Spyware / Malware / Virus Removal

tradeadexchange and/or totaladperformance removal? [Solved]

63 min read

Looking for the outcome? Ask AI

Kiboe Topic Starter

Post #1August 31, 2015, 5:15 PM UTC

breifly read through the other threads

so, here's the log for FRST

Additional scan result of Farbar Recovery Scan Tool (x64) Version:30-08-2015

Ran by [removed] (2015-08-31 12:07:16)

Running from C:\Users\[removed]\Downloads

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-1955443169-4279354119-354557393-500 - Administrator - Disabled)

DefaultAccount (S-1-5-21-1955443169-4279354119-354557393-503 - Limited - Disabled)

Guest (S-1-5-21-1955443169-4279354119-354557393-501 - Limited - Disabled)

Owner (S-1-5-21-1955443169-4279354119-354557393-1000 - Administrator - Enabled) => C:\Users\Owner

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Ad-Aware Antivirus (Disabled - Out of date) {D87B6541-12A1-DAEA-0033-9B8057AAB996}

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: AVG AntiVirus Free Edition 2015 (Disabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}

AS: Ad-Aware Antivirus (Disabled - Out of date) {631A84A5-349B-D564-3A83-A0F22C2DF32B}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

AS: AVG AntiVirus Free Edition 2015 (Disabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}

FW: Ad-Aware Firewall (Disabled) {E040E464-58CE-DBB2-2B6C-32B5A979FEED}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Active Sky Next for FSX SP2 (HKLM-x32\…\{F1AE1E08-5094-46AD-AA4D-670C482723B2}_is1) (Version: 1.0.5589.25332 - HiFi Technologies, Inc.)

Ad-Aware Antivirus (HKLM\…\{A041066D-37EF-46FC-9DF7-465A07F1C5CF}_AdAwareUpdater) (Version: 11.7.485.8398 - Lavasoft)

AdAwareInstaller (Version: 11.7.485.8398 - Lavasoft) Hidden

AdAwareUpdater (Version: 11.7.485.8398 - Lavasoft) Hidden

Adobe AIR (HKLM-x32\…\Adobe AIR) (Version: 17.0.0.172 - Adobe Systems Incorporated)

Adobe Flash Player 17 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)

Adobe Photoshop CS3 (HKLM-x32\…\Adobe_2ac78060bc5856b0c1cf873bb919b58) (Version: 10.0 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.10) (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

Adobe Shockwave Player 12.1 (HKLM-x32\…\{0E3C52E0-B4F1-4D1E-B172-E390813BD9FE}) (Version: 12.1.8.158 - Adobe Systems, Inc)

Aerosoft's - Airbus X Extended - FSX (HKLM-x32\…\Airbus X Extended - FSX) (Version: 1.16 - Aerosoft)

Airbus A320 Family Mega Pack FSX & P3D (HKLM\…\{B3433E82-1261-4523-9D4E-BEC8CA678D50}) (Version: 1 - Project Airbus & its collaborators, François Doré, repack by Luis Quintero)

AMD Catalyst Control Center (HKLM-x32\…\WUCCCApp) (Version: 1.00.0000 - AMD)

AMD Catalyst Install Manager (HKLM\…\{F2A7CE36-57BF-5C86-952D-90DBF3746D82}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)

AntimalwareEngine (Version: 3.0.98.0 - Lavasoft) Hidden

ASConnect for FSX Installer (HKLM-x32\…\{7E1270D4-42C4-49A4-9EC4-3300D2E47331}_is1) (Version: 1.0.0.33 - HiFi Technologies, Inc.)

Audacity 2.0.6 (HKLM-x32\…\Audacity_is1) (Version: 2.0.6 - Audacity Team)

AVG (HKLM\…\AvgZen) (Version: 1.3.1.13616 - AVG Technologies)

AVG 2015 (HKLM\…\AVG) (Version: 2015.0.6125 - AVG Technologies)

AVG 2015 (Version: 15.0.4409 - AVG Technologies) Hidden

AVG 2015 (Version: 15.0.6125 - AVG Technologies) Hidden

AVG Web TuneUp (HKLM-x32\…\AVG Web TuneUp) (Version: 4.1.5.143 - AVG Technologies)

AVG Zen (Version: 1.3.3 - AVG Technologies) Hidden

BitTorrent (HKU\S-1-5-21-1955443169-4279354119-354557393-1000\…\BitTorrent) (Version: 7.9.3.40634 - BitTorrent Inc.)

Citrix Online Launcher (HKLM-x32\…\{DB014C85-A264-4BCA-A66F-6DD1FCF8EC36}) (Version: 1.0.335 - Citrix)

Dropbox (HKLM-x32\…\Dropbox) (Version: 3.8.6 - Dropbox, Inc.)

Dropbox Update Helper (x32 Version: 1.3.27.33 - Dropbox, Inc.) Hidden

Firestorm SecondLife and OpenSim viewer (Version: 4.7.45325 - Phoenix Viewer Project) Hidden

Firestorm-Betax64 x64 (HKLM-x32\…\{97166652-349c-48f1-a024-fa8539c5cb47}) (Version: 4.7.45325 - Phoenix Firestorm Project Inc)

FMW 1 (Version: 1.4.1 - AVG Technologies) Hidden

Fraps (remove only) (HKLM-x32\…\Fraps) (Version: - )

FSacars (HKLM-x32\…\{FFC78FC9-2FE6-4648-BFEB-446C61C2D61E}) (Version: 4.0 - Jose Oliveira/FSacars team)

FSDreamTeam KJFK V2 FSX (HKLM-x32\…\FSDreamTeam KJFK V2 FSX_is1) (Version: 2.3.4 - VIRTUALI Sagl)

FSX FSND MD 83 version 2 (HKLM-x32\…\FSX FSND MD 83 version 2) (Version: - )

Google Chrome (HKLM-x32\…\Google Chrome) (Version: 44.0.2403.157 - Google Inc.)

Google Update Helper (x32 Version: 1.3.28.13 - Google Inc.) Hidden

Grand Theft Auto V (HKLM-x32\…\Steam App 271590) (Version: - Rockstar North)

HitmanPro 3.7 (HKLM\…\HitmanPro37) (Version: 3.7.9.245 - SurfRight B.V.)

iRacing.com Race Simulation (HKLM-x32\…\{CBBB3C80-76F5-42B5-92A6-C4BF84796DCB}) (Version: 1.01.0559 - iRacing.com Motorsport Simulations)

IvAp v2.0.2 (build 2773) (HKLM-x32\…\IvAp-v2_is1) (Version: - IVAO)

Java 8 Update 45 (64-bit) (HKLM\…\{26A24AE4-039D-4CA4-87B4-2F86418045F0}) (Version: 8.0.450 - Oracle Corporation)

Java 8 Update 45 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)

KMSP v2.1.2 for FSX (HKLM\…\{41C1DE35-5C5B-4586-B3D3-3204478366F2}) (Version: 2.1.2 - BluePrint Simulations)

Logitech Gaming Software 5.10 (HKLM\…\{1444D2EE-C7AD-44A8-844F-2634B49353D1}) (Version: 5.10.127 - Logitech)

Malwarebytes Anti-Exploit version 1.07.1.1015 (HKLM\…\Malwarebytes Anti-Exploit_is1) (Version: 1.07.1.1015 - Malwarebytes)

Malwarebytes Anti-Malware version 2.1.8.1057 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)

Microsoft Flight Simulator X Service Pack 2 (HKLM-x32\…\{4847BBB9-EADD-4C92-90BF-4223B0892FF6}) (Version: 10.0.61472.0 - Microsoft Game Studios)

Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\…\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\…\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\…\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\…\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\…\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\…\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\…\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)

mIRC (HKLM-x32\…\mIRC) (Version: 7.41 - mIRC Co. Ltd.)

Mozilla Firefox 38.0.5 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 38.0.5 (x86 en-US)) (Version: 38.0.5 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 38.0.5 - Mozilla)

MSXML 4.0 SP2 (KB954430) (HKLM-x32\…\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\…\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MSXML 4.0 SP2 Parser and SDK (HKLM-x32\…\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)

NVIDIA Drivers (HKLM\…\NVIDIA Drivers) (Version: 1.3 - NVIDIA Corporation)

PDF Settings (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden

Phoenix Mesa Gateway 2011 FSX (HKLM-x32\…\Phoenix Mesa Gateway 2011 FSX) (Version: - )

Plantronics® GameCom 780/788 Software for Dolby® Headphone (HKLM-x32\…\{EB3C9064-9140-4279-9E51-965119402151}) (Version: 3.20.0001 - Plantronics)

PMDG 737 6700 NGX Expansion FSX (HKLM-x32\…\{C7EE862A-D83D-4A9F-B746-CBDE39BD7001}) (Version: 1.10.6461 - PMDG Simulations, LLC.)

PMDG 737 8900 NGX Base Package FSX (HKLM-x32\…\{20708FD5-E94D-4097-A21E-E28564CDBC06}) (Version: 1.10.6461 - PMDG Simulations, LLC.)

RAAS Professional by FS2Crew (LOCKED) (HKLM-x32\…\RAAS Professional by FS2Crew (LOCKED)) (Version: - )

Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7535 - Realtek Semiconductor Corp.)

Rockstar Games Social Club (HKLM-x32\…\Rockstar Games Social Club) (Version: 1.1.6.1 - Rockstar Games)

Skype Click to Call (HKLM-x32\…\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.4.0.9058 - Microsoft Corporation)

Skype™ 7.8 (HKLM-x32\…\{6A0549A9-1B96-498C-ACBC-3943001FEB19}) (Version: 7.8.102 - Skype Technologies S.A.)

smartCARS - Fly Virtual (en-US) (HKLM\…\{75940AAA-2C00-2D34-CBC8-A6D4D55DC701_en-US}) (Version: 2.1.15.0 - TFDi Design)

Spotify (HKU\S-1-5-21-1955443169-4279354119-354557393-1000\…\Spotify) (Version: 1.0.12.161.g64b0797c - Spotify AB)

Spybot - Search & Destroy (HKLM-x32\…\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)

SpyHunter 4 (HKLM-x32\…\SpyHunter) (Version: 4.20.9.4533 - Enigma Software Group, LLC)

Steam (HKLM-x32\…\Steam) (Version: 2.10.91.91 - Valve Corporation)

SUPERAntiSpyware (HKLM\…\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1204 - SUPERAntiSpyware.com)

TeamSpeak 3 Client (HKLM\…\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)

Telegram Desktop version 0.8.52 (HKU\S-1-5-21-1955443169-4279354119-354557393-1000\…\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1) (Version: 0.8.52 - Telegram Messenger LLP)

Trading Paints (HKLM-x32\…\{7B2967FB-7828-4823-8D1F-C990FD6CB12E}) (Version: 1.2.0 - Shawn05.com)

Unity Web Player (HKU\S-1-5-21-1955443169-4279354119-354557393-1000\…\UnityWebPlayer) (Version: 5.0.3f2 - Unity Technologies ApS)

Vegas Pro 13.0 (64-bit) (HKLM\…\{D0360940-CCC6-11E3-B9C6-F04DA23A5C58}) (Version: 13.0.310 - Sony)

Visual Studio 2012 x64 Redistributables (HKLM\…\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)

Visual Studio 2012 x86 Redistributables (HKLM-x32\…\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

VLC media player (HKLM-x32\…\VLC media player) (Version: 2.2.1 - VideoLAN)

vPilot (HKU\S-1-5-21-1955443169-4279354119-354557393-1000\…\vPilot) (Version: 1.1.5638.40065 - Ross Carlson)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1955443169-4279354119-354557393-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InprocServer32 -> C:\Windows\system32\shell32.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-1955443169-4279354119-354557393-1000_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\Owner\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64\FileSyncShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-1955443169-4279354119-354557393-1000_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32 -> C:\Users\Owner\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64\FileSyncShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-1955443169-4279354119-354557393-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\Owner\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64\FileSyncShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-1955443169-4279354119-354557393-1000_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\Owner\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64\FileSyncShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-1955443169-4279354119-354557393-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Owner\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64\FileSyncShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-1955443169-4279354119-354557393-1000_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32 -> C:\Users\Owner\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64\FileSyncShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-1955443169-4279354119-354557393-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Owner\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64\FileSyncShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-1955443169-4279354119-354557393-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Owner\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64\FileSyncShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-1955443169-4279354119-354557393-1000_Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1A}\InprocServer32 -> C:\Windows\system32\shell32.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-1955443169-4279354119-354557393-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Owner\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64\FileSyncShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-1955443169-4279354119-354557393-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Owner\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points =========================

25-08-2015 12:02:17 JRT Pre-Junkware Removal

26-08-2015 12:06:03 Checkpoint by HitmanPro

27-08-2015 14:13:27 JRT Pre-Junkware Removal

29-08-2015 08:15:42 JRT Pre-Junkware Removal

30-08-2015 10:55:13 JRT Pre-Junkware Removal

31-08-2015 11:40:14 JRT Pre-Junkware Removal

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 21:34 - 2009-06-10 16:00 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {00EEBA9C-F9EF-4272-B793-C830FBADD359} - System32\Tasks\Microsoft\Windows\ApplicationData\DsSvcCleanup => C:\Windows\system32\dstokenclean.exe [2015-07-10] (Microsoft Corporation)

Task: {064C0E70-CF35-4D27-AD1F-D0BE964DE247} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\Windows\ehome\mcupdate.exe

Task: {09AE8FCB-3428-4541-9DC1-0A15FF21C47F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-07] (Google Inc.)

