 - 2012-08-05 00:24 - 00003768 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
    2016-11-25 15:31 - 2012-02-22 11:25 - 00000000 ____D C:\windows\system32\Macromed
    2016-11-25 15:31 - 2012-01-17 10:33 - 00142528 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
    2016-11-25 15:31 - 2009-11-11 21:00 - 00000000 ____D C:\windows\SysWOW64\Macromed
    2016-11-25 09:51 - 2013-04-04 20:35 - 00002166 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
    2016-11-25 09:51 - 2013-04-04 20:35 - 00002154 _____ C:\Users\Public\Desktop\Google Chrome.lnk
    2016-11-24 17:54 - 2015-05-28 14:58 - 00001718 _____ C:\Users\Public\Desktop\iTunes.lnk
    2016-11-24 17:54 - 2015-05-28 14:44 - 00001810 _____ C:\Users\Public\Desktop\QuickTime Player.lnk
    2016-11-24 17:54 - 2015-01-22 22:35 - 00001122 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
    2016-11-24 17:54 - 2015-01-22 22:35 - 00001116 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
    2016-11-24 17:54 - 2014-11-28 15:27 - 00002031 _____ C:\Users\Public\Desktop\Avast SafeZone.lnk
    2016-11-24 17:54 - 2014-11-28 15:27 - 00001971 _____ C:\Users\Public\Desktop\Avast Pro Antivirus.lnk
    2016-11-24 17:54 - 2014-05-18 12:35 - 00001571 _____ C:\Users\Public\Desktop\Launch PERRLA.lnk
    2016-11-24 17:54 - 2013-12-03 08:23 - 00002033 _____ C:\Users\Public\Desktop\Cisco NAC Agent.lnk
    2016-11-24 17:54 - 2013-10-02 20:08 - 00001857 _____ C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
    2016-11-24 17:54 - 2013-10-02 11:28 - 00001071 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    2016-11-24 17:54 - 2013-10-02 10:52 - 00000871 _____ C:\Users\Public\Desktop\CCleaner.lnk
    2016-11-24 17:54 - 2013-03-02 02:23 - 00002429 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
    2016-11-24 17:54 - 2013-03-02 02:23 - 00001984 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
    2016-11-24 17:54 - 2011-07-09 03:06 - 00002417 _____ C:\Users\Public\Desktop\WildTangent Games App - toshiba.lnk
    2016-11-24 17:54 - 2010-03-11 12:38 - 00002507 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
    2016-11-24 17:54 - 2010-02-16 22:21 - 00001038 _____ C:\Users\Public\Desktop\AOL Desktop 9.6.lnk
    2016-11-24 17:54 - 2009-12-08 09:40 - 00001714 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amazon.com - Shopping.lnk
    2016-11-24 17:54 - 2009-12-08 09:39 - 00001949 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickBooks Financial Center.lnk
    2016-11-24 17:54 - 2009-12-08 08:50 - 00002545 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office PowerPoint Viewer 2007.lnk
    2016-11-24 17:54 - 2009-12-08 08:49 - 00001106 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Works Task Launcher.lnk
    2016-11-24 17:54 - 2009-11-11 20:49 - 00001333 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
    2016-11-24 17:54 - 2009-11-11 20:49 - 00001314 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
    2016-11-24 17:54 - 2009-07-13 23:57 - 00001340 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
