Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Brand new laptop but very slow and Windows Command Processor malware

Started by XZY5 , Dec 29 2016 05:38 AM

This topic is locked

33 replies to this topic

#1 XZY5

Member

Full Member
15 posts

Posted 29 December 2016 - 05:38 AM

I recently (27th Dec) bought a new laptop (Lenovo IdeaPad 310 i7 64-bit). All I have downloaded on it are the following programmes:

Malwarebytes, Spywareblaster, Superantipspyware, WinPatrol, Filehippo, uTorrent, Advanced uninstaller PRO, Daemon tools, 7zip, iTunes, Java, Skype, VLC media player, and Microsoft office from my university's free subscription service. I have windows defender set to periodic scanning, with real time protection from the McAfee antivirus the laptop came with. I was planning on getting Kaspersky antivirus before disabling McAfee but I started having this problem before I could.

WinPatrol monitors changes programes want to make on my computer, and I get a pop-up asking for permission to let programes start at startup. After I downloaded microsoft office I got a pop asking for permission for Windows Command Processor, which sounded important and I was going to accept the change but I decided to research it a little bit first and found that it is actually type of malware. I rejected the change, but the same pop-up kept coming back and I found during my research that the malware is tricky to uninstall. On top of that several other start-up permission pop ups (Lync browser helper, itunes helper) and add-on permission pop-ups (Onedrive for business and lync click-to-call) keep coming up repeated within minutes of me rejecting them. On top of that, my new laptop is very slow on start-up despite my having disabled the programes I know I don't need running at start-up, and barely having anything in it. It cannot be because the processor is weak (its an i7) or because it doesn't have enough memory (8gb ram with 2tb storage). I checked task manager and found that the CPU usage was at 97% at one point and then dropped to 58% so I wasn't able to check what was eating up so much power. I am not sure exactly what is wrong, and how I got infected in the first place. The laptop is also running slower than expected when operating normally, and a lot of the setting that I have changed haven't actually taken effect even after restarting. If i check my settings they are set to what I changed them to, but in actual use I don't see those changes.

My old laptop is 6 years old and while I am a relatively safe user now, that wasn't really the case when I first got my old laptop. It could be that some form of infection I got in the early days never got cleaned out properly and stayed on. The only thing that I have connected from my old laptop to my new one is the USB mouse that I use instead of the touchpad. However, I am aware that it is possible for infections to go from one device to another if they're connected to the same router. I have 3 laptops, 1 desktop and 5 mobile phones all using the same wifi connection within my household, and I cannot say that all users are safe users within us. I have read the posting guidelines, and gather all the necessary logs from both my new laptop and the old one as I am suspecting there is a high chance that is how my new laptop got infected and I am copying them below. The first set is from my new laptop, and the second set is from my old one (Sony VAIO i3)

New laptop:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 21-12-2016

Ran by rubai (administrator) on LAPTOP-H11LMCGD (28-12-2016 22:08:04)

Running from C:\Users\rubai\Downloads

Loaded Profiles: rubai (Available Profiles: defaultuser0 & rubai)

Platform: Windows 10 Home Version 1607 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe

() C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe

(Windows ® Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe

(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe

(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(Conexant Systems, Inc.) C:\Windows\System32\SASrv.exe

(Intel Security, Inc.) C:\Program Files\Common Files\Intel Security\PEF\CORE\PEFService.exe

(McAfee, Inc.) C:\Windows\System32\mfevtps.exe

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe

(McAfee, Inc.) C:\Windows\System32\mfevtps.exe

(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe

(McAfee, Inc.) C:\Program Files\Common Files\McAfee\platform\mcsvchost\McSvHost.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Innovative Solutions GRUP SRL) C:\Program Files (x86)\Innovative Solutions\Advanced Uninstaller PRO\uninstaller.exe

(Conexant Systems, Inc) C:\Program Files\CONEXANT\SAII\SmartAudio.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDIntelligent.exe

(Intel Corporation) C:\Windows\System32\igfxEM.exe

(Intel Corporation) C:\Windows\System32\igfxHK.exe

() C:\Windows\System32\igfxTray.exe

(McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe

(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD12\PDVD12Serv.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

() C:\Program Files\Lenovo\LenovoUtility\utility.exe

() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe

() C:\Program Files\Dolby\Dolby DAX2\DAX2_APP\DolbyDAX2TrayIcon.exe

(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

() C:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe

(Ruiware) C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe

(CyberLink) C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc_P2G8.exe

(SweetLabs, Inc) C:\Users\rubai\AppData\Local\Host App Service\Engine\HostAppServiceUpdater.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Lenovo) C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe

(Microsoft Corporation) C:\Windows\System32\InstallAgentUserBroker.exe

(McAfee, Inc.) C:\Program Files\Common Files\McAfee\CSP\1.9.829.0\McCSPServiceHost.exe

(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

(McAfee, Inc.) C:\Program Files\mcafee\msc\McAPExe.exe

(Lenovo) C:\Program Files (x86)\Lenovo\GDCAgentSetupRed\GDCAgent.exe

(McAfee, Inc.) C:\Program Files\Common Files\McAfee\platform\McUICnt.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe

(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

(McAfee, Inc.) C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.Device.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe

() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.10.145.0_x64__kzf8qxf38zg5c\SkypeHost.exe

(Intel Security) C:\Program Files\Common Files\McAfee\ClientAnalytics\McClientAnalytics.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe

(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.350_none_43278ee965418581\TiWorker.exe

(Microsoft Corporation) C:\Windows\System32\smartscreen.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [LenovoUtility] => C:\Program Files\Lenovo\LenovoUtility\utility.exe [791848 2016-08-27] ()

HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()

HKLM\...\Run: [DAX2_APP] => C:\Program Files\Dolby\Dolby DAX2\DAX2_APP\DolbyDAX2TrayIcon.exe [809472 2016-05-16] ()

HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1830232 2016-03-08] (Conexant Systems, Inc.)

HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [602968 2015-12-08] (Conexant Systems, Inc.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [323056 2015-11-04] (Intel Corporation)

HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2016-09-07] (Microsoft Corporation)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176440 2016-12-06] (Apple Inc.)

HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES/MALWAREBYTES/ANTI-MALWARE\mbamtray.exe [2776528 2016-12-14] (Malwarebytes)

HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc_P2G8.exe [110008 2015-07-21] (CyberLink)

HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\Lenovo\Power2Go\VirtualDrive.exe [492472 2015-07-21] (CyberLink Corp.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-09-22] (Oracle Corporation)

HKU\S-1-5-21-249857850-3300716479-2824224529-1001\...\Run: [FileHippo.com] => C:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe [10566352 2015-09-02] ()

HKU\S-1-5-21-249857850-3300716479-2824224529-1001\...\Run: [WinPatrol] => C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe [1231240 2016-11-14] (Ruiware)

GroupPolicy: Restriction - Chrome <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Tcpip\..\Interfaces\{3c534fd4-232a-4f81-a4ae-106587f717f2}: [DhcpNameServer] 192.168.1.1

Tcpip\..\Interfaces\{524bc8a0-db43-47fd-b825-64eaecd18972}: [DhcpNameServer] 150.207.1.2

Internet Explorer:

==================

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKU\S-1-5-21-249857850-3300716479-2824224529-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo17win10.msn.com/?pc=LCTE

HKU\S-1-5-21-249857850-3300716479-2824224529-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo17win10.msn.com/?pc=LCTE

HKU\S-1-5-21-249857850-3300716479-2824224529-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://mystart.lenovo.com

SearchScopes: HKU\S-1-5-21-249857850-3300716479-2824224529-1001 -> DefaultScope {2EFAACDB-4865-45C6-849A-0F556923BA18} URL =

SearchScopes: HKU\S-1-5-21-249857850-3300716479-2824224529-1001 -> {2EFAACDB-4865-45C6-849A-0F556923BA18} URL =

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2016-12-28] (Microsoft Corporation)

BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2016-12-28] (Microsoft Corporation)

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2016-12-28] (Microsoft Corporation)

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\ssv.dll [2016-12-27] (Oracle Corporation)

BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2016-12-28] (Microsoft Corporation)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\jp2ssv.dll [2016-12-27] (Oracle Corporation)

Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-27] (Microsoft Corporation)

Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-27] (Microsoft Corporation)

Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-27] (Microsoft Corporation)

Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-27] (Microsoft Corporation)

Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll [2016-10-19] (McAfee, Inc.)

Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll [2016-10-19] (McAfee, Inc.)

FireFox:

========

FF DefaultProfile: s2hjnj8d.default

FF ProfilePath: C:\Users\rubai\AppData\Roaming\Mozilla\Firefox\Profiles\s2hjnj8d.default [2016-12-28]

FF Extension: (Awesome Screenshot - Capture, Annotate & More) - C:\Users\rubai\AppData\Roaming\Mozilla\Firefox\Profiles\s2hjnj8d.default\Extensions\jid0-GXjLLfbCoAx0LcltEdFrEkQdQPI@jetpack.xpi [2016-12-27]

FF Extension: (uBlock Origin) - C:\Users\rubai\AppData\Roaming\Mozilla\Firefox\Profiles\s2hjnj8d.default\Extensions\uBlock0@raymondhill.net.xpi [2016-12-27]

FF Extension: (Session Manager) - C:\Users\rubai\AppData\Roaming\Mozilla\Firefox\Profiles\s2hjnj8d.default\Extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi [2016-12-27]

FF Extension: (YouTube High Definition) - C:\Users\rubai\AppData\Roaming\Mozilla\Firefox\Profiles\s2hjnj8d.default\Extensions\{7b1bf0b6-a1b9-42b0-b75d-252036438bdc}.xpi [2016-12-27]

FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

FF Extension: (McAfee Anti-Spam Thunderbird Extension) - C:\Program Files\McAfee\MSK [2016-12-27] [not signed]

FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2016-10-19] ()

FF Plugin-x32: @java.com/DTPlugin,version=11.111.2 -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\dtplugin\npDeployJava1.dll [2016-12-27] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.111.2 -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\plugin2\npjp2.dll [2016-12-27] (Oracle Corporation)

FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2016-10-19] ()

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-12-28] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-12-27] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-28] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-28] (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)

Chrome:

=======

CHR Profile: C:\Users\rubai\AppData\Local\Google\Chrome\User Data\Default [2016-12-28]

CHR Extension: (Google Slides) - C:\Users\rubai\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-12-27]

CHR Extension: (Google Docs) - C:\Users\rubai\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-12-27]

CHR Extension: (Google Drive) - C:\Users\rubai\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-12-27]

CHR Extension: (YouTube) - C:\Users\rubai\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-12-27]

CHR Extension: (Session Buddy) - C:\Users\rubai\AppData\Local\Google\Chrome\User Data\Default\Extensions\edacconmaakjimmfgnblocblbcdcpbko [2016-12-27]

CHR Extension: (Google Sheets) - C:\Users\rubai\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-12-27]

CHR Extension: (Whatsapp Web) - C:\Users\rubai\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghahehbojcacaklcdefjblcpcpammjlj [2016-12-27]

CHR Extension: (Google Docs Offline) - C:\Users\rubai\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-12-27]

CHR Extension: (Awesome Screenshot: Screen capture, Annotate) - C:\Users\rubai\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlipoenfbbikpbjkfpfillcgkoblgpmj [2016-12-27]

CHR Extension: (Chrome Web Store Payments) - C:\Users\rubai\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-12-27]

CHR Extension: (Speedtest by Ookla) - C:\Users\rubai\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgjjikdiikihdfpoppgaidccahalehjh [2016-12-27]

CHR Extension: (Gmail) - C:\Users\rubai\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-12-27]

CHR Extension: (Chrome Media Router) - C:\Users\rubai\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-12-27]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-07-22] (SUPERAntiSpyware.com)

S2 0143641482962494mcinstcleanup; C:\Windows\TEMP\014364~1.EXE [961888 2016-05-16] (McAfee, Inc.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)

R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [338312 2016-06-29] (Windows ® Win 7 DDK provider)

R2 CCSDK; C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe [666608 2016-03-22] (Lenovo)

R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [3019968 2016-12-04] (Microsoft Corporation)

S3 cplspcon; C:\Windows\system32\IntelCpHDCPSvc.exe [457184 2016-09-03] (Intel Corporation)

R2 DAX2API; C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe [146944 2016-05-16] () [File not signed]

R2 ETDService; C:\Program Files\Elantech\ETDService.exe [134888 2016-07-20] (ELAN Microelectronics Corp.)

R2 GDCAgent; C:\Program Files (x86)\Lenovo\GDCAgentSetupRed\GDCAgent.exe [1210352 2016-03-23] (Lenovo)

R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1163712 2016-06-14] (NVIDIA Corporation)

R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [596768 2016-07-07] (McAfee, Inc.)

R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [19440 2015-11-04] (Intel Corporation)

R2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [382440 2016-09-03] (Intel Corporation)

R2 ImControllerService; C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [62792 2016-12-01] (Lenovo Group Limited)

S3 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4317648 2016-12-14] (Malwarebytes)

R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [993824 2016-10-19] (McAfee, Inc.)

S3 McAWFwk; c:\Program Files\Common Files\McAfee\ActWiz\McAWFwk.exe [419096 2016-04-01] (McAfee, Inc.)

R2 McBootDelayStartSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [596768 2016-07-07] (McAfee, Inc.)

R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.9.829.0\\McCSPServiceHost.exe [1910000 2016-05-31] (McAfee, Inc.)

R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [596768 2016-07-07] (McAfee, Inc.)

R2 McNaiAnn; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [596768 2016-07-07] (McAfee, Inc.)

S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [816128 2016-06-21] (McAfee, Inc.)

R2 mcpltsvc; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [596768 2016-07-07] (McAfee, Inc.)

R2 McProxy; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [596768 2016-07-07] (McAfee, Inc.)

R3 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [232688 2016-04-27] (McAfee, Inc.)

R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\\mfemms.exe [382456 2016-07-01] (McAfee, Inc.)

R3 mfevtp; C:\Windows\system32\mfevtps.exe [277744 2016-04-27] (McAfee, Inc.)

R2 ModuleCoreService; C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe [1454216 2016-09-13] (McAfee, Inc.)

S3 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [596768 2016-07-07] (McAfee, Inc.)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-06-14] (NVIDIA Corporation)

R2 PEFService; C:\Program Files\Common Files\Intel Security\PEF\CORE\PEFService.exe [1045336 2016-05-25] (Intel Security, Inc.)

R2 SAService; C:\Windows\system32\SAsrv.exe [431960 2015-09-15] (Conexant Systems, Inc.)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [78632 2016-04-27] (McAfee, Inc.)

R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91912 2013-11-12] (CyberLink)

S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [216704 2016-08-02] (McAfee, Inc.)

R0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [250816 2016-12-28] (Malwarebytes)

R3 mfeaack; C:\Windows\System32\drivers\mfeaack.sys [419616 2016-04-27] (McAfee, Inc.)

R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [349480 2016-04-27] (McAfee, Inc.)

S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [83608 2016-04-27] (McAfee, Inc.)

R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [493352 2016-04-27] (McAfee, Inc.)

R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [843048 2016-04-27] (McAfee, Inc.)

R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [519456 2016-08-01] (McAfee, Inc.)

S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [100136 2016-08-01] (McAfee, Inc.)

R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [243488 2016-04-27] (McAfee, Inc.)

S3 NetAdapterCx; C:\Windows\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()

S3 NETwNe64; C:\Windows\System32\drivers\NETwew01.sys [3343872 2016-07-16] (Intel Corporation)

R3 Qcamain10x64; C:\Windows\System32\drivers\Qcamain10x64.sys [2400184 2016-06-29] (Qualcomm Atheros, Inc.)