Task: {0CCA7916-2916-4F12-BD32-1E3BE31E1269} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Device-Join => C:\Windows\System32\dsregcmd.exe [2015-07-10] (Microsoft Corporation)

Task: {19865544-CE08-40BE-8B8C-87C47681433D} - System32\Tasks\Microsoft\Windows\WindowsUpdate\sihboot => C:\Windows\System32\sihclient.exe [2015-07-10] (Microsoft Corporation)

Task: {1C8607AE-583D-48DB-BC06-DA368BA166EA} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION

Task: {2199CCF5-E4CF-49FB-8CF9-E054233E85A8} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\Windows\ehome\ehPrivJob.exe

Task: {342319AD-A0BC-44DF-B158-D2CA4099C608} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION

Task: {3CDCEBA2-DCD4-4D11-AB7C-9196542E7765} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION

Task: {3F6E048D-6404-433B-8F5F-CFF4D89BF89E} - System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser => Rundll32.exe generaltel.dll,RunTelemetryW

Task: {41160EA0-208B-4C3E-B4DB-805BBABC6B93} - System32\Tasks\Microsoft\Windows\Feedback\Siuf\DmClient => C:\Windows\system32\dmclient.exe [2015-07-10] (Microsoft Corporation)

Task: {4A270F9F-7556-4A75-B693-893DA0142F5D} - System32\Tasks\{C4F148A2-C450-4C4A-8B94-C253B423B891} => Chrome.exe http://ui.skype.com/ui/0/7.5.0.102/en/abandoninstall?source=lightinstaller&page;=tsMain

Task: {4DE586A6-146C-479C-A352-FE41914DA6AE} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\Windows\ehome\ehPrivJob.exe

Task: {501898A5-C8F7-45D7-A32A-B3E2F0D9154E} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\Windows\ehome\mcupdate.exe

Task: {52B6FA24-C88B-4AA1-A36F-F989DEEC3503} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION

Task: {578AC950-911E-40B0-A3F0-B1CB3D9B8D94} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\Windows\ehome\ehPrivJob.exe

Task: {5B89CA3F-6DA1-4C5A-83E0-0AB0840185CC} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)

Task: {61FE9B6C-B472-409F-B5FC-1EA0C638A001} - System32\Tasks\Java Platform SE Auto Updater => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2015-04-10] (Oracle Corporation)

Task: {6E0319DB-9829-4FB5-AFA2-FA76185259C1} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\Windows\ehome\ehPrivJob.exe

Task: {73551810-E5F4-433E-9494-0D00B55C855E} - System32\Tasks\Microsoft\Windows\Maps\MapsToastTask

Task: {78B77FA3-9D97-441D-97B6-68CEA40B4F74} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe generaltel.dll,RunTelemetry -maintenance

Task: {7999FA6A-29B6-4B79-8613-6CDE032B02D1} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION

Task: {7FBBF666-218A-45EA-99B9-06A21B3F01BC} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\Windows\ehome\mcupdate.exe

Task: {89760631-D079-43BF-B36C-BB7A18121A1B} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\Windows\ehome\ehrec.exe

Task: {8CC7FCB6-A6E7-4BF5-937D-E95043A31502} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-07] (Google Inc.)

Task: {8DF84CB3-D8E0-4307-A35B-CA74E21786DB} - System32\Tasks\Microsoft\Windows\Clip\License Validation => C:\Windows\system32\ClipUp.exe [2015-07-31] (Microsoft Corporation)

Task: {90233114-6E90-47E6-BAF1-9C1FE924BC1F} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\Windows\ehome\ehPrivJob.exe

Task: {9618FDFC-16F4-45E6-8C80-2DDE308CB65D} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)

Task: {9695DA04-5F9C-4054-96F2-528E0C2428AC} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\Windows\ehome\ehPrivJob.exe

Task: {97BC6AA3-AFA9-4553-8518-0392F09CC5D4} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION

Task: {9ADF95F5-DB78-4835-80B9-BFCEFA22C70A} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)

Task: {9D2DCD06-DBEC-44B9-B0F2-A27E6E028D34} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2015-07-12] (Dropbox, Inc.)

Task: {9DFBC65C-6847-4734-9817-C2B1C6DB7A14} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\Windows\ehome\ehPrivJob.exe

Task: {A2A0D2BE-C195-4CC3-853B-9AFB723446A4} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-06-07] (Adobe Systems Incorporated)

Task: {A5B6CD85-1B57-49B9-BA80-5D5D65F02826} - System32\Tasks\Microsoft\Windows\AppID\EDP Policy Manager

Task: {A79D3CE7-046E-4AFC-857E-CB2BCAFD3E07} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\Windows\ehome\mcupdate.exe

Task: {AA08A2C0-DDCC-4A0A-97E7-8C76E8D2B2CF} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\Windows\ehome\ehPrivJob.exe

Task: {ADC2B457-C49A-4270-A4BA-71043C452CF4} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION

Task: {B056604D-0C9F-47C3-AE9A-37BBA68491BA} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION

Task: {B5517320-0349-4B27-A5ED-487F1C4BD5AE} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION

Task: {C1F68597-4B07-41A0-8DD1-B9417C93D279} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\Windows\ehome\ehPrivJob.exe

Task: {C3F3C7B4-AFC2-41E2-8F66-573C312FB50D} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)

Task: {C56AFFD3-06B8-4A16-AF7E-F7A6EB3FAE9E} - System32\Tasks\Microsoft\Windows\TPM\Tpm-HASCertRetr

Task: {C5EE2EA2-5312-4D1F-B9D0-41B18DF31B78} - System32\Tasks\Microsoft\Windows\WindowsUpdate\sih => C:\Windows\System32\sihclient.exe [2015-07-10] (Microsoft Corporation)

Task: {C7A236B2-12E1-46DC-9501-3B1B0209CC09} - System32\Tasks\Microsoft\Windows\Location\WindowsActionDialog => C:\Windows\System32\WindowsActionDialog.exe [2015-07-10] (Microsoft Corporation)

Task: {CC4F5199-AD27-4D7E-8370-615DA32F88F0} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\Windows\ehome\ehPrivJob.exe

Task: {CFA18871-7DA8-4ED6-9CF3-DF645B527A8D} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe

Task: {DE97BB53-C7A8-4BA7-B70F-D1DBE2C5A5B4} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\Windows\ehome\ehPrivJob.exe

Task: {DEEF5DF5-161E-45D7-9DBA-1D19AEF9E685} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2015-07-12] (Dropbox, Inc.)

Task: {E54AFBFF-9218-4538-8A27-FE2020B57DD0} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\Windows\ehome\mcupdate.exe

Task: {E5CAF409-8504-4422-9D4B-5E64806D9066} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\Windows\ehome\mcupdate.exe

Task: {EC8F11C4-4588-4832-9338-3768696D4BBA} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\Windows\ehome\ehPrivJob.exe

Task: {F1B633E8-D023-4A54-98B1-A4D52C75942C} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION

Task: {F49E1C63-C201-49CB-82A2-1FD1098E8134} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION

Task: {F642B634-3ACD-498A-A4CA-15E8F3492F4E} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\Windows\ehome\ehPrivJob.exe

Task: {FE73E080-287B-4FF9-96CD-86F8F689A8EB} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\Windows\ehome\MCUpdate.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe

Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe

Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2015-07-31 13:33 - 2015-07-31 13:33 - 00032768 _____ () C:\WINDOWS\SYSTEM32\licensemanagerapi.dll

2015-08-19 08:39 - 2015-08-11 04:14 - 00404480 _____ () C:\WINDOWS\System32\diagtrack_wininternal.dll

2015-08-29 05:45 - 2015-08-18 02:56 - 02498808 _____ () C:\WINDOWS\system32\CoreUIComponents.dll

2015-08-29 05:45 - 2015-08-18 02:56 - 02498808 _____ () C:\WINDOWS\System32\CoreUIComponents.dll

2015-07-10 05:59 - 2015-07-10 05:59 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll

2015-08-12 03:17 - 2015-08-02 20:11 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll

2015-07-10 06:00 - 2015-07-10 08:14 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll

2015-08-12 03:17 - 2015-08-02 20:14 - 00882688 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll

2015-08-19 08:39 - 2015-08-11 03:58 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll

2015-08-12 03:17 - 2015-08-02 20:09 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll

2015-08-12 03:17 - 2015-08-02 20:09 - 00928768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RulesBackgroundTasks.dll

2015-08-12 03:17 - 2015-08-02 20:09 - 02028544 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RulesService.dll

2015-07-31 13:33 - 2015-07-31 13:33 - 00619008 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SignalsManager.dll

2015-08-21 13:05 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl

2015-08-21 13:05 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl

2015-08-21 13:05 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl

2015-08-21 13:05 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll

2015-08-21 13:05 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll

2015-08-20 17:51 - 2015-08-18 00:23 - 01405768 _____ () C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.157\libglesv2.dll

2015-08-20 17:51 - 2015-08-18 00:23 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.157\libegl.dll

2015-08-20 17:51 - 2015-08-18 00:23 - 16393032 _____ () C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.157\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ahcache.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CoreMessagingRegistrar => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\StateRepository => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TileDataModelSvc => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\UserManager => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Ahcache.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CoreMessagingRegistrar => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\StateRepository => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TileDataModelSvc => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\UserManager => ""="Service"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1955443169-4279354119-354557393-1000\Control Panel\Desktop\\Wallpaper -> c:\windows\web\wallpaper\windows\img0.jpg

DNS Servers: [removed] - [removed]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\…\StartupApproved\Run32: => "SunJavaUpdateSched"

HKLM\…\StartupApproved\Run32: => "vProt"

HKU\S-1-5-21-1955443169-4279354119-354557393-1000\…\StartupApproved\Run: => "AceUpdater"

HKU\S-1-5-21-1955443169-4279354119-354557393-1000\…\StartupApproved\Run: => "AceStream"

HKU\S-1-5-21-1955443169-4279354119-354557393-1000\…\StartupApproved\Run: => "AceWebException"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139

FirewallRules: [MSMQ-In-TCP] => (Allow) %systemroot%\system32\mqsvc.exe

FirewallRules: [MSMQ-Out-TCP] => (Allow) %systemroot%\system32\mqsvc.exe

FirewallRules: [MSMQ-In-UDP] => (Allow) %systemroot%\system32\mqsvc.exe

FirewallRules: [MSMQ-Out-UDP] => (Allow) %systemroot%\system32\mqsvc.exe

FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => (Allow) LPort=808

FirewallRules: [{CB35CE52-555D-4280-907E-85D117644897}] => (Allow) C:\Users\Owner\AppData\Roaming\BitTorrent\BitTorrent.exe

FirewallRules: [{FE6B12BD-15D5-4F60-917F-F988B76F248E}] => (Allow) C:\Users\Owner\AppData\Roaming\BitTorrent\BitTorrent.exe

FirewallRules: [{6A3AA0CA-47A8-463A-93E7-DAC0BE18EA5F}] => (Allow) C:\Users\Owner\AppData\Roaming\BitTorrent\BitTorrent.exe

FirewallRules: [{5C4EE22B-C3EE-4A0C-933F-6127D4BCDE9F}] => (Allow) C:\Users\Owner\AppData\Roaming\BitTorrent\BitTorrent.exe

FirewallRules: [{E0E338D4-B53E-481A-8031-42ABC55819DE}] => (Allow) C:\Users\Owner\AppData\Roaming\BitTorrent\BitTorrent.exe

FirewallRules: [{8B8F553A-D82D-4A15-9937-62BB676845F6}] => (Allow) C:\Users\Owner\AppData\Roaming\BitTorrent\BitTorrent.exe

FirewallRules: [UDP Query User{03D6766C-FD0D-4CCD-8BED-3AB11034A08A}C:\program files (x86)\mirc\mirc.exe] => (Allow) C:\program files (x86)\mirc\mirc.exe

FirewallRules: [TCP Query User{80DD11C3-5084-4BAF-B845-DEDD61767A52}C:\program files (x86)\mirc\mirc.exe] => (Allow) C:\program files (x86)\mirc\mirc.exe

FirewallRules: [UDP Query User{4B92CFD9-2842-4A74-9B52-B98B7831E688}C:\users\owner\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\owner\appdata\roaming\spotify\spotify.exe

FirewallRules: [TCP Query User{31F15CC8-2FC5-4378-8670-4D6126FDB48B}C:\users\owner\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\owner\appdata\roaming\spotify\spotify.exe

FirewallRules: [UDP Query User{CF43CD7C-CA89-4434-A289-82B31B27B91B}C:\program files\firestorm-betax64\slvoice.exe] => (Allow) C:\program files\firestorm-betax64\slvoice.exe

FirewallRules: [TCP Query User{DFD51242-5F9C-4907-97E8-F4C8348ECFB4}C:\program files\firestorm-betax64\slvoice.exe] => (Allow) C:\program files\firestorm-betax64\slvoice.exe

FirewallRules: [UDP Query User{79D7BD23-6E60-466C-BF1F-4758354D5648}C:\program files (x86)\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\grand theft auto v\gta5.exe

FirewallRules: [TCP Query User{B45D672F-CAEF-4B9F-B902-51E214381843}C:\program files (x86)\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\grand theft auto v\gta5.exe

FirewallRules: [{8839CC48-AE21-4A5A-A279-EC1FB989F3A6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto V\GTAVLauncher.exe

FirewallRules: [{45BB5EB4-C08F-46B4-9EDF-DECD3C01E626}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto V\GTAVLauncher.exe

FirewallRules: [{9D3441B0-113A-4821-B2C9-457EA00C5557}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{6E09AA80-E3D9-479F-BA9A-BD9039F1BF59}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{86895378-9C0B-4A04-A6AF-B5B5DDF27D21}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{5A8D1293-F118-41CA-83D6-33337E1C40BF}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{AAD85D7D-7104-4996-BC9E-90767AC9E0FD}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe

FirewallRules: [{AFD252F7-F19F-427F-9038-CCA942AD59DE}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{819AE2BD-3DC5-45FE-8EA8-AB78E1C8CC79}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{E9962E8C-8DD4-4747-A6DB-879496EA55C9}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe

FirewallRules: [{F93E1A5B-0268-4DEF-9358-AF14E90A6E01}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe

FirewallRules: [{C083049D-5950-41EE-AA30-A5F3DC33387A}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe

FirewallRules: [{E1FBCD64-98C0-4CFF-979F-CEA3B1E656C8}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgdiagex.exe

FirewallRules: [{BBE987B7-E0DA-4F38-B728-A75AB00B551C}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgdiagex.exe

FirewallRules: [{D5C4F1FB-C520-4F51-83FC-D7CF0831D6FB}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe

FirewallRules: [{415D5A9E-4B9E-4E39-B18F-D0F6727050DF}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe

FirewallRules: [{4D88195A-94BF-4B7D-BF1C-9D0EA366E712}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe

FirewallRules: [{22DAA0F6-7279-497C-ADDC-A4CC9085534B}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe

FirewallRules: [{A05EDC6F-A792-410E-BCC3-08371A2F848F}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access

StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D; 2 Scanner Service

StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D; 2 Updater

StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D; 2 Background update service

==================== Faulty Device Manager Devices =============

Name: Microsoft PS/2 Mouse

Description: Microsoft PS/2 Mouse

Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: i8042prt

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.