    2016-11-24 17:54 - 2009-07-13 23:57 - 00001318 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
    2016-11-24 17:54 - 2009-07-13 23:57 - 00001234 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
    2016-11-24 17:54 - 2009-07-13 23:54 - 00001198 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
    2016-11-24 17:53 - 2015-07-20 10:37 - 00002318 _____ C:\Users\graymassie\Desktop\Chromium.lnk
    2016-11-24 17:53 - 2014-04-16 17:23 - 00001236 _____ C:\Users\graymassie\Desktop\Dropbox.lnk
    2016-11-24 17:53 - 2011-04-05 10:07 - 00001090 _____ C:\ProgramData\Microsoft\Windows\Start Menu\AOL Desktop 9.6.lnk
    2016-11-24 17:53 - 2010-03-06 16:17 - 00001077 _____ C:\Users\graymassie\Desktop\Documents - Shortcut.lnk
    2016-11-24 17:53 - 2010-02-28 18:02 - 00000622 _____ C:\Users\graymassie\Desktop\Solitaire - Shortcut.lnk
    2016-11-24 17:53 - 2010-02-25 16:12 - 00001070 _____ C:\Users\graymassie\Desktop\Pictures - Shortcut.lnk
    2016-11-24 17:53 - 2010-02-25 16:11 - 00001049 _____ C:\Users\graymassie\Desktop\Music - Shortcut.lnk
    2016-11-24 17:53 - 2010-02-24 11:28 - 00000355 _____ C:\Users\graymassie\Desktop\Computer - Shortcut.lnk
    2016-11-24 17:53 - 2010-02-24 11:26 - 00002675 _____ C:\Users\graymassie\Desktop\Microsoft Office Word 2007.lnk
    2016-11-24 17:53 - 2010-02-24 11:26 - 00002637 _____ C:\Users\graymassie\Desktop\Microsoft Office Excel 2007.lnk
    2016-11-24 17:53 - 2010-02-16 22:04 - 00002627 _____ C:\Users\graymassie\Desktop\Microsoft Office PowerPoint 2007.lnk
    2016-11-24 17:53 - 2010-02-16 22:04 - 00002625 _____ C:\Users\graymassie\Desktop\Microsoft Office Access 2007.lnk
    2016-11-24 17:53 - 2010-02-16 22:04 - 00002593 _____ C:\Users\graymassie\Desktop\Microsoft Office Publisher 2007.lnk
    2016-11-24 17:53 - 2010-02-10 18:47 - 00001428 _____ C:\Users\graymassie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
    2016-11-24 17:53 - 2009-11-11 20:49 - 00000360 _____ C:\Users\graymassie\Desktop\Mahjong.lnk
    2016-11-24 17:53 - 2009-07-14 00:01 - 00001282 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
    2016-11-24 17:53 - 2009-07-13 23:57 - 00000378 _____ C:\Users\graymassie\Desktop\Purble Place.lnk
    2016-11-24 17:53 - 2009-07-13 23:49 - 00001266 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
    2016-11-24 17:44 - 2013-04-04 20:32 - 00000258 __RSH C:\Users\graymassie\ntuser.pol
    2016-11-24 17:44 - 2010-02-10 18:45 - 00000000 ____D C:\Users\graymassie
    2016-11-24 16:39 - 2013-09-30 09:19 - 00000000 ____D C:\Users\graymassie\AppData\Roaming\Malwarebytes
    2016-11-24 16:38 - 2013-10-02 11:28 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2016-11-24 16:38 - 2013-09-30 09:19 - 00000000 ____D C:\ProgramData\Malwarebytes
    2016-11-24 15:23 - 2010-02-10 18:57 - 00000000 ____D C:\Users\graymassie\AppData\Local\Google
    2016-11-24 15:05 - 2015-06-29 14:58 - 00000000 ____D C:\Users\graymassie\AppData\Local\Dropbox
    2016-11-24 14:18 - 2013-10-02 20:08 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
    2016-11-24 13:54 - 2009-12-08 09:30 - 00000000 ____D C:\Program Files (x86)\Google