R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [935168 2016-01-22] (Realtek )

R3 RTSUER; C:\Windows\system32\Drivers\RtsUer.sys [416472 2016-05-17] (Realsil Semiconductor Corporation)

R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [3118848 2016-05-12] (Realtek Semiconductor Corp.)

R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)

R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)

S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-14] ("CyberLink)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-12-28 22:08 - 2016-12-28 22:08 - 00023551 _____ C:\Users\rubai\Downloads\FRST.txt

2016-12-28 22:07 - 2016-12-28 22:08 - 00000000 ____D C:\FRST

2016-12-28 21:55 - 2016-12-28 22:07 - 02420736 _____ (Farbar) C:\Users\rubai\Downloads\FRST64.exe

2016-12-28 21:54 - 2016-12-28 22:07 - 00899072 _____ C:\Users\rubai\Downloads\RGSA.exe

2016-12-28 21:40 - 2016-12-28 21:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee

2016-12-28 07:48 - 2016-12-28 07:48 - 00000020 ___SH C:\Users\defaultuser0\ntuser.ini

2016-12-28 07:48 - 2016-12-28 07:48 - 00000000 _SHDL C:\Users\defaultuser0\My Documents

2016-12-28 07:48 - 2016-12-28 07:48 - 00000000 _SHDL C:\Users\defaultuser0\Documents\My Videos

2016-12-28 07:48 - 2016-12-28 07:48 - 00000000 _SHDL C:\Users\defaultuser0\Documents\My Pictures

2016-12-28 07:48 - 2016-12-28 07:48 - 00000000 _SHDL C:\Users\defaultuser0\Documents\My Music

2016-12-28 07:48 - 2016-12-27 16:53 - 00000000 ____D C:\Users\defaultuser0\AppData\Local\Host App Service

2016-12-28 07:48 - 2016-12-27 16:48 - 00000000 ____D C:\Users\defaultuser0

2016-12-28 07:46 - 2016-12-28 07:46 - 00000000 _SHDL C:\Users\Public\Documents\My Videos

2016-12-28 07:46 - 2016-12-28 07:46 - 00000000 _SHDL C:\Users\Public\Documents\My Pictures

2016-12-28 07:46 - 2016-12-28 07:46 - 00000000 _SHDL C:\Users\Public\Documents\My Music

2016-12-28 07:46 - 2016-12-28 07:46 - 00000000 _SHDL C:\Users\Default\My Documents

2016-12-28 07:46 - 2016-12-28 07:46 - 00000000 _SHDL C:\Users\Default\Documents\My Videos

2016-12-28 07:46 - 2016-12-28 07:46 - 00000000 _SHDL C:\Users\Default\Documents\My Pictures

2016-12-28 07:46 - 2016-12-28 07:46 - 00000000 _SHDL C:\Users\Default\Documents\My Music

2016-12-28 07:46 - 2016-12-28 07:46 - 00000000 _SHDL C:\Users\Default User\Documents\My Videos

2016-12-28 07:46 - 2016-12-28 07:46 - 00000000 _SHDL C:\Users\Default User\Documents\My Pictures

2016-12-28 07:46 - 2016-12-28 07:46 - 00000000 _SHDL C:\Users\Default User\Documents\My Music

2016-12-28 07:46 - 2016-12-28 07:46 - 00000000 _SHDL C:\Documents and Settings

2016-12-28 00:47 - 2016-12-28 00:47 - 00000214 _____ C:\Windows\Tasks\CreateExplorerShellUnelevatedTask.job

2016-12-28 00:27 - 2016-12-28 00:27 - 02365296 _____ (Microsoft Corporation) C:\Windows\system32\WudfUpdate_01011.dll

2016-12-27 23:52 - 2016-12-27 23:52 - 00002248 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneDrive for Business.lnk

2016-12-27 23:52 - 2016-12-27 23:52 - 00002214 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype for Business 2016.lnk

2016-12-27 23:48 - 2016-12-27 23:48 - 03907376 _____ (Microsoft Corporation) C:\Users\rubai\Downloads\Setup.X86.en-us_O365ProPlusRetail_009121f5-1790-439a-bb30-497507999e9b_TX_PR_b_32_.exe

2016-12-27 23:38 - 2016-12-27 23:38 - 01512368 _____ (Ruiware) C:\Users\rubai\Downloads\wpsetup (1).exe

2016-12-27 23:36 - 2016-12-28 22:01 - 00004208 _____ C:\Windows\System32\Tasks\Intel Security DAT Reputation (AMCore) Post DAT update endpoint safety pulse

2016-12-27 23:36 - 2016-12-28 22:01 - 00004020 _____ C:\Windows\System32\Tasks\Intel Security DAT Reputation (AMCore) periodic endpoint safety pulse

2016-12-27 22:37 - 2016-12-27 22:37 - 00000000 ____D C:\Users\rubai\Downloads\Install JDownloader

2016-12-27 22:36 - 2016-12-27 22:36 - 01381582 _____ (Igor Pavlov) C:\Users\rubai\Downloads\7z1604-x64.exe

2016-12-27 22:36 - 2016-12-27 22:36 - 00248946 _____ C:\Users\rubai\Downloads\Install JDownloader.rar

2016-12-27 22:36 - 2016-12-27 22:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

2016-12-27 22:36 - 2016-12-27 22:36 - 00000000 ____D C:\Program Files\7-Zip

2016-12-27 22:29 - 2016-12-27 22:29 - 00000258 __RSH C:\ProgramData\ntuser.pol

2016-12-27 22:09 - 2016-12-27 22:32 - 00000000 ____D C:\Users\rubai\AppData\Roaming\WinPatrol

2016-12-27 22:08 - 2016-12-27 22:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN

2016-12-27 22:08 - 2016-12-27 22:08 - 00000000 ____D C:\Program Files (x86)\VideoLAN

2016-12-27 22:05 - 2016-12-27 22:05 - 00001821 _____ C:\Users\Public\Desktop\DAEMON Tools Lite.lnk

2016-12-27 22:05 - 2016-12-27 22:05 - 00000000 ____D C:\Users\rubai\AppData\Roaming\DAEMON Tools Lite

2016-12-27 22:05 - 2016-12-27 22:05 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite

2016-12-27 22:05 - 2016-12-27 22:05 - 00000000 ____D C:\Program Files\DAEMON Tools Lite

2016-12-27 22:03 - 2016-12-27 22:03 - 00692488 _____ (Disc Soft Ltd.) C:\Users\rubai\Downloads\DTLiteInstaller.exe

2016-12-27 21:58 - 2016-12-27 22:07 - 30533688 _____ C:\Users\rubai\Downloads\vlc-2.2.4-win32.exe

2016-12-27 21:57 - 2016-12-27 23:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPatrol

2016-12-27 21:57 - 2016-12-27 23:38 - 00000000 ____D C:\ProgramData\InstallMate

2016-12-27 21:57 - 2016-12-27 21:57 - 00000000 ____D C:\Program Files (x86)\Ruiware

2016-12-27 21:56 - 2016-12-27 21:57 - 01512368 _____ (Ruiware) C:\Users\rubai\Downloads\wpsetup.exe

2016-12-27 21:44 - 2016-12-27 21:46 - 00000000 ____D C:\Users\rubai\AppData\Roaming\Apple Computer

2016-12-27 21:44 - 2016-12-27 21:44 - 00002535 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk

2016-12-27 21:44 - 2016-12-27 21:44 - 00000000 ____D C:\Windows\System32\Tasks\Apple

2016-12-27 21:44 - 2016-12-27 21:44 - 00000000 ____D C:\Users\rubai\AppData\Local\Apple Computer

2016-12-27 21:44 - 2016-12-27 21:44 - 00000000 ____D C:\Users\rubai\AppData\Local\Apple

2016-12-27 21:44 - 2016-12-27 21:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2016-12-27 21:44 - 2016-12-27 21:44 - 00000000 ____D C:\ProgramData\Apple Computer

2016-12-27 21:44 - 2016-12-27 21:44 - 00000000 ____D C:\Program Files\iTunes

2016-12-27 21:44 - 2016-12-27 21:44 - 00000000 ____D C:\Program Files\iPod

2016-12-27 21:44 - 2016-12-27 21:44 - 00000000 ____D C:\Program Files (x86)\Apple Software Update

2016-12-27 21:43 - 2016-12-27 21:44 - 00000000 ____D C:\ProgramData\Apple

2016-12-27 21:43 - 2016-12-27 21:44 - 00000000 ____D C:\Program Files\Common Files\Apple

2016-12-27 21:43 - 2016-12-27 21:43 - 00000000 ____D C:\Program Files\Bonjour

2016-12-27 21:43 - 2016-12-27 21:43 - 00000000 ____D C:\Program Files (x86)\Bonjour

2016-12-27 21:42 - 2016-12-27 21:42 - 00000000 ____D C:\Users\rubai\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

2016-12-27 21:33 - 2016-12-27 21:42 - 177044296 _____ (Apple Inc.) C:\Users\rubai\Downloads\iTunes6464Setup.exe

2016-12-27 21:31 - 2016-12-27 21:31 - 00000000 ____D C:\Users\rubai\Documents\My Filehippo Downloads

2016-12-27 21:30 - 2016-12-27 21:30 - 00000000 ___HD C:\OneDriveTemp

2016-12-27 21:23 - 2016-12-27 21:23 - 00000000 ____D C:\Users\rubai\AppData\Roaming\Innovative Solutions

2016-12-27 21:22 - 2016-12-27 21:22 - 00002870 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC

2016-12-27 21:22 - 2016-12-27 21:22 - 00000870 _____ C:\Users\Public\Desktop\CCleaner.lnk

2016-12-27 21:22 - 2016-12-27 21:22 - 00000000 ____D C:\Users\rubai\AppData\LocalLow\uTorrent

2016-12-27 21:22 - 2016-12-27 21:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

2016-12-27 21:22 - 2016-12-27 21:22 - 00000000 ____D C:\Program Files\CCleaner

2016-12-27 21:21 - 2016-12-27 21:21 - 00002691 _____ C:\Users\rubai\Desktop\µTorrent.lnk

2016-12-27 21:19 - 2016-12-27 21:25 - 00000000 ____D C:\Users\rubai\AppData\Roaming\uTorrent

2016-12-27 21:19 - 2016-12-27 21:22 - 08803648 _____ (Piriform Ltd) C:\Users\rubai\Downloads\ccsetup525.exe

2016-12-27 21:19 - 2016-12-27 21:19 - 02237120 _____ (BitTorrent Inc.) C:\Users\rubai\Downloads\uTorrent.exe

2016-12-27 21:13 - 2016-12-06 15:17 - 00035488 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2016-12-27 21:13 - 2016-12-06 15:16 - 00153392 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2016-12-27 21:13 - 2016-12-06 15:16 - 00151352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2016-12-27 21:13 - 2016-09-07 08:51 - 00040664 _____ (The OpenVPN Project) C:\Windows\system32\Drivers\tap0901.sys

2016-12-27 21:10 - 2016-12-27 21:26 - 00000376 _____ C:\Windows\Tasks\Health-Check-deep.job

2016-12-27 21:10 - 2016-12-27 21:26 - 00000368 _____ C:\Windows\Tasks\Health-Check.job

2016-12-27 21:10 - 2016-12-27 21:24 - 00004114 _____ C:\Windows\System32\Tasks\AupAvUpdate

2016-12-27 21:10 - 2016-12-27 21:24 - 00003828 _____ C:\Windows\System32\Tasks\UninstallMonitor

2016-12-27 21:10 - 2016-12-27 21:24 - 00000000 ____D C:\Program Files (x86)\Innovative Solutions

2016-12-27 21:10 - 2016-12-27 21:13 - 00000000 ____D C:\Users\rubai\AppData\Local\Innovative Solutions

2016-12-27 21:10 - 2016-12-27 21:13 - 00000000 ____D C:\ProgramData\Innovative Solutions

2016-12-27 21:10 - 2016-12-27 21:10 - 00003002 _____ C:\Windows\System32\Tasks\Health-Check-deep

2016-12-27 21:10 - 2016-12-27 21:10 - 00002984 _____ C:\Windows\System32\Tasks\Health-Check

2016-12-27 21:10 - 2016-12-27 21:10 - 00001721 _____ C:\Users\rubai\Desktop\Advanced Uninstaller PRO 12.lnk

2016-12-27 21:10 - 2016-12-27 21:10 - 00001605 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced Uninstaller PRO 12.lnk

2016-12-27 21:10 - 2016-12-27 21:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced Uninstaller PRO

2016-12-27 21:06 - 2016-12-27 21:06 - 10388528 _____ (Innovative Solutions ) C:\Users\rubai\Downloads\Advanced_Uninstaller12.exe

2016-12-27 21:04 - 2016-12-27 21:04 - 00000000 ____D C:\Users\rubai\AppData\Roaming\Oracle

2016-12-27 21:00 - 2016-12-27 21:00 - 00097856 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2016-12-27 21:00 - 2016-12-27 21:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2016-12-27 21:00 - 2016-12-27 21:00 - 00000000 ____D C:\Program Files (x86)\Java

2016-12-27 20:28 - 2016-12-27 20:59 - 00737344 _____ (Oracle Corporation) C:\Users\rubai\Downloads\JavaSetup8u111.exe

2016-12-27 20:16 - 2016-12-28 00:26 - 00000000 ____D C:\Users\rubai\AppData\LocalLow\Mozilla

2016-12-27 20:16 - 2016-12-27 20:22 - 00000000 ____D C:\Users\rubai\AppData\Local\Mozilla

2016-12-27 20:16 - 2016-12-27 20:16 - 00001235 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2016-12-27 20:16 - 2016-12-27 20:16 - 00001223 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2016-12-27 20:16 - 2016-12-27 20:16 - 00000000 ____D C:\Users\rubai\AppData\Roaming\Mozilla

2016-12-27 20:16 - 2016-12-27 20:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2016-12-27 20:16 - 2016-12-27 20:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2016-12-27 20:14 - 2016-12-27 21:01 - 00000000 ____D C:\ProgramData\Oracle

2016-12-27 20:14 - 2016-12-27 20:15 - 00243552 _____ C:\Users\rubai\Downloads\Firefox Setup Stub 50.1.0.exe

2016-12-27 20:14 - 2016-12-27 20:14 - 00000000 ____D C:\Users\rubai\AppData\Roaming\Sun

2016-12-27 20:14 - 2016-12-27 20:14 - 00000000 ____D C:\Users\rubai\AppData\LocalLow\Sun

2016-12-27 20:11 - 2016-12-27 20:13 - 63235648 _____ (Oracle Corporation) C:\Users\rubai\Downloads\jre-8u111-windows-x64.exe

2016-12-27 20:06 - 2016-12-28 00:26 - 00000000 ____D C:\Users\rubai\AppData\Roaming\Skype

2016-12-27 20:06 - 2016-12-27 20:06 - 00002640 _____ C:\Users\Public\Desktop\Skype.lnk

2016-12-27 20:06 - 2016-12-27 20:06 - 00000000 ___RD C:\Program Files (x86)\Skype

2016-12-27 20:06 - 2016-12-27 20:06 - 00000000 ____D C:\Users\rubai\Tracing

2016-12-27 20:06 - 2016-12-27 20:06 - 00000000 ____D C:\ProgramData\Skype

2016-12-27 20:06 - 2016-12-27 20:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

2016-12-27 20:05 - 2016-12-27 20:05 - 00000000 ____D C:\Program Files (x86)\FileHippo.com

2016-12-27 20:04 - 2016-12-27 20:06 - 43878872 _____ (Skype Technologies S.A.) C:\Users\rubai\Downloads\SkypeSetupFull.exe