==================== Event log errors: =========================

Application errors:

==================

Error: (08/31/2015 11:40:27 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:

Access is denied.

Error: (08/31/2015 12:21:29 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: OWNERPC)

Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2147024865 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (08/31/2015 12:21:29 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: OWNERPC)

Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (08/30/2015 09:35:31 PM) (Source: ESENT) (EventID: 413) (User: )

Description: SettingSyncHost (9096) Unable to create a new logfile because the database cannot write to the log drive. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error -1032.

Error: (08/30/2015 09:35:31 PM) (Source: ESENT) (EventID: 488) (User: )

Description: SettingSyncHost (9096) An attempt to create the file "C:\WINDOWS\system32\edbtmp.log" failed with system error 5 (0x00000005): "Access is denied. ". The create file operation will fail with error -1032 (0xfffffbf8).

Error: (08/30/2015 09:35:21 PM) (Source: ESENT) (EventID: 413) (User: )

Error: (08/30/2015 09:35:21 PM) (Source: ESENT) (EventID: 488) (User: )

Error: (08/30/2015 09:35:11 PM) (Source: ESENT) (EventID: 413) (User: )

Error: (08/30/2015 09:35:11 PM) (Source: ESENT) (EventID: 488) (User: )

Error: (08/30/2015 09:35:00 PM) (Source: ESENT) (EventID: 413) (User: )

System errors:

=============

Error: (08/31/2015 11:42:11 AM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The iRacing.com Helper Service service terminated unexpectedly. It has done this 1 time(s).

Error: (08/31/2015 11:42:11 AM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The Message Queuing service terminated unexpectedly. It has done this 1 time(s).

Error: (08/31/2015 11:42:10 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Spybot-S&D; 2 Security Center Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (08/31/2015 11:42:10 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Spybot-S&D; 2 Updating Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (08/31/2015 11:42:09 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The AVG Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.

Error: (08/31/2015 11:42:08 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The SAS Core Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

Error: (08/31/2015 12:22:04 AM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the avgsvc service.

Error: (08/31/2015 12:21:29 AM) (Source: DCOM) (EventID: 10001) (User: OWNERPC)

Description: "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca31CortanaUI.AppXjxtspbn4351hrtx8tc95e89kaz3h2f1f.mcaUnavailableUnavailable

Error: (08/31/2015 12:21:29 AM) (Source: DCOM) (EventID: 10010) (User: OWNERPC)

Description: CortanaUI.AppXtpp90jhw9p0njjb85kvhxpppgrqfp117.mca

Error: (08/31/2015 12:21:26 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The User Data Access_Session1 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.

Microsoft Office:

=========================

Error: (08/31/2015 11:40:27 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:

Access is denied.

Error: (08/31/2015 12:21:29 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: OWNERPC)

Description: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI-2147024865

Error: (08/31/2015 12:21:29 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: OWNERPC)

Description: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI-2144927141

Error: (08/30/2015 09:35:31 PM) (Source: ESENT) (EventID: 413) (User: )

Description: SettingSyncHost9096-1032

Error: (08/30/2015 09:35:31 PM) (Source: ESENT) (EventID: 488) (User: )

Description: SettingSyncHost9096C:\WINDOWS\system32\edbtmp.log-1032 (0xfffffbf8)5 (0x00000005)Access is denied.

Error: (08/30/2015 09:35:21 PM) (Source: ESENT) (EventID: 413) (User: )

Description: SettingSyncHost9096-1032

Error: (08/30/2015 09:35:21 PM) (Source: ESENT) (EventID: 488) (User: )

Description: SettingSyncHost9096C:\WINDOWS\system32\edbtmp.log-1032 (0xfffffbf8)5 (0x00000005)Access is denied.

Error: (08/30/2015 09:35:11 PM) (Source: ESENT) (EventID: 413) (User: )

Description: SettingSyncHost9096-1032

Error: (08/30/2015 09:35:11 PM) (Source: ESENT) (EventID: 488) (User: )

Description: SettingSyncHost9096C:\WINDOWS\system32\edbtmp.log-1032 (0xfffffbf8)5 (0x00000005)Access is denied.

Error: (08/30/2015 09:35:00 PM) (Source: ESENT) (EventID: 413) (User: )

Description: SettingSyncHost9096-1032

CodeIntegrity:

===================================

Date: 2015-07-31 14:10:11.358

Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2015-07-31 14:10:11.090

Date: 2015-07-31 14:10:10.668

Date: 2015-07-31 14:10:09.843

Date: 2015-07-31 14:10:06.011

Date: 2015-07-31 14:09:58.300

Date: 2015-07-31 14:09:39.847

Date: 2015-07-31 14:09:39.702

Date: 2015-07-31 14:09:38.185

Date: 2015-07-31 14:09:34.484

==================== Memory info ===========================

Processor: AMD Athlon™ II X2 235e Processor

Percentage of memory in use: 53%

Total physical RAM: 6143.36 MB

Available physical RAM: 2835.27 MB

Total Virtual: 12287.36 MB

Available Virtual: 8564.38 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.22 GB) (Free:279.74 GB) NTFS

Drive d: (GSP1RMCHPXFRER_EN_DVD) (CDROM) (Total:3.09 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: F6AEA19F)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=465.2 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=450 MB) - (Type=27)

==================== End of Addition.txt ============================

here's the log for JRT

~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_721577D41E77D440C916E2687EBA0267

~~~ Registry Keys

~~~ Files

~~~ Folders

~~~ Chrome

[C:\Users\Owner\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\Owner\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\Owner\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\Owner\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:

[]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Mon 08/31/2015 at 11:49:01.52