    ==================== Files in the root of some directories =======

    2014-05-05 13:11 - 2014-05-05 13:11 - 0011264 _____ () C:\Users\graymassie\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2013-08-04 19:52 - 2013-08-04 19:52 - 0000093 _____ () C:\ProgramData\SAH_Install.ini

    ==================== Bamital & volsnap ======================

    (There is no automatic fix for files that do not pass verification.)

    C:\windows\system32\winlogon.exe => File is digitally signed
    C:\windows\system32\wininit.exe => File is digitally signed
    C:\windows\SysWOW64\wininit.exe => File is digitally signed
    C:\windows\explorer.exe => File is digitally signed
    C:\windows\SysWOW64\explorer.exe => File is digitally signed
    C:\windows\system32\svchost.exe => File is digitally signed
    C:\windows\SysWOW64\svchost.exe => File is digitally signed
    C:\windows\system32\services.exe => File is digitally signed
    C:\windows\system32\User32.dll => File is digitally signed
    C:\windows\SysWOW64\User32.dll => File is digitally signed
    C:\windows\system32\userinit.exe => File is digitally signed
    C:\windows\SysWOW64\userinit.exe => File is digitally signed
    C:\windows\system32\rpcss.dll => File is digitally signed
    C:\windows\system32\dnsapi.dll => File is digitally signed
    C:\windows\SysWOW64\dnsapi.dll => File is digitally signed
    C:\windows\system32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2014-06-15 19:33

    ==================== End of FRST.txt ============================
     
    BillB,
    #24
  6. 2016/12/12
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Download attached fixlist.txt file and save it to the Desktop.
    NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Run FRST(FRST64) and press the Fix button just once and wait.
    The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
     

    Attached Files:

    broni,
    #25
  7. 2016/12/13
    BillB Lifetime Subscription

    BillB Well-Known Member Thread Starter

    Joined:
    2003/03/18
    Messages:
    750
    Likes Received:
    0
    Fix result of Farbar Recovery Scan Tool (x64) Version: 30-11-2016
    Ran by graymassie (13-12-2016 09:20:52) Run:1
    Running from C:\Users\graymassie\Desktop
    Loaded Profiles: graymassie (Available Profiles: graymassie)
    Boot Mode: Normal
    ==============================================

