This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

mshta.exe popup virus [Closed]

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Hi, my name is Bryan.

Currently am having an issue with my pc having a popup porn which I assume its a virus

When I locate it using the Task Manager, it prompts me to a file called the mshta.exe

Kindly advice as to how should I proceed to remove this virus.

 

 

Your kind assistance is highly appreciated

Thank you 

:welcome:

 

 
[external image: 1QYkxTZ.jpg] Please download aswMBR to your desktop.
 
  • Double click the aswMBR icon to run it.
  • Click the Scan button to start scan.
  • If you are asked to update the Avast Virus database please allow it to do so.
  • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.
  •  
    I just want to see the report….Please Do Not Fix Anything
     
    ============================================================================
     
     
     
     
    Please download Farbar Recovery Scan Tool and save it to your desktop.
     
    Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
     
    How to determine whether a computer is running a 32-bit version or 64-bit version of the Windows operating system
    A simple way to check your system: Start –> Computer (right click) –> Properties
     
    [external image: FRST_zps5d956a1a.jpg]
     
     
    • Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
    • Please make sure All Users is checked
    • Just keep the defaults as in the picture checkmarked
    • Press Scan button.
    • It will produce a log called FRST.txt in the same directory the tool is run from.
    • Please copy and paste log back here.
    • The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.
    • aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
      Run date: 2015-03-31 11:21:20
      —————————–
      11:21:20.661    OS Version: Windows x64 6.1.7601 Service Pack 1
      11:21:20.661    Number of processors: 4 586 0x102
      11:21:20.661    ComputerName: JIMMY-PC  UserName: Jimmy
      11:21:22.237    Initialize success
      11:21:23.001    VM: initialized successfully
      11:21:23.001    VM: Amd CPU supported 
      11:22:05.293    AVAST engine defs: 15033001
      11:22:34.036    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1
      11:22:34.041    Disk 0 Vendor: WDC_WD5000AAKX-00ERMA0 15.01H15 Size: 476940MB BusType: 3
      11:22:34.132    Disk 0 MBR read successfully
      11:22:34.137    Disk 0 MBR scan
      11:22:34.148    Disk 0 Windows 7 default MBR code
      11:22:34.154    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
      11:22:34.165    Disk 0 Boot: NTFS     code=2
      11:22:34.186    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS       125000 MB offset 206848
      11:22:34.214    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       351838 MB offset 256206848
      11:22:34.314    Disk 0 scanning C:\Windows\system32\drivers
      11:22:45.777    Service scanning
      11:22:48.245    Service BHDrvx64 C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\BASHDefs\20150321.001\BHDrvx64.sys **LOCKED** 5
      11:22:53.241    Service IDSVia64 C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\IPSDefs\20150327.001\IDSvia64.sys **LOCKED** 5
      11:22:55.718    Service NAVENG C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20150330.001\ENG64.SYS **LOCKED** 5
      11:22:55.843    Service NAVEX15 C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20150330.001\EX64.SYS **LOCKED** 5
      11:23:14.665    Modules scanning
      11:23:14.679    Disk 0 trace - called modules:
      11:23:14.697    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys 
      11:23:14.704    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004d2f060]
      11:23:14.710    3 CLASSPNP.SYS[fffff88001ab043f] -> nt!IofCallDriver -> [0xfffffa8003dbe580]
      11:23:14.716    5 ACPI.sys[fffff88000ec87a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-1[0xfffffa8003dc8060]
      11:23:17.861    AVAST engine scan C:\Windows
      11:23:22.815    AVAST engine scan C:\Windows\system32
      11:28:18.545    AVAST engine scan C:\Windows\system32\drivers
      11:28:30.668    AVAST engine scan C:\Users\Jimmy
      11:40:15.244    Disk 0 MBR has been saved successfully to "C:\Users\Jimmy\Downloads\MBR.dat"
      11:40:15.251    The log file has been saved successfully to "C:\Users\Jimmy\Downloads\aswMBR.txt"
       
       
      ___________________________________________________________________________________________________________
       
      Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
      Ran by [removed] (administrator) on JIMMY-PC on 31-03-2015 11:24:21
      Running from C:\Users\[removed]\Downloads
      [removed]
      Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: English (United States)
      Internet Explorer Version 11 (Default browser: Chrome)
      Boot Mode: Normal
      Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
       
      ==================== Processes (Whitelisted) =================
       
      (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
       
      (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
      (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
      (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
      (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
      (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
      (The Firebird Project) C:\Program Files (x86)\Firebird\Firebird_1_5\bin\fbguard.exe
      (Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.7.0.11\n360.exe
      (Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.7.0.11\n360.exe
      (QnE Software Sdn. Bhd.) C:\QnE\Service\QNELS.exe
      (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
      () C:\Program Files (x86)\Common Files\Sage Software\SisPremiseService\UBS.SIS.Premise.Service.exe
      (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
      (QnE) C:\QnE\Service\QNEPanel.exe
      (Dropbox, Inc.) C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\Dropbox.exe
      () C:\Program Files (x86)\Common Files\Sage Software\SageScheduler\SageSchedulerService.exe
      () C:\Program Files (x86)\Common Files\Sage Software\BackupService\UBS.UBSService.exe
      (Sage Software Sdn Bhd) C:\Program Files (x86)\Common Files\Sage Software\LicenseService\UBS.Phoenix.Server.exe
      () C:\Program Files (x86)\Common Files\Sage Software\LicenseService\UBS.Phoenix.Server.Watchdog.exe
      (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
      (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
      (The Firebird Project) C:\Program Files (x86)\Firebird\Firebird_1_5\bin\fbserver.exe
      (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
      (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
      (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
      (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
      (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
      (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
      (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
      (AVAST Software) C:\Users\Jimmy\Downloads\aswMBR.exe
      (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      (Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
      (Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.7.0.11\conathst.exe
      (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\nacl64.exe
      (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\nacl64.exe
      (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\reader_sl.exe
       
       
      ==================== Registry (Whitelisted) ==================
       
      (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
       
      HKLM\…\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13776088 2014-12-11] (Realtek Semiconductor)
      HKLM\…\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
      HKLM\…\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2673296 2015-03-28] (NVIDIA Corporation)
      HKLM-x32\…\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2015-01-14] (Samsung Electronics Co., Ltd.)
      HKU\S-1-5-21-441726925-1278100211-2369931726-1000\…\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845120 2015-01-14] (Samsung)
      HKU\S-1-5-21-441726925-1278100211-2369931726-1000\…\Run: [Google+ Auto Backup] => C:\Users\Jimmy\AppData\Local\Programs\Google\Google+ Auto Backup\Google+ Auto Backup.exe [3619096 2014-01-06] (Google Inc.)
      HKU\S-1-5-21-441726925-1278100211-2369931726-1000\…\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-13] (Piriform Ltd)
      HKU\S-1-5-21-441726925-1278100211-2369931726-1000\…\Run: [webutcry] => C:\ProgramData\utcry\3M5VMMAW.hta [219704 2015-03-25] ()
      HKU\S-1-5-18\…\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2013-06-25] (Microsoft Corporation)
      Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QnE Service.lnk
      ShortcutTarget: QnE Service.lnk -> C:\Windows\Installer\{F7466868-C312-46A5-AB1B-70F7D27465D0}\_47FBF919DABCE28902FDEE.exe ()
      Startup: C:\Users\Jimmy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
      ShortcutTarget: Dropbox.lnk -> C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
      ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
      ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
      ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
      ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
      ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
      ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
      ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
      ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
      ShellIconOverlayIdentifiers: [OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton 360\Engine64\21.7.0.11\buShell.dll (Symantec Corporation)
      ShellIconOverlayIdentifiers: [OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton 360\Engine64\21.7.0.11\buShell.dll (Symantec Corporation)
      ShellIconOverlayIdentifiers: [OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton 360\Engine64\21.7.0.11\buShell.dll (Symantec Corporation)
      ShellIconOverlayIdentifiers-x32: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
      ShellIconOverlayIdentifiers-x32: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
      ShellIconOverlayIdentifiers-x32: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
      ShellIconOverlayIdentifiers-x32: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
      ShellIconOverlayIdentifiers-x32: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
      ShellIconOverlayIdentifiers-x32: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
      ShellIconOverlayIdentifiers-x32: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
      ShellIconOverlayIdentifiers-x32: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
       
      ==================== Internet (Whitelisted) ====================
       
      (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
       
      HKU\S-1-5-21-441726925-1278100211-2369931726-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
      HKU\S-1-5-21-441726925-1278100211-2369931726-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
      HKU\S-1-5-21-441726925-1278100211-2369931726-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://malaysia.msn.com/?ocid=iehp
      SearchScopes: HKU\S-1-5-21-441726925-1278100211-2369931726-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?q={sear
      BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine64\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation)
      BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
      BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation)
      BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton 360\Engine\21.7.0.11\IPS\IPSBHO.DLL [2015-03-05] (Symantec Corporation)
      BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
      Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine64\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation)
      Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation)
      Toolbar: HKU\S-1-5-21-441726925-1278100211-2369931726-1000 -> Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine64\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation)
      Hosts: 127.0.0.1 validation.sls.microsoft.com
      Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
      Tcpip\..\Interfaces\{9E462938-0AAD-4DE6-8208-009A6C89F59F}: [NameServer] 8.8.8.8,8.8.4.4
       
      FireFox:
      ========
      FF Plugin: @microsoft.com/GENUINE -> disabled No File
      FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll [2014-12-11] ( Microsoft Corporation)
      FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
      FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-01-07] (Google, Inc.)
      FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
      FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.31211.0\npctrl.dll [2014-12-11] ( Microsoft Corporation)
      FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
      FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
      FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-02-04] (NVIDIA Corporation)
      FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-02-04] (NVIDIA Corporation)
      FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-09] (Google Inc.)
      FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-09] (Google Inc.)
      FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
      FF HKLM-x32\…\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn
      FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn [2015-03-31]
       
      Chrome: 
      =======
      CHR HomePage: Default -> hxxp://www.google.com
      CHR StartupUrls: Default -> "hxxp://www.google.com"
      CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
      CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\ppGoogleNaClPluginChrome.dll No File
      CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\pdf.dll ()
      CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\gcswf32.dll No File
      CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
      CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
      CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll No File
      CHR Profile: C:\Users\Jimmy\AppData\Local\Google\Chrome\User Data\Default
      CHR Extension: (Norton Identity Safe) - C:\Users\Jimmy\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2014-08-15]
      CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Jimmy\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-16]
      CHR Extension: (Norton Security Toolbar) - C:\Users\Jimmy\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-07-03]
      CHR Extension: (Norton Safe) - C:\Users\Jimmy\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmgcfemagnogdodbambjhdcmfcpicngl [2014-08-15]
      CHR Extension: (Google Wallet) - C:\Users\Jimmy\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
      CHR Extension: (Gmail) - C:\Users\Jimmy\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-06-19]
      CHR HKLM\…\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - https://clients2.google.com/service/update2/crx
      CHR HKLM\…\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton 360\Engine\21.7.0.11\Exts\Chrome.crx [2015-03-23]
      CHR HKLM-x32\…\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - https://clients2.google.com/service/update2/crx
      CHR HKLM-x32\…\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton 360\Engine\21.7.0.11\Exts\Chrome.crx [2015-03-23]
       