End of JRT log

~~~~~~~~~~~~~~~~~

and here's the log for aswMBR

Run date: 2015-08-31 11:51:19

—————————–

11:51:19.725 OS Version: Windows x64 6.2.9200

11:51:19.725 Number of processors: 2 586 0x602

11:51:19.726 ComputerName: OWNERPC UserName: Owner

11:51:27.933 Initialize success

11:51:28.219 VM: initialized successfully

11:51:28.220 VM: Amd CPU supported

11:53:16.408 AVAST engine defs: 15083100

11:53:21.109 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000023

11:53:21.112 Disk 0 Vendor: WDC_WD50 15.0 Size: 476940MB BusType: 3

11:53:21.307 Disk 0 MBR read successfully

11:53:21.310 Disk 0 MBR scan

11:53:21.330 Disk 0 Windows 7 default MBR code

11:53:21.383 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048

11:53:21.411 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 476388 MB offset 206848

11:53:21.446 Disk 0 Partition 3 00 27 Hidden NTFS WinRE NTFS 450 MB offset 975849472

11:53:21.508 Disk 0 scanning C:\WINDOWS\system32\drivers

11:53:38.861 File: C:\WINDOWS\system32\drivers\hitmanpro37.sys **HIDDEN**

11:53:38.867 Service scanning

11:53:51.502 Service hitmanpro37 C:\WINDOWS\system32\drivers\hitmanpro37.sys **LOCKED**

11:54:18.304 Modules scanning

11:54:18.310 Disk 0 trace - called modules:

11:54:18.375 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll nvstor.sys

11:54:18.380 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe00189c22060]

11:54:18.385 3 CLASSPNP.SYS[fffff80075e946c5] -> nt!IofCallDriver -> [0xffffe00189b5e880]

11:54:18.391 5 ACPI.sys[fffff80074951361] -> nt!IofCallDriver -> \Device\00000023[0xffffe00189b24060]

11:54:22.329 AVAST engine scan C:\WINDOWS

11:54:25.533 AVAST engine scan C:\WINDOWS\system32

12:01:30.717 AVAST engine scan C:\WINDOWS\system32\drivers

12:02:01.870 AVAST engine scan C:\Users\Owner

12:14:21.758 Disk 0 MBR has been saved successfully to "C:\Users\Owner\Desktop\MBR.dat"

12:14:21.767 The log file has been saved successfully to "C:\Users\Owner\Desktop\aswMBR.txt"

ken545

Post #2September 2, 2015, 9:42 AM UTC

You posted the Additions log from FRST, I need to see the main FRST log please. Also do not run any other scans on your own or it will alter the logs

Kiboe

Post #3September 2, 2015, 10:46 AM UTC

You posted the Additions log from FRST, I need to see the main FRST log please. Also do not run any other scans on your own or it will alter the logs

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:30-08-2015

Ran by [removed] (administrator) on OWNERPC (31-08-2015 12:04:56)

Running from C:\Users\[removed]\Downloads

[removed]

Platform: Windows 10 Home (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe

(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe

(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe

(Microsoft Corporation) C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

(AVAST Software) C:\Users\Owner\Downloads\aswmbr.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\ActionUriServer.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13885696 2015-06-24] (Realtek Semiconductor)

HKLM\…\Run: [GamecomSound] => C:\Program Files\Plantronics\GameCom 780 & 788\GameCom780.exe [817440 2014-01-21] ()

HKLM\…\Run: [Start WingMan Profiler] => C:\Program Files\Logitech\Gaming Software\LWEMon.exe [190536 2010-06-14] (Logitech Inc.)

HKLM\…\Run: [] => [X]

HKLM\…\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareTray.exe [9549808 2015-06-24] ()

HKLM-x32\…\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-03] (Advanced Micro Devices, Inc.)

HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [335232 2015-04-10] (Oracle Corporation)

HKLM-x32\…\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [39179912 2015-08-05] (Dropbox, Inc.)

HKLM-x32\…\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguix.exe [1139624 2015-08-20] (AVG Technologies CZ, s.r.o.)

HKLM-x32\…\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3780520 2015-07-31] (AVG Technologies CZ, s.r.o.)

HKLM-x32\…\Run: [vProt] => C:\Program Files (x86)\AVG Web TuneUp\vprot.exe [3175312 2015-08-16] ()

HKLM-x32\…\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)

HKLM-x32\…\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe [2620728 2015-07-22] (Malwarebytes Corporation)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKU\S-1-5-21-1955443169-4279354119-354557393-1000\…\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2899136 2015-08-19] (Valve Corporation)

HKU\S-1-5-21-1955443169-4279354119-354557393-1000\…\Run: [Spotify Web Helper] => C:\Users\Owner\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2018360 2015-08-25] (Spotify Ltd)

HKU\S-1-5-21-1955443169-4279354119-354557393-1000\…\Run: [OneDrive] => C:\Users\Owner\AppData\Local\Microsoft\OneDrive\OneDrive.exe [404064 2015-08-19] (Microsoft Corporation)

HKU\S-1-5-21-1955443169-4279354119-354557393-1000\…\Run: [Trading Paints] => C:\Program Files (x86)\Trading Paints\Trading Paints.exe [233456 2015-01-30] ()

HKU\S-1-5-21-1955443169-4279354119-354557393-1000\…\Run: [Spotify] => C:\Users\Owner\AppData\Roaming\Spotify\Spotify.exe [7389752 2015-08-25] (Spotify Ltd)

HKU\S-1-5-21-1955443169-4279354119-354557393-1000\…\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53736048 2015-08-07] (Skype Technologies S.A.)

HKU\S-1-5-21-1955443169-4279354119-354557393-1000\…\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)

HKU\S-1-5-21-1955443169-4279354119-354557393-1000\…\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7930136 2015-07-30] (SUPERAntiSpyware)

HKU\S-1-5-21-1955443169-4279354119-354557393-1000\…\Run: [GoogleChromeAutoLaunch_721577D41E77D440C916E2687EBA0267] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [813896 2015-08-18] (Google Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-08-05] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-08-05] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-08-05] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-08-05] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-08-05] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-08-05] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-08-05] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-08-05] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File

ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-08-05] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-08-05] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-08-05] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-08-05] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-08-05] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-08-05] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-08-05] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-08-05] (Dropbox, Inc.)

BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] [removed] [removed] 192.168.1.1

Tcpip\..\Interfaces\{36664faf-d670-42de-a972-c83547a17be3}: [DhcpNameServer] [removed] [removed] 192.168.1.1

Internet Explorer:

==================

HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm

HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm

HKU\S-1-5-21-1955443169-4279354119-354557393-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp

HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm

BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-06-07] (Oracle Corporation)

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)

BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-07] (Oracle Corporation)

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-06-07] (Oracle Corporation)

BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-07] (Oracle Corporation)

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)

Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)

FireFox:

========

FF ProfilePath: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\h6ktkypm.default

FF DefaultSearchEngine.US: Google

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-06-07] ()

FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-07] (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-07] (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-06-07] ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll [2015-04-17] (Adobe Systems, Inc.)

FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.8.0\\npsitesafety.dll [No File]

FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-07] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-07] (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-28] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-28] (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-1955443169-4279354119-354557393-1000: @citrixonline.com/appdetectorplugin -> C:\Users\Owner\AppData\Local\Citrix\Plugins\104\npappdetector.dll No File

FF Plugin HKU\S-1-5-21-1955443169-4279354119-354557393-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Owner\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-06-08] (Unity Technologies ApS)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wtu-secure-search.xml [2015-08-16]

FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-05-01]

Chrome:

=======

CHR Profile: C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Adguard AdBlocker) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgnkhhnnamicmpeenaelnjfhikgbkllg [2015-08-22]

CHR Extension: (Google Cast) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2015-08-22]

CHR Extension: (Adblock Plus) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-08-22]

CHR Extension: (Adblock Super) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\knebimhcckndhiglamoabbnifdkijidd [2015-08-22]

CHR HKLM-x32\…\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-05-01]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-07-22] (SUPERAntiSpyware.com)

S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-08-03] (Advanced Micro Devices, Inc.) [File not signed]

S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3633576 2015-07-31] (AVG Technologies CZ, s.r.o.)

R2 avgsvc; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [1059240 2015-08-20] (AVG Technologies CZ, s.r.o.)

R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [335656 2015-07-31] (AVG Technologies CZ, s.r.o.)

S2 Bonjour Service; C:\Program Files (x86)\Bonjour\mDNSResponder.exe [229376 2006-02-28] (Apple Computer, Inc.) [File not signed]

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)

S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [134512 2015-07-12] (Dropbox, Inc.)

S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [134512 2015-07-12] (Dropbox, Inc.)

S2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [127752 2015-08-29] (SurfRight B.V.)

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]

S2 iRacingService; C:\Program Files (x86)\iRacing\iRacingService.exe [806176 2015-07-14] (iRacing.com Motorsport Simulations, LLC

Bedford, MA 01730)

S2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareService.exe [716664 2015-06-24] ()

S2 MbaeSvc; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [713016 2015-07-22] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)

S2 MSMQ; C:\Windows\system32\mqsvc.exe [26112 2015-07-31] (Microsoft Corporation)

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)

S3 SensorDataService; C:\Windows\System32\SensorDataService.exe [1031680 2015-07-31] (Microsoft Corporation)

R3 StateRepository; C:\Windows\SysWOW64\windows.staterepository.dll [2049024 2015-07-10] (Microsoft Corporation)

S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [84480 2015-07-31] (Microsoft Corporation)

R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [578560 2015-07-31] (Microsoft Corporation)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation)

S2 WtuSystemSupport; C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe [1195920 2015-08-16] ()

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWT6.sys [102912 2015-05-28] (Advanced Micro Devices)

S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [21152 2015-03-27] (AVG Technologies CZ, s.r.o.)

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [162784 2015-03-11] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [312752 2015-07-28] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [253408 2015-05-12] (AVG Technologies CZ, s.r.o.)

R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [259040 2015-06-16] (AVG Technologies CZ, s.r.o.)

R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [378336 2015-05-07] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [245680 2015-07-28] (AVG Technologies CZ, s.r.o.)

R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [40928 2015-03-20] (AVG Technologies CZ, s.r.o.)

R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [296896 2015-07-10] (AVG Technologies CZ, s.r.o.)

S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3436896 2015-07-10] (QLogic Corporation)

R1 ESProtectionDriver; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [63064 2015-07-22] ()

S0 LSI_SAS3i; C:\Windows\System32\drivers\lsi_sas3i.sys [99168 2015-07-10] (Avago Technologies)

R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)

S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)

R3 MQAC; C:\Windows\System32\drivers\mqac.sys [175104 2015-07-31] (Microsoft Corporation)

S3 nusb3xhc; C:\Windows\system32\drivers\nusb3xhc.sys [180736 2010-09-30] (Renesas Electronics Corporation) [File not signed]

R3 PlantronicsGC; C:\Windows\system32\drivers\PLTGC.sys [1328128 2013-02-07] (C-Media Electronics Inc)

R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

S3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [452040 2015-01-22] (BitDefender S.R.L.)

S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] ()

U3 aswMBR; C:\Users\Owner\AppData\Local\Temp\aswMBR.sys [62728 2015-08-31] () [File not signed]

U3 aswVmm; C:\Users\Owner\AppData\Local\Temp\aswVmm.sys [224896 2015-08-31] ()

U3 idsvc; no ImagePath

S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]

U3 wpcsvc; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-08-31 12:04 - 2015-08-31 12:05 - 00022367 _____ C:\Users\Owner\Downloads\FRST.txt

2015-08-31 12:04 - 2015-08-31 12:05 - 00000000 ____D C:\FRST

2015-08-31 12:04 - 2015-08-31 12:04 - 02188288 _____ (Farbar) C:\Users\Owner\Downloads\FRST64.exe

2015-08-31 11:57 - 2015-08-31 11:57 - 00000262 _____ C:\Users\Owner\Downloads\debug.log

2015-08-31 11:56 - 2015-08-31 11:56 - 05635666 _____ (Swearware) C:\Users\Owner\Downloads\ComboFix.exe

2015-08-31 11:50 - 2015-08-31 11:51 - 05200384 _____ (AVAST Software) C:\Users\Owner\Downloads\aswmbr.exe

2015-08-31 11:49 - 2015-08-31 11:49 - 00001227 _____ C:\Users\Owner\Desktop\JRT.txt

2015-08-31 11:39 - 2015-08-31 11:39 - 00016148 _____ C:\WINDOWS\system32\OWNERPC_Owner_HistoryPrediction.bin

2015-08-30 14:50 - 2015-08-30 14:50 - 00114194 _____ C:\Users\Owner\Desktop\My recording #2.m4a

2015-08-30 14:46 - 2015-08-30 14:46 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf

2015-08-30 09:59 - 2015-08-30 09:59 - 00000862 _____ C:\Users\Owner\Downloads\Brands Hatch S3 - Race.sto

2015-08-29 11:46 - 2015-08-29 11:46 - 00002174 _____ C:\Users\Owner\Downloads\Interlagos-Laguna 1.sto

2015-08-29 05:45 - 2015-08-20 01:02 - 22324656 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2015-08-29 05:45 - 2015-08-20 00:21 - 21875200 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll

2015-08-29 05:45 - 2015-08-20 00:16 - 20857848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2015-08-29 05:45 - 2015-08-19 23:31 - 18806272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll

2015-08-29 05:45 - 2015-08-18 02:56 - 02498808 _____ C:\WINDOWS\system32\CoreUIComponents.dll

2015-08-29 05:45 - 2015-08-18 02:54 - 01396064 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll

2015-08-29 05:45 - 2015-08-18 02:27 - 01771592 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll

2015-08-29 05:45 - 2015-08-18 02:24 - 00963920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll

2015-08-29 05:45 - 2015-08-18 02:12 - 02225664 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll

2015-08-29 05:45 - 2015-08-18 02:04 - 00859136 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll

2015-08-29 05:45 - 2015-08-18 01:52 - 01888768 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll

2015-08-29 05:44 - 2015-08-20 01:07 - 08019296 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2015-08-29 05:44 - 2015-08-20 01:06 - 00609592 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll

2015-08-29 05:44 - 2015-08-20 00:57 - 00077400 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll

2015-08-29 05:44 - 2015-08-20 00:26 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe

2015-08-29 05:44 - 2015-08-20 00:21 - 00193024 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseModernAppMgmtCSP.dll

2015-08-29 05:44 - 2015-08-20 00:13 - 02235904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

2015-08-29 05:44 - 2015-08-18 02:55 - 00373072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS

2015-08-29 05:44 - 2015-08-18 02:13 - 00497664 _____ (Microsoft Corporation) C:\WINDOWS\system32\WlanMediaManager.dll

2015-08-29 05:44 - 2015-08-18 02:13 - 00387584 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupShim.dll

2015-08-29 05:44 - 2015-08-18 02:07 - 02226688 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll

2015-08-29 05:44 - 2015-08-18 02:04 - 01234944 _____ (Microsoft Corporation) C:\WINDOWS\system32\aitstatic.exe

2015-08-29 05:44 - 2015-08-18 01:59 - 01294336 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcnwiz.dll

2015-08-29 05:44 - 2015-08-18 01:59 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\WcnApi.dll

2015-08-29 05:44 - 2015-08-18 01:58 - 00187392 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll

2015-08-29 05:44 - 2015-08-18 01:58 - 00117760 _____ (Microsoft Corporation) C:\WINDOWS\system32\dafWCN.dll

2015-08-29 05:44 - 2015-08-18 01:58 - 00112640 _____ (Microsoft Corporation) C:\WINDOWS\system32\fdWCN.dll

2015-08-29 05:44 - 2015-08-18 01:58 - 00050176 _____ (Microsoft Corporation) C:\WINDOWS\system32\WcnNetsh.dll

2015-08-29 05:44 - 2015-08-18 01:57 - 00045568 _____ (Microsoft Corporation) C:\WINDOWS\system32\wfdprov.dll

2015-08-29 05:44 - 2015-08-18 01:56 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthRadioMedia.dll

2015-08-29 05:44 - 2015-08-18 01:55 - 02178560 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll

2015-08-29 05:44 - 2015-08-18 01:54 - 00322048 _____ (Microsoft Corporation) C:\WINDOWS\system32\vaultsvc.dll

2015-08-29 05:44 - 2015-08-18 01:54 - 00247296 _____ C:\WINDOWS\system32\facecredentialprovider.dll

2015-08-29 05:44 - 2015-08-18 01:50 - 01795072 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll

2015-08-29 05:44 - 2015-08-18 01:49 - 01061888 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll

2015-08-29 05:44 - 2015-08-18 01:49 - 00274432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupShim.dll

2015-08-29 05:44 - 2015-08-18 01:49 - 00246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\PackageStateRoaming.dll

2015-08-29 05:44 - 2015-08-18 01:36 - 01226752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wcnwiz.dll

2015-08-29 05:44 - 2015-08-18 01:35 - 00100352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WcnApi.dll

2015-08-29 05:44 - 2015-08-18 01:35 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fdWCN.dll

2015-08-29 05:44 - 2015-08-18 01:34 - 00037376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wfdprov.dll

2015-08-29 05:44 - 2015-08-18 01:29 - 01593344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll

2015-08-29 05:44 - 2015-08-18 01:26 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PackageStateRoaming.dll

2015-08-29 05:44 - 2015-08-17 23:44 - 00008847 _____ C:\WINDOWS\system32\ResPriHMImageList

2015-08-28 12:12 - 2015-08-28 12:14 - 114573586 _____ C:\Users\Owner\Downloads\ASNext_FSX_Update_B5707.zip

2015-08-28 11:42 - 2015-08-28 12:03 - 00000000 ____D C:\ProgramData\Malwarebytes Anti-Exploit

2015-08-28 11:42 - 2015-08-28 11:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Exploit

2015-08-28 11:42 - 2015-08-28 11:42 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Exploit

2015-08-28 11:39 - 2015-08-28 11:42 - 02865192 _____ (Malwarebytes ) C:\Users\Owner\Downloads\mbae-setup-1.07.1.1015.exe

2015-08-28 11:33 - 2015-08-27 20:24 - 01798640 _____ (Malwarebytes Corporation) C:\Users\Owner\Desktop\JRT.exe

2015-08-28 11:32 - 2015-08-28 11:32 - 00000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job

2015-08-27 12:25 - 2015-08-28 11:38 - 00001962 _____ C:\Users\Public\Desktop\HitmanPro.lnk

2015-08-27 12:25 - 2015-08-27 12:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro

2015-08-26 11:57 - 2015-08-27 12:25 - 00000000 ____D C:\Program Files\HitmanPro

2015-08-26 11:56 - 2015-08-26 11:57 - 11032736 _____ (SurfRight B.V.) C:\Users\Owner\Downloads\HitmanPro_x64.exe

2015-08-26 11:55 - 2015-08-26 11:56 - 04189276 _____ C:\Users\Owner\Downloads\Unconfirmed 383585.crdownload

2015-08-25 12:01 - 2015-08-25 12:02 - 01798576 _____ (Malwarebytes Corporation) C:\Users\Owner\Downloads\JRT.exe

2015-08-22 21:29 - 2015-08-22 21:30 - 00000135 _____ C:\Users\Owner\Downloads\listen.m3u

2015-08-22 14:01 - 2015-08-22 14:01 - 00001849 _____ C:\Users\Owner\Desktop\SUPERAntiSpyware Free Edition.lnk

2015-08-22 14:01 - 2015-08-22 14:01 - 00000000 ____D C:\Users\Owner\AppData\Roaming\SUPERAntiSpyware.com

2015-08-22 14:01 - 2015-08-22 14:01 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware

2015-08-22 14:01 - 2015-08-22 14:01 - 00000000 ____D C:\ProgramData\SUPERAntiSpyware.com

2015-08-22 14:01 - 2015-08-22 14:01 - 00000000 ____D C:\Program Files\SUPERAntiSpyware

2015-08-22 13:50 - 2015-08-22 13:50 - 00000000 ___RD C:\Users\Owner\3D Objects

2015-08-22 13:30 - 2015-08-22 14:01 - 23190072 _____ (SUPERAntiSpyware) C:\Users\Owner\Downloads\SUPERAntiSpyware.exe

2015-08-22 11:22 - 2015-08-22 11:22 - 00000000 ____D C:\ProgramData\ATI

2015-08-22 10:29 - 2015-08-22 10:29 - 03237248 _____ (Enigma Software Group USA, LLC.) C:\Users\Owner\Downloads\SpyHunter-Installer (1).exe

2015-08-22 10:18 - 2015-08-22 10:18 - 00555856 _____ C:\Users\Owner\AppData\Local\census.cache

2015-08-22 10:18 - 2015-08-22 10:18 - 00200704 _____ C:\Users\Owner\AppData\Local\ars.cache

2015-08-22 10:15 - 2015-08-22 10:15 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome

2015-08-22 10:04 - 2015-08-22 10:04 - 00000010 _____ C:\Users\Owner\AppData\Local\sponge.last.runtime.cache

2015-08-22 09:56 - 2015-08-28 10:58 - 00000000 ____D C:\Users\DefaultAppPool

2015-08-22 09:56 - 2015-08-22 09:56 - 02494944 _____ (Trend Micro Inc.) C:\Users\Owner\Downloads\HousecallLauncher64.exe

2015-08-22 09:56 - 2015-08-22 09:56 - 00000036 _____ C:\Users\Owner\AppData\Local\housecall.guid.cache

2015-08-22 09:56 - 2015-08-22 09:56 - 00000020 ___SH C:\Users\DefaultAppPool\ntuser.ini

2015-08-22 09:56 - 2015-08-22 07:32 - 00000000 ____D C:\Users\DefaultAppPool\AppData\Roaming\ATI

2015-08-22 09:56 - 2015-08-22 07:32 - 00000000 ____D C:\Users\DefaultAppPool\AppData\Local\ATI

2015-08-22 09:56 - 2015-08-12 15:34 - 00000000 ___RD C:\Users\DefaultAppPool\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-08-22 09:56 - 2015-07-31 10:51 - 00000000 ____D C:\Users\DefaultAppPool\AppData\Roaming\TuneUp Software

2015-08-22 09:56 - 2015-07-31 10:51 - 00000000 ____D C:\Users\DefaultAppPool\AppData\Roaming\Macromedia

2015-08-22 09:56 - 2015-07-10 06:04 - 00000000 __RSD C:\Users\DefaultAppPool\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell

2015-08-22 09:56 - 2015-07-10 06:04 - 00000000 ___RD C:\Users\DefaultAppPool\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-08-22 09:56 - 2015-07-10 06:04 - 00000000 ___RD C:\Users\DefaultAppPool\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2015-08-22 09:56 - 2015-07-10 06:04 - 00000000 ____D C:\Users\DefaultAppPool\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2015-08-22 09:56 - 2015-05-29 02:43 - 00307352 _____ (Trend Micro Inc.) C:\WINDOWS\system32\Drivers\tmcomm.sys

2015-08-22 09:52 - 2015-08-22 09:52 - 04404952 _____ (Kaspersky Lab ZAO) C:\Users\Owner\Downloads\tdsskiller.exe

2015-08-22 07:36 - 2015-08-22 07:36 - 00061917 _____ C:\WINDOWS\SysWOW64\CCCInstall_201508220736049457.log

2015-08-22 07:35 - 2015-08-22 07:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center

2015-08-22 07:35 - 2015-08-22 07:35 - 00000000 ____D C:\Program Files\ATI Technologies

2015-08-22 07:33 - 2015-08-22 07:33 - 00061037 _____ C:\WINDOWS\SysWOW64\CCCInstall_201508220733388206.log

2015-08-22 07:32 - 2015-08-22 07:32 - 00000000 ____D C:\Users\Default\AppData\Roaming\ATI

2015-08-22 07:32 - 2015-08-22 07:32 - 00000000 ____D C:\Users\Default\AppData\Local\ATI

2015-08-22 07:32 - 2015-08-22 07:32 - 00000000 ____D C:\Users\Default User\AppData\Roaming\ATI

2015-08-22 07:32 - 2015-08-22 07:32 - 00000000 ____D C:\Users\Default User\AppData\Local\ATI

2015-08-22 07:31 - 2015-08-22 07:31 - 00000000 ____D C:\AMD

2015-08-22 07:29 - 2015-08-30 14:46 - 00002489 _____ C:\WINDOWS\setupact.log

2015-08-22 07:29 - 2015-08-22 07:29 - 00000000 _____ C:\WINDOWS\setuperr.log

2015-08-22 07:28 - 2015-08-22 07:28 - 47795680 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\amdocl64.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 39723504 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\amdocl.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 30760944 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atio6axx.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 27544560 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\amdocl12cl64.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 25308656 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atioglxx.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 22328800 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\amdocl12cl.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 15727072 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticaldd64.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 14312416 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticaldd.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 09191312 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdxc64.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 07575664 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdxc32.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 06486000 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdmantle64.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 05076976 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdmantle32.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 03471376 _____ C:\WINDOWS\SysWOW64\atiumdva.cap

2015-08-22 07:28 - 2015-08-22 07:28 - 03437632 _____ C:\WINDOWS\system32\atiumd6a.cap

2015-08-22 07:28 - 2015-08-22 07:28 - 01196032 _____ C:\WINDOWS\system32\amdocl_as64.exe

2015-08-22 07:28 - 2015-08-22 07:28 - 01070592 _____ C:\WINDOWS\system32\amdocl_ld64.exe

2015-08-22 07:28 - 2015-08-22 07:28 - 01005552 _____ C:\WINDOWS\SysWOW64\amdocl_as32.exe

2015-08-22 07:28 - 2015-08-22 07:28 - 00936928 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atiadlxy.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00936928 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atiadlxx.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00807424 _____ C:\WINDOWS\SysWOW64\amdocl_ld32.exe

2015-08-22 07:28 - 2015-08-22 07:28 - 00660928 _____ C:\WINDOWS\SysWOW64\atiapfxx.blb

2015-08-22 07:28 - 2015-08-22 07:28 - 00660928 _____ C:\WINDOWS\system32\atiapfxx.blb

2015-08-22 07:28 - 2015-08-22 07:28 - 00472832 _____ C:\WINDOWS\system32\amdmiracast.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00377312 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atiapfxx.exe

2015-08-22 07:28 - 2015-08-22 07:28 - 00341488 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\ATIODE.exe

2015-08-22 07:28 - 2015-08-22 07:28 - 00243696 _____ C:\WINDOWS\system32\clinfo.exe

2015-08-22 07:28 - 2015-08-22 07:28 - 00213488 _____ C:\WINDOWS\system32\amdgfxinfo64.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00201184 _____ (AMD) C:\WINDOWS\system32\atitmm64.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00198640 _____ C:\WINDOWS\SysWOW64\amdgfxinfo32.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00170464 _____ C:\WINDOWS\system32\atieah64.exe

2015-08-22 07:28 - 2015-08-22 07:28 - 00165360 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atig6txx.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00152560 _____ C:\WINDOWS\SysWOW64\atieah32.exe

2015-08-22 07:28 - 2015-08-22 07:28 - 00152032 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atigktxx.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00143344 _____ C:\WINDOWS\system32\amdhdl64.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00136176 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\mantle64.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00132080 _____ C:\WINDOWS\SysWOW64\amdhdl32.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00122352 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\mantle32.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00111600 _____ C:\WINDOWS\system32\hsa-thunk64.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00111088 _____ C:\WINDOWS\SysWOW64\hsa-thunk.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00102384 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\mantleaxl64.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00095216 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\mantleaxl32.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00089520 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atimpc64.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00088000 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdpcom64.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00085472 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atig6pxx.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00082680 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdpcom32.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00081160 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atimpc32.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00078320 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiglpxx.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00078320 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiglpxx.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00073712 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00071152 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticalrt64.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00069600 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00064496 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticalcl64.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00062432 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticalrt.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00061408 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\ATIODCLI.exe

2015-08-22 07:28 - 2015-08-22 07:28 - 00059376 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdmmcl6.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00059360 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticalcl.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00052208 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\ati2erec.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00049632 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdmmcl.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00039904 _____ (AMD) C:\WINDOWS\system32\atimuixx.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00012784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\detoured.dll

2015-08-22 07:28 - 2015-08-22 07:28 - 00012784 _____ (Microsoft Corporation) C:\WINDOWS\system32\detoured.dll

2015-08-21 14:22 - 2015-08-21 15:06 - 00000000 ____D C:\Users\Owner\AppData\Roaming\vlc

2015-08-21 14:05 - 2015-08-21 14:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN

2015-08-21 14:05 - 2015-08-21 14:05 - 00000000 ____D C:\Program Files (x86)\VideoLAN

2015-08-21 13:55 - 2015-08-21 13:59 - 28849904 _____ C:\Users\Owner\Downloads\vlc-2.2.1-win32.exe

2015-08-21 13:05 - 2015-08-21 15:00 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy

2015-08-21 13:05 - 2015-08-21 13:26 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2

2015-08-21 13:05 - 2015-08-21 13:05 - 00001460 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D; Start Center.lnk

2015-08-21 13:05 - 2015-08-21 13:05 - 00000000 ____D C:\WINDOWS\System32\Tasks\Safer-Networking

