Spyware / Malware / Virus Removal

Am I infected? [Closed]

2 min read

Looking for the outcome? Ask AI

sparkey75 Topic Starter

Post #1November 2, 2015, 2:30 AM UTC

So I have had two different credit cards hacked in the last two weeks making 4 different cards/numbers hacked in the last 6 months. I am wondering if something is wrong on my laptop. here are my log files:

Run date: 2015-11-01 18:24:00

—————————–

18:24:00.169 OS Version: Windows x64 6.2.9200

18:24:00.169 Number of processors: 4 586 0x3A09

18:24:00.185 ComputerName: DAN-ASUS UserName: Dan

18:24:01.467 Initialize success

18:24:01.639 VM: initialized successfully

18:24:01.654 VM: Intel CPU supported

18:24:07.390 VM: disk I/O iaStorA.sys

18:32:20.637 AVAST engine defs: 15110101

18:32:40.802 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000032

18:32:40.802 Disk 0 Vendor: ST750LM022_HN-M750MBB 2AR10001 Size: 715404MB BusType: 11

18:32:40.990 Disk 0 MBR read successfully

18:32:40.990 Disk 0 MBR scan

18:32:41.005 Disk 0 unknown MBR code

18:32:41.005 Disk 0 Partition 1 00 EE GPT 2097151 MB offset 1

18:32:41.115 Disk 0 scanning C:\WINDOWS\system32\drivers

18:33:08.768 Service scanning

18:34:06.447 Modules scanning

18:34:06.447 Disk 0 trace - called modules:

18:34:07.026 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll iaStorA.sys

18:34:07.026 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe000eb1a4060]

18:34:07.041 3 CLASSPNP.SYS[fffff801b3d92170] -> nt!IofCallDriver -> [0xffffe000ea1dcc50]

18:34:07.041 5 ACPI.sys[fffff801b380ec21] -> nt!IofCallDriver -> \Device\00000032[0xffffe000ea184450]

18:34:08.104 AVAST engine scan C:\WINDOWS

18:34:11.869 AVAST engine scan C:\WINDOWS\system32

18:41:21.076 AVAST engine scan C:\WINDOWS\system32\drivers

18:41:58.829 AVAST engine scan C:\Users\Dan

18:56:28.080 AVAST engine scan C:\ProgramData

18:59:01.064 Disk 0 statistics 3740665/0/0 @ 2.28 MB/s

18:59:01.079 Scan finished successfully

19:03:57.345 Disk 0 MBR has been saved successfully to "C:\Users\Dan\Desktop\MBR.dat"

19:03:57.365 The log file has been saved successfully to "C:\Users\Dan\Desktop\aswMBR11-1.txt"

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:31-10-2015

Ran by [removed] (administrator) on DAN-ASUS (01-11-2015 19:19:54)

Running from C:\Users\[removed]\Downloads

[removed]

Platform: Windows 8.1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe

(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe

() C:\Program Files\CE\CovenantEyesCommService.exe

(CovenantEyes) C:\Program Files\CE\CovenantEyesProxy.exe

(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(HP) C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe

(HP) C:\Windows\System32\HPSIsvc.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

() C:\Program Files\CE\authServer.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe

(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe

(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnWMI.exe

(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnCfg.exe

(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe

(ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe

(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe

(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe

(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe

(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

() C:\Program Files\CE\CovenantEyes.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe

() C:\Program Files\CE\CovenantEyesHelper.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

() C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe

(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe

(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe

(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13213328 2012-10-18] (Realtek Semiconductor)

HKLM\…\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp

HKLM\…\Run: [Covenant Eyes] => C:\Program Files\CE\CovenantEyes.exe [12269560 2015-05-19] ()

HKLM\…\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch

HKLM-x32\…\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40336 2015-09-24] (Adobe Systems Incorporated)

HKLM-x32\…\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)

HKLM-x32\…\Run: [ASUSWebStorage] => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.9.120\AsusWSPanel.exe [3417984 2012-08-27] (ASUS Cloud Corporation)

HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\…\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-08-28] (Brother Industries, Ltd.)

HKLM-x32\…\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)

HKLM-x32\…\Run: [] => [X]

HKLM-x32\…\Run: [HPUsageTrackingLEDM] => C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe [30264 2009-08-04] (Hewlett-Packard Company)

Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-1579019205-3585864088-4210726827-1001\…\Run: [GoogleChromeAutoLaunch_31FA44FE943CF384B13C12A03C90A9AD] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [811848 2015-10-20] (Google Inc.)

HKU\S-1-5-21-1579019205-3585864088-4210726827-1001\…\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1403192 2015-09-11] (Garmin Ltd. or its subsidiaries)

HKU\S-1-5-18\…\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1403192 2015-09-11] (Garmin Ltd. or its subsidiaries)

ShellIconOverlayIdentifiers: [AsusWSShellExt_B] -> {6D4133E5-0742-4ADC-8A8C-9303440F7190} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.9.120\ASUSWSShellExt64.dll [2012-03-13] (ASUS Cloud Corporation.)

ShellIconOverlayIdentifiers: [AsusWSShellExt_O] -> {64174815-8D98-4CE6-8646-4C039977D808} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.9.120\ASUSWSShellExt64.dll [2012-03-13] (ASUS Cloud Corporation.)

ShellIconOverlayIdentifiers: [AsusWSShellExt_U] -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4D} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.9.120\ASUSWSShellExt64.dll [2012-03-13] (ASUS Cloud Corporation.)