      ==================== Services (Whitelisted) =================
       
      (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
       
      S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
      R2 FirebirdGuardianDefaultInstance; C:\Program Files (x86)\Firebird\Firebird_1_5\bin\fbguard.exe [65536 2009-08-31] (The Firebird Project) [File not signed]
      R3 FirebirdServerDefaultInstance; C:\Program Files (x86)\Firebird\Firebird_1_5\bin\fbserver.exe [1532000 2009-08-31] (The Firebird Project) [File not signed]
      R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152144 2015-03-28] (NVIDIA Corporation)
      R2 N360; C:\Program Files (x86)\Norton 360\Engine\21.7.0.11\N360.exe [265000 2015-03-07] (Symantec Corporation)
      R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1878672 2015-03-28] (NVIDIA Corporation)
      R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [22995600 2015-03-28] (NVIDIA Corporation)
      R2 QNEService; C:\QNE\Service\QNELS.exe [97792 2012-06-29] (QnE Software Sdn. Bhd.) [File not signed]
      R2 SageConnectPremiseService; C:\Program Files (x86)\Common Files\Sage Software\SisPremiseService\UBS.SIS.Premise.Service.exe [80168 2014-08-04] ()
      S3 SageDMSFileWatcherService; C:\Program Files (x86)\Common Files\Sage Software\SageDMSFileWatcher\SageDMSFileWatcherService.exe [33064 2014-10-28] ()
      R2 SageSchedulerService; C:\Program Files (x86)\Common Files\Sage Software\SageScheduler\SageSchedulerService.exe [32552 2014-08-08] ()
      R2 SageUBSBackupService; C:\Program Files (x86)\Common Files\Sage Software\BackupService\UBS.UBSService.exe [9216 2011-08-23] () [File not signed]
      R2 SageUBSLicenseService; C:\Program Files (x86)\Common Files\Sage Software\LicenseService\UBS.Phoenix.Server.exe [16680 2014-08-21] (Sage Software Sdn Bhd)
      R2 SageUBSServiceWatchdog; C:\Program Files (x86)\Common Files\Sage Software\LicenseService\UBS.Phoenix.Server.Watchdog.exe [78648 2014-11-18] ()
      S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
       
      ==================== Drivers (Whitelisted) ====================
       
      (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
       
      R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [22128 2012-03-08] ()
      R1 BHDrvx64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\BASHDefs\20150321.001\BHDrvx64.sys [1622744 2015-02-03] (Symantec Corporation)
      R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1507000.00B\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
      S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [53816 2009-10-12] (Samsung Electronics Co., Ltd.)
      R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-12-15] (Symantec Corporation)
      R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2014-12-15] (Symantec Corporation)
      R1 IDSVia64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\IPSDefs\20150327.001\IDSvia64.sys [671448 2015-03-26] (Symantec Corporation)
      R3 NAVENG; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20150330.001\ENG64.SYS [129752 2015-01-21] (Symantec Corporation)
      R3 NAVEX15; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20150330.001\EX64.SYS [2137304 2015-01-21] (Symantec Corporation)
      R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-03-28] (NVIDIA Corporation)
      R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
      R3 SRTSP; C:\Windows\System32\Drivers\N360x64\1507000.00B\SRTSP64.SYS [876248 2014-08-26] (Symantec Corporation)
      R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1507000.00B\SRTSPX64.SYS [37592 2014-08-26] (Symantec Corporation)
      R0 SymDS; C:\Windows\System32\drivers\N360x64\1507000.00B\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)
      R0 SymEFA; C:\Windows\System32\drivers\N360x64\1507000.00B\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)
      R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2013-12-30] (Symantec Corporation)
      R1 SymIRON; C:\Windows\system32\drivers\N360x64\1507000.00B\Ironx64.SYS [266968 2014-08-07] (Symantec Corporation)
      R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1507000.00B\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)
      S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
      S3 gdrv; \??\C:\Windows\gdrv.sys [X]
      S2 Sllpsvdr; \SystemRoot\System32\Drivers\SLLPSVDR.SYS [X]
      S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
      S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
      S3 VGPU; System32\drivers\rdvgkmd.sys [X]
      U3 aswMBR; \??\C:\Users\Jimmy\AppData\Local\Temp\aswMBR.sys [X]
      U3 aswVmm; \??\C:\Users\Jimmy\AppData\Local\Temp\aswVmm.sys [X]
       
      ==================== NetSvcs (Whitelisted) ===================
       
      (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
       
       
      ==================== One Month Created Files and Folders ========
       
      (If an entry is included in the fixlist, the file\folder will be moved.)
       