2015-08-21 13:05 - 2015-08-21 13:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2

2015-08-21 13:05 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean64.exe

2015-08-21 12:53 - 2015-08-21 13:01 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Owner\Downloads\spybot-2.4.exe

2015-08-21 12:41 - 2015-08-21 12:41 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Lavasoft

2015-08-21 12:24 - 2015-08-21 12:24 - 00000000 ____D C:\Users\Owner\AppData\Roaming\LavasoftStatistics

2015-08-21 12:24 - 2015-08-21 12:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft

2015-08-21 12:24 - 2015-08-21 12:24 - 00000000 ____D C:\Program Files\Lavasoft

2015-08-21 12:23 - 2015-08-21 12:23 - 00000000 ____D C:\Program Files\Common Files\Lavasoft

2015-08-21 12:21 - 2015-08-21 12:21 - 02009904 _____ C:\Users\Owner\Downloads\Adaware_Installer.exe

2015-08-21 12:21 - 2015-08-21 12:21 - 00000000 ____D C:\ProgramData\Lavasoft

2015-08-21 11:45 - 2015-08-21 11:45 - 00000000 _____ C:\autoexec.bat

2015-08-21 11:44 - 2015-08-21 11:44 - 03237248 _____ (Enigma Software Group USA, LLC.) C:\Users\Owner\Downloads\SpyHunter-Installer.exe

2015-08-19 16:07 - 2015-08-19 16:07 - 09575367 _____ C:\Users\Owner\Downloads\51_template_FM.zip

2015-08-19 15:39 - 2015-08-19 15:39 - 00041705 _____ C:\Users\Owner\Downloads\taurine.svg

2015-08-19 08:39 - 2015-08-12 23:33 - 24593408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2015-08-19 08:39 - 2015-08-12 23:22 - 02093056 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll

2015-08-19 08:39 - 2015-08-12 23:20 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll

2015-08-19 08:39 - 2015-08-12 23:07 - 19323392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2015-08-19 08:39 - 2015-08-12 22:53 - 00311808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll

2015-08-19 08:39 - 2015-08-11 05:04 - 04532304 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe

2015-08-19 08:39 - 2015-08-11 05:04 - 02462648 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll

2015-08-19 08:39 - 2015-08-11 05:04 - 01087296 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll

2015-08-19 08:39 - 2015-08-11 05:03 - 00442208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys

2015-08-19 08:39 - 2015-08-11 05:02 - 00554744 _____ (Microsoft Corporation) C:\WINDOWS\system32\directmanipulation.dll

2015-08-19 08:39 - 2015-08-11 05:02 - 00292856 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppHost.exe

2015-08-19 08:39 - 2015-08-11 05:02 - 00080720 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\stornvme.sys

2015-08-19 08:39 - 2015-08-11 04:57 - 03622256 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2015-08-19 08:39 - 2015-08-11 04:52 - 00993104 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll

2015-08-19 08:39 - 2015-08-11 04:50 - 01643872 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll

2015-08-19 08:39 - 2015-08-11 04:40 - 04048808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe

2015-08-19 08:39 - 2015-08-11 04:40 - 02151208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll

2015-08-19 08:39 - 2015-08-11 04:40 - 00918320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll

2015-08-19 08:39 - 2015-08-11 04:38 - 00454000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\directmanipulation.dll

2015-08-19 08:39 - 2015-08-11 04:37 - 00243800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppHost.exe

2015-08-19 08:39 - 2015-08-11 04:31 - 02880032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2015-08-19 08:39 - 2015-08-11 04:26 - 00845664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll

2015-08-19 08:39 - 2015-08-11 04:23 - 16706560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll

2015-08-19 08:39 - 2015-08-11 04:21 - 00148992 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll

2015-08-19 08:39 - 2015-08-11 04:21 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringclient.dll

2015-08-19 08:39 - 2015-08-11 04:20 - 00483328 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneDriveSettingSyncProvider.dll

2015-08-19 08:39 - 2015-08-11 04:19 - 00235520 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_Notifications.dll

2015-08-19 08:39 - 2015-08-11 04:18 - 00235008 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserMgrProxy.dll

2015-08-19 08:39 - 2015-08-11 04:16 - 02416640 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll

2015-08-19 08:39 - 2015-08-11 04:14 - 00404480 _____ C:\WINDOWS\system32\diagtrack_wininternal.dll

2015-08-19 08:39 - 2015-08-11 04:13 - 00413184 _____ C:\WINDOWS\system32\diagtrack_win.dll

2015-08-19 08:39 - 2015-08-11 04:11 - 02446336 _____ C:\WINDOWS\system32\InputService.dll

2015-08-19 08:39 - 2015-08-11 04:11 - 00553472 _____ (Microsoft Corporation) C:\WINDOWS\system32\GamePanel.exe

2015-08-19 08:39 - 2015-08-11 04:10 - 00778752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll

2015-08-19 08:39 - 2015-08-11 04:10 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2015-08-19 08:39 - 2015-08-11 04:10 - 00293376 _____ C:\WINDOWS\system32\TextInputFramework.dll

2015-08-19 08:39 - 2015-08-11 04:09 - 00032768 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuautoappupdate.dll

2015-08-19 08:39 - 2015-08-11 04:08 - 00893440 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApiPublic.dll

2015-08-19 08:39 - 2015-08-11 04:08 - 00563200 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApi.dll

2015-08-19 08:39 - 2015-08-11 04:07 - 01178112 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll

2015-08-19 08:39 - 2015-08-11 04:07 - 00593920 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll

2015-08-19 08:39 - 2015-08-11 04:07 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeParserTask.exe

2015-08-19 08:39 - 2015-08-11 04:06 - 07523328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll

2015-08-19 08:39 - 2015-08-11 04:06 - 02662400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll

2015-08-19 08:39 - 2015-08-11 04:05 - 03527168 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll

2015-08-19 08:39 - 2015-08-11 04:05 - 00996352 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll

2015-08-19 08:39 - 2015-08-11 04:05 - 00342016 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationGeofences.dll

2015-08-19 08:39 - 2015-08-11 04:05 - 00269312 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationFramework.dll

2015-08-19 08:39 - 2015-08-11 04:05 - 00137216 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationPermissions.dll

2015-08-19 08:39 - 2015-08-11 04:05 - 00078848 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationFrameworkInternalPS.dll

2015-08-19 08:39 - 2015-08-11 04:03 - 02558976 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll

2015-08-19 08:39 - 2015-08-11 04:02 - 03588096 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys

2015-08-19 08:39 - 2015-08-11 04:02 - 00621056 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll

2015-08-19 08:39 - 2015-08-11 04:02 - 00186368 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll

2015-08-19 08:39 - 2015-08-11 04:01 - 01334784 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCore.dll

2015-08-19 08:39 - 2015-08-11 04:00 - 00336384 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe

2015-08-19 08:39 - 2015-08-11 04:00 - 00274432 _____ (Microsoft Corporation) C:\WINDOWS\system32\syncutil.dll

2015-08-19 08:39 - 2015-08-11 03:59 - 01106432 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysmain.dll

2015-08-19 08:39 - 2015-08-11 03:59 - 00642560 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdbui.dll

2015-08-19 08:39 - 2015-08-11 03:59 - 00123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll

2015-08-19 08:39 - 2015-08-11 03:59 - 00042496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tetheringclient.dll

2015-08-19 08:39 - 2015-08-11 03:58 - 00372224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneDriveSettingSyncProvider.dll

2015-08-19 08:39 - 2015-08-11 03:57 - 13024768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll

2015-08-19 08:39 - 2015-08-11 03:57 - 00159744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserMgrProxy.dll

2015-08-19 08:39 - 2015-08-11 03:51 - 01916928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll

2015-08-19 08:39 - 2015-08-11 03:51 - 01823232 _____ C:\WINDOWS\SysWOW64\InputService.dll

2015-08-19 08:39 - 2015-08-11 03:50 - 00420352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GamePanel.exe

2015-08-19 08:39 - 2015-08-11 03:50 - 00200704 _____ C:\WINDOWS\SysWOW64\TextInputFramework.dll

2015-08-19 08:39 - 2015-08-11 03:50 - 00131584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll

2015-08-19 08:39 - 2015-08-11 03:49 - 00586752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll

2015-08-19 08:39 - 2015-08-11 03:49 - 00247808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2015-08-19 08:39 - 2015-08-11 03:48 - 00671232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MbaeApiPublic.dll

2015-08-19 08:39 - 2015-08-11 03:47 - 00448512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MbaeApi.dll

2015-08-19 08:39 - 2015-08-11 03:45 - 01820672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll

2015-08-19 08:39 - 2015-08-11 03:43 - 02748416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll

2015-08-19 08:39 - 2015-08-11 03:42 - 05454848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll

2015-08-19 08:39 - 2015-08-11 03:40 - 01964544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll

2015-08-19 08:39 - 2015-08-11 03:40 - 01112064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCore.dll

2015-08-19 08:39 - 2015-08-11 03:39 - 00280576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe

2015-08-19 08:39 - 2015-08-11 03:38 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReInfo.dll

2015-08-18 21:00 - 2015-08-18 21:01 - 42341203 _____ C:\Users\Owner\Downloads\ComedyCentralMidnightSingleFurries.mov

2015-08-18 19:06 - 2015-08-18 19:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

2015-08-16 22:42 - 2015-08-16 22:42 - 00003798 _____ C:\WINDOWS\System32\Tasks\Java Platform SE Auto Updater

2015-08-16 14:49 - 2015-08-16 14:50 - 00000000 ____D C:\Users\Owner\AppData\Local\Mozilla

2015-08-16 14:11 - 2015-08-16 14:11 - 14243008 _____ (Microsoft Corporation) C:\Users\Owner\Downloads\mseinstall.exe

2015-08-16 14:09 - 2015-08-16 14:09 - 00000000 ____D C:\Users\Owner\AppData\Roaming\AVG

2015-08-16 14:06 - 2015-08-16 14:22 - 00000000 ____D C:\Program Files (x86)\AVG Web TuneUp

2015-08-16 14:04 - 2015-08-16 14:04 - 00000000 ____D C:\Users\Owner\AppData\Roaming\AVG2015

2015-08-16 14:04 - 2015-08-16 14:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

2015-08-16 14:03 - 2015-08-16 14:04 - 00000000 ____D C:\ProgramData\AVG2015

2015-08-16 14:03 - 2015-08-16 14:03 - 00000000 ___HD C:\$AVG

2015-08-16 14:02 - 2015-08-24 08:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Zen

2015-08-16 14:02 - 2015-08-19 15:05 - 00000000 ____D C:\Users\Owner\AppData\Local\Avg2015

2015-08-16 14:01 - 2015-08-16 14:21 - 00000000 ____D C:\Users\Owner\AppData\Local\AvgSetupLog

2015-08-16 14:01 - 2015-08-16 14:12 - 00000000 ____D C:\ProgramData\Avg

2015-08-16 14:01 - 2015-08-16 14:09 - 00000000 ____D C:\Program Files (x86)\AVG

2015-08-16 14:01 - 2015-08-16 14:01 - 16903752 _____ (AVG Technologies) C:\Users\Owner\Downloads\avg_gsr_stb_all_ltst_656.exe

2015-08-16 13:56 - 2015-08-16 13:56 - 16903752 _____ (AVG Technologies) C:\Users\Owner\Downloads\Unconfirmed 243411.crdownload

2015-08-16 12:48 - 2015-08-16 12:48 - 00000000 __SHD C:\found.000

2015-08-16 00:35 - 2015-08-16 00:36 - 00003729 _____ C:\AdwCleaner[C1].txt

2015-08-16 00:30 - 2015-08-16 00:31 - 00003393 _____ C:\AdwCleaner[S3].txt

2015-08-15 15:49 - 2015-08-16 16:45 - 00000000 ____D C:\ProgramData\HitmanPro

2015-08-15 15:25 - 2015-08-15 15:26 - 00003371 _____ C:\AdwCleaner[S2].txt

2015-08-15 15:23 - 2015-08-16 00:35 - 00000000 ____D C:\AdwCleaner

2015-08-15 15:23 - 2015-08-15 15:24 - 00003304 _____ C:\AdwCleaner[S1].txt

2015-08-12 18:32 - 2015-08-12 18:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox

2015-08-12 13:06 - 2015-08-12 13:06 - 01347828 _____ C:\Users\Owner\Downloads\1_template_SBRS.zip

2015-08-12 03:18 - 2015-08-02 21:18 - 08613200 _____ (Microsoft Corp.) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll

2015-08-12 03:18 - 2015-08-02 20:56 - 06878256 _____ (Microsoft Corp.) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll

2015-08-12 03:18 - 2015-08-02 20:18 - 12503552 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2015-08-12 03:18 - 2015-08-02 20:18 - 03780096 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll

2015-08-12 03:18 - 2015-08-02 20:01 - 11262464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2015-08-12 03:17 - 2015-08-08 02:29 - 01822280 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll

2015-08-12 03:17 - 2015-08-08 02:19 - 00608936 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe

2015-08-12 03:17 - 2015-08-08 02:01 - 01533496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll

2015-08-12 03:17 - 2015-08-08 01:48 - 00539728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe

2015-08-12 03:17 - 2015-08-08 01:40 - 00365056 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll

2015-08-12 03:17 - 2015-08-08 01:24 - 02415104 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll

2015-08-12 03:17 - 2015-08-08 01:24 - 01679360 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll

2015-08-12 03:17 - 2015-08-08 01:15 - 00303104 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll

2015-08-12 03:17 - 2015-08-08 01:00 - 01985024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll

2015-08-12 03:17 - 2015-08-05 22:17 - 00237392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdyboost.sys

2015-08-12 03:17 - 2015-08-05 22:17 - 00200528 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wof.sys

2015-08-12 03:17 - 2015-08-05 21:22 - 00685568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdiWiFi.sys

2015-08-12 03:17 - 2015-08-04 23:49 - 00783112 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll

2015-08-12 03:17 - 2015-08-04 23:29 - 00644128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll

2015-08-12 03:17 - 2015-08-04 23:00 - 00310784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActionCenter.dll

2015-08-12 03:17 - 2015-08-04 22:54 - 01274880 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll

2015-08-12 03:17 - 2015-08-04 22:47 - 01383424 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys

2015-08-12 03:17 - 2015-08-04 22:39 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActionCenter.dll

2015-08-12 03:17 - 2015-08-03 23:07 - 00102752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mountmgr.sys

2015-08-12 03:17 - 2015-08-03 23:06 - 00583128 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll

2015-08-12 03:17 - 2015-08-03 23:06 - 00243248 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll

2015-08-12 03:17 - 2015-08-03 22:23 - 00078848 _____ (Microsoft Corporation) C:\WINDOWS\system32\VPNv2CSP.dll

2015-08-12 03:17 - 2015-08-03 21:59 - 01212416 _____ (Microsoft Corporation) C:\WINDOWS\system32\RemoteNaturalLanguage.dll

2015-08-12 03:17 - 2015-08-03 21:47 - 00898560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RemoteNaturalLanguage.dll

2015-08-12 03:17 - 2015-08-02 21:32 - 00306688 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationObjFactory.dll

2015-08-12 03:17 - 2015-08-02 21:28 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NotificationObjFactory.dll

2015-08-12 03:17 - 2015-08-02 21:19 - 00505696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys

2015-08-12 03:17 - 2015-08-02 21:19 - 00393568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys

2015-08-12 03:17 - 2015-08-02 21:18 - 01983840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys

2015-08-12 03:17 - 2015-08-02 21:18 - 00594472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Shell.Broker.dll

2015-08-12 03:17 - 2015-08-02 21:18 - 00046432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msgpiowin32.sys

2015-08-12 03:17 - 2015-08-02 21:17 - 00516960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS

2015-08-12 03:17 - 2015-08-02 21:17 - 00052264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wpcfltr.sys