    fixlist content:
    *****************
    AV: Norton Internet Security (Disabled - Out of date) {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
    AS: Norton Internet Security (Disabled - Up to date) {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
    FW: Norton Internet Security (Disabled) {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}
    DeleteKey: "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{59DB31A9-BCB0-4985-ACA6-F6477C7BE367} "
    Task: {2703C912-476B-452A-AC8B-71AE82D1401E} - System32\Tasks\Symantec\Symantec Error Processor 17.6.0.32 => C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\SymErr.exe [2010-03-26] (Symantec Corporation)
    C:\Program Files (x86)\Norton Internet Security
    Task: {348D7DC0-5E96-4B63-ABAD-5AD0751419DA} - \Dregol fico -> No File <==== ATTENTION
    Task: {DDC658A3-9D5D-4AF5-BC13-777383D89E50} - System32\Tasks\Symantec\Symantec Error Analyzer 17.6.0.32 => C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\SymErr.exe [2010-03-26] (Symantec Corporation)
    AlternateDataStreams: C:\ProgramData\TEMP:D1B5B4F1 [104]
    AlternateDataStreams: C:\ProgramData\TEMP:D346F792 [294]
    MSCONFIG\startupreg: SMessaging => "C:\Users\graymassie\AppData\Local\Strongvault Online Backup\SMessaging.exe "
    (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\ccsvchst.exe
    HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe [529256 2009-08-10] (Toshiba)
    CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
    CHR HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    SearchScopes: HKLM -> {c9ab6446-7efc-47fe-966c-dc54324eff9f} URL =
    BHO-x32: Symantec NCO BHO -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\coIEPlg.dll [2010-03-25] (Symantec Corporation)
    BHO-x32: Symantec Intrusion Prevention -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\IPSBHO.DLL [2010-02-03] (Symantec Corporation)
    BHO-x32: No Name -> {3ef64538-8b54-4573-b48f-4d34b0238ab2} -> No File
    BHO-x32: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File
    Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
    Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
    Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\coIEPlg.dll [2010-03-25] (Symantec Corporation)
    Toolbar: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
    Toolbar: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
    Toolbar: HKU\S-1-5-21-4153870025-4142338956-1366997006-1000 -> No Name - {BA00B7B1-0351-477A-B948-23E3EE5A73D4} - No File
    FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn
    FF Extension: (No Name) - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn [2013-10-01] [not signed]
    FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn
    FF Extension: (No Name) - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn [2013-10-01] [not signed]
    FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\system32\Adobe\Director\np32dsw.dll [No File]
    R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\ccSvcHst.exe [126392 2010-02-25] (Symantec Corporation)
    S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20100211.001\BHDrvx64.sys [676912 2010-02-11] (Symantec Corporation)
    R1 ccHP; C:\windows\system32\drivers\NISx64\1106000.020\ccHPx64.sys [615040 2010-02-25] (Symantec Corporation)
    C:\ProgramData\Norton
    C:\windows\system32\drivers\NISx64\1106000.020\ccHPx64.sys
    R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [475696 2010-02-18] (Symantec Corporation)
    R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100310.001\IDSvia64.sys [466992 2009-10-28] (Symantec Corporation)
    S3 SRTSP; C:\windows\System32\Drivers\NISx64\1106000.020\SRTSP64.SYS [505392 2010-02-26] (Symantec Corporation)
    R1 SRTSPX; C:\windows\system32\drivers\NISx64\1106000.020\SRTSPX64.SYS [32304 2010-02-26] (Symantec Corporation)
    R0 SymDS; C:\windows\System32\drivers\NISx64\1106000.020\SYMDS64.SYS [433200 2009-08-29] (Symantec Corporation)
    R0 SymEFA; C:\windows\System32\drivers\NISx64\1106000.020\SYMEFA64.SYS [221232 2010-02-03] (Symantec Corporation)
    R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [173104 2010-02-18] (Symantec Corporation)
    S1 SymIRON; C:\windows\system32\drivers\NISx64\1106000.020\Ironx64.SYS [149552 2010-02-26] (Symantec Corporation)
    R1 SYMTDIv; C:\windows\System32\Drivers\NISx64\1106000.020\SYMTDIV.SYS [451120 2010-02-03] (Symantec Corporation)
    S3 catchme; \??\C:\ComboFix\catchme.sys [X]
    S3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100311.002\ENG64.SYS [X]
    S3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100311.002\EX64.SYS [X]
    C:\windows\System32\Drivers\NISx64\1106000.020\SRTSP64.SYS
    C:\windows\system32\drivers\NISx64\1106000.020\SRTSPX64.SYS
    C:\windows\System32\drivers\NISx64\1106000.020\SYMDS64.SYS
    C:\windows\System32\drivers\NISx64\1106000.020\SYMEFA64.SYS
    C:\windows\system32\Drivers\SYMEVENT64x86.SYS
    C:\windows\system32\drivers\NISx64\1106000.020\Ironx64.SYS
    C:\windows\System32\Drivers\NISx64\1106000.020\SYMTDIV.SYS
    2014-05-05 13:11 - 2014-05-05 13:11 - 0011264 _____ () C:\Users\graymassie\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2013-08-04 19:52 - 2013-08-04 19:52 - 0000093 _____ () C:\ProgramData\SAH_Install.ini