      2015-03-31 11:24 - 2015-03-31 11:26 - 00021354 _____ () C:\Users\Jimmy\Downloads\FRST.txt
      2015-03-31 11:23 - 2015-03-31 11:24 - 00000000 ____D () C:\FRST
      2015-03-31 11:08 - 2015-02-04 10:21 - 02558792 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
      2015-03-31 11:08 - 2015-02-04 08:00 - 00608072 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
      2015-03-31 11:08 - 2015-02-04 00:18 - 04229086 _____ () C:\Windows\system32\nvcoproc.bin
      2015-03-31 11:04 - 2015-03-31 11:04 - 00003090 _____ () C:\Windows\System32\Tasks\{10A415C6-2A58-44DA-8C6A-035414FCE22D}
      2015-03-31 11:04 - 2015-03-31 11:04 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
      2015-03-31 11:04 - 2015-03-31 11:04 - 00000000 ___SD () C:\Windows\system32\GWX
      2015-03-31 10:44 - 2015-03-31 10:45 - 02095616 _____ (Farbar) C:\Users\Jimmy\Downloads\FRST64.exe
      2015-03-31 09:57 - 2015-03-31 09:57 - 00166912 _____ () C:\Users\Jimmy\Downloads\JA Q-MITSUI-081 RC Sump at Chemical Store Work Done   31-3-2015.xls
      2015-03-31 09:57 - 2015-03-31 09:57 - 00093184 _____ () C:\Users\Jimmy\Downloads\JA Q-MITSUI-078 Fire Wall Work Done 31-3-2015.xls
      2015-03-31 09:57 - 2015-03-31 09:57 - 00086016 _____ () C:\Users\Jimmy\Downloads\JA Q-MITSUI-080 MISC March 2015 Work Done 31-3-2015.xls
      2015-03-30 15:29 - 2015-03-30 15:30 - 05198336 _____ (AVAST Software) C:\Users\Jimmy\Downloads\aswMBR.exe
      2015-03-30 13:35 - 2015-03-30 13:35 - 00086016 _____ () C:\Users\Jimmy\Downloads\JA Q-Kayaku-116 Work Done 28-3-2015.xls
      2015-03-30 13:31 - 2015-03-30 13:31 - 00103936 _____ () C:\Users\Jimmy\Downloads\JA Q-JST-005(COMBINED) Work Done (2).xls
      2015-03-30 11:01 - 2015-03-31 11:20 - 00001962 _____ () C:\Windows\setupact.log
      2015-03-30 11:01 - 2015-03-30 11:01 - 00000000 _____ () C:\Windows\setuperr.log
      2015-03-26 12:21 - 2015-03-26 12:21 - 00112128 _____ () C:\Users\Jimmy\Downloads\Q J1070 - JA, Kayaku.xls
      2015-03-25 12:15 - 2015-03-25 12:15 - 00444282 _____ () C:\Users\Jimmy\Downloads\starts85127743.hta
      2015-03-25 12:15 - 2015-03-25 12:15 - 00427027 _____ () C:\Users\Jimmy\Downloads\starts12015320.hta
      2015-03-25 12:15 - 2015-03-25 12:15 - 00000000 ____D () C:\ProgramData\utcry
      2015-03-24 12:32 - 2015-03-30 11:27 - 00000000 ____D () C:\UBSACC2015
      2015-03-24 12:32 - 2015-03-25 09:59 - 00000000 ____D () C:\UBSSTK2015
      2015-03-24 12:32 - 2015-03-24 12:37 - 00000000 ____D () C:\UBSCPL
      2015-03-24 12:32 - 2015-03-24 12:32 - 00001485 _____ () C:\Users\Public\Desktop\Sage UBS 2015.lnk
      2015-03-24 12:32 - 2015-03-24 12:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sage UBS
      2015-03-24 12:31 - 2015-03-24 12:31 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual FoxPro OLE DB Provider
      2015-03-24 12:27 - 2015-03-24 12:27 - 00000000 ____D () C:\ProgramData\AMMYY
      2015-03-24 12:26 - 2015-03-02 16:29 - 00769528 _____ (Ammyy LLC) C:\Users\Jimmy\Desktop\AA_v3.5.exe
      2015-03-24 12:26 - 2014-05-22 10:44 - 05676624 _____ (TeamViewer) C:\Users\Jimmy\Desktop\TeamViewerQS.exe
      2015-03-24 11:07 - 2015-03-31 11:13 - 00000138 _____ () C:\Windows\SysWOW64\ERRLOG2.XLS
      2015-03-24 11:07 - 2015-03-31 11:12 - 00002091 _____ () C:\Windows\SysWOW64\userslis.XLS
      2015-03-24 11:07 - 2015-03-31 11:12 - 00002091 _____ () C:\Windows\SysWOW64\lcAdminusers2.XLS
      2015-03-24 11:07 - 2015-03-31 11:12 - 00000254 _____ () C:\Windows\SysWOW64\ERRLOG.XLS
      2015-03-24 10:48 - 2015-03-24 11:07 - 00000000 ____D () C:\ProgramData\Sage
      2015-03-24 10:34 - 2015-03-24 10:34 - 00000000 ____D () C:\Windows\System32\Tasks\Norton 360
      2015-03-18 11:31 - 2015-03-18 11:31 - 00163328 _____ () C:\Users\Jimmy\Downloads\JA Q-TMAEON-001 (1).xls
      2015-03-18 11:30 - 2015-03-18 11:30 - 00110080 _____ () C:\Users\Jimmy\Downloads\Q JT1064 - AEON Maluri Cheras, SURAU & FOOD COURT   CORRIDOR.xls
      2015-03-18 11:29 - 2015-03-18 11:29 - 00103424 _____ () C:\Users\Jimmy\Downloads\Q J1065 (r1), JA, AEON,TEBRAU.xls
      2015-03-18 11:29 - 2015-03-18 11:29 - 00101888 _____ () C:\Users\Jimmy\Downloads\Q J1066 - JA, KAYAKU.xls
      2015-03-18 11:28 - 2015-03-18 11:28 - 00111616 _____ () C:\Users\Jimmy\Downloads\Q J1068 - JA, MHT.xls
      2015-03-17 10:40 - 2015-03-17 10:40 - 00163328 _____ () C:\Users\Jimmy\Downloads\JA Q-TMAEON-001.xls
      2015-03-16 15:27 - 2015-03-16 15:27 - 00112128 _____ () C:\Users\Jimmy\Downloads\Q J1063 (R1) - JA, Takenaka HQ, Wallpaper.xls
      2015-03-16 12:19 - 2015-03-16 12:19 - 00113152 _____ () C:\Users\Jimmy\Downloads\JA, I1150.xls
      2015-03-13 12:14 - 2015-03-13 12:14 - 00155136 _____ () C:\Users\Jimmy\Downloads\Aeon maluri cheras quotation.xls
      2015-03-13 12:13 - 2015-03-13 12:13 - 00111104 _____ () C:\Users\Jimmy\Downloads\Q J1060 - JA, Takenaka HQ, Wallpaper.xls
      2015-03-13 10:44 - 2015-03-13 10:44 - 00103424 _____ () C:\Users\Jimmy\Downloads\JA Q-JST-005(COMBINED) Work Done (1).xls
      2015-03-13 10:21 - 2015-03-13 10:21 - 00137728 _____ () C:\Users\Jimmy\Downloads\JA I1146, I1147, I1148.xls
      2015-03-13 10:20 - 2015-03-13 10:20 - 00138240 _____ () C:\Users\Jimmy\Downloads\PC0197 (C2 -  JA, JST-J001).xls
      2015-03-12 14:53 - 2015-03-12 14:54 - 01153536 _____ () C:\Users\Jimmy\Downloads\JA Q-MITSUI-076.xls
      2015-03-11 10:43 - 2015-02-20 12:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
      2015-03-11 10:43 - 2015-02-20 12:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
      2015-03-11 10:43 - 2015-02-20 12:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
      2015-03-11 10:43 - 2015-02-20 12:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
      2015-03-11 10:43 - 2015-02-20 12:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
      2015-03-11 10:43 - 2015-02-20 12:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
      2015-03-11 10:43 - 2015-02-20 12:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
      2015-03-11 10:43 - 2015-02-20 12:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
      2015-03-11 10:43 - 2015-02-20 11:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
      2015-03-11 10:43 - 2015-02-20 11:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
      2015-03-11 10:43 - 2015-02-03 11:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
      2015-03-11 10:43 - 2015-02-03 11:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
      2015-03-11 10:43 - 2015-02-03 11:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
      2015-03-11 10:43 - 2015-02-03 11:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
      2015-03-11 10:43 - 2015-02-03 11:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
      2015-03-11 10:43 - 2015-02-03 11:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
      2015-03-11 10:43 - 2015-02-03 11:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
      2015-03-11 10:43 - 2015-02-03 11:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
      2015-03-11 10:43 - 2015-02-03 11:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
      2015-03-11 10:43 - 2015-02-03 11:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
      2015-03-11 10:43 - 2015-02-03 11:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
      2015-03-11 10:43 - 2015-02-03 11:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
      2015-03-11 10:43 - 2015-02-03 11:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
      2015-03-11 10:43 - 2015-02-03 11:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
      2015-03-11 10:43 - 2015-02-03 11:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
      2015-03-11 10:43 - 2015-02-03 11:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
      2015-03-11 10:43 - 2015-02-03 11:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
      2015-03-11 10:43 - 2015-02-03 11:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
      2015-03-11 10:43 - 2015-02-03 11:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
      2015-03-11 10:43 - 2015-02-03 11:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
      2015-03-11 10:43 - 2015-02-03 11:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
      2015-03-11 10:43 - 2015-02-03 11:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
      2015-03-11 10:43 - 2015-02-03 11:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
      2015-03-11 10:43 - 2015-02-03 11:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
      2015-03-11 10:43 - 2015-02-03 11:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
      2015-03-11 10:43 - 2015-02-03 11:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
      2015-03-11 10:43 - 2015-02-03 11:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
      2015-03-11 10:43 - 2015-02-03 11:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
      2015-03-11 10:43 - 2015-02-03 11:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
      2015-03-11 10:43 - 2015-02-03 11:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
      2015-03-11 10:43 - 2015-02-03 11:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
      2015-03-11 10:43 - 2015-02-03 11:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
      2015-03-11 10:43 - 2015-02-03 11:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
      2015-03-11 10:43 - 2015-02-03 11:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
      2015-03-11 10:43 - 2015-02-03 11:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
      2015-03-11 10:43 - 2015-02-03 11:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
      2015-03-11 10:43 - 2015-02-03 11:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
      2015-03-11 10:43 - 2015-02-03 11:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
      2015-03-11 10:43 - 2015-02-03 11:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
      2015-03-11 10:43 - 2015-02-03 11:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
      2015-03-11 10:43 - 2015-02-03 11:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
      2015-03-11 10:43 - 2015-02-03 11:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
      2015-03-11 10:43 - 2015-02-03 11:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
      2015-03-11 10:43 - 2015-02-03 11:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
      2015-03-11 10:43 - 2015-02-03 11:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
      2015-03-11 10:43 - 2015-02-03 11:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
      2015-03-11 10:43 - 2015-02-03 11:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
      2015-03-11 10:43 - 2015-02-03 11:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
      2015-03-11 10:43 - 2015-02-03 11:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
      2015-03-11 10:43 - 2015-02-03 11:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
      2015-03-11 10:43 - 2015-02-03 11:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
      2015-03-11 10:43 - 2015-02-03 11:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
      2015-03-11 10:43 - 2015-02-03 11:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
      2015-03-11 10:43 - 2015-02-03 11:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
      2015-03-11 10:43 - 2015-02-03 11:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
      2015-03-11 10:43 - 2015-02-03 11:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
      2015-03-11 10:43 - 2015-02-03 11:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
      2015-03-11 10:43 - 2015-02-03 11:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
      2015-03-11 10:43 - 2015-02-03 11:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
      2015-03-11 10:43 - 2015-02-03 11:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
      2015-03-11 10:43 - 2015-02-03 11:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
      2015-03-11 10:43 - 2015-02-03 11:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
      2015-03-11 10:43 - 2015-02-03 11:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
      2015-03-11 10:43 - 2015-02-03 11:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
      2015-03-11 10:43 - 2015-02-03 10:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
      2015-03-11 10:43 - 2014-11-01 06:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
      2015-03-11 10:42 - 2015-02-03 11:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
      2015-03-11 10:42 - 2015-02-03 11:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
      2015-03-11 10:41 - 2015-03-06 13:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
      2015-03-11 10:41 - 2015-03-06 13:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
      2015-03-11 10:41 - 2015-03-06 13:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
      2015-03-11 10:41 - 2015-03-06 13:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
      2015-03-11 10:41 - 2015-03-06 13:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
      2015-03-11 10:41 - 2015-03-06 13:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
      2015-03-11 10:41 - 2015-03-06 13:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
      2015-03-11 10:41 - 2015-03-06 13:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
      2015-03-11 10:41 - 2015-03-06 13:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