2015-08-12 03:17 - 2015-08-02 21:12 - 00801632 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe

2015-08-12 03:17 - 2015-08-02 20:49 - 00700256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe

2015-08-12 03:17 - 2015-08-02 20:31 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModel.dll

2015-08-12 03:17 - 2015-08-02 20:30 - 00253952 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_UserAccount.dll

2015-08-12 03:17 - 2015-08-02 20:24 - 00503808 _____ (Microsoft Corporation) C:\WINDOWS\system32\tileobjserver.dll

2015-08-12 03:17 - 2015-08-02 20:24 - 00282112 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEEventDispatcher.dll

2015-08-12 03:17 - 2015-08-02 20:24 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModelShim.dll

2015-08-12 03:17 - 2015-08-02 20:23 - 00122880 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEDataLayerHelpers.dll

2015-08-12 03:17 - 2015-08-02 20:22 - 01601536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll

2015-08-12 03:17 - 2015-08-02 20:22 - 01008640 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll

2015-08-12 03:17 - 2015-08-02 20:22 - 00317440 _____ (Microsoft Corporation) C:\WINDOWS\system32\configmanager2.dll

2015-08-12 03:17 - 2015-08-02 20:21 - 00179712 _____ (Microsoft Corporation) C:\WINDOWS\system32\coredpus.dll

2015-08-12 03:17 - 2015-08-02 20:19 - 00215040 _____ (Microsoft Corporation) C:\WINDOWS\system32\notepad.exe

2015-08-12 03:17 - 2015-08-02 20:19 - 00215040 _____ (Microsoft Corporation) C:\WINDOWS\notepad.exe

2015-08-12 03:17 - 2015-08-02 20:18 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\SubscriptionMgr.dll

2015-08-12 03:17 - 2015-08-02 20:18 - 00120832 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkStatus.dll

2015-08-12 03:17 - 2015-08-02 20:15 - 01290752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll

2015-08-12 03:17 - 2015-08-02 20:15 - 00595456 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll

2015-08-12 03:17 - 2015-08-02 20:15 - 00573440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Cortana.Desktop.dll

2015-08-12 03:17 - 2015-08-02 20:15 - 00384000 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppBroker.dll

2015-08-12 03:17 - 2015-08-02 20:15 - 00171520 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinBioDataModel.dll

2015-08-12 03:17 - 2015-08-02 20:14 - 00273920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll

2015-08-12 03:17 - 2015-08-02 20:12 - 00217088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEEventDispatcher.dll

2015-08-12 03:17 - 2015-08-02 20:12 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEDataLayerHelpers.dll

2015-08-12 03:17 - 2015-08-02 20:11 - 00814080 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctfuimanager.dll

2015-08-12 03:17 - 2015-08-02 20:10 - 01162240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll

2015-08-12 03:17 - 2015-08-02 20:06 - 00207872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\notepad.exe

2015-08-12 03:17 - 2015-08-02 20:03 - 00494592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll

2015-08-12 03:17 - 2015-08-02 20:02 - 00311808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppBroker.dll

2015-08-12 03:17 - 2015-08-02 20:02 - 00195072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll

2015-08-12 03:17 - 2015-08-02 19:59 - 00752640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctfuimanager.dll

2015-08-11 22:25 - 2015-08-11 22:25 - 00034743 _____ C:\Users\Owner\Downloads\hauser.zip

2015-08-11 00:21 - 2015-08-28 11:37 - 00113880 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2015-08-11 00:21 - 2015-08-28 11:36 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Owner\Downloads\mbam-setup-2.1.8.1057.exe

2015-08-11 00:21 - 2015-08-11 00:21 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Owner\Downloads\mbam-setup-2.1.8.1057 (1).exe

2015-08-11 00:21 - 2015-08-11 00:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-08-11 00:21 - 2015-08-11 00:21 - 00000000 ____D C:\ProgramData\Malwarebytes

2015-08-11 00:21 - 2015-08-11 00:21 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-08-11 00:21 - 2015-06-18 08:42 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys

2015-08-11 00:21 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2015-08-11 00:21 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys

2015-08-10 16:45 - 2015-08-10 16:45 - 00001870 _____ C:\Users\Owner\Downloads\2015S2-qualify monza.sto

2015-08-10 16:45 - 2015-08-10 16:45 - 00001870 _____ C:\Users\Owner\Downloads\2015S2_MONZA v2 race.sto

2015-08-09 10:40 - 2015-08-09 10:42 - 70566360 _____ C:\Users\Owner\Downloads\Ace_Stream_Media_3.0.12_VLC_1.1.12.exe

2015-08-08 22:17 - 2015-08-08 22:17 - 00002174 _____ C:\Users\Owner\Downloads\ws_iowa_69.sto

2015-08-08 22:14 - 2015-08-08 22:14 - 00002238 _____ C:\Users\Owner\Downloads\ws_mosport.sto

2015-08-07 23:46 - 2015-08-16 22:41 - 00000000 ____D C:\WINDOWS\Minidump

2015-08-07 10:13 - 2015-08-19 11:21 - 00000000 ____D C:\Users\Owner\AppData\Local\Comms

2015-08-06 11:00 - 2015-07-29 22:49 - 11557888 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll

2015-08-06 11:00 - 2015-07-29 22:42 - 00518144 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationController.dll

2015-08-06 11:00 - 2015-07-29 22:15 - 09889792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll

2015-08-06 10:59 - 2015-07-30 01:24 - 01561872 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll

2015-08-06 10:59 - 2015-07-30 01:23 - 00527952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll

2015-08-06 10:59 - 2015-07-30 01:21 - 00816576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll

2015-08-06 10:59 - 2015-07-30 01:17 - 01200400 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll

2015-08-06 10:59 - 2015-07-30 01:17 - 01025840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsrcsnk.dll

2015-08-06 10:59 - 2015-07-30 01:16 - 02147080 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d9.dll

2015-08-06 10:59 - 2015-07-30 01:15 - 00632168 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll

2015-08-06 10:59 - 2015-07-30 01:14 - 00333168 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFPlay.dll

2015-08-06 10:59 - 2015-07-30 01:09 - 01562968 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpmde.dll

2015-08-06 10:59 - 2015-07-30 01:06 - 01043872 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll

2015-08-06 10:59 - 2015-07-30 01:05 - 00501008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll

2015-08-06 10:59 - 2015-07-30 01:03 - 02116448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys

2015-08-06 10:59 - 2015-07-30 00:24 - 00252768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContentDeliveryManager.Utilities.dll

2015-08-06 10:59 - 2015-07-29 23:29 - 00705520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll

2015-08-06 10:59 - 2015-07-29 23:26 - 01867160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d9.dll

2015-08-06 10:59 - 2015-07-29 23:26 - 00877016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll

2015-08-06 10:59 - 2015-07-29 23:25 - 01356368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll

2015-08-06 10:59 - 2015-07-29 23:25 - 00713312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll

2015-08-06 10:59 - 2015-07-29 23:24 - 00445240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll

2015-08-06 10:59 - 2015-07-29 23:24 - 00407616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll

2015-08-06 10:59 - 2015-07-29 23:24 - 00285632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFPlay.dll

2015-08-06 10:59 - 2015-07-29 23:22 - 00896144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsrcsnk.dll

2015-08-06 10:59 - 2015-07-29 23:22 - 00507696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll

2015-08-06 10:59 - 2015-07-29 23:12 - 00287744 _____ (Microsoft Corporation) C:\WINDOWS\system32\provhandlers.dll

2015-08-06 10:59 - 2015-07-29 23:12 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll

2015-08-06 10:59 - 2015-07-29 23:09 - 00024576 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManagerShellext.exe

2015-08-06 10:59 - 2015-07-29 23:08 - 00494592 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll

2015-08-06 10:59 - 2015-07-29 23:08 - 00055296 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe

2015-08-06 10:59 - 2015-07-29 22:59 - 00187904 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll

2015-08-06 10:59 - 2015-07-29 22:52 - 00521216 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll

2015-08-06 10:59 - 2015-07-29 22:52 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ACPBackgroundManagerPolicy.dll

2015-08-06 10:59 - 2015-07-29 22:46 - 02125312 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll

2015-08-06 10:59 - 2015-07-29 22:46 - 00487424 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmkvsrcsnk.dll

2015-08-06 10:59 - 2015-07-29 22:46 - 00204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll

2015-08-06 10:59 - 2015-07-29 22:45 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\system32\fwpolicyiomgr.dll

2015-08-06 10:59 - 2015-07-29 22:45 - 00155136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tunnel.sys

2015-08-06 10:59 - 2015-07-29 22:44 - 00280064 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll

2015-08-06 10:59 - 2015-07-29 22:44 - 00229376 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorService.dll

2015-08-06 10:59 - 2015-07-29 22:44 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsNativeApi.V2.dll

2015-08-06 10:59 - 2015-07-29 22:44 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthhfenum.sys

2015-08-06 10:59 - 2015-07-29 22:44 - 00041984 _____ (Microsoft Corporation) C:\WINDOWS\system32\VoiceActivationManager.dll

2015-08-06 10:59 - 2015-07-29 22:41 - 00407040 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredProvDataModel.dll

2015-08-06 10:59 - 2015-07-29 22:41 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationControllerPS.dll

2015-08-06 10:59 - 2015-07-29 22:40 - 00846336 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpncore.dll

2015-08-06 10:59 - 2015-07-29 22:38 - 01420288 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll

2015-08-06 10:59 - 2015-07-29 22:38 - 00080384 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxSysprep.dll

2015-08-06 10:59 - 2015-07-29 22:34 - 00599552 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnapps.dll

2015-08-06 10:59 - 2015-07-29 22:29 - 00654848 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToManager.dll

2015-08-06 10:59 - 2015-07-29 22:07 - 00163328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fwpolicyiomgr.dll

2015-08-06 10:59 - 2015-07-29 22:06 - 00373248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmkvsrcsnk.dll

2015-08-06 10:59 - 2015-07-29 22:06 - 00078336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SensorsNativeApi.V2.dll

2015-08-06 10:59 - 2015-07-29 22:06 - 00034816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VoiceActivationManager.dll

2015-08-06 10:59 - 2015-07-29 22:04 - 01714176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll

2015-08-06 10:59 - 2015-07-29 22:04 - 00335360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredProvDataModel.dll

2015-08-06 10:59 - 2015-07-29 21:59 - 00473088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpnapps.dll

2015-08-06 10:59 - 2015-07-29 21:58 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToManager.dll

2015-08-05 10:56 - 2015-08-05 10:56 - 02390859 _____ C:\Users\Owner\Downloads\driver_suit.zip

2015-08-03 16:35 - 2015-08-03 16:35 - 09011646 _____ C:\Users\Owner\Downloads\46_template_FF.zip

2015-08-03 16:34 - 2015-08-03 16:34 - 03840806 _____ C:\Users\Owner\Downloads\FF.zip

2015-08-02 21:17 - 2015-08-19 08:25 - 00000000 ____D C:\ProgramData\AVAST Software

2015-08-02 16:22 - 2015-08-02 16:22 - 00000000 ____D C:\WINDOWS\system32\SleepStudy

2015-08-02 13:32 - 2015-08-31 11:31 - 00004150 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{51AAD9D5-251F-4897-A5DB-05DA7F3DABE7}

2015-08-02 13:05 - 2015-08-02 13:05 - 00000000 ____D C:\Users\Owner\AppData\Local\Unity

2015-08-01 13:19 - 2015-08-01 13:19 - 00000000 ____D C:\Program Files\AVG Web TuneUp

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-08-31 11:57 - 2015-06-07 15:32 - 00000000 ____D C:\Users\Owner\AppData\Local\Google

2015-08-31 11:55 - 2015-06-07 15:32 - 00000922 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2015-08-31 11:42 - 2015-07-01 10:41 - 00000000 ____D C:\ProgramData\MFAData

2015-08-31 11:40 - 2015-06-07 00:11 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2015-08-31 11:39 - 2015-06-07 20:15 - 00000000 ____D C:\Program Files (x86)\Steam

2015-08-31 11:33 - 2015-07-10 06:04 - 00000000 ____D C:\WINDOWS\AppReadiness

2015-08-31 11:32 - 2015-07-31 11:23 - 00000000 ____D C:\Users\Owner\AppData\Local\Packages

2015-08-31 11:30 - 2015-06-07 15:58 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Skype

2015-08-31 11:29 - 2015-07-12 18:20 - 00000000 ___RD C:\Users\Owner\Dropbox

2015-08-31 11:29 - 2015-07-12 18:18 - 00000000 ____D C:\Users\Owner\AppData\Local\Dropbox

2015-08-31 11:29 - 2015-06-30 21:01 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Spotify

2015-08-31 11:29 - 2015-06-30 21:01 - 00000000 ____D C:\Users\Owner\AppData\Local\Spotify

2015-08-31 11:28 - 2015-07-12 18:18 - 00000906 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job

2015-08-31 11:28 - 2015-07-10 07:22 - 00000275 _____ C:\WINDOWS\WindowsUpdate.log

2015-08-31 11:27 - 2015-07-10 04:05 - 00032768 ___SH C:\WINDOWS\system32\config\ELAM

2015-08-31 11:26 - 2015-07-10 06:04 - 00000000 ____D C:\WINDOWS\system32\sru

2015-08-31 11:25 - 2015-07-12 18:18 - 00000902 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job

2015-08-31 11:25 - 2015-06-07 15:32 - 00000918 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2015-08-30 08:48 - 2015-07-10 07:21 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2015-08-30 08:47 - 2015-07-10 04:05 - 00524288 ___SH C:\WINDOWS\system32\config\BBI

2015-08-30 08:46 - 2015-07-10 06:04 - 00000000 ____D C:\WINDOWS\system32\oobe

2015-08-30 08:46 - 2015-07-10 06:04 - 00000000 ____D C:\WINDOWS\system32\appraiser

2015-08-29 13:03 - 2015-07-31 10:46 - 00000000 ____D C:\Users\Owner

2015-08-29 08:40 - 2015-07-10 05:55 - 00000000 ____D C:\WINDOWS\CbsTemp

2015-08-28 22:50 - 2015-06-07 15:32 - 00003980 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA

2015-08-28 22:50 - 2015-06-07 15:32 - 00003748 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore

2015-08-27 21:09 - 2015-07-31 09:15 - 00000000 ____D C:\Users\Owner\Documents\iRacing

2015-08-26 10:12 - 2015-07-31 10:39 - 00480216 _____ C:\WINDOWS\PFRO.log

2015-08-22 11:19 - 2015-07-10 06:04 - 00000000 ___RD C:\WINDOWS\PurchaseDialog

2015-08-22 11:19 - 2015-07-10 06:04 - 00000000 ____D C:\WINDOWS\security

2015-08-22 08:20 - 2015-07-02 20:02 - 00000000 ____D C:\Users\Owner\AppData\Roaming\mIRC

2015-08-22 07:44 - 2015-07-10 06:04 - 00000000 ____D C:\WINDOWS\rescache

2015-08-22 07:35 - 2015-07-31 10:43 - 00000000 ____D C:\ProgramData\AMD

2015-08-22 07:35 - 2015-07-31 10:43 - 00000000 ____D C:\Program Files (x86)\ATI Technologies

2015-08-22 07:28 - 2015-07-16 02:12 - 00162240 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiuxp64.dll

2015-08-22 07:28 - 2015-07-16 02:11 - 12062040 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atidxx64.dll

2015-08-22 07:28 - 2015-07-16 02:11 - 10191264 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atidxx32.dll

2015-08-22 07:28 - 2015-07-16 02:11 - 08979760 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiumd6a.dll

2015-08-22 07:28 - 2015-07-16 02:11 - 08865496 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiumd64.dll

2015-08-22 07:28 - 2015-07-16 02:11 - 08009344 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiumdva.dll

2015-08-22 07:28 - 2015-07-16 02:11 - 07482560 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiumdag.dll

2015-08-22 07:28 - 2015-07-16 02:11 - 01468224 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\aticfx64.dll

2015-08-22 07:28 - 2015-07-16 02:11 - 01213192 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\aticfx32.dll

2015-08-22 07:28 - 2015-07-16 02:11 - 00143048 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiuxpag.dll

2015-08-22 07:28 - 2015-07-16 02:11 - 00131592 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiu9p64.dll

2015-08-22 07:28 - 2015-07-16 02:11 - 00113880 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiu9pag.dll

2015-08-22 07:28 - 2015-07-16 02:06 - 21632992 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\atikmdag.sys

2015-08-22 07:28 - 2015-07-16 01:17 - 00681456 _____ (AMD) C:\WINDOWS\system32\atieclxx.exe

2015-08-22 07:28 - 2015-07-16 01:17 - 00452576 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atidemgy.dll

2015-08-22 07:28 - 2015-07-16 01:17 - 00256992 _____ (AMD) C:\WINDOWS\system32\atiesrxx.exe

2015-08-22 07:28 - 2015-07-16 01:13 - 01257952 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atiadlxx.dll

2015-08-22 07:28 - 2015-07-16 01:13 - 00675296 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\atikmpag.sys

2015-08-22 07:28 - 2015-07-16 01:12 - 00874480 _____ (AMD) C:\WINDOWS\system32\coinst_15.20.dll

2015-08-21 13:26 - 2015-07-02 11:31 - 00000000 ____D C:\Program Files\Common Files\AV

2015-08-21 11:43 - 2015-07-12 13:48 - 00000000 ____D C:\Program Files (x86)\FSrealWX Pro Server

2015-08-20 11:03 - 2015-07-10 06:04 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns

2015-08-19 13:49 - 2015-07-31 11:33 - 00002334 _____ C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

2015-08-19 13:49 - 2015-07-31 11:33 - 00000000 ___RD C:\Users\Owner\OneDrive

2015-08-19 08:25 - 2015-07-10 07:20 - 02129032 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2015-08-18 19:06 - 2015-06-07 15:58 - 00000000 ___RD C:\Program Files (x86)\Skype

2015-08-18 19:06 - 2015-06-07 15:58 - 00000000 ____D C:\ProgramData\Skype

2015-08-16 22:42 - 2015-07-12 17:54 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Sony

2015-08-16 22:41 - 2015-07-10 04:05 - 00000000 ____D C:\WINDOWS\system32\Sysprep

2015-08-16 16:45 - 2015-07-02 12:12 - 00000000 ____D C:\ProgramData\AVG Secure Search

2015-08-16 16:41 - 2015-07-10 06:04 - 00000000 ____D C:\WINDOWS\registration

2015-08-16 14:50 - 2015-07-02 12:13 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Mozilla

2015-08-16 14:10 - 2015-06-06 23:32 - 00000000 ____D C:\Users\Owner\AppData\Local\VirtualStore

2015-08-16 14:09 - 2015-07-31 09:25 - 00000000 ____D C:\Users\Owner\AppData\Local\Avg

2015-08-16 14:03 - 2015-07-10 06:04 - 00000000 ___HD C:\WINDOWS\ELAMBKUP

2015-08-16 12:41 - 2015-07-10 06:04 - 00000000 ____D C:\WINDOWS\system32\NDF

2015-08-16 00:40 - 2015-07-17 23:57 - 00000000 ____D C:\Users\Owner\AppData\Roaming\TradingPaints Downloader

2015-08-12 18:32 - 2015-07-12 18:18 - 00000000 ____D C:\Program Files (x86)\Dropbox

2015-08-12 15:35 - 2015-07-10 06:04 - 00000000 ____D C:\WINDOWS\Branding

2015-08-12 15:35 - 2015-06-07 00:14 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2015-08-12 15:35 - 2015-06-07 00:14 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2015-08-12 15:34 - 2015-07-10 06:04 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-08-12 15:34 - 2015-07-10 06:04 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-08-12 10:59 - 2015-06-07 00:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2015-08-12 10:58 - 2015-06-07 02:12 - 00000000 ____D C:\WINDOWS\system32\MRT

2015-08-12 10:52 - 2015-06-07 02:12 - 132483416 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2015-08-08 10:38 - 2015-07-10 06:06 - 00794088 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2015-08-08 10:38 - 2015-07-10 06:06 - 00179688 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2015-08-07 08:53 - 2015-07-10 06:04 - 00000000 ____D C:\WINDOWS\Provisioning

2015-08-02 21:39 - 2015-07-31 10:45 - 01005534 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2015-08-02 13:27 - 2015-07-31 15:15 - 00000000 ____D C:\Users\Owner\AppData\Local\MicrosoftEdge

2015-08-01 04:56 - 2015-07-10 06:04 - 00000000 ____D C:\WINDOWS\appcompat

==================== Files in the root of some directories =======

2015-08-22 10:18 - 2015-08-22 10:18 - 0200704 _____ () C:\Users\Owner\AppData\Local\ars.cache

2015-08-22 10:18 - 2015-08-22 10:18 - 0555856 _____ () C:\Users\Owner\AppData\Local\census.cache

2015-08-22 09:56 - 2015-08-22 09:56 - 0000036 _____ () C:\Users\Owner\AppData\Local\housecall.guid.cache

2015-08-22 10:04 - 2015-08-22 10:04 - 0000010 _____ () C:\Users\Owner\AppData\Local\sponge.last.runtime.cache

2015-07-31 10:41 - 2015-07-31 10:41 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some files in TEMP:

====================

C:\Users\Owner\AppData\Local\Temp\avguirn_081400547579.exe

C:\Users\Owner\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpwx_rvs.dll

C:\Users\Owner\AppData\Local\Temp\DseShExt-x64.dll

C:\Users\Owner\AppData\Local\Temp\DseShExt-x86.dll

C:\Users\Owner\AppData\Local\Temp\EsgInstallerx64Stub.exe

C:\Users\Owner\AppData\Local\Temp\SDShelEx-win32.dll

C:\Users\Owner\AppData\Local\Temp\SDShelEx-x64.dll

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed

C:\WINDOWS\system32\wininit.exe => File is digitally signed

C:\WINDOWS\explorer.exe => File is digitally signed

C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed

C:\WINDOWS\system32\svchost.exe => File is digitally signed

C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed

C:\WINDOWS\system32\services.exe => File is digitally signed

C:\WINDOWS\system32\User32.dll => File is digitally signed

C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed

C:\WINDOWS\system32\userinit.exe => File is digitally signed

C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed

C:\WINDOWS\system32\rpcss.dll => File is digitally signed

C:\WINDOWS\system32\dnsapi.dll => File is digitally signed

C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed

C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-08-22 07:28

==================== End of FRST.txt ============================

ken545

Post #4September 2, 2015, 11:32 AM UTC

Your logs are really not looking to bad. When you post there is no need to quote me

Run this program first, then you have Malwarebytes installed, open it, check for updates and run a new Threat Scan and post the log if it found anything

-AdwCleaner-by Xplode

Click on this link to download : ADWCleaner

Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.

Do not click on any links in the top Advertisment.

[external image: AdwCleaner4.201_zpsxrbk2llq.jpg]

Close all open programs and internet browsers.

Double click on AdwCleaner.exe to run the tool.

Click on Scan.

After the scan is complete click on "Clean"

Confirm each time with Ok.

Your computer will be rebooted automatically. A text file will open after the restart.

Please post the content of that logfile with your next reply.

You can find the logfile at C:\AdwCleaner[S1].txt as well.

=======================================================================

Open Chrome

Click the Chrome menu [external image: Clipboard01_zps2e55f676.jpg]on the browser toolbar.

Click on Settings

Then Manage Search Engines

Highlite TotalAdPerformance and select Delete

Then go to Other Search Engines and remove all you dont want

Click the Chrome menu [external image: Clipboard01_zps2e55f676.jpg]on the browser toolbar.

Click on Settings

Open a specific page or set of pages.

Set Pages

Remove TotalAdPerformance

You can copy and paste the url from a page you like or if you have that page open select use current

OK your way out and close chome.

Reopen Chrome and make sure your start page is the one you want

Open Chrome

Click the Chrome menu [external image: Clipboard01_zps2e55f676.jpg]on the browser toolbar.

Click on History

Click on Clear Browsing History

Check

1. Browsing History

2. Cookies and Site Plug Ins

3. Cached Images and Files

Then ok your way out and close Chrome

Open Chrome

Click the Chrome menu [external image: Clipboard01_zps2e55f676.jpg]on the browser toolbar.

Then go to Settings > Show Advanced Settings

Then go to Privacy > Content Settings

Plug Ins > Manage Exceptions > Delete any reference to TotalAdPerformance

Pop Ups > Manage Exceptions > Remove any reference to TotalAdPerformance

Ok your way out and close Chome, then reopen it and see if TotalAdPerformance are gone from your pages

Then give an update on your system in reference to TotalAdPerformance

Kiboe

Post #5September 2, 2015, 4:11 PM UTC

Malware bytes didn't find anything

but this is the log from the scam of ADW AdwCleaner v5.005 - Logfile created 02/09/2015 at 11:08:51

# Updated 31/08/2015 by Xplode

# Database : 2015-08-31.2 [Server]

# Operating system : Windows 10 Home (x64)

# Username : Owner - OWNERPC

# Running from : C:\Users\Owner\Downloads\AdwCleaner.exe

# Option : Scan

# Support : http://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

***** [ Files ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

Key Found : HKCU\Software\AppDataLow\Software\adawarebp

Key Found : HKU\S-1-5-21-1955443169-4279354119-354557393-1000\Software\AppDataLow\Software\adawarebp

***** [ Web browsers ] *****

*************************

C:\AdwCleaner[C1].txt - [3729 bytes] - [16/08/2015 00:35:57]

C:\AdwCleaner[S1].txt - [3304 bytes] - [15/08/2015 15:23:34]

C:\AdwCleaner[S2].txt - [3371 bytes] - [15/08/2015 15:25:39]

C:\AdwCleaner[S3].txt - [3393 bytes] - [16/08/2015 00:30:23]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [975 bytes] ##########

it seems to be gone for now,

ken545

Post #6September 2, 2015, 5:10 PM UTC

When you ran AdwCleaner did you select CLEAN because the log doesn't show that and those entries need to go

Kiboe

Post #7September 2, 2015, 5:18 PM UTC

i did after i ran this, yeah

# Running from : C:\Users\Owner\Downloads\AdwCleaner.exe

# Option : Scan

# Support : http://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

Folder Found : C:\Program Files (x86)\Common Files\AVG Secure Search

Folder Found : C:\ProgramData\AVG Secure Search

***** [ Files ] *****

File Found : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\wtu-secure-search.xml

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi

Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1

Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]

Key Found : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin

Key Found : HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\avgsh

Key Found : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}

Key Found : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}

Key Found : HKU\.DEFAULT\Software\Avg Secure Update

Key Found : HKCU\Software\Avg Secure Update

Key Found : HKCU\Software\AppDataLow\Software\adawarebp

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A2D81E70-2A98-4A08-A628-94388B063C5E}

Key Found : [x64] HKCU\Software\Avg Secure Update

Key Found : HKU\S-1-5-21-1955443169-4279354119-354557393-1000\Software\AppDataLow\Software\adawarebp

***** [ Web browsers ] *****

*************************

C:\AdwCleaner[C1].txt - [3729 bytes] - [16/08/2015 00:35:57]

C:\AdwCleaner[S1].txt - [3304 bytes] - [15/08/2015 15:23:34]

C:\AdwCleaner[S2].txt - [3371 bytes] - [15/08/2015 15:25:39]

C:\AdwCleaner[S3].txt - [3393 bytes] - [16/08/2015 00:30:23]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [2723 bytes] ##########

but, it seems to be gone for now, though, i mean i've been browsing for a bit and it's not there, cleared chrome of the exceptions and plugins too

ken545

Post #8September 2, 2015, 5:30 PM UTC

OK, let just hang on a bit and make sure it doesn't return. I will leave this thread open for you for a few days, post back with an update

Kiboe

Post #9September 3, 2015, 6:12 PM UTC

it just came back, no popups, but what i have is a little tab that opens up and sends me to some casino website on every other link i click

another scan with ADW

# AdwCleaner v5.005 - Logfile created 03/09/2015 at 10:10:59

# Updated 31/08/2015 by Xplode

# Database : 2015-08-31.2 [Server]

# Operating system : Windows 10 Home (x64)

# Username : Owner - OWNERPC

# Running from : C:\Users\Owner\Downloads\AdwCleaner.exe

# Option : Scan

# Support : http://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

***** [ Files ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

Key Found : HKCU\Software\AppDataLow\Software\adawarebp

Key Found : HKU\S-1-5-21-1955443169-4279354119-354557393-1000\Software\AppDataLow\Software\adawarebp

***** [ Web browsers ] *****

*************************

C:\AdwCleaner[C1].txt - [3729 bytes] - [16/08/2015 00:35:57]

C:\AdwCleaner[S1].txt - [3304 bytes] - [15/08/2015 15:23:34]

C:\AdwCleaner[S2].txt - [3371 bytes] - [15/08/2015 15:25:39]

C:\AdwCleaner[S3].txt - [3393 bytes] - [16/08/2015 00:30:23]

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [975 bytes] ##########

ken545

Post #10September 3, 2015, 6:21 PM UTC last edited September 3, 2015, 6:22 PM UTC

Go ahead and open FRST, make sure to checkmark Additions, run a new scan and post both logs please. Take your time as i may not be back online until later this evening

Also make sure that the entry that AdwCleaner found was removed

Kiboe

Post #11September 3, 2015, 7:47 PM UTC

FRST LOG

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:31-08-2015

Ran by [removed] (administrator) on OWNERPC (03-09-2015 14:40:51)

Running from C:\Users\[removed]\Downloads

[removed]

Platform: Windows 10 Home (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

() C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(Apple Computer, Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(iRacing.com Motorsport Simulations, LLC

Bedford, MA 01730) C:\Program Files (x86)\iRacing\iRacingService.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe

() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareService.exe

(Microsoft Corporation) C:\Windows\System32\mqsvc.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

(Microsoft Corporation) C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

() C:\Program Files\Plantronics\GameCom 780 & 788\GameCom780.exe

(Logitech Inc.) C:\Program Files\Logitech\Gaming Software\LWEMon.exe

() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareTray.exe

(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe

(Spotify Ltd) C:\Users\Owner\AppData\Roaming\Spotify\SpotifyWebHelper.exe

(Microsoft Corporation) C:\Users\Owner\AppData\Local\Microsoft\OneDrive\OneDrive.exe

() C:\Program Files (x86)\Trading Paints\Trading Paints.exe

(Spotify Ltd) C:\Users\Owner\AppData\Roaming\Spotify\Spotify.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(Spotify Ltd) C:\Users\Owner\AppData\Roaming\Spotify\SpotifyCrashService.exe

(Spotify Ltd) C:\Users\Owner\AppData\Roaming\Spotify\Spotify.exe

(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

(Spotify Ltd) C:\Users\Owner\AppData\Roaming\Spotify\Spotify.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneVideo_3.6.12711.0_x64__8wekyb3d8bbwe\Video.UI.exe

() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.827.16340.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe

() C:\Program Files\WindowsApps\9E2F88E3.Twitter_4.0.7.0_x86__wgeqdkkx372wm\Twitter.Windows.exe

() C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1508.14010.0_x64__8wekyb3d8bbwe\Calculator.exe

(Microsoft Corporation) C:\Windows\System32\WWAHost.exe

(Telegram Messenger LLP) C:\Users\Owner\AppData\Roaming\Telegram Desktop\Telegram.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe

() C:\Users\Owner\Downloads\AdwCleaner.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13885696 2015-06-24] (Realtek Semiconductor)

HKLM\…\Run: [GamecomSound] => C:\Program Files\Plantronics\GameCom 780 & 788\GameCom780.exe [817440 2014-01-21] ()

HKLM\…\Run: [Start WingMan Profiler] => C:\Program Files\Logitech\Gaming Software\LWEMon.exe [190536 2010-06-14] (Logitech Inc.)

HKLM\…\Run: [] => [X]

HKLM\…\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareTray.exe [9549808 2015-06-24] ()

HKLM-x32\…\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-03] (Advanced Micro Devices, Inc.)

HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [335232 2015-04-10] (Oracle Corporation)

HKLM-x32\…\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [39179912 2015-08-05] (Dropbox, Inc.)

HKLM-x32\…\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe [2620728 2015-07-22] (Malwarebytes Corporation)

HKLM-x32\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [6111824 2015-08-31] (AVAST Software)