GroupPolicy: Restriction - Chrome <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] [removed] [removed]

Tcpip\..\Interfaces\{958B2E52-9881-4BB0-B80E-FB26F359D3DB}: [NameServer] 127.0.0.2

Tcpip\..\Interfaces\{958B2E52-9881-4BB0-B80E-FB26F359D3DB}: [DhcpNameServer] [removed] [removed]

Internet Explorer:

==================

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION

HKU\S-1-5-21-1579019205-3585864088-4210726827-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus13.msn.com

HKU\S-1-5-21-1579019205-3585864088-4210726827-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus13.msn.com

BHO: Covenant Eyes for Internet Explorer -> {927BD2E1-2287-49D2-AE71-95F492CE662E} -> C:\Program Files\CE\extensions\ie\x64\ceie-0.7.2.dll [2015-05-19] (Covenant Eyes)

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-03-17] (Oracle Corporation)

BHO-x32: Covenant Eyes for Internet Explorer -> {927BD2E1-2287-49D2-AE71-95F492CE662E} -> C:\Program Files\CE\extensions\ie\x86\ceie-0.7.2.dll [2015-05-19] (Covenant Eyes)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-03-17] (Oracle Corporation)

FireFox:

========

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-03-17] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-03-17] (Oracle Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-09-24] (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-1579019205-3585864088-4210726827-1001: @citrixonline.com/appdetectorplugin -> C:\Users\Dan\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2015-07-22] (Citrix Online)

FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension

FF Extension: SmartPrintButton - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2011-01-26] [not signed]

FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files\CE\extensions\firefox\[removed]

FF Extension: Covenant Eyes for Firefox - C:\Program Files\CE\extensions\firefox\[removed] [2015-09-12] [not signed]

Chrome:

=======

CHR HomePage: Default -> hxxp://www.google.com

CHR Profile: C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-08]

CHR Extension: (Google Drive) - C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-28]

CHR Extension: (Covenant Eyes for Google Chrome™) - C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfegkegffcbgpfmemahhkgnbkocmbain [2015-09-12]

CHR Extension: (YouTube) - C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-27]

CHR Extension: (Google Search) - C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-28]

CHR Extension: (Google Docs Offline) - C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-04]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-25]

CHR Extension: (Gmail) - C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-03]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ASUS InstantOn; C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe [277120 2012-04-13] (ASUS)

R2 Auth Service; C:\Program Files\CE\authServer.exe [5438456 2015-05-19] ()

R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) [File not signed]

R2 CovenantEyesCommService; C:\Program Files\CE\CovenantEyesCommService.exe [7677432 2015-05-19] ()

R2 CovenantEyesProxy; C:\Program Files\CE\CovenantEyesProxy.exe [6797304 2015-05-18] (CovenantEyes)

S3 Garmin Device Interaction Service; C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe [762272 2015-09-11] (Garmin Ltd. or its subsidiaries)

R2 HP LaserJet Service; C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [136704 2009-06-24] (HP) [File not signed]

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-28] ()

R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)

R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-28] (Intel® Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [61824 2012-10-31] (ASUS Corporation)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)

R1 cewd64f; C:\WINDOWS\system32\Drivers\cewd64f.sys [34296 2015-05-18] () [File not signed]

R1 cewd64r; C:\WINDOWS\system32\Drivers\cewd64r.sys [45048 2015-05-18] () [File not signed]

R2 cewfp; C:\WINDOWS\system32\Drivers\cewfp64.sys [43000 2015-05-18] (CovenantEyes)

S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)

R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [14992 2012-08-01] ( )

R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)

R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2015-11-01] (Malwarebytes)

R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)

R3 NETwNe64; C:\Windows\system32\DRIVERS\Netwew00.sys [3345376 2013-10-08] (Intel Corporation)

R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [47072 2012-10-09] (Windows (R) Win 7 DDK provider)

S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)

R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)

R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)

R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188896 2012-10-09] (Windows (R) Win 7 DDK provider)

U3 aswMBR; \??\C:\Users\Dan\AppData\Local\Temp\aswMBR.sys [X]

U3 aswVmm; \??\C:\Users\Dan\AppData\Local\Temp\aswVmm.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-01 19:16 - 2015-11-01 19:16 - 00065464 _____ C:\Users\Dan\Downloads\Shortcut.txt

2015-11-01 19:14 - 2015-11-01 19:16 - 00026862 _____ C:\Users\Dan\Downloads\Addition.txt

2015-11-01 19:12 - 2015-11-01 19:19 - 00017531 _____ C:\Users\Dan\Downloads\FRST.txt

2015-11-01 19:10 - 2015-11-01 19:19 - 00000000 ____D C:\FRST

2015-11-01 19:09 - 2015-11-01 19:09 - 02198016 _____ (Farbar) C:\Users\Dan\Downloads\FRST64.exe

2015-11-01 19:03 - 2015-11-01 19:03 - 00001973 _____ C:\Users\Dan\Desktop\aswMBR11-1.txt

2015-11-01 19:03 - 2015-11-01 19:03 - 00000512 _____ C:\Users\Dan\Desktop\MBR.dat

2015-11-01 18:23 - 2015-11-01 18:23 - 05198336 _____ (AVAST Software) C:\Users\Dan\Downloads\aswMBR.exe