      2015-03-11 10:41 - 2015-03-06 13:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
      2015-03-11 10:41 - 2015-03-06 13:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
      2015-03-11 10:41 - 2015-03-06 13:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
      2015-03-11 10:41 - 2015-03-06 13:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
      2015-03-11 10:41 - 2015-03-06 13:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
      2015-03-11 10:41 - 2015-03-06 13:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
      2015-03-11 10:41 - 2015-03-06 13:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
      2015-03-11 10:41 - 2015-03-06 13:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
      2015-03-11 10:41 - 2015-03-06 13:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
      2015-03-11 10:41 - 2015-03-06 13:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
      2015-03-11 10:41 - 2015-03-06 13:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
      2015-03-11 10:41 - 2015-03-06 13:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
      2015-03-11 10:41 - 2015-03-06 13:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
      2015-03-11 10:41 - 2015-03-06 13:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
      2015-03-11 10:41 - 2015-03-06 13:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
      2015-03-11 10:41 - 2015-03-06 13:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
      2015-03-11 10:41 - 2015-03-06 13:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
      2015-03-11 10:41 - 2015-03-06 13:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
      2015-03-11 10:41 - 2015-03-06 13:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
      2015-03-11 10:41 - 2015-03-06 13:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
      2015-03-11 10:41 - 2015-03-06 13:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
      2015-03-11 10:41 - 2015-03-06 13:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
      2015-03-11 10:41 - 2015-02-13 13:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
      2015-03-11 10:41 - 2015-02-13 13:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
      2015-03-11 10:41 - 2015-02-03 11:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
      2015-03-11 10:41 - 2015-02-03 11:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
      2015-03-11 10:41 - 2015-01-31 11:48 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
      2015-03-11 10:41 - 2015-01-31 11:48 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
      2015-03-11 10:41 - 2015-01-31 07:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
      2015-03-11 10:41 - 2015-01-31 07:56 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
      2015-03-11 10:41 - 2015-01-17 10:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
      2015-03-11 10:41 - 2015-01-17 10:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
      2015-03-11 10:40 - 2015-02-26 11:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
      2015-03-11 10:40 - 2015-02-24 11:15 - 00389800 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
      2015-03-11 10:40 - 2015-02-24 10:32 - 00342696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
      2015-03-11 10:40 - 2015-02-21 09:16 - 25021440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
      2015-03-11 10:40 - 2015-02-21 08:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
      2015-03-11 10:40 - 2015-02-21 08:27 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
      2015-03-11 10:40 - 2015-02-21 08:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
      2015-03-11 10:40 - 2015-02-21 08:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
      2015-03-11 10:40 - 2015-02-21 07:58 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
      2015-03-11 10:40 - 2015-02-21 07:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
      2015-03-11 10:40 - 2015-02-20 11:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
      2015-03-11 10:40 - 2015-02-20 11:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
      2015-03-11 10:40 - 2015-02-20 10:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
      2015-03-11 10:40 - 2015-02-20 10:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
      2015-03-11 10:40 - 2015-02-20 10:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
      2015-03-11 10:40 - 2015-02-20 10:48 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
      2015-03-11 10:40 - 2015-02-20 10:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
      2015-03-11 10:40 - 2015-02-20 10:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
      2015-03-11 10:40 - 2015-02-20 10:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
      2015-03-11 10:40 - 2015-02-20 10:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
      2015-03-11 10:40 - 2015-02-20 10:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
      2015-03-11 10:40 - 2015-02-20 10:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
      2015-03-11 10:40 - 2015-02-20 10:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
      2015-03-11 10:40 - 2015-02-20 10:32 - 06035456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
      2015-03-11 10:40 - 2015-02-20 10:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
      2015-03-11 10:40 - 2015-02-20 10:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
      2015-03-11 10:40 - 2015-02-20 10:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
      2015-03-11 10:40 - 2015-02-20 10:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
      2015-03-11 10:40 - 2015-02-20 10:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
      2015-03-11 10:40 - 2015-02-20 10:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
      2015-03-11 10:40 - 2015-02-20 10:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
      2015-03-11 10:40 - 2015-02-20 10:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
      2015-03-11 10:40 - 2015-02-20 10:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
      2015-03-11 10:40 - 2015-02-20 10:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
      2015-03-11 10:40 - 2015-02-20 10:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
      2015-03-11 10:40 - 2015-02-20 10:01 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
      2015-03-11 10:40 - 2015-02-20 10:00 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
      2015-03-11 10:40 - 2015-02-20 09:58 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
      2015-03-11 10:40 - 2015-02-20 09:56 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
      2015-03-11 10:40 - 2015-02-20 09:56 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
      2015-03-11 10:40 - 2015-02-20 09:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
      2015-03-11 10:40 - 2015-02-20 09:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
      2015-03-11 10:40 - 2015-02-20 09:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
      2015-03-11 10:40 - 2015-02-20 09:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
      2015-03-11 10:40 - 2015-02-20 09:43 - 14398976 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
      2015-03-11 10:40 - 2015-02-20 09:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
      2015-03-11 10:40 - 2015-02-20 09:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
      2015-03-11 10:40 - 2015-02-20 09:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
      2015-03-11 10:40 - 2015-02-20 09:28 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
      2015-03-11 10:40 - 2015-02-20 09:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
      2015-03-11 10:40 - 2015-02-20 09:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
      2015-03-11 10:40 - 2015-02-20 09:23 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
      2015-03-11 10:40 - 2015-02-20 09:16 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
      2015-03-11 10:40 - 2015-02-20 09:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
      2015-03-11 10:40 - 2015-02-20 09:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
      2015-03-11 10:40 - 2015-02-20 08:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
      2015-03-11 10:40 - 2015-02-20 08:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
      2015-03-11 10:39 - 2015-02-04 11:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
      2015-03-11 10:39 - 2015-02-04 10:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
      2015-03-10 10:44 - 2015-03-10 10:44 - 00175616 _____ () C:\Users\Jimmy\Downloads\ClaimNo.8.9March2015.to.JasaAman.draft(revised.2).xls
      2015-03-10 10:27 - 2015-03-10 10:27 - 00084480 _____ () C:\Users\Jimmy\Downloads\JA Q-Kayaku-108 Work Done 3-7-2015 (1).xls
      2015-03-09 11:23 - 2015-03-09 11:23 - 00087552 _____ () C:\Users\Jimmy\Downloads\JA Q-ASAEON-048 Work Done 7-3-2015.xls
      2015-03-09 11:21 - 2015-03-09 11:21 - 00089600 _____ () C:\Users\Jimmy\Downloads\JA Q-AEON-TC-003 Work Done 7-3-2015.xls
      2015-03-09 11:17 - 2015-03-09 11:17 - 01973248 _____ () C:\Users\Jimmy\Downloads\JA Q-JST-013 Work Done 7-3-2015.xls
      2015-03-09 11:15 - 2015-03-09 11:15 - 01226752 _____ () C:\Users\Jimmy\Downloads\JA Q-JST-012 Work Done 7-3-2015.xls
      2015-03-09 11:14 - 2015-03-09 11:14 - 00154624 _____ () C:\Users\Jimmy\Downloads\JA Q-JST-011 Work Done 7-3-2015.xls
      2015-03-09 11:12 - 2015-03-09 11:12 - 00097280 _____ () C:\Users\Jimmy\Downloads\JA Q-JST-010 Work Done 7-3-2015.xls
      2015-03-09 11:10 - 2015-03-09 11:10 - 00097280 _____ () C:\Users\Jimmy\Downloads\JA Q-JST-009 Work Done 7-3-2015.xls
      2015-03-09 11:08 - 2015-03-09 11:08 - 00097280 _____ () C:\Users\Jimmy\Downloads\JA Q-JST-007 Work Done 7-3-2015.xls
      2015-03-09 11:01 - 2015-03-09 11:01 - 00103424 _____ () C:\Users\Jimmy\Downloads\JA Q-JST-005(COMBINED) Work Done.xls
      2015-03-09 10:54 - 2015-03-09 10:54 - 01982976 _____ () C:\Users\Jimmy\Downloads\JA Q-Kayaku-114 Work Done 7-3-2015 (1).xls
      2015-03-09 10:54 - 2015-03-09 10:54 - 00455168 _____ () C:\Users\Jimmy\Downloads\JA Q-Kayaku-115 Work Done 7-3-2015.xls
      2015-03-09 10:52 - 2015-03-09 10:52 - 01982976 _____ () C:\Users\Jimmy\Downloads\JA Q-Kayaku-114 Work Done 7-3-2015.xls
      2015-03-09 10:52 - 2015-03-09 10:52 - 00089600 _____ () C:\Users\Jimmy\Downloads\JA Q-Kayaku-113-P2 Work Done 7-3-2015 (1).xls
      2015-03-09 10:50 - 2015-03-09 10:50 - 00089600 _____ () C:\Users\Jimmy\Downloads\JA Q-Kayaku-113-P2 Work Done 7-3-2015.xls
      2015-03-09 10:49 - 2015-03-09 10:49 - 00123904 _____ () C:\Users\Jimmy\Downloads\JA Q-Kayaku-112-P2 Work Done 7-3-2015.xls
      2015-03-09 10:45 - 2015-03-09 10:45 - 00084992 _____ () C:\Users\Jimmy\Downloads\JA Q-Kayaku-111-P2 Work Done 7-3-2015.xls
      2015-03-09 10:44 - 2015-03-09 10:44 - 00084480 _____ () C:\Users\Jimmy\Downloads\JA Q-Kayaku-108 Work Done 3-7-2015.xls
      2015-03-09 10:38 - 2015-03-09 10:38 - 00117248 _____ () C:\Users\Jimmy\Downloads\JA PO-TAK HQ-EURO-001.xls
      2015-03-06 12:06 - 2015-03-06 12:06 - 00092672 _____ () C:\Users\Jimmy\Downloads\JA Q-TAK-003 Rev.1.xls
      2015-03-05 11:17 - 2015-03-05 11:17 - 00157184 _____ () C:\Users\Jimmy\Downloads\JA Q-MITSUI-075.xls
      2015-03-05 11:10 - 2015-03-05 11:10 - 00803328 _____ () C:\Users\Jimmy\Downloads\JA Q-MITSUI-074.xls
      2015-03-05 11:06 - 2015-03-05 11:06 - 00087552 _____ () C:\Users\Jimmy\Downloads\JA Q-MITSUI-073.xls
      2015-03-05 10:58 - 2015-03-05 10:58 - 00619520 _____ () C:\Users\Jimmy\Downloads\JA Q-MITSUI-072.xls
      2015-03-05 10:56 - 2015-03-05 10:56 - 00084480 _____ () C:\Users\Jimmy\Downloads\JA Q-MITSUI-071 Work Done 2-3-2015.xls
      2015-03-05 10:53 - 2015-03-05 10:53 - 00336896 _____ () C:\Users\Jimmy\Downloads\JA Q-MITSUI-070 Work Done 2-3-2015.xls
      2015-03-05 10:52 - 2015-03-05 10:52 - 00083968 _____ () C:\Users\Jimmy\Downloads\JA Q-MITSUI-067 Work Done 2-3-2015.xls
      2015-03-05 10:49 - 2015-03-05 10:49 - 00083968 _____ () C:\Users\Jimmy\Downloads\JA Q-MITSUI-064 Work Done 2-3-2015 (1).xls
      2015-03-05 10:48 - 2015-03-05 10:48 - 00083968 _____ () C:\Users\Jimmy\Downloads\JA Q-MITSUI-064 Work Done 2-3-2015.xls
      2015-03-05 10:44 - 2015-03-05 10:44 - 00084480 _____ () C:\Users\Jimmy\Downloads\JA Q-MITSUI-058 Work Done 2-3-2015.xls
      2015-03-05 10:39 - 2015-03-05 10:39 - 00084480 _____ () C:\Users\Jimmy\Downloads\JA Q-MITSUI-033-P2 Work Done 4-3-2015.xls
      2015-03-04 12:56 - 2015-03-04 12:56 - 00172032 _____ () C:\Users\Jimmy\Downloads\ClaimNo.8.3March2015.to.JasaAman.draft(revised.1).xls
      2015-03-04 11:22 - 2015-03-04 11:22 - 00253952 _____ () C:\Users\Jimmy\Downloads\pc-1023(7) mitsui phase 4.xls
      2015-03-04 11:12 - 2015-03-04 11:12 - 00261120 _____ () C:\Users\Jimmy\Downloads\pc-1022(7) aeon big r1 (1).xls
      2015-03-04 11:11 - 2015-03-04 11:11 - 00262656 _____ () C:\Users\Jimmy\Downloads\pc-1022(7) aeon big r1.xls
      2015-03-04 11:10 - 2015-03-04 11:10 - 00262656 _____ () C:\Users\Jimmy\Downloads\pc-1022(7) aeon big.xls
      2015-03-02 11:51 - 2015-03-02 11:51 - 00020992 _____ () C:\Users\Jimmy\Downloads\Quotation.MizuhoLevel34.Pantry.13Feb2014 (1).xls
      2015-03-02 11:38 - 2015-03-02 11:38 - 00020992 _____ () C:\Users\Jimmy\Downloads\Quotation.MizuhoLevel34.Pantry.13Feb2014.xls
       