2016-12-27 20:03 - 2016-12-27 20:04 - 02190552 _____ C:\Users\rubai\Downloads\appmanagersetup_2.0_b4_292.exe

2016-12-27 20:03 - 2016-12-27 20:03 - 00001856 _____ C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

2016-12-27 20:03 - 2016-12-27 20:03 - 00000000 ____D C:\Users\rubai\AppData\Roaming\SUPERAntiSpyware.com

2016-12-27 20:03 - 2016-12-27 20:03 - 00000000 ____D C:\ProgramData\SUPERAntiSpyware.com

2016-12-27 20:03 - 2016-12-27 20:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware

2016-12-27 20:03 - 2016-12-27 20:03 - 00000000 ____D C:\Program Files\SUPERAntiSpyware

2016-12-27 20:01 - 2016-12-27 20:02 - 28761688 _____ (SUPERAntiSpyware) C:\Users\rubai\Downloads\SUPERAntiSpyware.exe

2016-12-27 20:00 - 2016-12-27 22:29 - 00000000 ____D C:\Program Files (x86)\SpywareBlaster

2016-12-27 20:00 - 2016-12-27 20:00 - 00001155 _____ C:\Users\Public\Desktop\SpywareBlaster.lnk

2016-12-27 20:00 - 2016-12-27 20:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster

2016-12-27 20:00 - 2012-05-02 12:17 - 01070152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCOMCTL.OCX

2016-12-27 20:00 - 2009-03-24 13:52 - 00129872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSSTDFMT.DLL

2016-12-27 19:59 - 2016-12-27 20:00 - 04291320 _____ (BrightFort LLC ) C:\Users\rubai\Downloads\spywareblastersetup55.exe

2016-12-27 19:58 - 2016-12-28 00:48 - 00250816 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2016-12-27 19:58 - 2016-12-27 21:28 - 00102856 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys

2016-12-27 19:58 - 2016-12-27 21:28 - 00091584 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys

2016-12-27 19:58 - 2016-12-27 21:28 - 00043968 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys

2016-12-27 19:58 - 2016-12-27 19:58 - 00176064 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys

2016-12-27 19:58 - 2016-12-27 19:58 - 00001919 _____ C:\Users\Public\Desktop\Malwarebytes.lnk

2016-12-27 19:58 - 2016-12-27 19:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes

2016-12-27 19:58 - 2016-12-27 19:58 - 00000000 ____D C:\ProgramData\Malwarebytes

2016-12-27 19:58 - 2016-12-27 19:58 - 00000000 ____D C:\Program Files\Malwarebytes

2016-12-27 19:58 - 2016-12-14 12:55 - 00077416 _____ C:\Windows\system32\Drivers\mbae64.sys

2016-12-27 19:56 - 2016-12-27 19:57 - 54199488 _____ (Malwarebytes ) C:\Users\rubai\Downloads\mb3-setup-consumer-3.0.5.1299.exe

2016-12-27 19:22 - 2016-07-15 19:29 - 07702016 _____ (Microsoft Corporation) C:\Windows\system32\NL7Models0011.dll

2016-12-27 19:22 - 2016-07-15 19:29 - 02454528 _____ (Microsoft Corporation) C:\Windows\system32\NL7Lexicons0011.dll

2016-12-27 19:22 - 2016-07-15 19:25 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\MSWB70011.dll

2016-12-27 19:22 - 2016-07-15 19:24 - 07417344 _____ (Microsoft Corporation) C:\Windows\system32\NL7Data0011.dll

2016-12-27 19:22 - 2016-07-15 18:40 - 07253504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NL7Data0011.dll

2016-12-27 19:22 - 2016-07-15 18:40 - 00526848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSWB70011.dll

2016-12-27 19:22 - 2016-05-25 14:39 - 00002060 _____ C:\Windows\system32\noise.jpn

2016-12-27 19:22 - 2016-05-25 11:10 - 00002060 _____ C:\Windows\SysWOW64\noise.jpn

2016-12-27 19:20 - 2016-07-15 19:29 - 01794048 _____ (Microsoft Corporation) C:\Windows\system32\NlsLexicons0045.dll

2016-12-27 19:20 - 2016-07-15 19:26 - 03054080 _____ (Microsoft Corporation) C:\Windows\system32\MLS1.dll

2016-12-27 19:20 - 2016-07-15 19:26 - 00170496 _____ (Microsoft Corporation) C:\Windows\system32\NlsData0045.dll

2016-12-27 19:20 - 2016-07-15 18:45 - 01794048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NlsLexicons0045.dll

2016-12-27 19:20 - 2016-07-15 18:43 - 00132096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NlsData0045.dll

2016-12-27 19:20 - 2016-07-15 18:39 - 03004416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MLS1.dll

2016-12-27 19:05 - 2016-12-27 17:14 - 00485032 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2016-12-27 18:42 - 2016-12-27 18:42 - 00002351 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2016-12-27 18:42 - 2016-12-27 18:42 - 00002339 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2016-12-27 18:31 - 2016-12-27 18:34 - 00000000 ____D C:\Windows\system32\MRT

2016-12-27 18:31 - 2016-12-27 18:31 - 135632432 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe

2016-12-27 18:26 - 2016-12-09 10:32 - 07816032 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2016-12-27 18:26 - 2016-12-09 10:29 - 02681200 _____ C:\Windows\system32\CoreUIComponents.dll

2016-12-27 18:26 - 2016-12-09 10:19 - 01293152 _____ (Microsoft Corporation) C:\Windows\system32\LicenseManager.dll

2016-12-27 18:26 - 2016-12-09 10:18 - 01100128 _____ (Microsoft Corporation) C:\Windows\system32\hvix64.exe

2016-12-27 18:26 - 2016-12-09 10:18 - 00989024 _____ (Microsoft Corporation) C:\Windows\system32\hvax64.exe

2016-12-27 18:26 - 2016-12-09 10:18 - 00947552 _____ (Microsoft Corporation) C:\Windows\system32\hvloader.efi

2016-12-27 18:26 - 2016-12-09 10:18 - 00811872 _____ (Microsoft Corporation) C:\Windows\system32\hvloader.exe

2016-12-27 18:26 - 2016-12-09 10:15 - 08168000 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.Protection.PlayReady.dll

2016-12-27 18:26 - 2016-12-09 10:15 - 01988560 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4srcsnk.dll

2016-12-27 18:26 - 2016-12-09 10:14 - 01274712 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll

2016-12-27 18:26 - 2016-12-09 10:01 - 02323728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll

2016-12-27 18:26 - 2016-12-09 10:01 - 01503544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll

2016-12-27 18:26 - 2016-12-09 09:57 - 01852720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll

2016-12-27 18:26 - 2016-12-09 09:52 - 01435896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll

2016-12-27 18:26 - 2016-12-09 09:51 - 00117240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2016-12-27 18:26 - 2016-12-09 09:41 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WordBreakers.dll

2016-12-27 18:26 - 2016-12-09 09:38 - 00324608 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.LockScreen.dll

2016-12-27 18:26 - 2016-12-09 09:37 - 00411136 _____ (Microsoft Corporation) C:\Windows\system32\facecredentialprovider.dll

2016-12-27 18:26 - 2016-12-09 09:36 - 06285312 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.dll

2016-12-27 18:26 - 2016-12-09 09:36 - 03059200 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2016-12-27 18:26 - 2016-12-09 09:36 - 00425984 _____ (Microsoft Corporation) C:\Windows\system32\aadcloudap.dll

2016-12-27 18:26 - 2016-12-09 09:36 - 00410112 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentClient.dll

2016-12-27 18:26 - 2016-12-09 09:33 - 03777536 _____ (Microsoft Corporation) C:\Windows\system32\MFMediaEngine.dll

2016-12-27 18:26 - 2016-12-09 09:33 - 01589760 _____ (Microsoft Corporation) C:\Windows\system32\msdtctm.dll

2016-12-27 18:26 - 2016-12-09 09:31 - 00313856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppXDeploymentClient.dll

2016-12-27 18:26 - 2016-12-09 09:30 - 04612608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.dll

2016-12-27 18:26 - 2016-12-09 09:28 - 03306496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFMediaEngine.dll

2016-12-27 18:26 - 2016-12-09 09:27 - 00981504 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Security.Authentication.OnlineId.dll

2016-12-27 18:26 - 2016-12-09 09:26 - 01692672 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.onecore.dll

2016-12-27 18:26 - 2016-12-09 09:24 - 02275840 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentServer.dll

2016-12-27 18:26 - 2016-12-09 09:22 - 02820096 _____ (Microsoft Corporation) C:\Windows\system32\InputService.dll

2016-12-27 18:26 - 2016-12-09 09:22 - 02688512 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Logon.dll

2016-12-27 18:26 - 2016-12-09 09:19 - 01121280 _____ (Microsoft Corporation) C:\Windows\system32\aadtb.dll

2016-12-27 18:26 - 2016-12-09 09:19 - 00433664 _____ (Microsoft Corporation) C:\Windows\system32\TextInputFramework.dll

2016-12-27 18:26 - 2016-12-09 09:18 - 02138112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InputService.dll

2016-12-27 18:26 - 2016-12-09 09:16 - 00353280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TextInputFramework.dll

2016-12-27 18:26 - 2016-12-09 09:15 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Core.TextInput.dll

2016-12-27 18:26 - 2016-12-09 09:15 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InputLocaleManager.dll

2016-12-27 18:26 - 2016-12-09 09:15 - 00068096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EditBufferTestHook.dll

2016-12-27 18:26 - 2016-11-11 10:15 - 00101216 _____ (Microsoft Corporation) C:\Windows\system32\DeviceReactivation.dll

2016-12-27 18:26 - 2016-11-11 10:14 - 00603488 _____ (Microsoft Corporation) C:\Windows\system32\ContentDeliveryManager.Utilities.dll

2016-12-27 18:26 - 2016-11-11 10:13 - 00352096 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys

2016-12-27 18:26 - 2016-11-11 10:03 - 00328008 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Storage.ApplicationData.dll

2016-12-27 18:26 - 2016-11-11 10:02 - 00360040 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlows.exe

2016-12-27 18:26 - 2016-11-11 10:01 - 01859264 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.dll

2016-12-27 18:26 - 2016-11-11 10:00 - 00219488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tpm.sys

2016-12-27 18:26 - 2016-11-11 09:57 - 04130432 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll

2016-12-27 18:26 - 2016-11-11 09:57 - 01473048 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll

2016-12-27 18:26 - 2016-11-11 09:56 - 01062480 _____ (Microsoft Corporation) C:\Windows\system32\mfsvr.dll

2016-12-27 18:26 - 2016-11-11 09:56 - 00187520 _____ (Microsoft Corporation) C:\Windows\system32\CloudStorageWizard.exe

2016-12-27 18:26 - 2016-11-11 09:56 - 00126568 _____ (Microsoft Corporation) C:\Windows\system32\mfaudiocnv.dll

2016-12-27 18:26 - 2016-11-11 09:55 - 01600624 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll

2016-12-27 18:26 - 2016-11-11 09:55 - 00882680 _____ (Microsoft Corporation) C:\Windows\system32\EditionUpgradeManagerObj.dll

2016-12-27 18:26 - 2016-11-11 09:55 - 00743224 _____ (Microsoft Corporation) C:\Windows\system32\sppwinob.dll

2016-12-27 18:26 - 2016-11-11 09:51 - 00454592 _____ (Microsoft Corporation) C:\Windows\system32\services.exe

2016-12-27 18:26 - 2016-11-11 09:28 - 00040960 _____ (Microsoft Corporation) C:\Windows\system32\CbtBackgroundManagerPolicy.dll

2016-12-27 18:26 - 2016-11-11 09:27 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\lpremove.exe

2016-12-27 18:26 - 2016-11-11 09:25 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\DisplayManager.dll

2016-12-27 18:26 - 2016-11-11 09:25 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\Windows.StateRepositoryBroker.dll

2016-12-27 18:26 - 2016-11-11 09:24 - 00158720 _____ (Microsoft Corporation) C:\Windows\system32\VEStoreEventHandlers.dll

2016-12-27 18:26 - 2016-11-11 09:24 - 00122880 _____ (Microsoft Corporation) C:\Windows\system32\Windows.StateRepositoryClient.dll

2016-12-27 18:26 - 2016-11-11 09:24 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\VPNv2CSP.dll

2016-12-27 18:26 - 2016-11-11 09:24 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\browserbroker.dll

2016-12-27 18:26 - 2016-11-11 09:22 - 00211968 _____ (Microsoft Corporation) C:\Windows\system32\InstallAgent.exe

2016-12-27 18:26 - 2016-11-11 09:21 - 00748544 _____ (Microsoft Corporation) C:\Windows\system32\StoreAgent.dll

2016-12-27 18:26 - 2016-11-11 09:20 - 00590336 _____ (Microsoft Corporation) C:\Windows\system32\efswrt.dll

2016-12-27 18:26 - 2016-11-11 09:20 - 00260608 _____ (Microsoft Corporation) C:\Windows\system32\InstallAgentUserBroker.exe

2016-12-27 18:26 - 2016-11-11 09:19 - 00389632 _____ (Microsoft Corporation) C:\Windows\system32\ActivationManager.dll

2016-12-27 18:26 - 2016-11-11 09:16 - 01477632 _____ (Microsoft Corporation) C:\Windows\system32\wsecedit.dll

2016-12-27 18:26 - 2016-11-11 09:16 - 00560128 _____ (Microsoft Corporation) C:\Windows\system32\AppReadiness.dll

2016-12-27 18:26 - 2016-11-11 09:14 - 02104320 _____ (Microsoft Corporation) C:\Windows\system32\wlidsvc.dll

2016-12-27 18:26 - 2016-11-11 09:14 - 00713216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys

2016-12-27 18:26 - 2016-11-11 09:13 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\StorSvc.dll

2016-12-27 18:26 - 2016-11-11 09:12 - 00870912 _____ (Microsoft Corporation) C:\Windows\system32\msdtcprx.dll

2016-12-27 18:26 - 2016-11-11 09:11 - 00870400 _____ (Microsoft Corporation) C:\Windows\system32\mfmkvsrcsnk.dll

2016-12-27 18:26 - 2016-11-11 09:08 - 00539136 _____ (Microsoft Corporation) C:\Windows\system32\PlayToManager.dll

2016-12-27 18:26 - 2016-11-11 09:07 - 00991232 _____ (Microsoft Corporation) C:\Windows\system32\comdlg32.dll

2016-12-27 18:26 - 2016-11-11 09:05 - 04136448 _____ (Microsoft Corporation) C:\Windows\system32\Windows.StateRepository.dll

2016-12-27 18:26 - 2016-11-11 09:05 - 02852864 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsThresholdAdminFlowUI.dll

2016-12-27 18:26 - 2016-11-11 09:05 - 00673792 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe

2016-12-27 18:26 - 2016-11-11 09:04 - 00909312 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Search.dll

2016-12-27 18:26 - 2016-11-11 09:03 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\LogonController.dll

2016-12-27 18:26 - 2016-11-11 09:03 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\wuuhext.dll

2016-12-27 18:26 - 2016-11-11 09:02 - 03542016 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll

2016-12-27 18:26 - 2016-11-11 09:02 - 01726976 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Immersive.dll

2016-12-27 18:26 - 2016-11-11 08:01 - 00167848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscapi.dll

2016-12-27 18:26 - 2016-11-11 07:54 - 00122208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\migisol.dll

2016-12-27 18:26 - 2016-11-11 07:49 - 00263472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Storage.ApplicationData.dll

2016-12-27 18:26 - 2016-11-11 07:48 - 02277248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll

2016-12-27 18:26 - 2016-11-11 07:47 - 05722832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\windows.storage.dll

2016-12-27 18:26 - 2016-11-11 07:47 - 00527880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll

2016-12-27 18:26 - 2016-11-11 07:42 - 03892864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll

2016-12-27 18:26 - 2016-11-11 07:42 - 01123912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll

2016-12-27 18:26 - 2016-11-11 07:42 - 00952416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfsvr.dll

2016-12-27 18:26 - 2016-11-11 07:42 - 00091936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfaudiocnv.dll

2016-12-27 18:26 - 2016-11-11 07:41 - 04311736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe

2016-12-27 18:26 - 2016-11-11 07:41 - 00157536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CloudStorageWizard.exe

2016-12-27 18:26 - 2016-11-11 07:38 - 01263856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll

2016-12-27 18:26 - 2016-11-11 07:25 - 00117248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapsBtSvc.dll

2016-12-27 18:26 - 2016-11-11 07:25 - 00071168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MosStorage.dll

2016-12-27 18:26 - 2016-11-11 07:23 - 00094208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.StateRepositoryClient.dll

2016-12-27 18:26 - 2016-11-11 07:22 - 00505856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcastdvr.exe

2016-12-27 18:26 - 2016-11-11 07:21 - 00332288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapConfiguration.dll

2016-12-27 18:26 - 2016-11-11 07:19 - 00114176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setupugc.exe

2016-12-27 18:26 - 2016-11-11 07:18 - 02333184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll

2016-12-27 18:26 - 2016-11-11 07:17 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe

2016-12-27 18:26 - 2016-11-11 07:15 - 07626752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll

2016-12-27 18:26 - 2016-11-11 07:15 - 01357824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAutomationCore.dll

2016-12-27 18:26 - 2016-11-11 07:15 - 00838144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JpMapControl.dll

2016-12-27 18:26 - 2016-11-11 07:15 - 00348672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\zipfldr.dll

2016-12-27 18:26 - 2016-11-11 07:10 - 06109184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mos.dll

2016-12-27 18:26 - 2016-11-11 07:10 - 00746496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdtcprx.dll

2016-12-27 18:26 - 2016-11-11 07:09 - 05380608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\BingMaps.dll

2016-12-27 18:26 - 2016-11-11 07:09 - 00545280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmkvsrcsnk.dll

2016-12-27 18:26 - 2016-11-11 07:08 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xolehlp.dll

2016-12-27 18:26 - 2016-11-11 07:06 - 02362880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapRouter.dll

2016-12-27 18:26 - 2016-11-11 07:06 - 02109952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapGeocoder.dll

2016-12-27 18:26 - 2016-11-11 07:06 - 00359936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mtxclu.dll

2016-12-27 18:26 - 2016-11-11 07:05 - 04423680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll

2016-12-27 18:26 - 2016-11-11 07:05 - 03370496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.StateRepository.dll

2016-12-27 18:26 - 2016-11-11 07:04 - 01992704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll

2016-12-27 18:26 - 2016-11-11 07:04 - 00912896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comdlg32.dll

2016-12-27 18:26 - 2016-11-11 07:04 - 00715264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapControlCore.dll

2016-12-27 18:26 - 2016-11-11 07:03 - 02484736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gameux.dll

2016-12-27 18:26 - 2016-11-11 07:03 - 01556480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Immersive.dll

2016-12-27 18:26 - 2016-11-11 07:03 - 00760832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NMAA.dll

2016-12-27 18:26 - 2016-11-11 07:02 - 00711680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Search.dll

2016-12-27 18:26 - 2016-11-02 12:01 - 00315744 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll

2016-12-27 18:26 - 2016-11-02 11:22 - 00601712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll

2016-12-27 18:26 - 2016-11-02 11:09 - 02257104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2016-12-27 18:26 - 2016-11-02 11:05 - 00405856 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2016-12-27 18:26 - 2016-11-02 11:03 - 00714592 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vhdmp.sys

2016-12-27 18:26 - 2016-11-02 11:01 - 00545936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontdrvhost.exe

2016-12-27 18:26 - 2016-11-02 10:45 - 00182784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfsensorgroup.dll

2016-12-27 18:26 - 2016-11-02 10:43 - 00198144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FSClient.dll

2016-12-27 18:26 - 2016-11-02 10:42 - 00632832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sud.dll

2016-12-27 18:26 - 20

Back to top

#2 XZY5

Member

Full Member
15 posts

Posted 29 December 2016 - 05:57 AM

Scan logs from my old laptop (Sony VAIO i3)

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 21-12-2016

Ran by upoma-efti (administrator) on UPOMA-EFTI-PC (28-12-2016 22:27:59)

Running from C:\Users\upoma-efti\Downloads

Loaded Profiles: upoma-efti (Available Profiles: upoma-efti & DefaultAppPool)

Platform: Windows 10 Home Version 1607 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe

(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe

(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\avp.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Windows\System32\mqsvc.exe

(Paramount Software UK Ltd) C:\Program Files\Macrium\Reflect\ReflectService.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe

(AMD) C:\Windows\System32\atieclxx.exe

(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\avpui.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(BitTorrent Inc.) C:\Users\upoma-efti\AppData\Roaming\uTorrent\uTorrent.exe

(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

() C:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe

(Ruiware) C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe

(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(BitTorrent Inc.) C:\Users\upoma-efti\AppData\Roaming\uTorrent\updates\3.4.9_43085\utorrentie.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.10.145.0_x64__kzf8qxf38zg5c\SkypeHost.exe

(BitTorrent Inc.) C:\Users\upoma-efti\AppData\Roaming\uTorrent\updates\3.4.9_43085\utorrentie.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\LockAppHost.exe

(Fork, Ltd.) C:\Windows\Prey\wpxsvc.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\smartscreen.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176440 2016-09-09] (Apple Inc.)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-11-04] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [25779624 2016-12-21] (Dropbox, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-09-22] (Oracle Corporation)

HKU\S-1-5-21-1687197661-551072276-2564851244-1000\...\Run: [uTorrent] => C:\Users\upoma-efti\AppData\Roaming\uTorrent\uTorrent.exe [1979072 2016-12-19] (BitTorrent Inc.)

HKU\S-1-5-21-1687197661-551072276-2564851244-1000\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7943072 2016-12-13] (SUPERAntiSpyware)

HKU\S-1-5-21-1687197661-551072276-2564851244-1000\...\Run: [FileHippo.com] => C:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe [2926800 2015-01-27] ()

HKU\S-1-5-21-1687197661-551072276-2564851244-1000\...\Run: [WinPatrol] => C:\Program Files (x86)\Ruiware\WinPatrol\winpatrol.exe [1216648 2015-07-27] (Ruiware)

HKU\S-1-5-21-1687197661-551072276-2564851244-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8944344 2016-09-28] (Piriform Ltd)

HKU\S-1-5-21-1687197661-551072276-2564851244-1000\...\MountPoints2: {4e205d96-826d-11e6-991d-0024bec07c8b} - "E:\startme.exe"

ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt9] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File

ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt10] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt9] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

GroupPolicy: Restriction - Chrome <======= ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Tcpip\..\Interfaces\{2686c023-5fe9-45d6-bc9d-dd5da652213e}: [DhcpNameServer] 192.168.1.1

Tcpip\..\Interfaces\{48ad0809-ef32-4f29-afdd-71e1660bdca9}: [DhcpNameServer] 192.168.1.1

Internet Explorer:

==================

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

SearchScopes: HKLM -> {31090377-0740-419E-BEFC-A56E50500D5B} URL =

SearchScopes: HKU\S-1-5-21-1687197661-551072276-2564851244-1000 -> {0B69DF57-5D50-42C1-ACDB-0FEEAF5A8A0B} URL =

SearchScopes: HKU\S-1-5-21-1687197661-551072276-2564851244-1000 -> {31090377-0740-419E-BEFC-A56E50500D5B} URL =

BHO: Kaspersky Protection -> {03993315-5CE9-4F00-8790-D14A94F1D91A} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\x64\IEExt\ie_plugin.dll [2016-12-02] (AO Kaspersky Lab)

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2016-12-09] (Microsoft Corporation)

BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_112\bin\ssv.dll [2016-11-06] (Oracle Corporation)

BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2016-12-09] (Microsoft Corporation)

BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_112\bin\jp2ssv.dll [2016-11-06] (Oracle Corporation)

BHO-x32: Kaspersky Protection -> {03993315-5CE9-4F00-8790-D14A94F1D91A} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\IEExt\ie_plugin.dll [2016-12-02] (AO Kaspersky Lab)

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2016-12-09] (Microsoft Corporation)

BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2016-12-09] (Microsoft Corporation)

Toolbar: HKLM - Kaspersky Protection Toolbar - {001032CB-B0AC-4F2C-A650-AD4B2B26E5DA} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\x64\IEExt\ie_plugin.dll [2016-12-02] (AO Kaspersky Lab)

Toolbar: HKLM-x32 - Kaspersky Protection Toolbar - {001032CB-B0AC-4F2C-A650-AD4B2B26E5DA} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\IEExt\ie_plugin.dll [2016-12-02] (AO Kaspersky Lab)

Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-09] (Microsoft Corporation)

Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-09] (Microsoft Corporation)

Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-09] (Microsoft Corporation)

Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-09] (Microsoft Corporation)

FireFox:

========

FF ProfilePath: C:\Users\upoma-efti\AppData\Roaming\Mozilla\Firefox\Profiles\bwhtxa25.default-1482336262565 [2016-12-26]

FF HKLM-x32\...\Firefox\Extensions: [light_plugin_ACF0E80077C511E59DED005056C00008@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\FFExt\light_plugin_firefox\addon.xpi

FF Extension: (Kaspersky Protection) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\FFExt\light_plugin_firefox\addon.xpi [2016-12-02]

FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_24_0_0_186.dll [2016-12-22] ()

FF Plugin: @java.com/DTPlugin,version=11.112.2 -> C:\Program Files\Java\jre1.8.0_112\bin\dtplugin\npDeployJava1.dll [2016-11-06] (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=11.112.2 -> C:\Program Files\Java\jre1.8.0_112\bin\plugin2\npjp2.dll [2016-11-06] (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_24_0_0_186.dll [2016-12-22] ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1225195.dll [2016-09-20] (Adobe Systems, Inc.)

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-12-09] (Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-12-09] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-22] (VideoLAN)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-09-30] (Adobe Systems Inc.)

Chrome:

=======

CHR DefaultProfile: Default

CHR HomePage: Default -> hxxps://www.google.co.uk/

CHR StartupUrls: Default -> "hxxp://www.google.co.uk/"

CHR Profile: C:\Users\upoma-efti\AppData\Local\Google\Chrome\User Data\Default [2016-12-28]

CHR Extension: (Google Docs) - C:\Users\upoma-efti\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-05]

CHR Extension: (Google Drive) - C:\Users\upoma-efti\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-25]

CHR Extension: (YouTube) - C:\Users\upoma-efti\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24]

CHR Extension: (Google Search) - C:\Users\upoma-efti\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]

CHR Extension: (Session Buddy) - C:\Users\upoma-efti\AppData\Local\Google\Chrome\User Data\Default\Extensions\edacconmaakjimmfgnblocblbcdcpbko [2016-11-18]

CHR Extension: (Google Docs Offline) - C:\Users\upoma-efti\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-15]

CHR Extension: (WhatsApp™ Messenger) - C:\Users\upoma-efti\AppData\Local\Google\Chrome\User Data\Default\Extensions\infelompnbbancffeibkenmdbbmpoged [2016-11-22]

CHR Extension: (LINE) - C:\Users\upoma-efti\AppData\Local\Google\Chrome\User Data\Default\Extensions\menkifleemblimdogmoihpfopnplikde [2016-12-02]

CHR Extension: (Office Online) - C:\Users\upoma-efti\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndjpnladcallmjemlbaebfadecfhkepb [2016-10-15]

CHR Extension: (Chrome Web Store Payments) - C:\Users\upoma-efti\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-04]

CHR Extension: (Gmail) - C:\Users\upoma-efti\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-28]

CHR Extension: (Chrome Media Router) - C:\Users\upoma-efti\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-12-16]

CHR HKLM\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - hxxps://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa

CHR HKLM\...\Chrome\Extension: [lpeeaghdjmhlakojjcgfdhgcejdaefmi] - hxxps://chrome.google.com/webstore/detail/lpeeaghdjmhlakojjcgfdhgcejdaefmi

CHR HKU\S-1-5-21-1687197661-551072276-2564851244-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bakijjialdiiboeaknfpmflphhmljfkd] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - hxxps://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa

CHR HKLM-x32\...\Chrome\Extension: [lpeeaghdjmhlakojjcgfdhgcejdaefmi] - hxxps://chrome.google.com/webstore/detail/lpeeaghdjmhlakojjcgfdhgcejdaefmi

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-07-22] (SUPERAntiSpyware.com)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-08-05] (Apple Inc.)

R2 AVP16.0.1; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\avp.exe [236928 2015-12-22] (AO Kaspersky Lab)

R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [2946304 2016-12-09] (Microsoft Corporation)

R2 CronService; C:\Windows\Prey\wpxsvc.exe [611854 2016-04-18] (Fork, Ltd.) [File not signed]

S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-05] (Dropbox, Inc.)

S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-05] (Dropbox, Inc.)

R2 DbxSvc; C:\WINDOWS\system32\DbxSvc.exe [42096 2016-12-21] (Dropbox, Inc.)

S3 klvssbrigde64; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.1\x64\vssbridge64.exe [152488 2015-12-22] (AO Kaspersky Lab)

R2 ReflectService.exe; C:\Program Files\Macrium\Reflect\ReflectService.exe [3764472 2016-09-07] (Paramount Software UK Ltd)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R0 cm_km; C:\WINDOWS\System32\DRIVERS\cm_km.sys [389816 2015-07-05] (Kaspersky Lab ZAO)

R2 IntelHaxm; C:\WINDOWS\System32\DRIVERS\IntelHaxm.sys [91392 2014-03-14] ()

R0 kl1; C:\WINDOWS\System32\DRIVERS\kl1.sys [478392 2015-09-11] (Kaspersky Lab ZAO)

R0 klbackupdisk; C:\WINDOWS\System32\DRIVERS\klbackupdisk.sys [53432 2015-06-06] (Kaspersky Lab ZAO)

R1 klbackupflt; C:\WINDOWS\System32\DRIVERS\klbackupflt.sys [79752 2015-12-01] (AO Kaspersky Lab)

R2 kldisk; C:\WINDOWS\system32\DRIVERS\kldisk.sys [78200 2015-12-01] (AO Kaspersky Lab)

S0 klelam; C:\WINDOWS\System32\DRIVERS\klelam.sys [30328 2015-06-24] (Kaspersky Lab)

R3 klflt; C:\WINDOWS\system32\DRIVERS\klflt.sys [182664 2015-12-11] (AO Kaspersky Lab)

R1 klhk; C:\WINDOWS\System32\drivers\klhk.sys [237912 2016-12-02] (AO Kaspersky Lab)

R3 klids; C:\ProgramData\Kaspersky Lab\AVP16.0.1\Bases\klids.sys [182360 2016-12-03] (AO Kaspersky Lab)

R1 KLIF; C:\WINDOWS\System32\DRIVERS\klif.sys [992600 2016-08-23] (AO Kaspersky Lab)

R1 KLIM6; C:\WINDOWS\system32\DRIVERS\klim6.sys [51288 2016-04-29] (AO Kaspersky Lab)

R3 klkbdflt; C:\WINDOWS\system32\DRIVERS\klkbdflt.sys [52608 2015-11-11] (AO Kaspersky Lab)

R3 klmouflt; C:\WINDOWS\system32\DRIVERS\klmouflt.sys [41656 2015-06-07] (Kaspersky Lab ZAO)

R1 klpd; C:\WINDOWS\System32\DRIVERS\klpd.sys [45960 2015-12-07] (AO Kaspersky Lab)

R1 klwfp; C:\WINDOWS\system32\DRIVERS\klwfp.sys [87984 2016-08-23] (AO Kaspersky Lab)

R1 Klwtp; C:\WINDOWS\system32\DRIVERS\klwtp.sys [110424 2016-08-23] (AO Kaspersky Lab)

R1 kneps; C:\WINDOWS\system32\DRIVERS\kneps.sys [194440 2015-12-02] (AO Kaspersky Lab)

S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()

R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

R1 VBoxNetAdp; C:\WINDOWS\System32\drivers\VBoxNetAdp6.sys [127456 2016-03-04] (Oracle Corporation)

R1 VBoxNetLwf; C:\WINDOWS\system32\DRIVERS\VBoxNetLwf.sys [205784 2016-03-04] (Oracle Corporation)

S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)

S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)

S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)

R3 ykinw8; C:\WINDOWS\System32\drivers\ykinx64.sys [288768 2016-07-16] (Marvell)

S3 dbx; system32\DRIVERS\dbx.sys [X]

U3 idsvc; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-12-28 22:27 - 2016-12-28 22:30 - 00022421 _____ C:\Users\upoma-efti\Downloads\FRST.txt

2016-12-28 22:27 - 2016-12-28 22:27 - 00899072 _____ C:\Users\upoma-efti\Downloads\RGSA.exe

2016-12-28 22:27 - 2016-12-28 22:27 - 00000000 ____D C:\FRST

2016-12-28 22:24 - 2016-12-28 22:27 - 02420736 _____ (Farbar) C:\Users\upoma-efti\Downloads\FRST64.exe

2016-12-27 18:37 - 2016-12-27 23:07 - 00000000 ____D C:\Users\upoma-efti\Desktop\To new laptop

2016-12-23 21:06 - 2016-12-26 21:26 - 00000000 ____D C:\Users\upoma-efti\AppData\LocalLow\Mozilla

2016-12-22 00:46 - 2016-12-22 00:46 - 20364888 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerInstaller.exe

2016-12-21 23:45 - 2016-12-21 23:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox

2016-12-21 18:15 - 2016-12-21 18:15 - 00075888 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-stable.sys

2016-12-21 18:15 - 2016-12-21 18:15 - 00075888 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-dev.sys

2016-12-21 18:15 - 2016-12-21 18:15 - 00075888 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-canary.sys

2016-12-21 18:15 - 2016-12-21 18:15 - 00042096 _____ (Dropbox, Inc.) C:\WINDOWS\system32\DbxSvc.exe

2016-12-21 16:52 - 2016-12-24 19:38 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2016-12-19 19:49 - 2016-12-27 15:34 - 00000000 ____D C:\Users\upoma-efti\AppData\LocalLow\uTorrent

2016-12-17 17:57 - 2016-12-11 23:56 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2016-12-17 17:57 - 2016-12-11 23:56 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2016-12-14 21:23 - 2016-12-09 10:15 - 08168000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll

2016-12-14 21:23 - 2016-12-09 09:30 - 04612608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll

2016-12-14 21:22 - 2016-12-09 10:32 - 07816032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2016-12-14 21:22 - 2016-12-09 10:29 - 02681200 _____ C:\WINDOWS\system32\CoreUIComponents.dll

2016-12-14 21:22 - 2016-12-09 10:19 - 01293152 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll

2016-12-14 21:22 - 2016-12-09 10:18 - 01100128 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe

2016-12-14 21:22 - 2016-12-09 10:18 - 00989024 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe

2016-12-14 21:22 - 2016-12-09 10:18 - 00947552 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.efi

2016-12-14 21:22 - 2016-12-09 10:18 - 00811872 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.exe

2016-12-14 21:22 - 2016-12-09 10:15 - 01988560 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll

2016-12-14 21:22 - 2016-12-09 10:14 - 01274712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll

2016-12-14 21:22 - 2016-12-09 10:01 - 02323728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll

2016-12-14 21:22 - 2016-12-09 10:01 - 01503544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll

2016-12-14 21:22 - 2016-12-09 09:57 - 01852720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll

2016-12-14 21:22 - 2016-12-09 09:52 - 01435896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll

2016-12-14 21:22 - 2016-12-09 09:51 - 00117240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll

2016-12-14 21:22 - 2016-12-09 09:45 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\WordBreakers.dll

2016-12-14 21:22 - 2016-12-09 09:41 - 00032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WordBreakers.dll

2016-12-14 21:22 - 2016-12-09 09:38 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll

2016-12-14 21:22 - 2016-12-09 09:37 - 00411136 _____ (Microsoft Corporation) C:\WINDOWS\system32\facecredentialprovider.dll

2016-12-14 21:22 - 2016-12-09 09:36 - 06285312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll

2016-12-14 21:22 - 2016-12-09 09:36 - 03059200 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll

2016-12-14 21:22 - 2016-12-09 09:36 - 00425984 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll

2016-12-14 21:22 - 2016-12-09 09:36 - 00410112 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll

2016-12-14 21:22 - 2016-12-09 09:33 - 03777536 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll

2016-12-14 21:22 - 2016-12-09 09:33 - 01589760 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtctm.dll

2016-12-14 21:22 - 2016-12-09 09:31 - 00313856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll

2016-12-14 21:22 - 2016-12-09 09:28 - 03306496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll

2016-12-14 21:22 - 2016-12-09 09:27 - 13084160 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2016-12-14 21:22 - 2016-12-09 09:27 - 00981504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll

2016-12-14 21:22 - 2016-12-09 09:26 - 01692672 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll

2016-12-14 21:22 - 2016-12-09 09:24 - 02275840 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll

2016-12-14 21:22 - 2016-12-09 09:22 - 02820096 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll

2016-12-14 21:22 - 2016-12-09 09:22 - 02688512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll

2016-12-14 21:22 - 2016-12-09 09:19 - 01121280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll

2016-12-14 21:22 - 2016-12-09 09:19 - 00433664 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll

2016-12-14 21:22 - 2016-12-09 09:19 - 00261120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll

2016-12-14 21:22 - 2016-12-09 09:19 - 00119296 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll

2016-12-14 21:22 - 2016-12-09 09:19 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditBufferTestHook.dll

2016-12-14 21:22 - 2016-12-09 09:18 - 02138112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll

2016-12-14 21:22 - 2016-12-09 09:16 - 00353280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TextInputFramework.dll

2016-12-14 21:22 - 2016-12-09 09:15 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll

2016-12-14 21:22 - 2016-12-09 09:15 - 00092672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputLocaleManager.dll

2016-12-14 21:22 - 2016-12-09 09:15 - 00068096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EditBufferTestHook.dll

2016-12-14 21:21 - 2016-12-09 10:42 - 01637728 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll

2016-12-14 21:21 - 2016-12-09 10:42 - 00137568 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll

2016-12-14 21:21 - 2016-12-09 10:34 - 01051112 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi

2016-12-14 21:21 - 2016-12-09 10:34 - 00894096 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe

2016-12-14 21:21 - 2016-12-09 10:33 - 01354320 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi

2016-12-14 21:21 - 2016-12-09 10:33 - 01173496 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe

2016-12-14 21:21 - 2016-12-09 10:30 - 00377184 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys

2016-12-14 21:21 - 2016-12-09 10:28 - 00764392 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll

2016-12-14 21:21 - 2016-12-09 10:20 - 02677544 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll

2016-12-14 21:21 - 2016-12-09 10:19 - 00168424 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcrypt.dll

2016-12-14 21:21 - 2016-12-09 10:18 - 02913144 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll

2016-12-14 21:21 - 2016-12-09 10:18 - 01267512 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll

2016-12-14 21:21 - 2016-12-09 10:18 - 00624048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys

2016-12-14 21:21 - 2016-12-09 10:14 - 00241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHost.dll

2016-12-14 21:21 - 2016-12-09 10:10 - 01572768 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll

2016-12-14 21:21 - 2016-12-09 10:10 - 01461200 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll

2016-12-14 21:21 - 2016-12-09 10:09 - 00455520 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe

2016-12-14 21:21 - 2016-12-09 10:01 - 00861024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll

2016-12-14 21:21 - 2016-12-09 10:00 - 00106896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcrypt.dll

2016-12-14 21:21 - 2016-12-09 09:59 - 02166752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll

2016-12-14 21:21 - 2016-12-09 09:59 - 00846560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll

2016-12-14 21:21 - 2016-12-09 09:57 - 06668040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll

2016-12-14 21:21 - 2016-12-09 09:52 - 01415752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll

2016-12-14 21:21 - 2016-12-09 09:47 - 22563328 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll

2016-12-14 21:21 - 2016-12-09 09:45 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2016-12-14 21:21 - 2016-12-09 09:41 - 00380928 _____ (Microsoft Corporation) C:\WINDOWS\system32\wincorlib.dll

2016-12-14 21:21 - 2016-12-09 09:40 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys

2016-12-14 21:21 - 2016-12-09 09:37 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll

2016-12-14 21:21 - 2016-12-09 09:34 - 00288768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wincorlib.dll

2016-12-14 21:21 - 2016-12-09 09:31 - 03689984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll

2016-12-14 21:21 - 2016-12-09 09:30 - 23677952 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2016-12-14 21:21 - 2016-12-09 09:30 - 19413504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll

2016-12-14 21:21 - 2016-12-09 09:29 - 04749312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll

2016-12-14 21:21 - 2016-12-09 09:28 - 01004544 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll

2016-12-14 21:21 - 2016-12-09 09:27 - 19417088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2016-12-14 21:21 - 2016-12-09 09:27 - 05114368 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll

2016-12-14 21:21 - 2016-12-09 09:26 - 08129536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll

2016-12-14 21:21 - 2016-12-09 09:23 - 12177920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2016-12-14 21:21 - 2016-12-09 09:22 - 01490944 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll

2016-12-14 21:21 - 2016-12-09 09:21 - 04746752 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2016-12-14 21:21 - 2016-12-09 09:21 - 03616768 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys

2016-12-14 21:21 - 2016-12-09 09:21 - 00716800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ShareHost.dll

2016-12-14 21:21 - 2016-12-09 09:20 - 06044160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll

2016-12-14 21:21 - 2016-12-09 09:20 - 03198464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll

2016-12-14 21:21 - 2016-12-09 09:20 - 00187392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll

2016-12-14 21:21 - 2016-12-09 09:20 - 00172544 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceEnroller.exe

2016-12-14 21:21 - 2016-12-09 09:18 - 00165376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mdmregistration.dll

2016-12-14 21:21 - 2016-12-09 09:17 - 00886272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll

2016-12-14 21:21 - 2016-12-09 09:17 - 00566784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ShareHost.dll

2016-12-14 21:21 - 2016-12-09 09:16 - 02998272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys

2016-12-14 21:21 - 2016-12-09 09:16 - 01880576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll

2016-12-14 21:21 - 2016-12-09 08:54 - 00483840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll

2016-12-14 21:20 - 2016-12-09 10:27 - 00172528 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspicli.dll

2016-12-14 21:20 - 2016-12-09 10:20 - 02189664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys

2016-12-14 21:20 - 2016-12-09 10:20 - 01738560 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll

2016-12-14 21:20 - 2016-12-09 10:20 - 00658784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys

2016-12-14 21:20 - 2016-12-09 10:20 - 00402272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys

2016-12-14 21:20 - 2016-12-09 10:11 - 02048496 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll

2016-12-14 21:20 - 2016-12-09 09:56 - 00959112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll

2016-12-14 21:20 - 2016-12-09 09:42 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdd.dll

2016-12-14 21:20 - 2016-12-09 09:37 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll

2016-12-14 21:20 - 2016-12-09 09:36 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll

2016-12-14 21:20 - 2016-12-09 09:34 - 00822784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll

2016-12-14 21:20 - 2016-12-09 09:32 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll

2016-12-14 21:20 - 2016-12-09 09:31 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll

2016-12-14 21:20 - 2016-12-09 09:25 - 00376832 _____ (Microsoft Corporation) C:\WINDOWS\system32\CryptoWinRT.dll

2016-12-14 21:20 - 2016-12-09 09:21 - 01512960 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys

2016-12-14 21:20 - 2016-12-09 09:20 - 00730624 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll

2016-12-14 21:20 - 2016-12-09 09:18 - 03666432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2016-12-09 21:19 - 2016-11-11 09:57 - 22224480 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2016-12-09 21:19 - 2016-11-11 09:18 - 17188352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll

2016-12-09 21:18 - 2016-11-11 10:22 - 00590960 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll

2016-12-09 21:18 - 2016-11-11 10:14 - 00603488 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContentDeliveryManager.Utilities.dll

2016-12-09 21:18 - 2016-11-11 10:13 - 01886344 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll

2016-12-09 21:18 - 2016-11-11 10:13 - 00352096 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fastfat.sys

2016-12-09 21:18 - 2016-11-11 10:12 - 00128352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\partmgr.sys

2016-12-09 21:18 - 2016-11-11 10:03 - 01069720 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll

2016-12-09 21:18 - 2016-11-11 10:03 - 00266544 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll

2016-12-09 21:18 - 2016-11-11 10:01 - 01859264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll

2016-12-09 21:18 - 2016-11-11 09:56 - 00534096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll

2016-12-09 21:18 - 2016-11-11 09:56 - 00424616 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFPlay.dll

2016-12-09 21:18 - 2016-11-11 09:56 - 00418952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll

2016-12-09 21:18 - 2016-11-11 09:56 - 00163752 _____ (Microsoft Corporation) C:\WINDOWS\system32\RTWorkQ.dll

2016-12-09 21:18 - 2016-11-11 09:29 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll

2016-12-09 21:18 - 2016-11-11 09:25 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcertinst.exe

2016-12-09 21:18 - 2016-11-11 09:25 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\system32\HttpsDataSource.dll

2016-12-09 21:18 - 2016-11-11 09:24 - 00098304 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll

2016-12-09 21:18 - 2016-11-11 09:22 - 00211968 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe

2016-12-09 21:18 - 2016-11-11 09:21 - 00748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll

2016-12-09 21:18 - 2016-11-11 09:21 - 00379392 _____ (Microsoft Corporation) C:\WINDOWS\system32\apprepsync.dll

2016-12-09 21:18 - 2016-11-11 09:21 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\domgmt.dll

2016-12-09 21:18 - 2016-11-11 09:20 - 00260608 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe

2016-12-09 21:18 - 2016-11-11 09:14 - 00615424 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnprv.dll

2016-12-09 21:18 - 2016-11-11 09:11 - 00942080 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll

2016-12-09 21:18 - 2016-11-11 09:08 - 00539136 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToManager.dll

2016-12-09 21:18 - 2016-11-11 09:07 - 00347648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rascustom.dll

2016-12-09 21:18 - 2016-11-11 09:04 - 01232384 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll

2016-12-09 21:18 - 2016-11-11 09:04 - 00455168 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll

2016-12-09 21:18 - 2016-11-11 07:49 - 00263472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll

2016-12-09 21:18 - 2016-11-11 07:48 - 02277248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll

2016-12-09 21:18 - 2016-11-11 07:47 - 00527880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll

2016-12-09 21:18 - 2016-11-11 07:42 - 03892864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll

2016-12-09 21:18 - 2016-11-11 07:42 - 01123912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll

2016-12-09 21:18 - 2016-11-11 07:42 - 00952416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll

2016-12-09 21:18 - 2016-11-11 07:42 - 00091936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfaudiocnv.dll

2016-12-09 21:18 - 2016-11-11 07:41 - 00157536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudStorageWizard.exe

2016-12-09 21:18 - 2016-11-11 07:25 - 00117248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapsBtSvc.dll

2016-12-09 21:18 - 2016-11-11 07:25 - 00071168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosStorage.dll

2016-12-09 21:18 - 2016-11-11 07:21 - 00332288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll

2016-12-09 21:18 - 2016-11-11 07:19 - 01755136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DeviceFlows.DataModel.dll

2016-12-09 21:18 - 2016-11-11 07:18 - 02333184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmSvc.dll

2016-12-09 21:18 - 2016-11-11 07:17 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSManHTTPConfig.exe

2016-12-09 21:18 - 2016-11-11 07:15 - 01357824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCore.dll

2016-12-09 21:18 - 2016-11-11 07:15 - 00838144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JpMapControl.dll

2016-12-09 21:18 - 2016-11-11 07:10 - 06109184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll

2016-12-09 21:18 - 2016-11-11 07:09 - 05380608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll

2016-12-09 21:18 - 2016-11-11 07:09 - 00545280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmkvsrcsnk.dll

2016-12-09 21:18 - 2016-11-11 07:06 - 02362880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapRouter.dll

2016-12-09 21:18 - 2016-11-11 07:06 - 02109952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapGeocoder.dll

2016-12-09 21:18 - 2016-11-11 07:05 - 04423680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll

2016-12-09 21:18 - 2016-11-11 07:05 - 03370496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepository.dll

2016-12-09 21:18 - 2016-11-11 07:04 - 01992704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll

2016-12-09 21:18 - 2016-11-11 07:04 - 00912896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.dll

2016-12-09 21:18 - 2016-11-11 07:04 - 00715264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlCore.dll

2016-12-09 21:18 - 2016-11-11 07:03 - 00760832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NMAA.dll

2016-12-09 21:17 - 2016-11-11 10:14 - 02482280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll

2016-12-09 21:17 - 2016-11-11 10:14 - 02186896 _____ (Microsoft Corporation) C:\WINDOWS\system32\hevcdecoder.dll

2016-12-09 21:17 - 2016-11-11 09:26 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseModernAppMgmtCSP.dll

2016-12-09 21:17 - 2016-11-11 09:26 - 00109056 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReportingCSP.dll

2016-12-09 21:17 - 2016-11-11 09:24 - 00110080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.BackgroundManagerPolicy.dll

2016-12-09 21:17 - 2016-11-11 09:23 - 00041472 _____ (Microsoft Corporation) C:\WINDOWS\system32\EAMProgressHandler.dll

2016-12-09 21:17 - 2016-11-11 09:22 - 00143360 _____ (Microsoft Corporation) C:\WINDOWS\system32\EDPCleanup.exe

2016-12-09 21:17 - 2016-11-11 09:20 - 00574464 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_StorageSense.dll

2016-12-09 21:17 - 2016-11-11 09:20 - 00407552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Management.dll

2016-12-09 21:17 - 2016-11-11 09:20 - 00176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\apprepapi.dll

2016-12-09 21:17 - 2016-11-11 09:19 - 00389632 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActivationManager.dll

2016-12-09 21:17 - 2016-11-11 09:19 - 00366080 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchFolder.dll

2016-12-09 21:17 - 2016-11-11 09:19 - 00320000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2016-12-09 21:17 - 2016-11-11 09:19 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseAppMgmtSvc.dll

2016-12-09 21:17 - 2016-11-11 09:13 - 00306176 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtcuiu.dll

2016-12-09 21:17 - 2016-11-11 09:11 - 00337920 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll

2016-12-09 21:17 - 2016-11-11 09:06 - 00650752 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll

2016-12-09 21:17 - 2016-11-11 09:04 - 02800128 _____ (Microsoft Corporation) C:\WINDOWS\system32\netshell.dll

2016-12-09 21:17 - 2016-11-11 09:03 - 00842240 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntshrui.dll

2016-12-09 21:17 - 2016-11-11 07:24 - 00138240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DisplayManager.dll

2016-12-09 21:17 - 2016-11-11 07:23 - 00094208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryClient.dll

2016-12-09 21:17 - 2016-11-11 07:19 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apprepsync.dll

2016-12-09 21:17 - 2016-11-11 07:19 - 00125952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apprepapi.dll

2016-12-09 21:17 - 2016-11-11 07:15 - 00348672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\zipfldr.dll

2016-12-09 21:17 - 2016-11-11 07:04 - 02682880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netshell.dll

2016-12-09 21:16 - 2016-11-11 10:02 - 02828376 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll

2016-12-09 21:16 - 2016-11-11 09:20 - 00641024 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngccredprov.dll

2016-12-09 21:16 - 2016-11-11 09:18 - 02084352 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceFlows.DataModel.dll

2016-12-09 21:16 - 2016-11-11 09:16 - 00560128 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppReadiness.dll

2016-12-09 21:16 - 2016-11-11 09:14 - 02104320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll

2016-12-09 21:16 - 2016-11-11 09:07 - 02510848 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll

2016-12-09 21:16 - 2016-11-11 09:05 - 04136448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll

2016-12-09 21:16 - 2016-11-11 09:04 - 00909312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll

2016-12-09 21:16 - 2016-11-11 07:42 - 00382784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll

2016-12-09 21:16 - 2016-11-11 07:38 - 01263856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll

2016-12-09 21:15 - 2016-11-11 10:01 - 00637400 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll

2016-12-09 21:15 - 2016-11-11 09:23 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnr.dll

2016-12-09 21:15 - 2016-11-11 09:16 - 00184832 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscsvc.dll

2016-12-09 21:15 - 2016-11-11 09:05 - 02852864 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsThresholdAdminFlowUI.dll

2016-12-09 21:15 - 2016-11-11 09:02 - 03542016 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll

2016-12-09 21:15 - 2016-11-11 08:39 - 00484584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll

2016-12-09 21:15 - 2016-11-11 07:22 - 00505856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.exe

2016-12-09 21:14 - 2016-11-11 10:15 - 00198856 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscapi.dll

2016-12-09 21:14 - 2016-11-11 10:02 - 00360040 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe

2016-12-09 21:14 - 2016-11-11 09:51 - 00454592 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe

2016-12-09 21:14 - 2016-11-11 09:31 - 00366080 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXTaskFactory.dll

2016-12-09 21:14 - 2016-11-11 09:26 - 00258560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\xboxgip.sys

2016-12-09 21:14 - 2016-11-11 09:25 - 00073216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryBroker.dll

2016-12-09 21:14 - 2016-11-11 09:24 - 00158720 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEStoreEventHandlers.dll

2016-12-09 21:14 - 2016-11-11 09:24 - 00122880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryClient.dll

2016-12-09 21:14 - 2016-11-11 09:23 - 00058880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Shell.Search.UriHandler.dll

2016-12-09 21:14 - 2016-11-11 09:20 - 00381952 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptngc.dll

2016-12-09 21:14 - 2016-11-11 09:18 - 00278016 _____ (Microsoft Corporation) C:\WINDOWS\system32\netplwiz.dll

2016-12-09 21:14 - 2016-11-11 09:17 - 01220096 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscui.cpl

2016-12-09 21:14 - 2016-11-11 09:15 - 00159232 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscinterop.dll

2016-12-09 21:14 - 2016-11-11 09:04 - 01359360 _____ (Microsoft Corporation) C:\WINDOWS\system32\usercpl.dll

2016-12-09 21:14 - 2016-11-11 07:42 - 00152416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RTWorkQ.dll

2016-12-09 21:14 - 2016-11-11 07:24 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BcastDVRHelper.dll

2016-12-09 21:14 - 2016-11-11 07:23 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppCapture.dll

2016-12-09 21:14 - 2016-11-11 07:18 - 01336320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsecedit.dll

2016-12-09 21:14 - 2016-11-11 07:18 - 00431616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\efswrt.dll

2016-12-09 21:14 - 2016-11-11 07:17 - 00333312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActivationManager.dll

2016-12-09 21:14 - 2016-11-11 07:06 - 01228288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usercpl.dll

2016-12-09 21:14 - 2016-11-11 07:06 - 00400384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToManager.dll

2016-12-09 21:13 - 2016-11-11 09:55 - 01600624 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll

2016-12-09 21:13 - 2016-11-11 07:19 - 13868544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll

2016-12-09 21:13 - 2016-11-11 07:15 - 07626752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll

2016-12-09 21:12 - 2016-11-11 10:00 - 00219488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tpm.sys

2016-12-09 21:12 - 2016-11-11 09:55 - 00882680 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeManagerObj.dll

2016-12-09 21:12 - 2016-11-11 09:55 - 00743224 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll

2016-12-09 21:12 - 2016-11-11 09:54 - 01418312 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll

2016-12-09 21:12 - 2016-11-11 09:24 - 00159744 _____ (Microsoft Corporation) C:\WINDOWS\system32\ACPBackgroundManagerPolicy.dll

2016-12-09 21:12 - 2016-11-11 09:20 - 00339456 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpusersvc.dll

2016-12-09 21:12 - 2016-11-11 09:19 - 00411648 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpsvc.dll

2016-12-09 21:12 - 2016-11-11 09:16 - 01477632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsecedit.dll

2016-12-09 21:12 - 2016-11-11 09:09 - 01366016 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpncore.dll

2016-12-09 21:12 - 2016-11-11 09:07 - 02009600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRHInproc.dll

2016-12-09 21:12 - 2016-11-11 09:07 - 00991232 _____ (Microsoft Corporation) C:\WINDOWS\system32\comdlg32.dll

2016-12-09 21:12 - 2016-11-11 09:06 - 00960000 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll

2016-12-09 21:12 - 2016-11-11 09:03 - 00717824 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll

2016-12-09 21:12 - 2016-11-11 09:02 - 01726976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll

2016-12-09 21:12 - 2016-11-11 07:59 - 01572768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll

2016-12-09 21:12 - 2016-11-11 07:49 - 00869848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll

2016-12-09 21:12 - 2016-11-11 07:41 - 04311736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe

2016-12-09 21:12 - 2016-11-11 07:04 - 01595392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2016-12-09 21:12 - 2016-11-11 07:03 - 02256384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2016-12-09 21:12 - 2016-11-11 07:02 - 00711680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll

2016-12-09 21:11 - 2016-11-11 10:15 - 00101216 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceReactivation.dll

2016-12-09 21:11 - 2016-11-11 10:13 - 02213760 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll

2016-12-09 21:11 - 2016-11-11 10:01 - 07219672 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll

2016-12-09 21:11 - 2016-11-11 09:57 - 04130432 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll

2016-12-09 21:11 - 2016-11-11 09:56 - 01062480 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll

2016-12-09 21:11 - 2016-11-11 09:27 - 00068096 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpremove.exe

2016-12-09 21:11 - 2016-11-11 09:26 - 00042496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\modem.sys

2016-12-09 21:11 - 2016-11-11 09:24 - 00107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\VPNv2CSP.dll

2016-12-09 21:11 - 2016-11-11 09:17 - 01002496 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll

2016-12-09 21:11 - 2016-11-11 09:16 - 00161792 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeHelper.dll

2016-12-09 21:11 - 2016-11-11 09:13 - 00396800 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll

2016-12-09 21:11 - 2016-11-11 09:05 - 00673792 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe

2016-12-09 21:11 - 2016-11-11 09:03 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll

2016-12-09 21:11 - 2016-11-11 08:00 - 01706488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll

2016-12-09 21:11 - 2016-11-11 07:49 - 00248480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll

2016-12-09 21:11 - 2016-11-11 07:47 - 05722832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll

2016-12-09 21:11 - 2016-11-11 07:28 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll

2016-12-09 21:11 - 2016-11-11 07:27 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe

2016-12-09 21:11 - 2016-11-11 07:24 - 00047104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Shell.Search.UriHandler.dll

2016-12-09 21:11 - 2016-11-11 07:22 - 00122880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sendmail.dll

2016-12-09 21:11 - 2016-11-11 07:21 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.BackgroundManagerPolicy.dll

2016-12-09 21:11 - 2016-11-11 07:19 - 00506880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DevicePairing.dll

2016-12-09 21:11 - 2016-11-11 07:19 - 00298496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Management.dll

2016-12-09 21:11 - 2016-11-11 07:18 - 00318464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchFolder.dll

2016-12-09 21:11 - 2016-11-11 07:14 - 00395264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmenrollengine.dll

2016-12-09 21:11 - 2016-11-11 07:10 - 00746496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msdtcprx.dll

2016-12-09 21:11 - 2016-11-11 07:08 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xolehlp.dll

2016-12-09 21:11 - 2016-11-11 07:06 - 06474752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mspaint.exe

2016-12-09 21:11 - 2016-11-11 07:06 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mtxclu.dll

2016-12-09 21:11 - 2016-11-11 07:04 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\stobject.dll

2016-12-09 21:11 - 2016-11-11 07:03 - 02484736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gameux.dll

2016-12-09 21:11 - 2016-11-11 07:03 - 01576448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll

2016-12-09 21:11 - 2016-11-11 07:03 - 01556480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll

2016-12-09 21:11 - 2016-11-11 07:03 - 00565248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasapi32.dll

2016-12-09 21:10 - 2016-11-11 10:08 - 00142176 _____ (Microsoft Corporation) C:\WINDOWS\system32\migisol.dll

2016-12-09 21:10 - 2016-11-11 10:03 - 00328008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll

2016-12-09 21:10 - 2016-11-11 10:00 - 00335712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys

2016-12-09 21:10 - 2016-11-11 09:57 - 01473048 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll

2016-12-09 21:10 - 2016-11-11 09:56 - 00187520 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudStorageWizard.exe

2016-12-09 21:10 - 2016-11-11 09:56 - 00126568 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfaudiocnv.dll

2016-12-09 21:10 - 2016-11-11 09:26 - 00034816 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgentc.exe

2016-12-09 21:10 - 2016-11-11 09:25 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\system32\BcastDVRHelper.dll

2016-12-09 21:10 - 2016-11-11 09:25 - 00185344 _____ (Microsoft Corporation) C:\WINDOWS\system32\DisplayManager.dll

2016-12-09 21:10 - 2016-11-11 09:24 - 00170496 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppCapture.dll

2016-12-09 21:10 - 2016-11-11 09:19 - 09131008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll

2016-12-09 21:10 - 2016-11-11 09:19 - 00620544 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.exe

2016-12-09 21:10 - 2016-11-11 09:19 - 00198144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll

2016-12-09 21:10 - 2016-11-11 09:17 - 00068096 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvSysprep.dll

2016-12-09 21:10 - 2016-11-11 09:16 - 00105984 _____ (Microsoft Corporation) C:\WINDOWS\system32\RjvMDMConfig.dll

2016-12-09 2

Back to top

#3 Android 8888

SWI Malware Tracker

Trusted Advisor*
1,179 posts

Posted 31 December 2016 - 05:23 AM

Hello XZY5.
Welcome to SpywareInfo Forum.
I'm Android 8888 and I'll be helping you. Please ask questions if anything is unclear.

For now let's just take care of your new laptop (Lenovo IdeaPad 310 i7 64-bit). I suggest that you disconnect the old laptop from the router until the new laptop is clean.

Now I suggest printing out each set of instructions or copy them to a Notepad file and reading the entire post before proceeding. It will make following them easier.
Please follow the directions in the order listed.

I highly recommend that you consider uninstalling uTorrent. P2P (Peer-to-Peer) file sharing programs represent a security threat to the information on your system as they allow others to access your system. In many cases P2P programs also represent a risk of infection from the program itself, as some have installed adware/spyware, or other programs without consent. Even if the program itself is clean, many P2P networks are riddled with malware, and it's often the newest, most difficult to remove malware.

There are many risks associated with P2P programs, none are worth the risks. If you don't uninstall the P2P software, we will continue to clean your system, but realize that it's likely only a matter of time before you are infected again.

NOTICE: The script below was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Press the Windows key + r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and click the OK button.

Please copy the entire contents of the code box below.
To do this highlight the contents of the box and right click on it and select Copy.
Paste this into the open Notepad.

Start

CreateRestorePoint:
CloseProcesses:
EmptyTemp:

(SweetLabs, Inc) C:\Users\rubai\AppData\Local\Host App Service\Engine\HostAppServiceUpdater.exe
GroupPolicy: Restriction - Chrome <======= ATTENTION
SearchScopes: HKU\S-1-5-21-249857850-3300716479-2824224529-1001 -> DefaultScope {2EFAACDB-4865-45C6-849A-0F556923BA18} URL =
SearchScopes: HKU\S-1-5-21-249857850-3300716479-2824224529-1001 -> {2EFAACDB-4865-45C6-849A-0F556923BA18} URL =
CHR Extension: (Chrome Web Store Payments) - C:\Users\rubai\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-12-27]
CHR Extension: (Chrome Media Router) - C:\Users\rubai\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-12-27]
S2 0143641482962494mcinstcleanup; C:\Windows\TEMP\014364~1.EXE [961888 2016-05-16] (McAfee, Inc.)
C:\Users\defaultuser0\AppData\Local\Temp\oct836C.tmp.exe
C:\Users\rubai\AppData\Local\Temp\131273518702090365.exe
C:\Users\rubai\AppData\Local\Temp\oct5514.tmp.exe
Task: {A73D3A80-EB22-484B-B667-021B3050A5E7} - System32\Tasks\App Explorer => C:\Users\rubai\AppData\Local\Host App Service\Engine\HostAppServiceUpdater.exe [2016-11-07] (SweetLabs, Inc)
AlternateDataStreams: C:\ProgramData\Temp:5C321E34 [252]

End

Save the files as fixlist.txt in to the same folder as FRST64
Run FRST64 and click Fix only once and wait.
When finished FRST64 will generate a log on the Desktop (fixlog.txt). Please post it to your reply.

NOTE. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.

Please download AdwCleaner by Xplode and save it to your Desktop.

Close all open programs and internet browsers.
Right click on the icon and chose Run as administrator.
Click Yes to accept any security warnings that may appear.
Click I Agree on the disclaimer to accept the Terms of Use.
Click the Scan button to start the scan and wait for the process to complete.
Click the Logfile button and the report will open in Notepad.
NOTE: If you get an error message, it means that nothing was found. Exit from AdwCleaner.
Click on the Clean button and follow the prompts.
A log file will automatically open after the scan has finished and the PC has rebooted.
Please post the content of that log file in your next reply.
You can find the log file at C:\AdwCleaner[Sn].txt (n is a number).

In your next reply please post:
The fixlog.txt of the FRST tool (which should be located in C:\Users\rubai\Downloads)
The AdwCleaner log.

How is your laptop running now?

Android 8888

Website: http://android8888.comlu.com

Tavira - Here's where I live!

Please read the Instructions for posting requested logs and the article "So how did I get infected in the first place?"

Our help is free, but if you wish to help keep these forums running please consider a donation; Please see This Topic for details.

Back to top

#4 XZY5

Member

Full Member
15 posts

Posted 31 December 2016 - 12:01 PM

Hi Android 8888, thank you very much for your help.

I have had my old laptop turned off since I ran the scans on it and posted the logs here. I have followed your instructions in the order that you presented them (except the uninstallation of uTorrent, I fully understand the implications of that) and I'm posting the logs below. I wasn't sure whether you wanted me to post the scan log or the clean log so I've copied both in order.

Fix result of Farbar Recovery Scan Tool (x64) Version: 21-12-2016

Ran by rubai (31-12-2016 17:27:49) Run:1

Running from C:\Users\rubai\Downloads

Loaded Profiles: rubai (Available Profiles: defaultuser0 & rubai)

Boot Mode: Normal

==============================================

fixlist content:

*****************

Start

CreateRestorePoint:

CloseProcesses:

EmptyTemp:

(SweetLabs, Inc) C:\Users\rubai\AppData\Local\Host App Service\Engine\HostAppServiceUpdater.exe

GroupPolicy: Restriction - Chrome <======= ATTENTION

SearchScopes: HKU\S-1-5-21-249857850-3300716479-2824224529-1001 -> DefaultScope {2EFAACDB-4865-45C6-849A-0F556923BA18} URL =

SearchScopes: HKU\S-1-5-21-249857850-3300716479-2824224529-1001 -> {2EFAACDB-4865-45C6-849A-0F556923BA18} URL =

CHR Extension: (Chrome Web Store Payments) - C:\Users\rubai\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-12-27]

CHR Extension: (Chrome Media Router) - C:\Users\rubai\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-12-27]

S2 0143641482962494mcinstcleanup; C:\Windows\TEMP\014364~1.EXE [961888 2016-05-16] (McAfee, Inc.)

C:\Users\defaultuser0\AppData\Local\Temp\oct836C.tmp.exe

C:\Users\rubai\AppData\Local\Temp\131273518702090365.exe

C:\Users\rubai\AppData\Local\Temp\oct5514.tmp.exe

Task: {A73D3A80-EB22-484B-B667-021B3050A5E7} - System32\Tasks\App Explorer => C:\Users\rubai\AppData\Local\Host App Service\Engine\HostAppServiceUpdater.exe [2016-11-07] (SweetLabs, Inc)

AlternateDataStreams: C:\ProgramData\Temp:5C321E34 [252]

End

*****************

Restore point was successfully created.

Processes closed successfully.

C:\Users\rubai\AppData\Local\Host App Service\Engine\HostAppServiceUpdater.exe => No running process found

C:\Windows\system32\GroupPolicy\Machine => moved successfully

C:\Windows\system32\GroupPolicy\GPT.ini => moved successfully

C:\Windows\SysWOW64\GroupPolicy\GPT.ini => moved successfully

HKU\S-1-5-21-249857850-3300716479-2824224529-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully

"HKU\S-1-5-21-249857850-3300716479-2824224529-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2EFAACDB-4865-45C6-849A-0F556923BA18}" => key removed successfully

HKCR\CLSID\{2EFAACDB-4865-45C6-849A-0F556923BA18} => key not found.

C:\Users\rubai\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda => moved successfully

C:\Users\rubai\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm => moved successfully

0143641482962494mcinstcleanup => service removed successfully

C:\Users\defaultuser0\AppData\Local\Temp\oct836C.tmp.exe => moved successfully

C:\Users\rubai\AppData\Local\Temp\131273518702090365.exe => moved successfully

C:\Users\rubai\AppData\Local\Temp\oct5514.tmp.exe => moved successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{A73D3A80-EB22-484B-B667-021B3050A5E7}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A73D3A80-EB22-484B-B667-021B3050A5E7}" => key removed successfully

C:\Windows\System32\Tasks\App Explorer => moved successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\App Explorer" => key removed successfully

C:\ProgramData\Temp => ":5C321E34" ADS removed successfully.

=========== EmptyTemp: ==========

BITS transfer queue => 7665776 B

DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 15976770 B

Java, Flash, Steam htmlcache => 1029 B

Windows/system/drivers => 9123409 B

Edge => 6236713 B

Chrome => 775358598 B

Firefox => 57138117 B

Opera => 0 B

Temp, IE cache, history, cookies, recent:

Default => 0 B

Users => 0 B

ProgramData => 0 B

Public => 0 B

systemprofile => 185 B

systemprofile32 => 0 B

LocalService => 5770 B

NetworkService => 19266 B

defaultuser0 => 5765643 B

rubai => 127158402 B

RecycleBin => 1512470 B

EmptyTemp: => 959.4 MB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 17:28:27 ====

# AdwCleaner v6.041 - Logfile created 31/12/2016 at 17:36:08

# Updated on 16/12/2016 by Malwarebytes

# Database : 2016-12-30.1 [Server]

# Operating System : Windows 10 Home (X64)

# Username : rubai - LAPTOP-H11LMCGD

# Running from : C:\Users\rubai\Downloads\adwcleaner_6.041.exe

# Mode: Scan

# Support : https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

Folder Found: C:\Users\defaultuser0\AppData\Local\Host App Service

Folder Found: C:\Users\rubai\AppData\Local\Host App Service

Folder Found: C:\ProgramData\Host App Service

Folder Found: C:\ProgramData\Application Data\Host App Service

Folder Found: C:\Users\rubai\AppData\Local\Host App Service

Folder Found: C:\Users\Default\AppData\Local\Host App Service

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious keys found.

***** [ Shortcuts ] *****

No infected shortcut found.

***** [ Scheduled Tasks ] *****

No malicious task found.

***** [ Registry ] *****

Key Found: HKU\S-1-5-21-249857850-3300716479-2824224529-1001\Software\Classes\AppXrh6feys59dqfzsv9p3s9p6aep0hwtb23

Key Found: HKCU\Software\Classes\AppXrh6feys59dqfzsv9p3s9p6aep0hwtb23

Key Found: [x64] HKCU\Software\Classes\AppXrh6feys59dqfzsv9p3s9p6aep0hwtb23

Key Found: HKU\S-1-5-21-249857850-3300716479-2824224529-1001\Software\PRODUCTSETUP

Key Found: HKU\S-1-5-21-249857850-3300716479-2824224529-1001\Software\Host App Service

Key Found: HKU\S-1-5-21-249857850-3300716479-2824224529-1001\Software\csastats

Key Found: HKU\S-1-5-21-249857850-3300716479-2824224529-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall\Host App Service

Key Found: HKCU\Software\PRODUCTSETUP

Key Found: HKCU\Software\Host App Service

Key Found: HKCU\Software\csastats

Key Found: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Host App Service

Key Found: [x64] HKCU\Software\PRODUCTSETUP

Key Found: [x64] HKCU\Software\Host App Service

Key Found: [x64] HKCU\Software\csastats

Key Found: [x64] HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Host App Service

Data Found: HKU\S-1-5-21-249857850-3300716479-2824224529-1001\Software\Microsoft\Internet Explorer\Main [Secondary Start Pages] - hxxp://mystart.lenovo.com

Data Found: HKU\S-1-5-21-249857850-3300716479-2824224529-1001\Software\Microsoft\Internet Explorer\Main [Default_Secondary_Page_URL] - hxxp://mystart.lenovo.com

Data Found: HKCU\Software\Microsoft\Internet Explorer\Main [Secondary Start Pages] - hxxp://mystart.lenovo.com

Data Found: HKCU\Software\Microsoft\Internet Explorer\Main [Default_Secondary_Page_URL] - hxxp://mystart.lenovo.com

Data Found: [x64] HKCU\Software\Microsoft\Internet Explorer\Main [Secondary Start Pages] - hxxp://mystart.lenovo.com

Data Found: [x64] HKCU\Software\Microsoft\Internet Explorer\Main [Default_Secondary_Page_URL] - hxxp://mystart.lenovo.com

***** [ Web browsers ] *****

No malicious Firefox based browser items found.

No malicious Chromium based browser items found.

*************************

C:\AdwCleaner\AdwCleaner[S0].txt - [3161 Bytes] - [31/12/2016 17:36:08]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3234 Bytes] ##########

# AdwCleaner v6.041 - Logfile created 31/12/2016 at 17:41:27

# Updated on 16/12/2016 by Malwarebytes

# Database : 2016-12-30.1 [Server]

# Operating System : Windows 10 Home (X64)

# Username : rubai - LAPTOP-H11LMCGD

# Running from : C:\Users\rubai\Downloads\adwcleaner_6.041.exe

# Mode: Clean

# Support : https://www.malwarebytes.com/support

***** [ Services ] *****

***** [ Folders ] *****

[-] Folder deleted: C:\Users\defaultuser0\AppData\Local\Host App Service

[-] Folder deleted: C:\Users\rubai\AppData\Local\Host App Service

[-] Folder deleted: C:\ProgramData\Host App Service

[#] Folder deleted on reboot: C:\ProgramData\Application Data\Host App Service

[#] Folder deleted on reboot: C:\Users\rubai\AppData\Local\Host App Service

[-] Folder deleted: C:\Users\Default\AppData\Local\Host App Service

***** [ Files ] *****

***** [ DLL ] *****

***** [ WMI ] *****

***** [ Shortcuts ] *****

***** [ Scheduled Tasks ] *****

***** [ Registry ] *****

[-] Key deleted: HKU\S-1-5-21-249857850-3300716479-2824224529-1001\Software\Classes\AppXrh6feys59dqfzsv9p3s9p6aep0hwtb23

[#] Key deleted on reboot: HKCU\Software\Classes\AppXrh6feys59dqfzsv9p3s9p6aep0hwtb23

[#] Key deleted on reboot: [x64] HKCU\Software\Classes\AppXrh6feys59dqfzsv9p3s9p6aep0hwtb23

[-] Key deleted: HKU\S-1-5-21-249857850-3300716479-2824224529-1001\Software\PRODUCTSETUP

[-] Key deleted: HKU\S-1-5-21-249857850-3300716479-2824224529-1001\Software\Host App Service

[-] Key deleted: HKU\S-1-5-21-249857850-3300716479-2824224529-1001\Software\csastats

[-] Key deleted: HKU\S-1-5-21-249857850-3300716479-2824224529-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall\Host App Service

[#] Key deleted on reboot: HKCU\Software\PRODUCTSETUP

[#] Key deleted on reboot: HKCU\Software\Host App Service

[#] Key deleted on reboot: HKCU\Software\csastats

[#] Key deleted on reboot: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Host App Service

[#] Key deleted on reboot: [x64] HKCU\Software\PRODUCTSETUP

[#] Key deleted on reboot: [x64] HKCU\Software\Host App Service

[#] Key deleted on reboot: [x64] HKCU\Software\csastats

[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Host App Service

[-] Data restored: HKU\S-1-5-21-249857850-3300716479-2824224529-1001\Software\Microsoft\Internet Explorer\Main [Secondary Start Pages]

[-] Data restored: HKU\S-1-5-21-249857850-3300716479-2824224529-1001\Software\Microsoft\Internet Explorer\Main [Default_Secondary_Page_URL]

[-] Data restored: HKCU\Software\Microsoft\Internet Explorer\Main [Secondary Start Pages]

[-] Data restored: HKCU\Software\Microsoft\Internet Explorer\Main [Default_Secondary_Page_URL]

[-] Data restored: [x64] HKCU\Software\Microsoft\Internet Explorer\Main [Secondary Start Pages]

[-] Data restored: [x64] HKCU\Software\Microsoft\Internet Explorer\Main [Default_Secondary_Page_URL]

***** [ Web browsers ] *****

*************************

:: "Tracing" keys deleted

:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [3087 Bytes] - [31/12/2016 17:41:27]

C:\AdwCleaner\AdwCleaner[S0].txt - [3341 Bytes] - [31/12/2016 17:36:08]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [3233 Bytes] ##########

Again, thank you very much for all your help! My laptop is starting up much faster now, and I have stopped getting the prompt from WinPatrol about the start-up programmes and IE add-ons. I stopped receiving the prompt regarding Windows Command Processor prior to your reply however, but I'm not sure what that means - is it gone? is it just being quiet?

Back to top

#5 Android 8888

SWI Malware Tracker

Trusted Advisor*
1,179 posts

Posted 02 January 2017 - 11:05 AM

Hello XZY5.

Sorry for the delay in responding.

Again, thank you very much for all your help! My laptop is starting up much faster now, and I have stopped getting the prompt from WinPatrol about the start-up programmes and IE add-ons.

I'm glad to hear that. :)

I stopped receiving the prompt regarding Windows Command Processor prior to your reply however, but I'm not sure what that means - is it gone? is it just being quiet?

Windows Command Processor Notification is a rogue security program that will issue several alerts on the computer.

The file below detected and quarantined by Malwarebytes was probably one of the culprits:

-Blocked Malware Details-
File: 1
PUP.Optional.InstallCore, C:\Users\rubai\AppData\Local\Temp\13127351873594018888.exe, Quarantined, [8], [355724],0.0.0

Now your logs appear to be clean, so if you have no further issues with your laptop, then please proceed with the following housekeeping procedure outlined below.

Download DelFix (by Xplode) and save it to your Desktop.

Close all running programs and start delfix.exe.
Make sure that all available options are checked.
Click on Run.
DelFix should remove all our tools and delete itself afterwards.
I don't need the log file.

Are there any further questions?

Android 8888

Website: http://android8888.comlu.com

Tavira - Here's where I live!

Please read the Instructions for posting requested logs and the article "So how did I get infected in the first place?"

Our help is free, but if you wish to help keep these forums running please consider a donation; Please see This Topic for details.

Back to top

#6 XZY5

Member

Full Member
15 posts

Posted 02 January 2017 - 11:18 AM

My new laptop is running great =] thank you

However, I do have a number of important files that I need to transfer from my old laptop to my new one - it's totaling around 250gb of data. With the condition that my old laptop is in, I am not feeling confident connecting any storage devices to it as I'm afraid it could infect my new laptop again. What would be the best thing to do?

Back to top

#7 Android 8888

SWI Malware Tracker

Trusted Advisor*
1,179 posts

Posted 02 January 2017 - 06:30 PM

Hello XZY5.

I will help you with your malware issues on your old laptop but first to make sure that your new laptop is completely free of malware please run another scan with ESET Online Scanner.
Please keep your old laptop disconnected from the router.

Now delete the old file of ESET Online Scanner.

Click on this link to open ESET Online Scanner in a new window.
- Click on the Scan Now button to download the esetonlinescanner_enu.exe file. Save it to your Desktop.
- Close all your programs and browsers.
- Please disable your antivirus program to avoid potential conflicts, improve the performance and speed up the scan.
- Double click on esetonlinescanner_enu.exe to start ESET Online Scanner. It will open a window with the Terms of Use.

Check mark Download latest version of ESET Online Scanner and click the Accept button.
Click Yes to accept any security warnings that may appear.
Under Computer scan settings, check mark Enable detection of potentially unwanted applications.
Then click Advanced settings and check mark the following options:
- Enable detection of potentially unsafe applications
- Clean threats automatically
Click the Scan button.
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, click List Threats.
Click Export, and save the file to your Desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Click the Back button.
Click the Finish button.

Note: If nothing is found, it will not produce a log.

Please re-enable your antivirus program.

In your next reply please post the ESET log for my review (if it produced one).

Android 8888

Website: http://android8888.comlu.com

Tavira - Here's where I live!

Please read the Instructions for posting requested logs and the article "So how did I get infected in the first place?"

Our help is free, but if you wish to help keep these forums running please consider a donation; Please see This Topic for details.

Back to top

#8 XZY5

Member

Full Member
15 posts

Posted 03 January 2017 - 02:31 PM

C:\$Recycle.Bin\S-1-5-21-1687197661-551072276-2564851244-1000\$REWAXN4.iso a variant of Win32/ExpressDownloader.K potentially unwanted application

C:\$Recycle.Bin\S-1-5-21-1687197661-551072276-2564851244-1000\$RCN7WE1\Big_Bang_Alive_Mini_Album_Rar.exe a variant of Win32/ExpressDownloader.K potentially unwanted application

C:\Users\upoma-efti\AppData\Roaming\uTorrent\updates\3.4.2_31515.exe a variant of Win32/AdkDLLWrapper.A potentially unwanted application

C:\Users\upoma-efti\AppData\Roaming\uTorrent\updates\3.4.2_33080.exe a variant of Win32/AdkDLLWrapper.A potentially unwanted application

Back to top

#9 Android 8888

SWI Malware Tracker

Trusted Advisor*
1,179 posts

Posted 04 January 2017 - 03:45 AM

Hello XZY5.

ESET found two threats in your Recycle Bin folder.

Please empty your Recycle Bin.

Right-click on the Recycle Bin icon and choose Empty Recycle Bin.

The other two threats are Potentially Unwanted Applications (PUA) that are related to the uTorrent application. A potentially unwanted application (PUA) is a program that contains adware, installs toolbars or has other unclear objectives, however it is not considered malware.

Now that your new laptop appears to be free of malware I can help you in searching for malware in your old computer so that you can transfer your data files to the new laptop.

Please let me know if you wish to continue.

Android 8888

Website: http://android8888.comlu.com

Tavira - Here's where I live!

Please read the Instructions for posting requested logs and the article "So how did I get infected in the first place?"

Our help is free, but if you wish to help keep these forums running please consider a donation; Please see This Topic for details.

Back to top

#10 Android 8888

SWI Malware Tracker

Trusted Advisor*
1,179 posts

Posted 05 January 2017 - 05:51 PM

Hello XZY5.

If you are still with us please let me also know where did you downloaded the MS Office that you mentioned in your first post in this topic. Was it from an official and trusted website or was it through a peer-to-peer file-sharing program like uTorrent?

Android 8888

Website: http://android8888.comlu.com

Tavira - Here's where I live!

Please read the Instructions for posting requested logs and the article "So how did I get infected in the first place?"

Our help is free, but if you wish to help keep these forums running please consider a donation; Please see This Topic for details.

Back to top

#11 XZY5

Member

Full Member
15 posts

Posted 05 January 2017 - 06:15 PM

Hi android8888

Sorry about the delay. The eset log I posted before was from my old laptop not the new one. The new one is clean, the old one I used eset to clean (I saved the export file prior to cleaning) so when I ran the scan again following your instructions eset found nothing in my old laptop so no log was made.

I downloaded MS office using my university's free subscription offer from Outlook. I haven't used utorrent in my new laptop at all.

Back to top

#12 Android 8888

SWI Malware Tracker

Trusted Advisor*
1,179 posts

Posted 05 January 2017 - 06:34 PM

Hello XZY5.

Thank you for your reply.

Sorry about the delay.

No worries.

Now just let me know if you still need help in searching and removing any malware from your old computer so that you can feel confident to transfer your data files to the new laptop.

Android 8888

Website: http://android8888.comlu.com

Tavira - Here's where I live!

Please read the Instructions for posting requested logs and the article "So how did I get infected in the first place?"

Our help is free, but if you wish to help keep these forums running please consider a donation; Please see This Topic for details.

Back to top

#13 XZY5

Member

Full Member
15 posts

Posted 05 January 2017 - 06:45 PM

So with the eset cleaning done it's fine now? I can transfer my files and reset the laptop? I'm mostly just unsure about it right now

Back to top

#14 Android 8888

SWI Malware Tracker

Trusted Advisor*
1,179 posts

Posted 07 January 2017 - 04:26 AM

Hello XZY5.

Sorry for the delay.

So with the eset cleaning done it's fine now?

That is a good sign but could not be enough. Let's check it further.

Now please disconnect your new laptop from the router and keep it like that while we are working in your old computer.

Please download the free version Malwarebytes Anti-Malware from here

Right-click on the MBAM icon and select Run as administrator to run the tool.
Click Yes to accept any security warnings that may appear.
Once the MBAM dashboard opens, on the right detail pane click on the word "Current" under the Scan Status to update the tool database.
On the left menu pane click the Settings tab, and then select the Protection tab on the top.
Under the Scan Options, turn on the button Scan for rootkits.
Click the Scan tab on the right detail pane, select Threat Scan and click the Start Scan button
Note: The scan may take some time to finish, so please be patient.
If potential threats are detected, ensure to check-mark all the listed items, and click the Quarantine Selected button.
While still on the Scan tab, click the View Report button, and in the window that opens click the Export button, select Text file (*.txt), and save the log to your Desktop.
The log can also be viewed by clicking the log to select it, then clicking the View Report button.

Please post the log for my review.

Note: If asked to restart the computer, please do so immediately.

Please download AdwCleaner by Xplode and save it to your Desktop.

Close all open programs and internet browsers.
Right-click on the icon and chose Run as administrator to run the tool.
Click Yes to accept any security warnings that may appear.
Click I Agree on the disclaimer to accept the Terms of Use.
Click the Scan button to start the scan and wait for the process to complete.
Click the Logfile button and the report will open in Notepad.
NOTE: If you get an error message, it means that nothing was found. Exit from AdwCleaner.
Click on the Clean button and follow the prompts.
A log file will automatically open after the scan has finished and the PC has rebooted.
Please post the content of that log file in your next reply.
You can find the log file at C:\AdwCleaner[Sn].txt (n is a number).

Please delete the old version of FRST64 and the logs it created in the folder C:\Users\upoma-efti\Downloads
Now download a new version from here and save it to your computer's Desktop.

Right-click on the icon and select Run As Administrator.
When the tool opens click Yes to disclaimer.
Click on the Scan button.

It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please copy and paste it to your reply.

Please post:
Malwarebytes log.
AdwCleaner log.
The two logs from Farbar Recovery Scan Tool (FRST.txt and Addition.txt) each in their own replies (due to the length), and note any errors encountered. If any log was cut off, please check to see where it was cut off and post the remainder in an additional reply.

Android 8888

Website: http://android8888.comlu.com

Tavira - Here's where I live!

Please read the Instructions for posting requested logs and the article "So how did I get infected in the first place?"

Our help is free, but if you wish to help keep these forums running please consider a donation; Please see This Topic for details.

Back to top

#15 XZY5

Member

Full Member
15 posts

Posted 08 January 2017 - 02:50 PM

Hi Android8888, this reply has the malwarebytes, and adwcleaner logs

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 08/01/2017

Scan Time: 18:20

Logfile: mwb.txt

Administrator: Yes

Version: 2.2.1.1043

Malware Database: v2017.01.08.04

Rootkit Database: v2016.11.20.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

OS: Windows 10

CPU: x64

File System: NTFS

User: upoma-efti

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 354450

Time Elapsed: 1 hr, 31 min, 49 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 0

(No malicious items detected)

Physical Sectors: 0

(No malicious items detected)

(end)

# AdwCleaner v6.042 - Logfile created 08/01/2017 at 20:06:26

# Updated on 06/01/2017 by Malwarebytes

# Database : 2017-01-06.1 [Server]

# Operating System : Windows 10 Home (X64)

# Username : upoma-efti - UPOMA-EFTI-PC

# Running from : C:\Users\upoma-efti\Downloads\adwcleaner_6.042.exe

# Mode: Scan

# Support : https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

Folder Found: C:\Users\upoma-efti\AppData\Local\DriverToolkit

Folder Found: C:\Users\upoma-efti\AppData\Roaming\Microsoft\Windows\Start Menu\ByteFence

Folder Found: C:\Program Files (x86)\DriverToolkit

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious keys found.

***** [ Shortcuts ] *****

No infected shortcut found.

***** [ Scheduled Tasks ] *****

No malicious task found.

***** [ Registry ] *****

Key Found: HKCU\Software\Classes\CLSID\{BEBBC426-4F16-4567-8FE1-BE198C982027}

Key Found: HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Key Found: HKU\S-1-5-21-1687197661-551072276-2564851244-1000\Software\DriverToolkit

Key Found: HKCU\Software\DriverToolkit

Key Found: [x64] HKCU\Software\DriverToolkit

Key Found: HKCU\Software\Google\Chrome\Extensions\bakijjialdiiboeaknfpmflphhmljfkd

Key Found: [x64] HKCU\Software\Google\Chrome\Extensions\bakijjialdiiboeaknfpmflphhmljfkd

***** [ Web browsers ] *****

No malicious Firefox based browser items found.

Chrome pref Found: [C:\Users\upoma-efti\AppData\Local\Google\Chrome\User Data\Default\Web data] - uk.ask.com

Chrome pref Found: [C:\Users\upoma-efti\AppData\Local\Google\Chrome\User Data\Default\Web data] - yahoo.com Search

Chrome pref Found: [C:\Users\upoma-efti\AppData\Local\Google\Chrome\User Data\Default\Web data] - speedial.com

Chrome pref Found: [C:\Users\upoma-efti\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences ] - bakijjialdiiboeaknfpmflphhmljfkd

*************************

C:\AdwCleaner\AdwCleaner[S0].txt - [2085 Bytes] - [08/01/2017 20:06:26]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2158 Bytes] ##########

# AdwCleaner v6.042 - Logfile created 08/01/2017 at 20:10:30

# Updated on 06/01/2017 by Malwarebytes

# Database : 2017-01-06.1 [Server]

# Operating System : Windows 10 Home (X64)

# Username : upoma-efti - UPOMA-EFTI-PC

# Running from : C:\Users\upoma-efti\Downloads\adwcleaner_6.042.exe

# Mode: Clean

# Support : https://www.malwarebytes.com/support

***** [ Services ] *****

***** [ Folders ] *****

[-] Folder deleted: C:\Users\upoma-efti\AppData\Local\DriverToolkit

[-] Folder deleted: C:\Users\upoma-efti\AppData\Roaming\Microsoft\Windows\Start Menu\ByteFence

[-] Folder deleted: C:\Program Files (x86)\DriverToolkit

***** [ Files ] *****

***** [ DLL ] *****

***** [ WMI ] *****

***** [ Shortcuts ] *****

***** [ Scheduled Tasks ] *****

***** [ Registry ] *****

[-] Key deleted: HKCU\Software\Classes\CLSID\{BEBBC426-4F16-4567-8FE1-BE198C982027}

[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

[-] Key deleted: HKU\S-1-5-21-1687197661-551072276-2564851244-1000\Software\DriverToolkit

[#] Key deleted on reboot: HKCU\Software\DriverToolkit

[#] Key deleted on reboot: [x64] HKCU\Software\DriverToolkit

[-] Key deleted: HKCU\Software\Google\Chrome\Extensions\bakijjialdiiboeaknfpmflphhmljfkd

[#] Key deleted on reboot: [x64] HKCU\Software\Google\Chrome\Extensions\bakijjialdiiboeaknfpmflphhmljfkd

***** [ Web browsers ] *****

[-] [C:\Users\upoma-efti\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: uk.ask.com

[-] [C:\Users\upoma-efti\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: yahoo.com Search

[-] [C:\Users\upoma-efti\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: speedial.com

[-] [C:\Users\upoma-efti\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: bakijjialdiiboeaknfpmflphhmljfkd

*************************

:: "Tracing" keys deleted

:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [2052 Bytes] - [08/01/2017 20:10:30]

C:\AdwCleaner\AdwCleaner[S0].txt - [2245 Bytes] - [08/01/2017 20:06:26]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [2198 Bytes] ##########

Back to top

#16 XZY5

Member

Full Member
15 posts

Posted 08 January 2017 - 02:51 PM

This is the FRST.txt

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 08-01-2017

Ran by upoma-efti (administrator) on UPOMA-EFTI-PC (08-01-2017 20:27:55)

Running from C:\Users\upoma-efti\Downloads

Loaded Profiles: upoma-efti & DefaultAppPool (Available Profiles: upoma-efti & DefaultAppPool)