    *****************

    AV: Norton Internet Security (Disabled - Out of date) {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855} => removed successfully
    AS: Norton Internet Security (Disabled - Up to date) {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8} => removed successfully
    FW: Norton Internet Security (Disabled) {B0F2DB13-C654-2E74-30D4-99C9310F0F2E} => removed successfully
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{59DB31A9-BCB0-4985-ACA6-F6477C7BE367} => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2703C912-476B-452A-AC8B-71AE82D1401E}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2703C912-476B-452A-AC8B-71AE82D1401E}" => key removed successfully
    C:\windows\System32\Tasks\Symantec\Symantec Error Processor 17.6.0.32 => moved successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Symantec\Symantec Error Processor 17.6.0.32" => key removed successfully
    C:\Program Files (x86)\Norton Internet Security => moved successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{348D7DC0-5E96-4B63-ABAD-5AD0751419DA}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{348D7DC0-5E96-4B63-ABAD-5AD0751419DA}" => key removed successfully
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Dregol fico => key not found.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{DDC658A3-9D5D-4AF5-BC13-777383D89E50}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DDC658A3-9D5D-4AF5-BC13-777383D89E50}" => key removed successfully
    C:\windows\System32\Tasks\Symantec\Symantec Error Analyzer 17.6.0.32 => moved successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Symantec\Symantec Error Analyzer 17.6.0.32" => key removed successfully
    C:\ProgramData\TEMP => ":D1B5B4F1" ADS removed successfully.
    C:\ProgramData\TEMP => ":D346F792" ADS removed successfully.
    "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SMessaging" => key removed successfully
    [1776] C:\Program Files (x86)\Norton Internet Security\Engine\17.6.0.32\ccsvchst.exe => process closed successfully.
    HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\NortonOnlineBackupReminder => value removed successfully
    "HKLM\SOFTWARE\Policies\Google" => key removed successfully
    "HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\SOFTWARE\Policies\Google" => key removed successfully
    "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
    "HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{c9ab6446-7efc-47fe-966c-dc54324eff9f}" => key removed successfully
    HKCR\CLSID\{c9ab6446-7efc-47fe-966c-dc54324eff9f} => key not found.
    "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}" => key removed successfully
    "HKCR\Wow6432Node\CLSID\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}" => key removed successfully
    "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}" => key removed successfully
    "HKCR\Wow6432Node\CLSID\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}" => key removed successfully
    "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3ef64538-8b54-4573-b48f-4d34b0238ab2}" => key removed successfully
    HKCR\Wow6432Node\CLSID\{3ef64538-8b54-4573-b48f-4d34b0238ab2} => key not found.
    "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}" => key removed successfully
    HKCR\Wow6432Node\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB} => key not found.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} => value removed successfully
    HKCR\CLSID\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} => key not found.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => value removed successfully
    HKCR\CLSID\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => key not found.
    HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => value removed successfully
    "HKCR\Wow6432Node\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}" => key removed successfully
    HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value removed successfully
    HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => key not found.
    HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => value removed successfully
    HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => key not found.
    HKU\S-1-5-21-4153870025-4142338956-1366997006-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BA00B7B1-0351-477A-B948-23E3EE5A73D4} => value removed successfully
    HKCR\CLSID\{BA00B7B1-0351-477A-B948-23E3EE5A73D4} => key not found.
    HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB} => value removed successfully
    C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn => moved successfully
    HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62} => value removed successfully
    C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn => moved successfully
    "HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer" => key removed successfully
    NIS => service removed successfully
    BHDrvx64 => service removed successfully
    ccHP => Service stopped successfully.
    ccHP => service removed successfully
    C:\ProgramData\Norton => moved successfully
    C:\windows\system32\drivers\NISx64\1106000.020\ccHPx64.sys => moved successfully
    eeCtrl => Service stopped successfully.
    eeCtrl => service removed successfully
    IDSVia64 => Service stopped successfully.
    IDSVia64 => service removed successfully
    SRTSP => service removed successfully
    SRTSPX => Service stopped successfully.
    SRTSPX => service removed successfully
    SymDS => Unable to stop service.
    SymDS => service removed successfully
    SymEFA => Unable to stop service.
    SymEFA => service removed successfully
    SymEvent => Unable to stop service.
    SymEvent => service removed successfully
    SymIRON => service removed successfully
    SYMTDIv => Unable to stop service.
    SYMTDIv => service removed successfully
    catchme => service removed successfully
    NAVENG => service removed successfully
    NAVEX15 => service removed successfully
    C:\windows\System32\Drivers\NISx64\1106000.020\SRTSP64.SYS => moved successfully
    C:\windows\system32\drivers\NISx64\1106000.020\SRTSPX64.SYS => moved successfully
    C:\windows\System32\drivers\NISx64\1106000.020\SYMDS64.SYS => moved successfully
    C:\windows\System32\drivers\NISx64\1106000.020\SYMEFA64.SYS => moved successfully
    C:\windows\system32\Drivers\SYMEVENT64x86.SYS => moved successfully
    C:\windows\system32\drivers\NISx64\1106000.020\Ironx64.SYS => moved successfully
    C:\windows\System32\Drivers\NISx64\1106000.020\SYMTDIV.SYS => moved successfully
    C:\Users\graymassie\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => moved successfully
    C:\ProgramData\SAH_Install.ini => moved successfully


    The system needed a reboot.

    ==== End of Fixlog 09:23:56 ====
     
    BillB,
    #26
  8. 2016/12/13
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Last scans...

    [​IMG] Download Security Check from here or here and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

    NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
    NOTE 2. SecurityCheck may produce some false warning(s), so leave the results reading to me.
    NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run


    [​IMG] Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
    Make sure the following options are checked:
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center
    • Windows Update
    • Windows Defender
    • Other Services

    Press "Scan ".
    It will create a log (FSS.txt) in the same directory the tool is run.
    Please copy and paste the log to your reply.


    [​IMG] Download Temp File Cleaner (TFC)
    Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    [​IMG] Download Sophos Free Virus Removal Tool and save it to your desktop.
    • Double click the icon and select Run
    • Click Next
    • Select I accept the terms in this license agreement, then click Next twice
    • Click Install
    • Click Finish to launch the program
    • Once the virus database has been updated click Start Scanning
    • If any threats are found click Details, then View log file... (bottom left hand corner)
    • Copy and paste the results in your reply
    • Close the Notepad document, close the Threat Details screen, then click Start cleanup
    • Click Exit to close the program
     
    broni,
    #27
  9. 2016/12/14
    BillB Lifetime Subscription

    BillB Well-Known Member Thread Starter

    Joined:
    2003/03/18
    Messages:
    750
    Likes Received:
    0
    Here are the logs requested. TFC stopped working after several minutes, the desktop background was the only thing on the screen, I let it sit for several minutes but there was no hard drive activity at all. I had to power off and on again. The Sophos tool didn't find anything.

    Results of screen317's Security Check version 0.99.93
    Windows 7 Service Pack 1 x64 (UAC is enabled)
    Internet Explorer 11
    ``````````````Antivirus/Firewall Check:``````````````
    Windows Firewall Enabled!
    avast! Antivirus
    Antivirus up to date!
    `````````Anti-malware/Other Utilities Check:`````````
    Java(TM) 6 Update 14
    Java version 32-bit out of Date!
    Adobe Flash Player 24.0.0.186
    Adobe Reader XI
    Mozilla Firefox (39.0)
    Google Chrome (51.0.2704.103)
    Google Chrome (54.0.2840.99)
    Google Chrome (SetupMetrics...)
    ````````Process Check: objlist.exe by Laurent````````
    windows defender MpCmdRun.exe
    AVAST Software Avast AvastSvc.exe
    AVAST Software Avast avastui.exe
    `````````````````System Health check`````````````````
    Total Fragmentation on Drive C: 2%
    ````````````````````End of Log``````````````````````


    Farbar Service Scanner Version: 27-01-2016
    Ran by graymassie (administrator) on 14-12-2016 at 12:48:34
    Running from "C:\Users\graymassie\Desktop"
    Microsoft Windows 7 Home Premium Service Pack 1 (X64)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Google IP is accessible.
    Google.com is accessible.
    Yahoo.com is accessible.