      ==================== One Month Modified Files and Folders =======
       
      (If an entry is included in the fixlist, the file\folder will be moved.)
       
      2015-03-31 11:25 - 2013-06-19 21:01 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
      2015-03-31 11:25 - 2013-06-19 21:01 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
      2015-03-31 11:20 - 2009-07-14 12:45 - 00020672 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
      2015-03-31 11:20 - 2009-07-14 12:45 - 00020672 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
      2015-03-31 11:19 - 2013-06-19 21:00 - 01989386 _____ () C:\Windows\WindowsUpdate.log
      2015-03-31 11:15 - 2014-12-22 10:23 - 00002896 _____ () C:\Windows\System32\Tasks\AutoKMS
      2015-03-31 11:15 - 2013-08-23 11:15 - 00000000 ___RD () C:\Users\Jimmy\Dropbox
      2015-03-31 11:15 - 2013-06-19 21:49 - 00000266 _____ () C:\Windows\Tasks\AutoKMS.job
      2015-03-31 11:13 - 2013-08-23 11:12 - 00000000 ____D () C:\Users\Jimmy\AppData\Roaming\Dropbox
      2015-03-31 11:11 - 2013-06-19 22:24 - 00000000 ____D () C:\ProgramData\NVIDIA
      2015-03-31 11:11 - 2009-07-14 13:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
      2015-03-31 11:09 - 2013-06-21 11:19 - 00000000 ____D () C:\Temp
      2015-03-31 11:09 - 2013-06-19 22:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
      2015-03-31 11:09 - 2013-06-19 22:24 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
      2015-03-31 11:09 - 2013-06-19 22:24 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
      2015-03-31 11:06 - 2013-06-19 22:23 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
      2015-03-31 10:58 - 2013-06-19 21:04 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM
      2015-03-28 11:44 - 2015-01-15 09:58 - 01316000 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
      2015-03-28 11:44 - 2013-10-30 10:12 - 01316000 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
      2015-03-28 11:43 - 2015-01-15 09:58 - 01756424 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
      2015-03-28 11:43 - 2013-10-30 10:12 - 01570672 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
      2015-03-27 11:28 - 2015-01-15 10:14 - 00000000 ____D () C:\Users\Jimmy\AppData\Local\CrashDumps
      2015-03-24 13:28 - 2009-07-14 11:20 - 00000000 ____D () C:\Windows\rescache
      2015-03-24 12:28 - 2009-07-14 13:13 - 00786622 _____ () C:\Windows\system32\PerfStringBackup.INI
      2015-03-24 12:27 - 2013-07-12 11:47 - 00000000 ____D () C:\Users\Jimmy\AppData\Roaming\TeamViewer
      2015-03-24 11:20 - 2013-06-21 12:40 - 00000000 ____D () C:\UBSACC90
      2015-03-24 10:28 - 2013-12-31 10:14 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360
      2015-03-24 10:28 - 2013-07-02 17:07 - 00003206 _____ () C:\Windows\System32\Tasks\Norton WSC Integration
      2015-03-24 10:28 - 2013-07-02 17:07 - 00002319 _____ () C:\Users\Public\Desktop\Norton 360.lnk
      2015-03-24 10:28 - 2013-07-02 17:07 - 00000000 ____D () C:\Windows\system32\Drivers\N360x64
      2015-03-23 11:26 - 2013-06-19 21:01 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
      2015-03-13 12:07 - 2014-04-22 11:46 - 00001969 _____ () C:\Users\Public\Desktop\Samsung Kies 3.lnk
      2015-03-13 12:07 - 2013-06-21 11:17 - 00000000 ____D () C:\Program Files (x86)\Samsung
      2015-03-13 12:05 - 2013-10-03 11:08 - 00000000 ____D () C:\Users\Jimmy\Documents\SelfMV
      2015-03-13 11:14 - 2013-08-23 11:15 - 00001017 _____ () C:\Users\Jimmy\Desktop\Dropbox.lnk
      2015-03-13 11:14 - 2013-08-23 11:13 - 00000000 ____D () C:\Users\Jimmy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
      2015-03-12 14:49 - 2009-07-14 12:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
      2015-03-12 14:46 - 2009-07-14 12:45 - 00340112 _____ () C:\Windows\system32\FNTCACHE.DAT
      2015-03-12 14:45 - 2009-07-14 11:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
      2015-03-12 14:45 - 2009-07-14 11:20 - 00000000 ____D () C:\Windows\system32\Dism
      2015-03-11 15:28 - 2013-06-19 21:30 - 00000000 ____D () C:\ProgramData\Microsoft Help
      2015-03-11 15:28 - 2009-07-14 10:34 - 00000478 _____ () C:\Windows\win.ini
      2015-03-11 15:22 - 2013-08-14 15:41 - 00000000 ____D () C:\Windows\system32\MRT
      2015-03-11 15:18 - 2013-06-21 12:04 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
      2015-03-06 12:46 - 2013-06-21 10:47 - 00000000 ___RD () C:\Users\Jimmy\Desktop\Jimmy Doc
      2015-03-02 10:53 - 2013-10-03 10:50 - 00002002 _____ () C:\Users\Public\Desktop\Samsung Kies (Lite).lnk
       
      ==================== Files in the root of some directories =======
       
      2013-10-10 14:28 - 2013-10-10 14:28 - 50053120 _____ () C:\Program Files (x86)\GUTCFDC.tmp
       
      Some content of TEMP:
      ====================
      C:\Users\Jimmy\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpabqkdy.dll
       
       
      ==================== Bamital & volsnap Check =================
       
      (There is no automatic fix for files that do not pass verification.)
       
      C:\Windows\System32\winlogon.exe => File is digitally signed
      C:\Windows\System32\wininit.exe => File is digitally signed
      C:\Windows\SysWOW64\wininit.exe => File is digitally signed
      C:\Windows\explorer.exe => File is digitally signed
      C:\Windows\SysWOW64\explorer.exe => File is digitally signed
      C:\Windows\System32\svchost.exe => File is digitally signed
      C:\Windows\SysWOW64\svchost.exe => File is digitally signed
      C:\Windows\System32\services.exe => File is digitally signed
      C:\Windows\System32\User32.dll => File is digitally signed
      C:\Windows\SysWOW64\User32.dll => File is digitally signed
      C:\Windows\System32\userinit.exe => File is digitally signed
      C:\Windows\SysWOW64\userinit.exe => File is digitally signed
      C:\Windows\System32\rpcss.dll => File is digitally signed
      C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
       
       
      LastRegBack: 2015-03-30 15:12
       
      ==================== End Of Log ============================
       
      _________________________________________________________________________________________________________________
       
      Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
      Ran by [removed] at 2015-03-31 11:26:36
      Running from C:\Users\[removed]\Downloads
      Boot Mode: Normal
      ==========================================================
       
       
      ==================== Security Center ========================
       
      (If an entry is included in the fixlist, it will be removed.)
       
      AV: Norton 360 (Enabled - Up to date) {53C7D717-52E2-B95E-FA61-6F32ECC805DB}
      AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
      AS: Norton 360 (Enabled - Up to date) {E8A636F3-74D8-B6D0-C0D1-5440974F4F66}
      FW: Norton 360 (Enabled) {6BFC5632-188D-B806-D13E-C607121B42A0}
       
      ==================== Installed Programs ======================
       
      (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
       
      Adobe Reader XI (11.0.10) (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
      CCleaner (HKLM\…\CCleaner) (Version: 5.01 - Piriform)
      Cisco EAP-FAST Module (HKLM-x32\…\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
      Cisco LEAP Module (HKLM-x32\…\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
      Cisco PEAP Module (HKLM-x32\…\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
      Dropbox (HKU\S-1-5-21-441726925-1278100211-2369931726-1000\…\Dropbox) (Version: 3.2.9 - Dropbox, Inc.)
      Etron USB3.0 Host Controller (x32 Version: 0.115 - Etron Technology) Hidden
      Firebird 1.5.6 (HKLM-x32\…\FBDBServer_1_5_is1) (Version:  - Firebird Project)
      Google Chrome (HKLM-x32\…\Google Chrome) (Version: 41.0.2272.101 - Google Inc.)
      Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
      Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
      Google+ Auto Backup (HKLM-x32\…\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
      InterBase (HKLM-x32\…\InterBase) (Version:  - )
      Microsoft .NET Framework 4.5.2 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
      Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\…\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
      Microsoft Office Professional 2010 (HKLM-x32\…\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
      Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.31211.0 - Microsoft Corporation)
      Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\…\{14297226-E0A0-3781-8911-E9D529552663}) (Version: 9.0.30729 - Microsoft Corporation)
      Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
      Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
      Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
      Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
      Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
      Microsoft Visual FoxPro OLE DB Provider (HKLM-x32\…\{3DA245C5-23B1-4874-BFA7-287B7D6C1EF6}) (Version: 1.0.0 - Microsoft Corporation)
      Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\…\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
      MyFreeCodec (HKU\S-1-5-21-441726925-1278100211-2369931726-1000\…\MyFreeCodec) (Version:  - )
      Norton 360 (HKLM-x32\…\N360) (Version: 21.7.0.11 - Symantec Corporation)
      NVIDIA 3D Vision Controller Driver 320.18 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 320.18 - NVIDIA Corporation)
      NVIDIA 3D Vision Driver 341.44 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 341.44 - NVIDIA Corporation)
      NVIDIA GeForce Experience 2.4.1.21 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.4.1.21 - NVIDIA Corporation)
      NVIDIA Graphics Driver 341.44 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 341.44 - NVIDIA Corporation)
      NVIDIA HD Audio Driver 1.3.30.1 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
      NVIDIA PhysX System Software 9.12.1031 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.1031 - NVIDIA Corporation)
      ON_OFF Charge B12.0308.1 (HKLM-x32\…\{3DECD372-76A1-4483-BF10-B547790A3261}) (Version: 1.00.0001 - GIGABYTE)
      Picasa 3 (HKLM-x32\…\Picasa 3) (Version: 3.9 - Google, Inc.)
      QnE Business Solutions (HKLM-x32\…\QnE Business Solutions_is1) (Version:  - QnE Software Sdn. Bhd. (611852-V))
      QnE Business Solutions For Client (HKLM-x32\…\{528043D2-EDDF-4D9D-A0F2-83260497F5D4}) (Version: 3.7.2006 - QnE Software Sdn. Bhd.)
      QNE Service (HKLM-x32\…\{F7466868-C312-46A5-AB1B-70F7D27465D0}) (Version: 1.0.4 - Qne Software)
      Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)
      Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7404 - Realtek Semiconductor Corp.)
      Sage UBS 2015 (HKLM-x32\…\{CE558458-6360-4D36-BBE9-43921B3F7DF0}) (Version: 10.0.0.0 - Sage Software Sdn Bhd)
      Samsung Kies (HKLM-x32\…\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.0.13091_9 - Samsung Electronics Co., Ltd.)
      Samsung Kies (x32 Version: 2.6.0.13091_9 - Samsung Electronics Co., Ltd.) Hidden
      Samsung Kies3 (HKLM-x32\…\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.15024.8 - Samsung Electronics Co., Ltd.)
      Samsung Kies3 (x32 Version: 3.2.15024.8 - Samsung Electronics Co., Ltd.) Hidden
      Samsung SCX-4x21 Series (HKLM-x32\…\Samsung SCX-4x21 Series) (Version:  - Samsung Electronics CO.,LTD)
      Samsung Story Album Viewer (HKLM-x32\…\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.)
      Samsung Story Album Viewer (x32 Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Hidden
      SAMSUNG USB Driver for Mobile Phones (HKLM\…\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.49.0 - SAMSUNG Electronics Co., Ltd.)
      Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\…\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
      SHIELD Streaming (Version: 4.1.1000 - NVIDIA Corporation) Hidden
      SHIELD Wireless Controller Driver (Version: 2.4.1.21 - NVIDIA Corporation) Hidden
      TP-LINK 150Mbps Mini Wireless N USB Adapter Driver (HKLM-x32\…\{30DD6255-BF58-4F07-AC03-68A73C5BCD5D}) (Version:  - TP-LINK)
       