2015-11-01 05:26 - 2015-11-01 18:17 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2015-11-01 05:23 - 2015-11-01 05:23 - 00001120 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-11-01 05:23 - 2015-11-01 05:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-11-01 05:23 - 2015-11-01 05:23 - 00000000 ____D C:\ProgramData\Malwarebytes

2015-11-01 05:23 - 2015-11-01 05:23 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-11-01 05:23 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2015-11-01 05:23 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys

2015-11-01 05:23 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys

2015-11-01 05:18 - 2015-11-01 05:18 - 00321848 _____ (Malwarebytes Corporation) C:\Users\Dan\Downloads\mbam-clean-2.1.1.1001.exe

2015-11-01 05:09 - 2015-11-01 05:10 - 22908888 _____ (Malwarebytes ) C:\Users\Dan\Downloads\mbam-setup-2.2.0.1024.exe

2015-10-14 21:26 - 2015-09-18 20:18 - 00035384 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe

2015-10-14 21:26 - 2015-09-18 06:42 - 01290752 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll

2015-10-14 21:26 - 2015-09-18 06:42 - 01163776 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll

2015-10-14 21:26 - 2015-09-18 06:42 - 00766464 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll

2015-10-14 21:26 - 2015-09-18 06:42 - 00699904 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll

2015-10-14 21:26 - 2015-09-18 06:42 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll

2015-10-14 21:26 - 2015-09-18 06:42 - 00073216 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll

2015-10-14 01:05 - 2015-09-29 05:31 - 07457624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2015-10-14 01:05 - 2015-09-29 05:31 - 01658536 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi

2015-10-14 01:05 - 2015-09-29 05:31 - 01519592 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe

2015-10-14 01:05 - 2015-09-29 05:31 - 01487008 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi

2015-10-14 01:05 - 2015-09-29 05:31 - 01355848 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe

2015-10-14 01:05 - 2015-09-24 09:42 - 00348672 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdesvc.dll

2015-10-14 01:05 - 2015-09-24 09:40 - 00737280 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll

2015-10-14 01:05 - 2015-09-10 11:02 - 25851392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2015-10-14 01:05 - 2015-09-10 10:19 - 00585728 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll

2015-10-14 01:05 - 2015-09-10 10:18 - 02886656 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2015-10-14 01:05 - 2015-09-10 10:18 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll

2015-10-14 01:05 - 2015-09-10 10:14 - 05990400 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2015-10-14 01:05 - 2015-09-10 10:09 - 20358144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2015-10-14 01:05 - 2015-09-10 10:06 - 00616960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll

2015-10-14 01:05 - 2015-09-10 10:04 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll

2015-10-14 01:05 - 2015-09-10 09:51 - 00489984 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll

2015-10-14 01:05 - 2015-09-10 09:39 - 00504832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll

2015-10-14 01:05 - 2015-09-10 09:37 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll

2015-10-14 01:05 - 2015-09-10 09:37 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll

2015-10-14 01:05 - 2015-09-10 09:35 - 00315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll

2015-10-14 01:05 - 2015-09-10 09:33 - 02279936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2015-10-14 01:05 - 2015-09-10 09:28 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll

2015-10-14 01:05 - 2015-09-10 09:28 - 00480256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll

2015-10-14 01:05 - 2015-09-10 09:27 - 00663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll

2015-10-14 01:05 - 2015-09-10 09:24 - 14456832 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2015-10-14 01:05 - 2015-09-10 09:21 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll

2015-10-14 01:05 - 2015-09-10 09:19 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2015-10-14 01:05 - 2015-09-10 09:19 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2015-10-14 01:05 - 2015-09-10 09:19 - 00374784 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll

2015-10-14 01:05 - 2015-09-10 09:17 - 02126336 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl

2015-10-14 01:05 - 2015-09-10 09:17 - 00416256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll

2015-10-14 01:05 - 2015-09-10 09:07 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll

2015-10-14 01:05 - 2015-09-10 09:05 - 00279040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll

2015-10-14 01:05 - 2015-09-10 09:02 - 04527616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2015-10-14 01:05 - 2015-09-10 09:01 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll

2015-10-14 01:05 - 2015-09-10 09:00 - 12853760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2015-10-14 01:05 - 2015-09-10 08:57 - 02487808 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2015-10-14 01:05 - 2015-09-10 08:57 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll

2015-10-14 01:05 - 2015-09-10 08:55 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl

2015-10-14 01:05 - 2015-09-10 08:55 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

2015-10-14 01:05 - 2015-09-10 08:55 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll

2015-10-14 01:05 - 2015-09-10 08:45 - 01546752 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2015-10-14 01:05 - 2015-09-10 08:34 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll

2015-10-14 01:05 - 2015-09-10 08:31 - 02011136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2015-10-14 01:05 - 2015-09-10 08:27 - 01311232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2015-10-14 01:05 - 2015-09-10 08:26 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll

2015-10-14 01:05 - 2015-08-26 19:43 - 22372152 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2015-10-14 01:05 - 2015-08-26 19:42 - 19795904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2015-10-14 01:05 - 2015-08-07 14:40 - 01736520 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll

2015-10-14 01:05 - 2015-08-07 14:40 - 01499920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll

2015-10-14 01:05 - 2015-08-07 14:40 - 01134752 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll

2015-10-14 01:05 - 2015-08-07 14:40 - 00686960 _____ (Microsoft Corporation) C:\WINDOWS\system32\advapi32.dll

2015-10-14 01:05 - 2015-08-07 14:40 - 00507176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\advapi32.dll

2015-10-14 01:05 - 2015-08-07 07:13 - 00862720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll

2015-10-14 01:05 - 2015-08-06 10:05 - 00669184 _____ (Microsoft Corporation) C:\WINDOWS\system32\hhctrl.ocx

2015-10-14 01:05 - 2015-08-06 09:47 - 04710400 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll

2015-10-14 01:05 - 2015-08-06 09:37 - 00536576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hhctrl.ocx

2015-10-14 01:05 - 2015-08-06 09:18 - 04068352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll

2015-10-14 01:04 - 2015-09-29 05:29 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

2015-10-14 01:04 - 2015-09-28 11:45 - 03705344 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

2015-10-14 01:04 - 2015-09-28 11:26 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll

2015-10-14 01:04 - 2015-09-28 11:25 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll

2015-10-14 01:04 - 2015-09-28 11:25 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll

2015-10-14 01:04 - 2015-09-28 11:25 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe

2015-10-14 01:04 - 2015-09-28 11:22 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll

2015-10-14 01:04 - 2015-09-28 11:22 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll

2015-10-14 01:04 - 2015-09-28 11:22 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe

2015-10-14 01:04 - 2015-09-28 11:15 - 02243072 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll

2015-10-14 01:04 - 2015-09-28 11:13 - 00891904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll

2015-10-14 01:04 - 2015-09-28 11:12 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll

2015-10-14 01:04 - 2015-08-22 06:42 - 00901264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll

2015-10-14 01:04 - 2015-08-22 06:42 - 00066400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-private-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:42 - 00022368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-math-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:42 - 00019808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:42 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-string-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:42 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:42 - 00016224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:42 - 00015712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:42 - 00014176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-time-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:42 - 00013664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-process-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:35 - 00984448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll

2015-10-14 01:04 - 2015-08-22 06:35 - 00063840 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-private-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:35 - 00020832 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-math-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:35 - 00019808 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-multibyte-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:35 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-string-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:35 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-stdio-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:35 - 00016224 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-runtime-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:35 - 00015712 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-convert-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:35 - 00014176 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-time-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:35 - 00013664 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-filesystem-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-process-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-heap-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-conio-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-utility-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-locale-l1-1-0.dll

2015-10-14 01:04 - 2015-08-22 06:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-environment-l1-1-0.dll

2015-10-14 01:04 - 2015-07-16 11:58 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\system32\NcdAutoSetup.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-01 19:20 - 2015-08-24 20:24 - 00000664 _____ C:\WINDOWS\Tasks\G2MUploadTask-S-1-5-21-1579019205-3585864088-4210726827-1001.job

2015-11-01 19:14 - 2013-08-21 22:01 - 00000924 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2015-11-01 19:07 - 2015-07-22 13:22 - 00000568 _____ C:\WINDOWS\Tasks\G2MUpdateTask-S-1-5-21-1579019205-3585864088-4210726827-1001.job

2015-11-01 19:02 - 2013-08-22 08:36 - 00000000 ____D C:\WINDOWS\system32\sru

2015-11-01 18:32 - 2014-08-16 12:49 - 01390029 _____ C:\WINDOWS\WindowsUpdate.log

2015-11-01 17:14 - 2013-08-21 22:01 - 00000920 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2015-11-01 17:08 - 2014-11-26 12:19 - 00003918 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{0FFE8422-D8B2-4FF6-AE3A-DAC333434274}

2015-11-01 17:05 - 2014-03-18 03:03 - 00863592 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2015-11-01 09:58 - 2015-01-08 05:46 - 00003886 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task

2015-11-01 07:10 - 2013-08-15 19:14 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1579019205-3585864088-4210726827-1001

2015-11-01 05:23 - 2014-08-17 15:32 - 00000000 ___DO C:\Users\Dan\OneDrive

2015-11-01 05:23 - 2013-08-15 19:06 - 00000401 _____ C:\Users\Dan\AppData\Roaming\sp_data.sys

2015-11-01 05:20 - 2015-09-12 12:53 - 00000000 ____D C:\ProgramData\boost_interprocess

2015-11-01 05:20 - 2015-09-12 12:50 - 00005232 _____ C:\WINDOWS\SysWOW64\CovenantEyesProxyOff.ini

2015-11-01 05:20 - 2015-09-12 12:50 - 00005232 _____ C:\WINDOWS\system32\CovenantEyesProxyOff.ini

2015-11-01 05:20 - 2013-08-22 07:46 - 00313853 _____ C:\WINDOWS\setupact.log

2015-11-01 05:20 - 2013-08-22 07:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2015-11-01 05:19 - 2014-03-18 02:54 - 00089502 _____ C:\WINDOWS\PFRO.log

2015-11-01 05:19 - 2013-08-22 06:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI

2015-11-01 05:13 - 2013-08-22 08:36 - 00000000 ____D C:\WINDOWS\system32\NDF

2015-10-28 22:24 - 2015-08-24 20:24 - 00003660 _____ C:\WINDOWS\System32\Tasks\G2MUploadTask-S-1-5-21-1579019205-3585864088-4210726827-1001

2015-10-28 22:24 - 2015-07-22 13:22 - 00003564 _____ C:\WINDOWS\System32\Tasks\G2MUpdateTask-S-1-5-21-1579019205-3585864088-4210726827-1001

2015-10-26 15:43 - 2013-08-22 08:36 - 00000000 ____D C:\WINDOWS\AppReadiness

2015-10-26 02:15 - 2013-08-21 22:02 - 00002205 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2015-10-20 20:54 - 2012-07-26 00:59 - 00000000 ____D C:\WINDOWS\CbsTemp

2015-10-16 11:49 - 2013-08-22 08:36 - 00000000 ____D C:\WINDOWS\rescache

2015-10-16 10:43 - 2014-01-18 21:09 - 00002041 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk

2015-10-16 10:43 - 2012-08-04 19:25 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk

2015-10-16 10:25 - 2014-12-13 20:59 - 00000000 ____D C:\WINDOWS\system32\appraiser

2015-10-16 10:25 - 2014-08-08 23:17 - 00000000 ___SD C:\WINDOWS\system32\CompatTel

2015-10-16 10:25 - 2013-08-22 08:36 - 00000000 ___RD C:\WINDOWS\ToastData

2015-10-15 21:51 - 2015-07-16 17:04 - 00810488 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2015-10-15 21:51 - 2015-07-16 17:04 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2015-10-14 04:05 - 2013-08-17 03:21 - 00000000 ____D C:\WINDOWS\system32\MRT

2015-10-14 04:00 - 2013-08-17 03:21 - 143481208 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2015-10-06 00:12 - 2015-04-06 19:08 - 00000000 ___SD C:\WINDOWS\system32\GWX

2015-10-05 21:24 - 2015-04-06 19:08 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX

==================== Files in the root of some directories =======

2013-08-15 19:06 - 2015-11-01 05:23 - 0000401 _____ () C:\Users\Dan\AppData\Roaming\sp_data.sys

2014-07-24 22:30 - 2014-07-24 22:30 - 0000000 _____ () C:\Users\Dan\AppData\Local\{EC25E351-7464-48FB-8B88-553ED77466F0}

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed

C:\WINDOWS\system32\wininit.exe => File is digitally signed

C:\WINDOWS\explorer.exe => File is digitally signed

C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed

C:\WINDOWS\system32\svchost.exe => File is digitally signed

C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed

C:\WINDOWS\system32\services.exe => File is digitally signed

C:\WINDOWS\system32\User32.dll => File is digitally signed

C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed

C:\WINDOWS\system32\userinit.exe => File is digitally signed

C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed

C:\WINDOWS\system32\rpcss.dll => File is digitally signed

C:\WINDOWS\system32\dnsapi.dll => File is digitally signed

C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed

C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-11-01 10:08

==================== End of FRST.txt ============================

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1579019205-3585864088-4210726827-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Dan\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

DNS Servers: 127.0.0.2

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139

FirewallRules: [{094DBE3F-1270-4271-A673-B2EB4A33C5D5}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe

FirewallRules: [{C05DFAE4-813A-48F7-8F82-D30D748B530D}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe

FirewallRules: [{FED36F20-95B9-4BEA-BDCF-462AAD4A30C4}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe

FirewallRules: [{1EE0148C-E66E-4BF4-A026-2337E31B8623}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE

FirewallRules: [{8A93C0D2-7B21-4CB1-B4F8-A370C138FE96}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe

FirewallRules: [{A7514949-2FC1-490E-8579-AC882A69447E}] => (Allow) C:\Program Files\Intel Corporation\Intel WiDi\WiDiApp.exe

FirewallRules: [{9020C34E-2F7D-4F0A-8BE5-69006E41E44A}] => (Allow) F:\ProductInst64.exe

FirewallRules: [{7672535B-BD14-4BB4-B1C2-F6BFCFB6A111}] => (Allow) F:\ProductInst64.exe

FirewallRules: [{38B34D9C-561A-4FF7-96AD-D7BDCDA460F2}] => (Allow) LPort=9100

FirewallRules: [{8BF93180-2048-45B0-A45C-76325476DA95}] => (Allow) LPort=427

FirewallRules: [{DC2B9008-3E2C-4195-8E99-CDC65B98D59C}] => (Allow) LPort=161

FirewallRules: [{CC7745C6-E887-4938-8972-F7922F3BCD4C}] => (Allow) LPort=427

FirewallRules: [{F4189E4E-AADD-4A8D-A56C-2997273B3C9A}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (11/01/2015 06:05:37 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )

Description: 80070005

Error: (11/01/2015 10:10:42 AM) (Source: SideBySide) (EventID: 78) (User: )

Description: Activation context generation failed for "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest1".Error in manifest or policy file "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest2" on line C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest3.

A component version required by the application conflicts with another component version already active.

Conflicting components are:.

Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.

Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.

Error: (11/01/2015 05:16:49 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: CovenantEyes.exe, version: 0.0.0.0, time stamp: 0x555b556b

Faulting module name: CovenantEyes.exe, version: 0.0.0.0, time stamp: 0x555b556b

Exception code: 0xc0000005

Fault offset: 0x00000000001eb3d5

Faulting process id: 0x1e44

Faulting application start time: 0xCovenantEyes.exe0

Faulting application path: CovenantEyes.exe1

Faulting module path: CovenantEyes.exe2

Report Id: CovenantEyes.exe3

Faulting package full name: CovenantEyes.exe4

Faulting package-relative application ID: CovenantEyes.exe5

Error: (11/01/2015 05:15:51 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: mbam.exe, version: 1.75.0.1, time stamp: 0x511f8eb2

Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000

Exception code: 0xc0000005

Fault offset: 0x77c7971d

Faulting process id: 0x9d8

Faulting application start time: 0xmbam.exe0

Faulting application path: mbam.exe1

Faulting module path: mbam.exe2

Report Id: mbam.exe3

Faulting package full name: mbam.exe4

Faulting package-relative application ID: mbam.exe5

Error: (11/01/2015 05:06:46 AM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program LiveComm.exe version 17.5.9600.20911 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 7ec

Start Time: 01d1143da3a15645

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: ebdbca8c-8090-11e5-beca-84a6c869cde5

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

Error: (11/01/2015 05:06:09 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DAN-ASUS)

Description: Activation of app microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1 failed with error: -2147024865 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (10/31/2015 05:01:01 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )

Description: 80070005

Error: (10/30/2015 08:30:12 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )

Description: 80070005

Error: (10/30/2015 02:11:12 AM) (Source: SideBySide) (EventID: 78) (User: )

A component version required by the application conflicts with another component version already active.

Conflicting components are:.

Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.

Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.

Error: (10/28/2015 04:32:19 AM) (Source: SideBySide) (EventID: 78) (User: )

A component version required by the application conflicts with another component version already active.

Conflicting components are:.

Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.

Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.

System errors:

=============

Error: (11/01/2015 05:06:09 AM) (Source: DCOM) (EventID: 10001) (User: DAN-ASUS)

Description: "C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exe" -ServerName:Microsoft.WindowsLive.Platform.Server31Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mcaUnavailableUnavailable

Error: (10/22/2015 09:09:45 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)

Description: Installation Failure: Windows failed to install the following update with error 0x80010108: Microsoft.BingWeather.

Error: (10/03/2015 08:13:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The TCP/IP NetBIOS Helper service failed to start due to the following error:

%%1069

Error: (10/03/2015 08:13:15 PM) (Source: Service Control Manager) (EventID: 7038) (User: )

Description: The lmhosts service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error:

%%50

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

Error: (10/02/2015 10:10:53 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Auth Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

Error: (09/21/2015 09:36:31 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Auth Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

Error: (09/18/2015 06:59:59 PM) (Source: Tcpip) (EventID: 4199) (User: )

Description: The system detected an address conflict for IP address 0.0.0.0 with the system

having network hardware address 00-00-00-00-00-00. Network operations on this system may

be disrupted as a result.

Error: (09/18/2015 12:59:20 PM) (Source: NetBT) (EventID: 4321) (User: )

Description: The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.1.104.

The computer with the IP address 192.168.1.106 did not allow the name to be claimed by

this computer.

Error: (09/12/2015 04:50:44 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)

Description: Installation Failure: Windows failed to install the following update with error 0x80240020: Upgrade to Windows 10 Home.

Error: (09/12/2015 01:19:16 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)

Description: Installation Failure: Windows failed to install the following update with error 0x80240020: Upgrade to Windows 10 Home.

==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz

Percentage of memory in use: 48%

Total physical RAM: 6033.75 MB

Available physical RAM: 3131.21 MB

Total Virtual: 6993.75 MB

Available Virtual: 3414.57 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:279.01 GB) (Free:224.67 GB) NTFS ==>[system with boot components (obtained from drive)]

Drive d: (Data) (Fixed) (Total:398.17 GB) (Free:398.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (Size: 698.6 GB) (Disk ID: 66F8AFCF)

Partition: GPT.

==================== End of Addition.txt ============================

ken545

Post #2November 3, 2015, 3:07 AM UTC

Make sure you contact your credit card companies and make them aware of the situation

CovenantEyes.exe <– Is this a program that you installed and are aware of ?

You need to post the entire Additions log that was created when you first ran FRST

sparkey75

Post #3November 3, 2015, 3:30 AM UTC last edited November 3, 2015, 3:32 AM UTC

yes I am aware.

Here is the full addition, sorry about that:

Additional scan result of Farbar Recovery Scan Tool (x64) Version:31-10-2015

Ran by [removed] (2015-11-01 19:20:48)

Running from C:\Users\[removed]\Downloads

Windows 8.1 (X64) (2014-08-17 22:27:29)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-1579019205-3585864088-4210726827-500 - Administrator - Disabled)

Dan (S-1-5-21-1579019205-3585864088-4210726827-1001 - Administrator - Enabled) => C:\Users\Dan

Guest (S-1-5-21-1579019205-3585864088-4210726827-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-1579019205-3585864088-4210726827-1003 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Reader X (10.1.16) MUI (HKLM-x32\…\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.16 - Adobe Systems Incorporated)

ANT Drivers Installer x64 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden

ASUS Instant Connect (HKLM-x32\…\{89ECB85A-D933-4CEA-9116-5CBC9C2ED95B}) (Version: 1.2.8 - ASUS)

ASUS InstantOn (HKLM-x32\…\{749F674B-2674-47E8-879C-5626A06B2A91}) (Version: 3.0.4 - ASUS)

ASUS LifeFrame3 (HKLM-x32\…\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}) (Version: 3.1.9 - ASUS)

ASUS Live Update (HKLM-x32\…\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version: 3.1.9 - ASUS)

ASUS Power4Gear Hybrid (HKLM\…\{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}) (Version: 2.0.4 - ASUS)

ASUS Smart Gesture (HKLM-x32\…\{4D3286A6-F6AB-498A-82A4-E4F040529F3D}) (Version: 1.0.35 - ASUS)

ASUS Splendid Video Enhancement Technology (HKLM-x32\…\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 1.03.0006 - ASUS)

ASUS Tutor (HKLM-x32\…\{58172D66-2F69-4215-9AEC-ED8196023736}) (Version: 1.0.6 - ASUS)

ASUS USB Charger Plus (HKLM-x32\…\{A859E3E5-C62F-4BFA-AF1D-2B95E03166AF}) (Version: 2.1.4 - ASUS)

ASUS WebStorage Sync Agent (HKLM-x32\…\ASUS WebStorage) (Version: 1.1.9.120 - ASUS Cloud Corporation)

ASUSDVD (HKLM-x32\…\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4126.52 - CyberLink Corp.)

ASUSDVD (x32 Version: 10.0.4126.52 - CyberLink Corp.) Hidden

ATK Package (HKLM-x32\…\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0025 - ASUS)

Brother MFL-Pro Suite MFC-J825DW (HKLM-x32\…\{A1B36B88-AF90-43A3-8906-6DBEE89B4FBD}) (Version: 1.1.6.0 - Brother Industries, Ltd.)

Citrix Online Launcher (HKLM-x32\…\{DB014C85-A264-4BCA-A66F-6DD1FCF8EC36}) (Version: 1.0.335 - Citrix)

Covenant Eyes (HKLM-x32\…\{5AC5ED2E-2936-4B54-A429-703F9034938E}) (Version: 5.4.3 - Covenant Eyes, Inc.)

Elevated Installer (x32 Version: 4.1.8.0 - Garmin Ltd or its subsidiaries) Hidden

ESET Online Scanner v3 (HKLM-x32\…\ESET Online Scanner) (Version: - )

Garmin Express (HKLM-x32\…\{44d9dfc0-3a4a-4439-870f-f97550a9bc8d}) (Version: 4.1.8.0 - Garmin Ltd or its subsidiaries)

Garmin Express (x32 Version: 4.1.8.0 - Garmin Ltd or its subsidiaries) Hidden

Garmin Express Tray (x32 Version: 4.1.8.0 - Garmin Ltd or its subsidiaries) Hidden

Google Chrome (HKLM-x32\…\Google Chrome) (Version: 46.0.2490.80 - Google Inc.)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden

GoToMeeting 7.4.1.3770 (HKU\S-1-5-21-1579019205-3585864088-4210726827-1001\…\GoToMeeting) (Version: 7.4.1.3770 - CitrixOnline)

HP LaserJet Professional P1100-P1560-P1600 Series (HKLM\…\HP LaserJet Professional P1100-P1560-P1600 Series) (Version: - )

hppLaserJetService (x32 Version: 001.001.0.0 - Hewlett-Packard) Hidden

hppP1100P1560P1600SeriesLaserJetService (x32 Version: 001.001.0.0 - Hewlett-Packard) Hidden

hppusgP1100P1560P1600Series (x32 Version: 1.0.0.1 - Hewlett-Packard) Hidden

HPSSupply (HKLM-x32\…\{7902E313-FF0F-4493-ACB1-A8147B78DCD0}) (Version: 2.1.1.0000 - Hewlett Packard Development Company L.P.)

Intel(R) Management Engine Components (HKLM-x32\…\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)

Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3308 - Intel Corporation)

Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\…\{7854AA22-A2F0-4F29-A2E9-D0C5A2B685E7}) (Version: 2.5.0.0236 - Motorola Solutions, Inc)

Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\…\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)

Intel(R) WiDi (HKLM\…\{6097158B-0184-4140-BEC3-7885794D2571}) (Version: 3.5.40.0 - Intel Corporation)

Intel® PROSet/Wireless Software (HKLM-x32\…\{c9967fbd-e3c3-4ed0-992a-5b33260f2944}) (Version: 16.1.5 - Intel Corporation)

Java 7 Update 55 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.550 - Oracle)

Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)

MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden

MetaTrader 4 at FOREX.com (HKLM-x32\…\MetaTrader 4 at FOREX.com) (Version: 4.00 - MetaQuotes Software Corp.)

Microsoft Office (HKLM-x32\…\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.6120.5004 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6760 - Realtek Semiconductor Corp.)

Realtek USB 2.0 Card Reader (HKLM-x32\…\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)

Shared C Run-time for x64 (HKLM\…\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)

Snapz Master Electrician 2008 (HKLM-x32\…\Snapz Master Electrician 2008) (Version: - )

Windows Driver Package - ASUS (ATP) Mouse (10/29/2012 1.0.0.148) (HKLM\…\C01F56FBD9B141017E63E2A1A141E59934D4DC67) (Version: 10/29/2012 1.0.0.148 - ASUS)

Windows Driver Package - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\…\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)

Windows Driver Package - Silicon Labs Software (DSI_SiUSBXp_3_1) USB (02/06/2007 3.1) (HKLM\…\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)

WinFlash (HKLM-x32\…\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.41.1 - ASUS)

WSOP.com (HKLM-x32\…\WSOP.com) (Version: - )

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1579019205-3585864088-4210726827-1001_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\Dan\AppData\Local\Citrix\GoToMeeting\2553\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)

==================== Restore Points =========================

14-10-2015 03:55:33 Windows Update

20-10-2015 20:53:25 Windows Update

28-10-2015 04:43:50 Scheduled Checkpoint

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 06:25 - 2013-08-22 06:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {19847B9B-5EF0-4066-B32D-6B621DB5478B} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)

Task: {51E3A16F-FF47-4BF9-941B-A7F998BE8D4A} - System32\Tasks\ASUS USB Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [2012-07-24] (ASUSTek Computer Inc.)

Task: {6672F934-7977-4F60-8387-1C0E4342AE7F} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express SelfUpdater\ExpressSelfUpdater.exe [2015-09-11] ()

Task: {68C8F863-269D-423D-ABDD-98A2170DA3C0} - System32\Tasks\ASUS P4G => C:\Program Files\ASUS\P4G\BatteryLife.exe [2012-08-24] (ASUS)

Task: {780052BD-DE61-4710-A418-CBE299CCF3E6} - System32\Tasks\ASUS Touchpad Launcher (x64) => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2012-10-31] (AsusTek)

Task: {A51ECFD5-943B-42DA-974E-69D9E3FE287C} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2012-08-22] (ASUSTeK Computer Inc.)

Task: {A6F12E1A-88DA-4EDF-A943-0DC2FC4F88AD} - System32\Tasks\G2MUpdateTask-S-1-5-21-1579019205-3585864088-4210726827-1001 => C:\Users\Dan\AppData\Local\Citrix\GoToMeeting\3770\g2mupdate.exe [2015-10-28] (Citrix Online, a division of Citrix Systems, Inc.)

Task: {AC0C4D7B-FED5-4E1F-B624-978B77219425} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-10-14] (Microsoft Corporation)

Task: {DA8EAC7F-8833-473C-AA37-380CF53F0268} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)

Task: {EAAD3020-1CF7-48C8-824B-B276CEE29271} - System32\Tasks\ASUS Splendid ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2012-10-17] (ASUS)

Task: {EC0FFBEA-6D2F-4733-A47B-D94AF4FE6B25} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)

Task: {F3A4274A-93CD-4E27-8CB3-CA40CA7FD545} - System32\Tasks\G2MUploadTask-S-1-5-21-1579019205-3585864088-4210726827-1001 => C:\Users\Dan\AppData\Local\Citrix\GoToMeeting\3770\g2mupload.exe [2015-10-28] (Citrix Online, a division of Citrix Systems, Inc.)

Task: {F5A7808C-566A-4310-80C5-AADE8ECD83DD} - System32\Tasks\ASUS InstantOn Config => C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnCfg.exe [2012-09-24] (ASUS)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\G2MUpdateTask-S-1-5-21-1579019205-3585864088-4210726827-1001.job => C:\Users\Dan\AppData\Local\Citrix\GoToMeeting\3770\g2mupdate.exe

Task: C:\WINDOWS\Tasks\G2MUploadTask-S-1-5-21-1579019205-3585864088-4210726827-1001.job => C:\Users\Dan\AppData\Local\Citrix\GoToMeeting\3770\g2mupload.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2015-08-09 16:12 - 2012-08-21 15:07 - 00288768 _____ () C:\WINDOWS\System32\HP1100LM.DLL

2015-08-09 16:12 - 2012-08-21 15:07 - 00074240 _____ () C:\WINDOWS\system32\spool\PRTPROCS\x64\HP1100PP.DLL

2015-09-12 12:50 - 2015-05-19 10:25 - 07677432 _____ () C:\Program Files\CE\CovenantEyesCommService.exe

2015-09-12 12:50 - 2015-05-19 10:25 - 05438456 _____ () C:\Program Files\CE\authServer.exe

2015-09-12 12:50 - 2015-05-19 10:25 - 01162232 _____ () C:\Program Files\CE\nmsvc64.dll

2015-09-12 12:50 - 2015-05-19 10:25 - 00197624 _____ () C:\Program Files\CE\nmsvTree64.dll

2012-08-24 18:26 - 2012-08-24 18:26 - 00031360 _____ () C:\Program Files\ASUS\P4G\DevMng.dll

2012-11-13 01:30 - 2012-10-14 21:09 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2015-09-12 12:50 - 2015-05-19 10:25 - 12269560 _____ () C:\Program Files\CE\CovenantEyes.exe

2015-09-12 12:50 - 2015-05-19 10:25 - 09644024 _____ () C:\Program Files\CE\CovenantEyesHelper.exe

2012-10-17 10:51 - 2012-10-17 10:51 - 00168664 _____ () C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe

2015-10-26 02:15 - 2015-10-20 07:08 - 01532744 _____ () C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.80\libglesv2.dll

2015-10-26 02:15 - 2015-10-20 07:08 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.80\libegl.dll

2012-10-17 10:51 - 2012-10-17 10:51 - 00011776 _____ () C:\Program Files (x86)\ASUS\Splendid\GLCDdll.dll

2014-06-04 23:41 - 2009-02-27 14:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll

2013-01-14 21:13 - 2012-06-24 19:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

2015-10-26 02:15 - 2015-10-20 07:08 - 16493384 _____ () C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.80\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\cewd64f.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\cewd64r.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Auth Service => ""="service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\cewd64f.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\cewd64r.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\cewfp => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CovenantEyesCommService => ""="service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CovenantEyesProxy => ""="service"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)