    Windows Firewall:
    =============

    Firewall Disabled Policy:
    ==================


    System Restore:
    ============

    System Restore Policy:
    ========================


    Action Center:
    ============


    Windows Update:
    ============

    Windows Autoupdate Disabled Policy:
    ============================


    Windows Defender:
    ==============

    Other Services:
    ==============


    File Check:
    ========
    C:\Windows\System32\nsisvc.dll => File is digitally signed
    C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
    C:\Windows\System32\dhcpcore.dll => File is digitally signed
    C:\Windows\System32\drivers\afd.sys => File is digitally signed
    C:\Windows\System32\drivers\tdx.sys => File is digitally signed
    C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
    C:\Windows\System32\dnsrslvr.dll => File is digitally signed
    C:\Windows\System32\dnsapi.dll => File is digitally signed
    C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
    C:\Windows\System32\mpssvc.dll => File is digitally signed
    C:\Windows\System32\bfe.dll => File is digitally signed
    C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
    C:\Windows\System32\SDRSVC.dll => File is digitally signed
    C:\Windows\System32\vssvc.exe => File is digitally signed
    C:\Windows\System32\wscsvc.dll => File is digitally signed
    C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
    C:\Windows\System32\wuaueng.dll => File is digitally signed
    C:\Windows\System32\qmgr.dll => File is digitally signed
    C:\Windows\System32\es.dll => File is digitally signed
    C:\Windows\System32\cryptsvc.dll => File is digitally signed
    C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
    C:\Windows\System32\ipnathlp.dll => File is digitally signed
    C:\Windows\System32\iphlpsvc.dll => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed


    **** End of log ****
     
    BillB,
    #28
  10. 2016/12/14
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    [​IMG] Update Firefox to the current version.

    [​IMG] Update Adobe Flash Player: Adobe Flash Player Install for all versions
    Make sure you UN-check Yes, install McAfee Security Scan Plus

    NOTE 1: Beginning with Adobe Flash Version 11.3, the universal installer includes the 32-bit and 64-bit versions of the Flash Player.
    NOTE 2: While installing make sure you UN-check any extra garbage which wants to install alongside.

    [​IMG] Update your Java version here: Java Downloads for All Operating Systems
    Alternate download: http://www.filehippo.com/search?q=java

    Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.
    Note 2: If you're running 64-bit system make sure you install BOTH, 32-bit and 64-bit Java.

    ================================

    Your computer is clean [​IMG]

    1. This step will remove all cleaning tools we used, it'll reset restore points (so you won't get reinfected by accidentally using some older restore point) and it'll make some other minor adjustments...
    This is a very crucial step so make sure you don't skip it.
    Download [​IMG]DelFix by Xplode to your desktop. Delfix will delete all the used tools and logfiles.

    Double-click Delfix.exe to start the tool.
    Make sure the following items are checked:
    • Activate UAC (optional; some users prefer to keep it off)
    • Remove disinfection tools
    • Create registry backup
    • Purge System Restore
    • Reset system settings
    Now click "Run" and wait patiently.
    Once finished a logfile will be created. You don't have to attach it to your next reply.

    2. Make sure Windows Updates are current.

    3. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    4. Check if your browser plugins are up to date.
    Firefox - Keep your Firefox healthy with a quick checkup
    other browsers: Qualys BrowserCheck (click on "Scan without installing plugin" and then on "Scan now")

    5. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    6. Run Temporary File Cleaner (TFC), AdwCleaner and Junkware Removal Tool (JRT) weekly (you need to redownload these tools since they were removed by DelFix).

    7. Download and install Secunia Personal Software Inspector (PSI): Personal Software Inspector. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    8. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    9. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

    10. Read:
    How did I get infected?, With steps so it does not happen again!: How did I get infected? - Anti-Virus, Anti-Malware, and Privacy Software
    Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/
    About those Toolbars and Add-ons - Potentially Unwanted Programs (PUPs) which change your browser settings: http://www.bleepingcomputer.com/for...curity-questions-best-practices/#entry3187642

    11. Please, let me know, how your computer is doing.
     
    broni,
    #29
  11. 2016/12/15
    BillB Lifetime Subscription

    BillB Well-Known Member Thread Starter

    Joined:
    2003/03/18
    Messages:
    750
    Likes Received:
    0
    All tools have been removed, Java updated, firefox updated and flash player updated. The system seems to be performing better than when I got it, but still seems a bit sluggish to me, I'm guessing that's a memory constraint issue. I'm going to recommend a memory upgrade, it can be doubled to a max of 4gig.

    I appreciate the help with this, it's definitely running better than when I first got it.
     
    BillB,
    #30
  12. 2016/12/15
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Definitely....2GB is not much.
    Good luck and stay safe :)
     
    broni,
    #31
Page 2 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...