      ==================== Custom CLSID (selected items): ==========================
       
      (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
       
      CustomCLSID: HKU\S-1-5-21-441726925-1278100211-2369931726-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
      CustomCLSID: HKU\S-1-5-21-441726925-1278100211-2369931726-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
      CustomCLSID: HKU\S-1-5-21-441726925-1278100211-2369931726-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
      CustomCLSID: HKU\S-1-5-21-441726925-1278100211-2369931726-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
      CustomCLSID: HKU\S-1-5-21-441726925-1278100211-2369931726-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
      CustomCLSID: HKU\S-1-5-21-441726925-1278100211-2369931726-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
      CustomCLSID: HKU\S-1-5-21-441726925-1278100211-2369931726-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
      CustomCLSID: HKU\S-1-5-21-441726925-1278100211-2369931726-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
      CustomCLSID: HKU\S-1-5-21-441726925-1278100211-2369931726-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
      CustomCLSID: HKU\S-1-5-21-441726925-1278100211-2369931726-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
       
      ==================== Restore Points  =========================
       
      24-03-2015 10:47:54 Installed Sage UBS 2015
      24-03-2015 11:19:33 Removed UBS Accounting System 9.2 (SR3.1)
      24-03-2015 12:24:57 Removed Sage UBS 2015
      24-03-2015 12:31:52 Installed Sage UBS 2015
      30-03-2015 12:35:38 Configured Microsoft Office Professional 2010
      30-03-2015 12:38:27 Configured Microsoft Office Professional 2010
      31-03-2015 10:56:55 Windows Update
       
      ==================== Hosts content: ==========================
       
      (If needed Hosts: directive could be included in the fixlist to reset Hosts.)
       
      2009-07-14 10:34 - 2013-06-19 21:22 - 00000864 ____N C:\Windows\system32\Drivers\etc\hosts
      127.0.0.1 validation.sls.microsoft.com
       
      ==================== Scheduled Tasks (whitelisted) =============
       
      (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
       
      Task: {042A1C16-7E7D-4723-AB50-E09522EC2F39} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-25] (Microsoft Corporation)
      Task: {209D2136-91F4-48A3-B7B9-C9F4F186EED8} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-13] (Piriform Ltd)
      Task: {264B642A-A4F8-4ADA-A883-D3D3AE0007BA} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
      Task: {4138D135-B1D3-49B0-A513-60CA370AB430} - System32\Tasks\{10A415C6-2A58-44DA-8C6A-035414FCE22D} => Chrome.exe http://ui.skype.com/ui/0/7.0.0.102/en/abandoninstall?page=tsMain
      Task: {56FA04AE-0305-420C-A198-1B243F604ECF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-28] (Google Inc.)
      Task: {5E6051B7-823B-44B4-96CA-F1BA8CC5FF3D} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
      Task: {889B0408-3B3A-4462-A71B-3AF1249CC582} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton 360\Engine\21.7.0.11\WSCStub.exe [2015-03-07] (Symantec Corporation)
      Task: {942165E4-8798-4F4F-9824-07A005B65DFF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-28] (Google Inc.)
      Task: {B98443A9-3506-4304-BCD1-494573BEC795} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
      Task: {C0728279-B14B-48B7-8323-E2D77BB1BE7C} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
      Task: {ED2024DF-29C9-423E-8A2A-79B4E71E3658} - System32\Tasks\AutoKMS => C:\WINDOWS\AutoKMS\AutoKMS.exe [2013-06-19] ()
      Task: {EDBB9A95-8008-4D9E-A75D-C454AC8208E5} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files (x86)\Norton 360\Engine\21.7.0.11\SymErr.exe [2014-01-31] (Symantec Corporation)
      Task: {EE9DE7FE-104C-4F1B-8AD0-F83F1845351D} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
      Task: {FDCA44E3-F7E7-4B9A-AA62-40A6AB86FD59} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files (x86)\Norton 360\Engine\21.7.0.11\SymErr.exe [2014-01-31] (Symantec Corporation)
      Task: C:\Windows\Tasks\AutoKMS.job => C:\WINDOWS\AutoKMS\AutoKMS.exe
      Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
       
      ==================== Loaded Modules (whitelisted) ==============
       
      2013-06-19 22:24 - 2015-02-04 10:21 - 00115400 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
      2013-06-21 11:17 - 2009-10-13 16:44 - 00022016 _____ () C:\Windows\System32\sugw2l6.dll
      2014-08-04 21:47 - 2014-08-04 21:47 - 00080168 _____ () C:\Program Files (x86)\Common Files\Sage Software\SisPremiseService\UBS.SIS.Premise.Service.exe
      2014-08-08 13:58 - 2014-08-08 13:58 - 00032552 _____ () C:\Program Files (x86)\Common Files\Sage Software\SageScheduler\SageSchedulerService.exe
      2011-08-23 14:34 - 2011-08-23 14:34 - 00009216 _____ () C:\Program Files (x86)\Common Files\Sage Software\BackupService\UBS.UBSService.exe
      2009-09-11 11:30 - 2009-09-11 11:30 - 00008192 _____ () C:\Program Files (x86)\Common Files\Sage Software\BackupService\UBS.UBSService.ScheduledJob.dll
      2009-09-11 11:30 - 2009-09-11 11:30 - 00007168 _____ () C:\Program Files (x86)\Common Files\Sage Software\BackupService\UBS.UBSService.UBSLogger.dll
      2011-08-23 14:34 - 2011-08-23 14:34 - 00012800 _____ () C:\Program Files (x86)\Common Files\Sage Software\BackupService\UBS.UBSService.BackupService.dll
      2014-11-18 17:03 - 2014-11-18 17:03 - 00078648 _____ () C:\Program Files (x86)\Common Files\Sage Software\LicenseService\UBS.Phoenix.Server.Watchdog.exe
      2013-06-21 11:19 - 2009-10-07 05:33 - 00327168 _____ () C:\Windows\system32\SaMinDrv.dll
      2014-08-04 21:47 - 2014-08-04 21:47 - 00071976 _____ () C:\Program Files (x86)\Common Files\Sage Software\SisPremiseService\UBS.SIS.Premise.dll
      2014-09-12 18:08 - 2014-09-12 18:08 - 00060728 _____ () C:\UBSACC2015\SisPremiseAppACC9.dll
      2015-03-02 18:23 - 2015-03-02 18:23 - 00071976 _____ () C:\UBSACC2015\UBS.SIS.Premise.dll
      2014-12-07 17:24 - 2014-12-07 17:24 - 00134282 _____ () c:\ubsacc2015\sageconnectacc9.dll
      2011-11-14 12:22 - 2011-11-14 12:22 - 00077824 _____ () C:\UBSACC2015\Jayrock.Json.dll
      2013-09-12 04:34 - 2013-09-12 04:34 - 00077824 _____ () C:\Program Files (x86)\Common Files\Sage Software\SisPremiseService\Jayrock.Json.dll
      2014-12-06 17:57 - 2014-12-06 17:57 - 00111495 _____ () c:\ubsstk2015\sageconnectbil9.dll
      2015-03-05 06:08 - 2015-03-05 06:08 - 00750080 _____ () C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\libGLESv2.dll
      2015-03-31 11:12 - 2015-03-31 11:12 - 00043008 _____ () c:\users\jimmy\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpabqkdy.dll
      2015-03-05 06:08 - 2015-03-05 06:08 - 00047616 _____ () C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\libEGL.dll
      2015-03-05 06:08 - 2015-03-05 06:08 - 00865280 _____ () C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
      2015-03-05 06:07 - 2015-03-05 06:07 - 00200704 _____ () C:\Users\Jimmy\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
      2014-08-08 13:58 - 2014-08-08 13:58 - 00050984 _____ () C:\Program Files (x86)\Common Files\Sage Software\SageScheduler\SageScheduler.dll
      2015-03-31 11:19 - 2015-03-28 11:45 - 00011920 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
      2015-03-23 11:26 - 2015-03-14 18:12 - 01174856 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\libglesv2.dll
      2015-03-23 11:26 - 2015-03-14 18:12 - 00080200 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\libegl.dll
      2015-03-23 11:26 - 2015-03-14 18:12 - 09278792 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\pdf.dll
       
      ==================== Alternate Data Streams (whitelisted) =========
       
      (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
       
      AlternateDataStreams: C:\Users\Jimmy\Documents\FFOutput:Roxio EMC Stream
      AlternateDataStreams: C:\Users\Jimmy\Documents\Games:Roxio EMC Stream
      AlternateDataStreams: C:\Users\Jimmy\Documents\My Data Sources:Roxio EMC Stream
      AlternateDataStreams: C:\Users\Jimmy\Documents\OneNote Notebooks:Roxio EMC Stream
      AlternateDataStreams: C:\Users\Jimmy\Documents\samsung:Roxio EMC Stream
      AlternateDataStreams: C:\Users\Jimmy\Documents\Samsung PC Studio:Roxio EMC Stream
      AlternateDataStreams: C:\Users\Jimmy\Documents\Samsung PC Studio 3:Roxio EMC Stream
      AlternateDataStreams: C:\Users\Jimmy\Documents\Sara:Roxio EMC Stream
      AlternateDataStreams: C:\Users\Jimmy\Documents\Symantec:Roxio EMC Stream
       
      ==================== Safe Mode (whitelisted) ===================
       
      (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
       
       
      ==================== EXE Association (whitelisted) ===============
       
      (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
       
       
      ==================== Other Areas ============================
       
      (Currently there is no automatic fix for this section.)
       
      HKU\S-1-5-21-441726925-1278100211-2369931726-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Jimmy\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
      DNS Servers: 8.8.8.8 - 8.8.4.4
       
      ==================== MSCONFIG/TASK MANAGER disabled items ==
       
      (Currently there is no automatic fix for this section.)
       
       
      ==================== Accounts: =============================
       
      Administrator (S-1-5-21-441726925-1278100211-2369931726-500 - Administrator - Disabled)
      Guest (S-1-5-21-441726925-1278100211-2369931726-501 - Limited - Enabled)
      HomeGroupUser$ (S-1-5-21-441726925-1278100211-2369931726-1002 - Limited - Enabled)
      Jimmy (S-1-5-21-441726925-1278100211-2369931726-1000 - Administrator - Enabled) => C:\Users\Jimmy
       
      ==================== Faulty Device Manager Devices =============
       
       
      ==================== Event log errors: =========================
       
      Application errors:
      ==================
      Error: (03/30/2015 03:12:17 PM) (Source: SideBySide) (EventID: 80) (User: )
      Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" on line C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
      A component version required by the application conflicts with another component version already active.
      Conflicting components are:.
      Component 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
      Component 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
       
      Error: (03/24/2015 01:20:59 PM) (Source: SideBySide) (EventID: 80) (User: )
      Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" on line C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
      A component version required by the application conflicts with another component version already active.
      Conflicting components are:.
      Component 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
      Component 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
       
      Error: (03/24/2015 10:51:17 AM) (Source: Application Error) (EventID: 1000) (User: )
      Description: Faulting application name: Explorer.EXE, version: 6.1.7601.17567, time stamp: 0x4d672ee4
      Faulting module name: SHELL32.dll, version: 6.1.7601.18762, time stamp: 0x54dd89c7
      Exception code: 0xc0000005
      Fault offset: 0x0000000000046b18
      Faulting process id: 0x700
      Faulting application start time: 0xExplorer.EXE0
      Faulting application path: Explorer.EXE1
      Faulting module path: Explorer.EXE2
      Report Id: Explorer.EXE3
       
      Error: (03/11/2015 00:58:46 PM) (Source: SideBySide) (EventID: 80) (User: )
      Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" on line C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
      A component version required by the application conflicts with another component version already active.
      Conflicting components are:.
      Component 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
      Component 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
       
      Error: (03/10/2015 01:21:16 PM) (Source: SideBySide) (EventID: 80) (User: )
      Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" on line C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
      A component version required by the application conflicts with another component version already active.
      Conflicting components are:.
      Component 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
      Component 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
       
      Error: (03/09/2015 01:23:37 PM) (Source: SideBySide) (EventID: 80) (User: )
      Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" on line C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
      A component version required by the application conflicts with another component version already active.
      Conflicting components are:.
      Component 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
      Component 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
       
      Error: (03/02/2015 00:20:30 PM) (Source: SideBySide) (EventID: 80) (User: )
      Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
      A component version required by the application conflicts with another component version already active.
      Conflicting components are:.
      Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
      Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
       
      Error: (03/02/2015 00:20:30 PM) (Source: SideBySide) (EventID: 80) (User: )
      Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
      A component version required by the application conflicts with another component version already active.
      Conflicting components are:.
      Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
      Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
       
      Error: (03/02/2015 11:14:18 AM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )
      Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - 1>Failed to compile: C:\Program Files (x86)\Samsung\Kies\Kies.exe . Error code = 0x80131f07
       
      Error: (03/02/2015 11:14:18 AM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )
      Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - 1>Failed to compile: C:\Program Files (x86)\Samsung\Kies\Kies.exe . Error code = 0x80131f07
       
       
      System errors:
      =============
      Error: (03/31/2015 11:12:38 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
      Description: The SmartLock LAN Pro service failed to start due to the following error: 
      %%1275
       
      Error: (03/31/2015 11:12:38 AM) (Source: Application Popup) (EventID: 1060) (User: )
      Description: \SystemRoot\SysWow64\Drivers\SLLPSVDR.SYS has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
       
      Error: (03/31/2015 11:12:01 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
      Description: The DgiVecp service failed to start due to the following error: 
      %%20
       
      Error: (03/31/2015 11:04:41 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
      Description: Installation Failure: Windows failed to install the following update with error 0x80070643: Skype for Windows desktop 7.0 (KB2876229).
       
      Error: (03/31/2015 09:51:28 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
      Description: The SmartLock LAN Pro service failed to start due to the following error: 
      %%1275
       
      Error: (03/31/2015 09:51:28 AM) (Source: Application Popup) (EventID: 1060) (User: )
      Description: \SystemRoot\SysWow64\Drivers\SLLPSVDR.SYS has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
       
      Error: (03/31/2015 09:50:58 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
      Description: The DgiVecp service failed to start due to the following error: 
      %%20
       
      Error: (03/30/2015 03:20:11 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
      Description: The SmartLock LAN Pro service failed to start due to the following error: 
      %%1275
       
      Error: (03/30/2015 03:20:11 PM) (Source: Application Popup) (EventID: 1060) (User: )
      Description: \SystemRoot\SysWow64\Drivers\SLLPSVDR.SYS has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
       
      Error: (03/30/2015 03:19:46 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
      Description: The DgiVecp service failed to start due to the following error: 
      %%20
       
       
      Microsoft Office Sessions:
      =========================
      Error: (03/30/2015 03:12:17 PM) (Source: SideBySide) (EventID: 80) (User: )
      Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestc:\program files\CCleaner\CCleaner.exe
       
      Error: (03/24/2015 01:20:59 PM) (Source: SideBySide) (EventID: 80) (User: )
      Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestc:\program files\CCleaner\CCleaner.exe
       
      Error: (03/24/2015 10:51:17 AM) (Source: Application Error) (EventID: 1000) (User: )
      Description: Explorer.EXE6.1.7601.175674d672ee4SHELL32.dll6.1.7601.1876254dd89c7c00000050000000000046b1870001d065da2a25610aC:\Windows\Explorer.EXEC:\Windows\system32\SHELL32.dlla44af261-d1d0-11e4-901f-94de8025b2ad
       
      Error: (03/11/2015 00:58:46 PM) (Source: SideBySide) (EventID: 80) (User: )
      Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestc:\program files\CCleaner\CCleaner.exe
       
      Error: (03/10/2015 01:21:16 PM) (Source: SideBySide) (EventID: 80) (User: )
      Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestc:\program files\CCleaner\CCleaner.exe
       
      Error: (03/09/2015 01:23:37 PM) (Source: SideBySide) (EventID: 80) (User: )
      Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestc:\program files\CCleaner\CCleaner.exe
       
      Error: (03/02/2015 00:20:30 PM) (Source: SideBySide) (EventID: 80) (User: )
      Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files\CCleaner\CCleaner64.exe
       
      Error: (03/02/2015 00:20:30 PM) (Source: SideBySide) (EventID: 80) (User: )
      Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files\CCleaner\CCleaner64.exe
       
      Error: (03/02/2015 11:14:18 AM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )
      Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - 1>Failed to compile: C:\Program Files (x86)\Samsung\Kies\Kies.exe . Error code = 0x80131f07 
      C:\Program Files (x86)\Samsung\Kies\Kies.exe
       
      Error: (03/02/2015 11:14:18 AM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )
      Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - 1>Failed to compile: C:\Program Files (x86)\Samsung\Kies\Kies.exe . Error code = 0x80131f07 
      C:\Program Files (x86)\Samsung\Kies\Kies.exe
       
       
      ==================== Memory info =========================== 
       
      Processor: AMD FX™-4100 Quad-Core Processor 
      Percentage of memory in use: 51%
      Total physical RAM: 4066.57 MB
      Available physical RAM: 1986.42 MB
      Total Pagefile: 8131.32 MB
      Available Pagefile: 5426.7 MB
      Total Virtual: 8192 MB
      Available Virtual: 8191.85 MB
       
      ==================== Drives ================================
       
      Drive c: () (Fixed) (Total:122.07 GB) (Free:43.45 GB) NTFS
      Drive d: () (Fixed) (Total:343.59 GB) (Free:341.6 GB) NTFS
       
      ==================== MBR & Partition Table ==================
       
      ========================================================
      Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 2212C473)
      Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
      Partition 2: (Not Active) - (Size=122.1 GB) - (Type=07 NTFS)
      Partition 3: (Not Active) - (Size=343.6 GB) - (Type=07 NTFS)
       
      ==================== End Of Log ============================

      Hi,

       

      What can you tell me about this ?

      C:\ProgramData\utcry\3M5VMMAW.hta 

       

       

      I am going to have you run a few programs and lets see what they find and remove, run them in the order listed and post the log from each one, keep in mind most tools and scanners run best from the desktop in lieu of being buried in some folder, go into your Downloads folder and look for FRST64, right click on it and select CUT, come back to your desktop and right click on a blank space and select PASTE.  Try to download and run the programs I am posting from the desktop

       

       

       
      -AdwCleaner-by Xplode
       
      Click on this link to download : ADWCleaner
      Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.
      Use my link only, do not do a search for AdwCleaner as there is a bogus copy going around by scammers
       
       
      Do not click on any links in the top Advertisment.
       
      •  
      • Close all open programs and internet browsers.
      • Double click on AdwCleaner.exe to run the tool.
      • Click on Scan.
      • After the scan is complete click on "Clean"
      • Confirm each time with Ok.
      • Your computer will be rebooted automatically. A text file will open after the restart.
      • Please post the content of that logfile with your next reply.
      • You can find the logfile at C:\AdwCleaner[S1].txt as well.
       
       
       
      ===============================================================================
       
       
      [external image: thisisujrt.gif] Please download Junkware Removal Tool to your desktop.
      •  
      • Shut down your protection software now to avoid potential conflicts.
      • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
      • The tool will open and start scanning your system.
      • Please be patient as this can take a while to complete depending on your system's specifications.
      • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
      • Post the contents of JRT.txt into your next message.
       
       
       
       
      ===============================================================================
       
      Download Malwarebytes' Anti-Malware  to your desktop. 
       
      •  
      • Windows XP : Double click on the icon to run it.
      • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
       
       
      [external image: MBAMDashboard_zpsddef9b5f.gif]
       
      •  
      • On the Dashboard click on Update Now
      • Go to the Setting Tab
      • Under Setting go to Detection and Protection
      • Under PUP and PUM make sure both are set to show Treat Detections as Malware
      • Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
      • Then on the Dashboard click on Scan
      • Make sure to select THREAT SCAN
      • Then click on Scan
      • When the scan is finished and the log pops up…select Copy to Clipboard
      • Please paste the log back into this thread for review
      • Exit Malwarebytes
       
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      Junkware Removal Tool (JRT) by Thisisu
      Version: 6.5.0 (03.31.2015:2)
      OS: Windows 7 Ultimate x64
      Ran by [removed] on Wed 01/04/2015 at 14:45:19.85
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
       
       
       
       
      ~~~ Services
       
       
       
      ~~~ Registry Values
       
       
       
      ~~~ Registry Keys
       
       
       
      ~~~ Files
       
       
       
      ~~~ Folders
       
      Successfully deleted: [Folder] "C:\ProgramData\ammyy"
      Successfully deleted: [Folder] "C:\Program Files (x86)\myfree codec"
       
       
       
      # AdwCleaner v4.200 - Logfile created 01/04/2015 at 14:40:23
      # Updated 29/03/2015 by Xplode
      # Database : 2015-03-29.1 [Server]
      # Operating system : Windows 7 Ultimate Service Pack 1 (x64)
      # Username : Jimmy - JIMMY-PC
      # Running from : C:\Users\Jimmy\Desktop\adwcleaner_4.200.exe
      # Option : Cleaning
       
      ***** [ Services ] *****
       
       
      ***** [ Files / Folders ] *****
       
      Folder Deleted : C:\Users\Jimmy\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk
       
      ***** [ Scheduled tasks ] *****
       
       
      ***** [ Shortcuts ] *****
       
       
      ***** [ Registry ] *****
       
      Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk
      Key Deleted : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk
      Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
      Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
      Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
      Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
      Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
      Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
      Key Deleted : HKCU\Software\Myfree Codec
      Key Deleted : HKLM\SOFTWARE\Myfree Codec
       
      ***** [ Web browsers ] *****
       
      -\\ Internet Explorer v11.0.9600.17689
       
       
      -\\ Google Chrome v41.0.2272.101
       
      [C:\Users\Jimmy\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Deleted [Extension] : mkfokfffehpeedafpekjeddnmnjhmcmk
       
      *************************
       
      AdwCleaner[R0].txt - [1981 bytes] - [01/04/2015 14:38:33]
      AdwCleaner[R1].txt - [2040 bytes] - [01/04/2015 14:39:48]
      AdwCleaner[S0].txt - [1935 bytes] - [01/04/2015 14:40:23]
       
      ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1994  bytes] ##########
       
      _____________________________________________________________________________________________
       
      ~~~ Event Viewer Logs were cleared
       
       
       
       
       
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      Scan was completed on Wed 01/04/2015 at 14:48:37.72
      End of JRT log
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
       
      ________________________________________________________________________________________________
       
      Malwarebytes Anti-Malware
      www.malwarebytes.org
       
      Scan Date: 1/4/2015
      Scan Time: 3:01:07 PM
      Logfile: 
      Administrator: Yes
       
      Version: 2.01.4.1018
      Malware Database: v2015.03.09.05
      Rootkit Database: v2015.02.25.01
      License: Free
      Malware Protection: Disabled
      Malicious Website Protection: Disabled
      Self-protection: Disabled
       
      OS: Windows 7 Service Pack 1
      CPU: x64
      File System: NTFS
      User: Jimmy
       
      Scan Type: Threat Scan
      Result: Completed
      Objects Scanned: 342612
      Time Elapsed: 8 min, 57 sec
       
      Memory: Enabled
      Startup: Enabled
      Filesystem: Enabled
      Archives: Enabled
      Rootkits: Disabled
      Heuristics: Enabled
      PUP: Enabled
      PUM: Enabled
       
      Processes: 0
      (No malicious items detected)
       
      Modules: 0
      (No malicious items detected)
       
      Registry Keys: 0
      (No malicious items detected)
       
      Registry Values: 1
      Trojan.PMovie, HKU\S-1-5-21-441726925-1278100211-2369931726-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|webutcry, mshta "C:\ProgramData\utcry\3M5VMMAW.hta", , [f584370c1872b08602d7d5cc20e404fc]
       
      Registry Data: 0
      (No malicious items detected)
       
      Folders: 1
      Trojan.PMovie, C:\ProgramData\utcry, , [f584370c1872b08602d7d5cc20e404fc], 
       
      Files: 3
      Trojan.PMovie, C:\ProgramData\utcry\3M5VMMAW.hta, , [f584370c1872b08602d7d5cc20e404fc], 
      Trojan.PMovie, C:\ProgramData\utcry\2.dat, , [f584370c1872b08602d7d5cc20e404fc], 
      Trojan.PMovie, C:\ProgramData\utcry\bg.jpg, , [f584370c1872b08602d7d5cc20e404fc], 
       
      Physical Sectors: 0
      (No malicious items detected)
       
       
      (end)
       
       
       
       
       
       
       
       
       
      I was unable to locate the AdwCleaner[S1].txt but found the AdwCleaner[S0].txt
      Also I was unable to update the Malwarebytes since I was not able to use even the trial version 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      Junkware Removal Tool (JRT) by Thisisu
      Version: 6.5.0 (03.31.2015:2)
      OS: Windows 7 Ultimate x64
      Ran by [removed] on Wed 01/04/2015 at 14:45:19.85
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
       
       
       
       
      ~~~ Services
       
       
       
      ~~~ Registry Values
       
       
       
      ~~~ Registry Keys
       
       
       
      ~~~ Files
       
       
       
      ~~~ Folders
       
      Successfully deleted: [Folder] "C:\ProgramData\ammyy"
      Successfully deleted: [Folder] "C:\Program Files (x86)\myfree codec"
       
       
       
      # AdwCleaner v4.200 - Logfile created 01/04/2015 at 14:40:23
      # Updated 29/03/2015 by Xplode
      # Database : 2015-03-29.1 [Server]
      # Operating system : Windows 7 Ultimate Service Pack 1 (x64)
      # Username : Jimmy - JIMMY-PC
      # Running from : C:\Users\Jimmy\Desktop\adwcleaner_4.200.exe
      # Option : Cleaning
       
      ***** [ Services ] *****
       
       
      ***** [ Files / Folders ] *****
       
      Folder Deleted : C:\Users\Jimmy\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk
       
      ***** [ Scheduled tasks ] *****
       
       
      ***** [ Shortcuts ] *****
       
       
      ***** [ Registry ] *****
       
      Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk
      Key Deleted : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk
      Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
      Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
      Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
      Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
      Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
      Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
      Key Deleted : HKCU\Software\Myfree Codec
      Key Deleted : HKLM\SOFTWARE\Myfree Codec
       
      ***** [ Web browsers ] *****
       
      -\\ Internet Explorer v11.0.9600.17689
       
       
      -\\ Google Chrome v41.0.2272.101
       
      [C:\Users\Jimmy\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Deleted [Extension] : mkfokfffehpeedafpekjeddnmnjhmcmk
       
      *************************
       
      AdwCleaner[R0].txt - [1981 bytes] - [01/04/2015 14:38:33]
      AdwCleaner[R1].txt - [2040 bytes] - [01/04/2015 14:39:48]
      AdwCleaner[S0].txt - [1935 bytes] - [01/04/2015 14:40:23]
       
      ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1994  bytes] ##########
       
      _____________________________________________________________________________________________
       
      ~~~ Event Viewer Logs were cleared
       
       
       
       
       
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      Scan was completed on Wed 01/04/2015 at 14:48:37.72
      End of JRT log
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
       
      ________________________________________________________________________________________________
       
      Malwarebytes Anti-Malware
      www.malwarebytes.org
       
      Scan Date: 1/4/2015
      Scan Time: 3:01:07 PM
      Logfile: 
      Administrator: Yes
       
      Version: 2.01.4.1018
      Malware Database: v2015.03.09.05
      Rootkit Database: v2015.02.25.01
      License: Free
      Malware Protection: Disabled
      Malicious Website Protection: Disabled
      Self-protection: Disabled
       
      OS: Windows 7 Service Pack 1
      CPU: x64
      File System: NTFS
      User: Jimmy
       
      Scan Type: Threat Scan
      Result: Completed
      Objects Scanned: 342612
      Time Elapsed: 8 min, 57 sec
       
      Memory: Enabled
      Startup: Enabled
      Filesystem: Enabled
      Archives: Enabled
      Rootkits: Disabled
      Heuristics: Enabled
      PUP: Enabled
      PUM: Enabled
       
      Processes: 0
      (No malicious items detected)
       
      Modules: 0
      (No malicious items detected)
       
      Registry Keys: 0
      (No malicious items detected)
       
      Registry Values: 1
      Trojan.PMovie, HKU\S-1-5-21-441726925-1278100211-2369931726-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|webutcry, mshta "C:\ProgramData\utcry\3M5VMMAW.hta", , [f584370c1872b08602d7d5cc20e404fc]
       
      Registry Data: 0
      (No malicious items detected)
       
      Folders: 1
      Trojan.PMovie, C:\ProgramData\utcry, , [f584370c1872b08602d7d5cc20e404fc], 
       
      Files: 3
      Trojan.PMovie, C:\ProgramData\utcry\3M5VMMAW.hta, , [f584370c1872b08602d7d5cc20e404fc], 
      Trojan.PMovie, C:\ProgramData\utcry\2.dat, , [f584370c1872b08602d7d5cc20e404fc], 
      Trojan.PMovie, C:\ProgramData\utcry\bg.jpg, , [f584370c1872b08602d7d5cc20e404fc], 
       
      Physical Sectors: 0
      (No malicious items detected)
       
       
      (end)
       
       
       
       
       
       
       
       
       
      I was unable to locate the AdwCleaner[S1].txt but found the AdwCleaner[S0].txt
      Also I was unable to update the Malwarebytes since I was not able to use even the trial version 

      Morning Bryan

       

      Lets completely uninstall Malwarebytes and reinstall it, I am going to give you a link to a tool that will uninstall it, first go to Programs and Features in the Control Panel and uninstall Malwarebytes, reboot your system and run there removal tool, then reboot again and download and install Malwarebytes via my instructions

       

      Use this procedure to remove Malwarebytes from your computer
       
      •  
      • Download and run their removal utility HERE
      • It will ask to restart your computer (please allow it to).
      • Then download Malwarebytes' Anti-Malware Version 2.1.4  from HERE
      • On the Dashboard click on Update Now
      • Go to the Setting Tab
      • Under Setting go to Detection and Protection
      • Under PUP and PUM make sure both are set to show Threat Detections as Malware
      • Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
      • Then on the Dashboard click on Scan
      • Make sure to select THREAT SCAN
      • Then click on Scan
      • When the scan is finished and the log pops up…select Copy to Clipboard
      • Please paste the log back into this thread for review
      • Exit Malwarebytes
       

      Good Morning

       

        Malwarebytes Anti-Malware

      www.malwarebytes.org
       
      Scan Date: 2/4/2015
      Scan Time: 9:53:36 AM
      Logfile: 
      Administrator: Yes
       
      Version: 2.01.4.1018
      Malware Database: v2015.04.01.11
      Rootkit Database: v2015.03.31.01
      License: Trial
      Malware Protection: Enabled
      Malicious Website Protection: Enabled
      Self-protection: Disabled
       
      OS: Windows 7 Service Pack 1
      CPU: x64
      File System: NTFS
      User: Jimmy
       
      Scan Type: Threat Scan
      Result: Completed
      Objects Scanned: 345739
      Time Elapsed: 10 min, 12 sec
       
      Memory: Enabled
      Startup: Enabled
      Filesystem: Enabled
      Archives: Enabled
      Rootkits: Disabled
      Heuristics: Enabled
      PUP: Enabled
      PUM: Enabled
       
      Processes: 0
      (No malicious items detected)
       
      Modules: 0
      (No malicious items detected)
       
      Registry Keys: 0
      (No malicious items detected)
       
      Registry Values: 1
      Trojan.PMovie, HKU\S-1-5-21-441726925-1278100211-2369931726-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|webutcry, mshta "C:\ProgramData\utcry\3M5VMMAW.hta", , [1659fa6d305a63d399cdb8fe56ae1ae6]
       
      Registry Data: 0
      (No malicious items detected)
       
      Folders: 0
      (No malicious items detected)
       
      Files: 0
      (No malicious items detected)
       
      Physical Sectors: 0
      (No malicious items detected)
       
       
      (end)

      Its still picking up a registry value that needs to be removed, make sure you follow my instructions for automatically removing them

       

      • Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked

       

       

      Try running it again to make sure it comes up clean

       

       

      Then open up FRST, make sure to checkmark Additions , run a new scan and post both logs please

      Ask AI

      AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

      Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI