Spyware / Malware / Virus Removal

Infected [Closed]

5 min read

Looking for the outcome? Ask AI

lisavvvv Topic Starter

Post #1August 17, 2016, 2:34 PM UTC

I looked at my "this PC" area today to see how much storage I had left and noticed there was a "local disk" listed there that does not exist.

I've been getting the "firefox patch" popups lately, so I know I've got something and suspect this is related. Windows Defender did not find anything.

Help!

Satchfan

Post #2August 17, 2016, 4:09 PM UTC

Hello Selene and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

=========================

The Firefox popup could be legitimate as could be the “local disk” but we’ll have a look and see what’s happening.

=========================

Please read the following guidelines which will help to make cleaning your machine easier:

please follow all instructions in the order posted
please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
if you don't understand something, please don't hesitate to ask for clarification before proceeding
the fixes are specific to your problem and should only be used for this issue on this machine.
please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Note: Please run these in the order given in the instructions.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

run AdwCleaner by clicking on Scan
when it has finished, leave everything that was found checked, (ticked), then click on Clean
if it asks to reboot, allow the reboot
on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Run RogueKiller

IMPORTANT: Please remove any usb or external drives from the computer before you run this scan!

Close all running programs.

Download RogueKiller to your desktop

close all running programs
for Windows Vista/7/8/10, right click -> run as administrator, for XP simply double-click on RogueKiller.exe
when the pre-scan is finished, click on Scan
click on Report and copy/paste the content in your next post
NOTE: DO NOT attempt to remove anything that the scan detects –everything that is reported is not necessarily bad

If the program is blocked, continue to try it several times. If it still doesn’t work, (it could happen), rename it to winlogon.exe.

Please post the contents of the RKreport.txt in your next reply.

===================================================

Run Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
press Scan button
it will produce a log called Frst.txt in the same directory the tool is run from
please copy and paste log back here.
the first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the Frst.txt into your reply.

Logs to include with next post:

AdwCleaner log
RKreport.txt
Frst.txt
Addition.txt

Thanks

Satchfan

lisavvvv

Post #3August 17, 2016, 7:27 PM UTC

# AdwCleaner v6.000 - Logfile created 17/08/2016 at 15:21:09
# Updated on 12/08/2016 by ToolsLib
# Database : 2016-08-17.2 [Server]
# Operating System : Windows 8.1 (X64)
# Username : lisa - LISASCOMPUTER
# Running from : C:\Users\lisa\Downloads\adwcleaner_6.000.exe
# Mode: Clean
# Support : https://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

[-] Folder deleted: C:\Users\lisa\AppData\Local\pokki
[-] Folder deleted: C:\Users\lisa\AppData\Local\Free Youtube Downloader
[-] Folder deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Youtube Downloader
[-] Folder deleted: C:\Program Files (x86)\Free Youtube Downloader
[-] Folder deleted: C:\Users\Default User\AppData\Local\Pokki
[#] Folder deleted on reboot: C:\Users\Default\AppData\Local\Pokki

***** [ Files ] *****

[-] File deleted: C:\Users\lisa\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Free Youtube Downloader.lnk
[-] File deleted: C:\Users\Public\Desktop\Free Youtube Downloader.lnk

***** [ DLL ] *****

***** [ WMI ] *****

***** [ Shortcuts ] *****

***** [ Scheduled Tasks ] *****

***** [ Registry ] *****

[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pokki_b52b7a05ea010d22183cece45cbb6e86cf917a76
[-] Key deleted: HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\Software\Pokki
[-] Key deleted: HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pokki
[#] Key deleted on reboot: HKCU\Software\Pokki
[#] Key deleted on reboot: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pokki
[-] Value deleted: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce [Application Restart #1]

***** [ Web browsers ] *****

*************************

:: "Tracing" keys deleted
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [1923 Bytes] - [17/08/2016 15:21:09]
C:\AdwCleaner\AdwCleaner[R0].txt - [1454 Bytes] - [19/05/2015 19:22:36]
C:\AdwCleaner\AdwCleaner[S0].txt - [1504 Bytes] - [19/05/2015 19:24:38]
C:\AdwCleaner\AdwCleaner[S1].txt - [2267 Bytes] - [17/08/2016 15:18:52]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [2215 Bytes] ##########

lisavvvv

Post #4August 17, 2016, 8:15 PM UTC

RogueKiller V12.4.4.0 (x64) [Aug 16 2016] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 8.1 (6.3.9600) 64 bits version
Started in : Normal mode
User : lisa [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Scan – Date : 08/17/2016 16:11:36

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 6 ¤¤¤
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpKsld8b5291b (\??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{6B79FDBD-B9D1-4DFA-ABFC-D649711AAB81}\MpKsld8b5291b.sys) -> Found
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MpKsld8b5291b (\??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{6B79FDBD-B9D1-4DFA-ABFC-D649711AAB81}\MpKsld8b5291b.sys) -> Found
[PUM.HomePage] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : http://toshiba13.msn.com/?pc=TNJB -> Found
[PUM.HomePage] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://toshiba13.msn.com/?pc=TNJB -> Found
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-1534849743-2360249728-2914029306-1001\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://toshiba13.msn.com/?pc=TNJB -> Found
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-1534849743-2360249728-2914029306-1001\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://toshiba13.msn.com/?pc=TNJB -> Found

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 1 ¤¤¤
[PUP][File] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Toshiba Start.lnk [LNK@] C:\Users\lisa\AppData\Local\Pokki\Engine\pokki.exe /OPENb52b7a05ea010d22183cece45cbb6e86cf917a76 -> Found

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: HGST HTS541075A9E680 +++++
— User —
[MBR] a84dd93b5b19931ceaddbccc47850486
[BSP] df4f83c1f72e36823a12b0dfc7617313 : Empty MBR Code
Partition table:
0 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 2048 | Size: 1024 MB
1 - [MAN-MOUNT] Basic data partition | Offset (sectors): 2099200 | Size: 260 MB
2 - [MAN-MOUNT] Basic data partition | Offset (sectors): 2631680 | Size: 128 MB
3 - Basic data partition | Offset (sectors): 2893824 | Size: 701107 MB
4 - [SYSTEM][MAN-MOUNT] | Offset (sectors): 1438760960 | Size: 450 MB
5 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 1439682560 | Size: 12434 MB
User = LL1 … OK
User = LL2 … OK

lisavvvv

Post #5August 17, 2016, 8:25 PM UTC

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 17-08-2016
Ran by [removed] (administrator) on LISASCOMPUTER (17-08-2016 16:19:28)
Running from C:\Users\[removed]\Downloads
[removed] Platform: Windows 8.1 (Update) (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\Dragon Assistant\Core\DACore.exe
() C:\Program Files (x86)\DTS, Inc\DTS Studio Sound\dts_apo_service.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Toshiba Corporation) C:\Program Files\Toshiba\Teco\TecoService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Hotkey\TCrdMain_Win8.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Teco\TecoResident.exe
() C:\Program Files\Toshiba\Hotkey\Hotkey\TCrdKBB.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Program Files (x86)\Toshiba\System Setting\TSleepSrv.exe
() C:\Program Files (x86)\Toshiba\System Setting\TODDMain.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3510 series\Bin\HPNetworkCommunicator.exe
(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA Service Station\ToshibaServiceStation.exe
(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE
(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA Service Station\TMachInfo.exe
() C:\Program Files\RogueKiller\RogueKiller64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_22_0_0_209.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_22_0_0_209.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [HotKeysCmds] => C:\windows\system32\hkcmd.exe
HKLM\…\Run: [Persistence] => C:\windows\system32\igfxpers.exe
HKLM\…\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [894048 2013-01-11] (Conexant Systems, Inc.)
HKLM\…\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\…\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2565472 2013-04-22] (TOSHIBA Corporation)
HKLM\…\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [170848 2013-01-28] (TOSHIBA Corporation)
HKLM\…\Run: [ThpSrv] => C:\windows\system32\thpsrv /logon
HKLM\…\Run: [TSleepSrv] => C:\Program Files (x86)\TOSHIBA\System Setting\TSleepSrv.exe [1549392 2013-03-04] (TOSHIBA Corporation)
HKLM\…\Run: [TODDMain] => C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] ()
HKLM\…\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161240 2016-05-21] (IvoSoft)
HKLM\…\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3050736 2013-04-05] (Synaptics Incorporated)
HKLM\…\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\…\Run: [] => [X]
HKLM-x32\…\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\…\Run: [HP Deskjet 3510 series (NET)] => C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\…\Run: [BitTorrent] => C:\Users\lisa\AppData\Roaming\BitTorrent\BitTorrent.exe [2140680 2016-08-13] (BitTorrent Inc.)
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\…\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\…\Run: [GoogleChromeAutoLaunch_9D01F335F49EFDFF400652C34E0227C8] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1152840 2016-08-02] (Google Inc.)
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-05-21] (IvoSoft)
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-05-21] (IvoSoft)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.254.254
Tcpip\..\Interfaces\{1AF619BF-12CC-461E-93BC-22751F7E5501}: [DhcpNameServer] 192.168.254.254

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com/?pc=TNJB
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com/?pc=TNJB
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com/?pc=TNJB
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://mystart.toshiba.com
SearchScopes: HKU\S-1-5-21-1534849743-2360249728-2914029306-1001 -> DefaultScope {7C65B0C5-B202-40E1-A4B2-C6F57D5CE4D9} URL =
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2016-06-23] (Microsoft Corporation)
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-05-21] (IvoSoft)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2016-06-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2016-06-23] (Microsoft Corporation)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2016-05-21] (IvoSoft)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-05-21] (IvoSoft)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2016-06-23] (Microsoft Corporation)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2016-05-21] (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-05-21] (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-05-21] (IvoSoft)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2016-06-23] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2012-06-01] (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\lisa\AppData\Roaming\Mozilla\Firefox\Profiles\y6umi16h.default
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_22_0_0_209.dll [2016-08-09] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_209.dll [2016-08-09] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-02-15] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-02-15] (Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2016-06-23] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2012-10-12] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.)
FF Extension: WOT - C:\Users\lisa\AppData\Roaming\Mozilla\Firefox\Profiles\y6umi16h.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2016-06-29]
FF Extension: Share Button for Pinterest - C:\Users\lisa\AppData\Roaming\Mozilla\Firefox\Profiles\y6umi16h.default\Extensions\{677a8f98-fd64-40b0-a883-b8c95d0cbf17}.xpi [2016-08-15]

Chrome:
=======
CHR Profile: C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-07-13]
CHR Extension: (Google Docs) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-07-13]
CHR Extension: (Google Drive) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-07-13]
CHR Extension: (YouTube) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-07-13]
CHR Extension: (Google Sheets) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-07-13]
CHR Extension: (Google Docs Offline) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-07-16]
CHR Extension: (Pinterest Save Button) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdjojdkbbmdfjfahjcgigfpmkopogic [2016-07-21]
CHR Extension: (Chrome Web Store Payments) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-07-13]
CHR Extension: (Gmail) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-07-13]
CHR Extension: (Chrome Media Router) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-08-17]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 DACoreService; C:\Program Files (x86)\Nuance\Dragon Assistant\Core\DACore.exe [432528 2013-05-02] (Nuance Communications, Inc.)
R2 dts_apo_service; C:\Program Files (x86)\DTS, Inc\DTS Studio Sound\dts_apo_service.exe [16720 2013-04-15] ()
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [29760 2016-07-04] (HP Inc.)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319888 2014-12-31] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [732160 2012-12-10] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129848 2013-02-22] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [167736 2013-02-22] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-28] ()
R2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1854056 2012-12-07] (Microsoft Corporation)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S4 THAccelSvc; C:\Program Files\TOSHIBA\HDD Accelerator\THAccelSvc.exe [216976 2013-03-26] (TOSHIBA CORPORATION)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2016-06-20] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2016-06-20] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-28] (Intel® Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\Netwew00.sys [3345376 2013-10-08] (Intel Corporation)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [288328 2013-01-23] (Realtek Semiconductor Corp.)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33008 2013-04-05] (Synaptics Incorporated)
R0 THAccel; C:\Windows\System32\DRIVERS\THAccel.sys [110976 2013-03-25] (TOSHIBA Corporation)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [28272 2016-08-17] ()
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [48024 2013-01-28] (Windows (R) Win 7 DDK provider)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44560 2016-06-20] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [270168 2016-06-20] (Microsoft Corporation)
R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2016-06-20] (Microsoft Corporation)
R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [194456 2013-01-28] (Windows (R) Win 7 DDK provider)
S1 MpKsld8b5291b; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{6B79FDBD-B9D1-4DFA-ABFC-D649711AAB81}\MpKsld8b5291b.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-17 16:19 - 2016-08-17 16:19 - 00019202 _____ C:\Users\lisa\Downloads\FRST.txt
2016-08-17 16:17 - 2016-08-17 16:17 - 02394624 _____ (Farbar) C:\Users\lisa\Downloads\FRST64.exe
2016-08-17 15:35 - 2016-08-17 15:35 - 00028272 _____ C:\WINDOWS\system32\Drivers\TrueSight.sys
2016-08-17 15:34 - 2016-08-17 15:34 - 00000881 _____ C:\Users\Public\Desktop\RogueKiller.lnk
2016-08-17 15:34 - 2016-08-17 15:34 - 00000000 ____D C:\Users\lisa\AppData\Local\CrashDumps
2016-08-17 15:34 - 2016-08-17 15:34 - 00000000 ____D C:\ProgramData\RogueKiller
2016-08-17 15:34 - 2016-08-17 15:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
2016-08-17 15:34 - 2016-08-17 15:34 - 00000000 ____D C:\Program Files\RogueKiller
2016-08-17 15:28 - 2016-08-17 15:34 - 34636056 _____ (Adlice Software ) C:\Users\lisa\Downloads\setup.exe
2016-08-17 15:16 - 2016-08-17 15:16 - 03784256 _____ C:\Users\lisa\Downloads\adwcleaner_6.000.exe
2016-08-15 21:54 - 2016-08-15 21:57 - 00000000 ____D C:\Users\lisa\Downloads\Stranger.Things.S01E02.WEBRip.x264-TURBO[ettv]
2016-08-15 20:22 - 2016-08-16 09:02 - 00000000 ____D C:\Users\lisa\AppData\Roaming\vlc
2016-08-15 19:42 - 2016-08-15 19:42 - 00001097 _____ C:\Users\Public\Desktop\VLC media player.lnk
2016-08-15 19:42 - 2016-08-15 19:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2016-08-15 19:42 - 2016-08-15 19:42 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2016-08-15 19:12 - 2016-08-15 19:15 - 30533688 _____ C:\Users\lisa\Downloads\vlc-2.2.4-win32.exe
2016-08-15 18:30 - 2016-08-15 19:09 - 00000000 ____D C:\Users\lisa\Downloads\Stranger.Things.S01E01.WEBRip.x264-TURBO[ettv]
2016-08-15 09:46 - 2016-08-15 09:47 - 14205112 _____ (HOW Inc. ) C:\Users\lisa\Downloads\FYTDSetup (3).exe
2016-08-13 10:15 - 2016-08-17 15:25 - 00000000 ____D C:\Users\lisa\AppData\LocalLow\BitTorrent
2016-08-12 15:20 - 2016-08-12 15:20 - 04337689 _____ C:\Users\lisa\Downloads\video-1471029581.mp4
2016-08-12 14:50 - 2016-08-12 14:50 - 04222057 _____ C:\Users\lisa\Downloads\video-1471027608.mp4
2016-08-10 01:16 - 2016-06-18 16:06 - 00590688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fvevol.sys
2016-08-10 01:16 - 2016-06-18 16:06 - 00072408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpfve.sys
2016-08-10 01:16 - 2016-06-11 15:52 - 00379232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2016-08-10 01:16 - 2016-06-11 15:52 - 00057184 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\stornvme.sys
2016-08-10 01:16 - 2016-06-11 14:05 - 00216576 _____ (Microsoft Corporation) C:\WINDOWS\system32\gpresult.exe
2016-08-10 01:16 - 2016-06-11 12:50 - 00987136 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2016-08-10 01:16 - 2016-06-11 12:46 - 00482304 _____ (Microsoft Corporation) C:\WINDOWS\system32\tpmvsc.dll
2016-08-10 01:16 - 2016-06-11 12:44 - 00509440 _____ (Microsoft Corporation) C:\WINDOWS\system32\webio.dll
2016-08-10 01:16 - 2016-06-11 12:37 - 00796672 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll
2016-08-10 01:16 - 2016-06-11 12:24 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2016-08-10 01:16 - 2016-06-11 12:20 - 00413184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webio.dll
2016-08-10 01:16 - 2016-06-11 12:16 - 00626176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll
2016-08-10 01:16 - 2016-06-10 23:44 - 00107984 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptsslp.dll
2016-08-10 01:16 - 2016-06-10 23:44 - 00091416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptsslp.dll
2016-08-10 01:16 - 2016-06-10 16:07 - 03820544 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2016-08-10 01:16 - 2016-06-10 16:03 - 00432128 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2016-08-10 01:16 - 2016-06-10 15:04 - 03547136 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2016-08-10 01:16 - 2016-06-10 14:11 - 06521800 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
2016-08-10 01:16 - 2016-06-10 14:11 - 01487992 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2016-08-10 01:16 - 2016-06-10 14:11 - 00261376 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll
2016-08-10 01:16 - 2016-06-10 14:11 - 00125024 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptxml.dll
2016-08-10 01:16 - 2016-06-10 14:10 - 00099136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptxml.dll
2016-08-10 01:16 - 2016-06-10 14:07 - 03273728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2016-08-10 01:16 - 2016-06-10 14:04 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2016-08-10 01:16 - 2016-06-09 15:32 - 00228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebClnt.dll
2016-08-10 01:16 - 2016-06-09 14:18 - 00199168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebClnt.dll
2016-08-10 01:16 - 2016-06-03 20:38 - 01613528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2016-08-10 01:16 - 2016-06-03 20:37 - 01970968 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2016-08-10 01:16 - 2016-05-29 03:08 - 22361344 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-08-10 01:16 - 2016-05-28 14:31 - 19788688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2016-08-10 01:16 - 2016-05-18 16:56 - 01291776 _____ (Microsoft Corporation) C:\WINDOWS\system32\certutil.exe
2016-08-10 01:16 - 2016-05-18 16:28 - 02635264 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertEnroll.dll
2016-08-10 01:16 - 2016-05-18 16:16 - 02317824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnroll.dll
2016-08-10 01:16 - 2016-05-14 16:26 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2016-08-10 01:16 - 2016-05-14 01:19 - 01134768 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2016-08-10 01:16 - 2016-05-13 19:08 - 00111616 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidclass.sys
2016-08-10 01:16 - 2016-05-13 19:08 - 00032768 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidusb.sys
2016-08-10 01:16 - 2016-05-13 18:24 - 00862720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2016-08-10 01:16 - 2016-05-13 17:42 - 03667968 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2016-08-10 01:16 - 2016-05-13 17:27 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2016-08-10 01:16 - 2016-05-13 17:26 - 02230784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2016-08-10 01:16 - 2016-05-13 17:26 - 00897024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2016-08-10 01:16 - 2016-05-13 17:16 - 00727040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2016-08-10 01:16 - 2016-05-12 14:36 - 00034600 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserAccountBroker.exe
2016-08-10 01:16 - 2016-05-12 13:39 - 00030984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserAccountBroker.exe
2016-08-10 01:16 - 2016-05-06 17:59 - 00331608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Classpnp.sys
2016-08-10 01:16 - 2016-05-06 13:13 - 00138240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dfsc.sys
2016-08-10 01:16 - 2016-05-05 14:28 - 01661072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2016-08-10 01:16 - 2016-05-05 13:39 - 01212256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2016-08-10 01:16 - 2016-05-05 13:18 - 00065024 _____ (Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe
2016-08-10 01:16 - 2016-05-05 13:02 - 03320832 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2016-08-10 01:16 - 2016-05-05 12:37 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msiexec.exe
2016-08-10 01:16 - 2016-05-05 12:29 - 03607040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2016-08-10 01:16 - 2016-04-16 09:56 - 01080320 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2016-08-10 01:16 - 2016-04-10 01:35 - 00551256 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2016-08-10 01:16 - 2016-04-09 18:15 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\system32\wfapigp.dll
2016-08-10 01:16 - 2016-04-09 18:14 - 00306176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Geolocation.dll
2016-08-10 01:16 - 2016-04-09 18:10 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2016-08-10 01:16 - 2016-04-09 18:09 - 00754176 _____ (Microsoft Corporation) C:\WINDOWS\system32\FirewallAPI.dll
2016-08-10 01:16 - 2016-04-09 18:02 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationApi.dll
2016-08-10 01:16 - 2016-04-09 17:59 - 00218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Geolocation.dll
2016-08-10 01:16 - 2016-04-09 17:56 - 00543232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FirewallAPI.dll
2016-08-10 01:16 - 2016-04-09 17:55 - 00881152 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2016-08-10 01:16 - 2016-04-09 17:52 - 00281088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LocationApi.dll
2016-08-10 01:16 - 2016-04-07 12:06 - 00927744 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll
2016-08-10 01:16 - 2016-04-06 17:21 - 00114528 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mup.sys
2016-08-10 01:16 - 2016-04-06 14:20 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2016-08-10 01:16 - 2016-04-06 14:17 - 18825216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2016-08-10 01:16 - 2016-04-06 12:25 - 15158272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2016-08-10 01:16 - 2016-04-05 18:37 - 00205824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndiswan.sys
2016-08-10 01:16 - 2016-04-02 09:58 - 00108032 _____ (Microsoft Corporation) C:\WINDOWS\system32\BdeHdCfgLib.dll
2016-08-10 01:15 - 2016-06-11 13:14 - 00192512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gpresult.exe
2016-08-10 01:15 - 2016-06-07 14:10 - 00083456 _____ (Microsoft Corporation) C:\WINDOWS\system32\hbaapi.dll
2016-08-10 01:15 - 2016-06-07 13:13 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hbaapi.dll
2016-08-10 01:15 - 2016-05-18 17:54 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\certenc.dll
2016-08-10 01:15 - 2016-05-18 17:15 - 00044032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certenc.dll
2016-08-10 01:15 - 2016-05-18 16:33 - 01060352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certutil.exe
2016-08-10 01:15 - 2016-05-13 19:08 - 00032512 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidparse.sys
2016-08-10 01:15 - 2016-05-13 17:30 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2016-08-10 01:15 - 2016-05-13 17:29 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2016-08-10 01:15 - 2016-05-13 17:27 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2016-08-10 01:15 - 2016-05-13 17:18 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2016-08-10 01:15 - 2016-05-13 17:18 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2016-08-10 01:15 - 2016-05-13 17:16 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2016-08-10 01:15 - 2016-05-05 12:34 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2016-08-10 01:15 - 2016-05-05 11:28 - 02778624 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2016-08-10 01:15 - 2016-05-05 11:16 - 02464768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2016-08-10 01:15 - 2016-04-09 17:59 - 00020480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wfapigp.dll
2016-08-10 01:15 - 2016-04-01 13:40 - 00322048 _____ (Microsoft Corporation) C:\WINDOWS\system32\fvecpl.dll
2016-08-10 01:15 - 2016-04-01 12:53 - 00348672 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdesvc.dll
2016-08-10 01:15 - 2016-04-01 12:50 - 00737280 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2016-08-10 01:15 - 2016-02-04 12:57 - 00018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\httpprxp.dll
2016-08-10 01:15 - 2016-02-04 12:49 - 00125440 _____ (Microsoft Corporation) C:\WINDOWS\system32\httpprxm.dll
2016-08-10 01:15 - 2016-02-04 12:39 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\system32\adhsvc.dll
2016-08-10 01:12 - 2016-08-02 02:54 - 25808384 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-08-10 01:12 - 2016-07-08 10:32 - 01753600 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2016-08-10 01:12 - 2016-07-08 10:25 - 01491456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2016-08-10 01:12 - 2016-07-08 10:22 - 01445376 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-08-10 01:12 - 2016-07-08 10:18 - 04169216 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2016-08-10 01:12 - 2016-07-07 18:33 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2016-08-10 01:12 - 2016-07-07 17:53 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2016-08-10 01:12 - 2016-07-07 16:06 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2016-08-10 01:12 - 2016-07-06 10:26 - 07793152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2016-08-10 01:12 - 2016-07-06 10:26 - 07075328 _____ (Microsoft Corporation) C:\WINDOWS\system32\glcndFilter.dll
2016-08-10 01:12 - 2016-07-06 10:23 - 05270016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\glcndFilter.dll
2016-08-10 01:12 - 2016-07-06 10:21 - 05265920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2016-08-10 01:12 - 2016-05-18 19:18 - 00563024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2016-08-10 01:12 - 2016-05-18 19:18 - 00397232 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2016-08-10 01:12 - 2016-05-18 19:16 - 00178016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2016-08-10 01:12 - 2016-05-18 18:28 - 00340880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2016-08-10 01:11 - 2016-08-02 02:32 - 02894336 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-08-10 01:11 - 2016-08-02 02:31 - 00572416 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2016-08-10 01:11 - 2016-08-02 02:20 - 00615936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2016-08-10 01:11 - 2016-08-02 02:18 - 06047744 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-08-10 01:11 - 2016-08-02 02:18 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2016-08-10 01:11 - 2016-08-02 01:55 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2016-08-10 01:11 - 2016-08-02 01:54 - 20343808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-08-10 01:11 - 2016-08-02 01:51 - 00497664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2016-08-10 01:11 - 2016-08-02 01:47 - 02286592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-08-10 01:11 - 2016-08-02 01:46 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2016-08-10 01:11 - 2016-08-02 01:41 - 00663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2016-08-10 01:11 - 2016-08-02 01:40 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2016-08-10 01:11 - 2016-08-02 01:39 - 00378880 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2016-08-10 01:11 - 2016-08-02 01:38 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2016-08-10 01:11 - 2016-08-02 01:38 - 00724992 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2016-08-10 01:11 - 2016-08-02 01:36 - 02131456 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2016-08-10 01:11 - 2016-08-02 01:28 - 15412224 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-08-10 01:11 - 2016-08-02 01:23 - 02868224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-08-10 01:11 - 2016-08-02 01:21 - 04608000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-08-10 01:11 - 2016-08-02 01:20 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2016-08-10 01:11 - 2016-08-02 01:15 - 00692736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2016-08-10 01:11 - 2016-08-02 01:15 - 00330752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2016-08-10 01:11 - 2016-08-02 01:14 - 02055680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2016-08-10 01:11 - 2016-08-02 01:11 - 13808128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-08-10 01:11 - 2016-08-02 01:10 - 01550848 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-08-10 01:11 - 2016-08-02 00:59 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2016-08-10 01:11 - 2016-08-02 00:56 - 02393088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-08-10 01:11 - 2016-08-02 00:53 - 01316352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-08-10 01:11 - 2016-08-02 00:51 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2016-08-10 01:10 - 2016-07-08 20:09 - 00442712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2016-08-10 01:10 - 2016-07-08 20:08 - 00332632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2016-08-10 01:10 - 2016-07-08 10:19 - 00840704 _____ (Microsoft Corporation) C:\WINDOWS\system32\netlogon.dll
2016-08-10 01:10 - 2016-07-08 10:17 - 00696832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netlogon.dll
2016-08-10 01:07 - 2016-07-12 10:08 - 00175616 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2016-08-09 17:04 - 2016-08-09 17:04 - 00000000 ____D C:\Users\lisa\AppData\Local\Macromedia
2016-08-06 14:53 - 2016-08-06 14:53 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2016-08-01 20:18 - 2016-08-12 10:14 - 00000000 ____D C:\Users\lisa\Downloads\Astrology for lovers
2016-08-01 11:28 - 2016-08-01 11:29 - 16834831 _____ C:\Users\lisa\Downloads\blog-08-01-2016.xml
2016-07-27 16:48 - 2016-07-27 16:48 - 01500438 _____ C:\Users\lisa\Downloads\KingoRoot.apk
2016-07-27 16:48 - 2016-07-27 16:48 - 00339162 _____ C:\Users\lisa\Downloads\IMG_3155(1).3gp
2016-07-27 16:48 - 2016-07-27 16:48 - 00100235 _____ C:\Users\lisa\Downloads\MOV_1947(2).3gp
2016-07-27 16:48 - 2016-07-27 16:48 - 00098020 _____ C:\Users\lisa\Downloads\MOV_6110(1).3gp
2016-07-27 16:00 - 2016-07-27 16:00 - 01555675 _____ C:\Users\lisa\Downloads\QuickCam_1469149944992(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 01524059 _____ C:\Users\lisa\Downloads\QuickCam_1469146931104(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 01460013 _____ C:\Users\lisa\Downloads\QuickCam_1469150351247(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 01310407 _____ C:\Users\lisa\Downloads\QuickCam_1469149138677(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 01300086 _____ C:\Users\lisa\Downloads\QuickCam_1469146323829(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00925942 _____ C:\Users\lisa\Downloads\QuickCam_1469583005771(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00865049 _____ C:\Users\lisa\Downloads\QuickCam_1469582316237(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00792216 _____ C:\Users\lisa\Downloads\QuickCam_1469147171539(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00700849 _____ C:\Users\lisa\Downloads\QuickCam_1469149345732(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00680240 _____ C:\Users\lisa\Downloads\QuickCam_1469147029437(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00669743 _____ C:\Users\lisa\Downloads\QuickCam_1469582275506(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00619124 _____ C:\Users\lisa\Downloads\QuickCam_1469582950245(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00352489 _____ C:\Users\lisa\Downloads\QuickCam_1469150052159(1).mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01555675 _____ C:\Users\lisa\Downloads\QuickCam_1469149944992.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01524059 _____ C:\Users\lisa\Downloads\QuickCam_1469146931104.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01460013 _____ C:\Users\lisa\Downloads\QuickCam_1469150351247.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01310407 _____ C:\Users\lisa\Downloads\QuickCam_1469149138677.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01300086 _____ C:\Users\lisa\Downloads\QuickCam_1469146323829.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00925942 _____ C:\Users\lisa\Downloads\QuickCam_1469583005771.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00865049 _____ C:\Users\lisa\Downloads\QuickCam_1469582316237.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00792216 _____ C:\Users\lisa\Downloads\QuickCam_1469147171539.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00700849 _____ C:\Users\lisa\Downloads\QuickCam_1469149345732.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00680240 _____ C:\Users\lisa\Downloads\QuickCam_1469147029437.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00669743 _____ C:\Users\lisa\Downloads\QuickCam_1469582275506.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00619124 _____ C:\Users\lisa\Downloads\QuickCam_1469582950245.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00352489 _____ C:\Users\lisa\Downloads\QuickCam_1469150052159.mp4
2016-07-25 11:55 - 2016-07-25 11:55 - 00000000 ___SD C:\Users\lisa\Documents\My Data Sources
2016-07-20 06:31 - 2016-07-20 06:31 - 00000000 ____D C:\WINDOWS\EOONotify

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-17 16:19 - 2015-05-19 12:57 - 00000000 ____D C:\FRST
2016-08-17 16:13 - 2016-06-19 06:54 - 00000000 ____D C:\Users\lisa\AppData\Local\ClassicShell
2016-08-17 15:40 - 2016-06-19 06:01 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1534849743-2360249728-2914029306-1001
2016-08-17 15:37 - 2016-06-23 20:20 - 00004990 _____ C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for LISASCOMPUTER-lisa LisasComputer
2016-08-17 15:30 - 2016-07-04 09:57 - 00000000 ____D C:\Users\lisa\AppData\Roaming\BitTorrent
2016-08-17 15:28 - 2016-07-13 17:11 - 00000934 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2016-08-17 15:24 - 2016-07-13 17:11 - 00000930 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2016-08-17 15:24 - 2016-06-20 21:46 - 00000000 __RDO C:\Users\lisa\OneDrive
2016-08-17 15:24 - 2016-06-20 21:43 - 00000000 __SHD C:\Users\lisa\IntelGraphicsProfiles
2016-08-17 15:23 - 2013-08-22 10:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-08-17 15:22 - 2013-08-22 09:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2016-08-17 15:21 - 2015-05-19 19:22 - 00000000 ____D C:\AdwCleaner
2016-08-17 13:43 - 2016-07-13 16:36 - 00003942 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{A0ACBCB3-23B6-4FE2-92CB-7E0E8DA1AEF0}
2016-08-17 08:47 - 2012-07-26 03:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-08-17 00:14 - 2014-03-07 15:25 - 117961216 ___SH C:\Users\lisa\Downloads\Thumbs.db
2016-08-15 14:11 - 2014-11-21 04:44 - 00863592 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-08-15 14:11 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\Inf
2016-08-13 08:04 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\rescache
2016-08-12 10:12 - 2013-08-22 10:44 - 05133264 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-08-12 10:07 - 2013-08-22 11:36 - 00000000 ___RD C:\WINDOWS\ToastData
2016-08-12 10:07 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\system32\SecureBootUpdates
2016-08-10 05:13 - 2013-08-22 11:36 - 00000000 ___HD C:\Program Files\WindowsApps
2016-08-10 05:13 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-08-10 05:09 - 2016-06-19 08:02 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-08-10 05:03 - 2016-06-19 08:02 - 147640136 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-08-09 17:04 - 2016-06-19 06:11 - 00000000 ____D C:\Users\lisa\AppData\Local\Adobe
2016-08-09 16:49 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2016-08-09 16:49 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\system32\Macromed
2016-08-07 21:30 - 2016-06-19 05:53 - 00000000 ____D C:\Users\lisa\AppData\Local\Packages
2016-08-04 18:29 - 2016-07-13 17:14 - 00002226 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-08-04 18:29 - 2016-07-13 17:14 - 00002214 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-08-01 16:18 - 2016-07-03 15:33 - 00003072 ____H C:\Users\lisa\Desktop\photothumb.db
2016-07-28 19:23 - 2016-07-13 17:11 - 00003906 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2016-07-28 19:23 - 2016-07-13 17:11 - 00003670 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2016-07-27 15:25 - 2016-06-20 10:40 - 00504488 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2016-07-25 19:44 - 2016-06-20 18:29 - 00000000 ____D C:\Users\lisa
2016-07-20 06:34 - 2016-06-24 00:12 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX
2016-07-20 06:34 - 2016-06-24 00:12 - 00000000 ___SD C:\WINDOWS\system32\GWX
2016-07-19 09:03 - 2014-08-31 21:31 - 00113152 ___SH C:\Users\lisa\Desktop\Thumbs.db

==================== Files in the root of some directories =======

2016-07-08 11:23 - 2016-07-13 14:19 - 0000132 _____ () C:\Users\lisa\AppData\Roaming\Adobe PNG Format CS6 Prefs
2016-06-25 18:43 - 2016-06-25 18:43 - 0000057 _____ () C:\ProgramData\Ament.ini
2016-07-03 14:33 - 2016-07-03 14:33 - 0000016 _____ () C:\ProgramData\mntemp
2016-07-03 14:33 - 2016-07-03 14:33 - 0004864 _____ () C:\ProgramData\oqztiqep.adk

Some files in TEMP:
====================
C:\Users\lisa\AppData\Local\Temp\dllnt_dump.dll
C:\Users\lisa\AppData\Local\Temp\libeay32.dll
C:\Users\lisa\AppData\Local\Temp\msvcr120.dll
C:\Users\lisa\AppData\Local\Temp\OfficeSetup.exe
C:\Users\lisa\AppData\Local\Temp\SetupO365HomePremRetail.x86.en-US_O365HomePremRetail_4VB9X-YNMP2-33RMG-F8788-Q67JR_act_1_.exe
C:\Users\lisa\AppData\Local\Temp\sqlite3.dll

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-08-11 03:57

==================== End of FRST.txt ============================Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 17-08-2016
Ran by [removed] (administrator) on LISASCOMPUTER (17-08-2016 16:19:28)
Running from C:\Users\[removed]\Downloads
[removed] Platform: Windows 8.1 (Update) (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\Dragon Assistant\Core\DACore.exe
() C:\Program Files (x86)\DTS, Inc\DTS Studio Sound\dts_apo_service.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Toshiba Corporation) C:\Program Files\Toshiba\Teco\TecoService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Hotkey\TCrdMain_Win8.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Teco\TecoResident.exe
() C:\Program Files\Toshiba\Hotkey\Hotkey\TCrdKBB.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Program Files (x86)\Toshiba\System Setting\TSleepSrv.exe
() C:\Program Files (x86)\Toshiba\System Setting\TODDMain.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3510 series\Bin\HPNetworkCommunicator.exe
(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA Service Station\ToshibaServiceStation.exe
(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE
(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA Service Station\TMachInfo.exe
() C:\Program Files\RogueKiller\RogueKiller64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_22_0_0_209.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_22_0_0_209.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [HotKeysCmds] => C:\windows\system32\hkcmd.exe
HKLM\…\Run: [Persistence] => C:\windows\system32\igfxpers.exe
HKLM\…\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [894048 2013-01-11] (Conexant Systems, Inc.)
HKLM\…\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\…\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2565472 2013-04-22] (TOSHIBA Corporation)
HKLM\…\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [170848 2013-01-28] (TOSHIBA Corporation)
HKLM\…\Run: [ThpSrv] => C:\windows\system32\thpsrv /logon
HKLM\…\Run: [TSleepSrv] => C:\Program Files (x86)\TOSHIBA\System Setting\TSleepSrv.exe [1549392 2013-03-04] (TOSHIBA Corporation)
HKLM\…\Run: [TODDMain] => C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] ()
HKLM\…\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161240 2016-05-21] (IvoSoft)
HKLM\…\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3050736 2013-04-05] (Synaptics Incorporated)
HKLM\…\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\…\Run: [] => [X]
HKLM-x32\…\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\…\Run: [HP Deskjet 3510 series (NET)] => C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\…\Run: [BitTorrent] => C:\Users\lisa\AppData\Roaming\BitTorrent\BitTorrent.exe [2140680 2016-08-13] (BitTorrent Inc.)
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\…\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\…\Run: [GoogleChromeAutoLaunch_9D01F335F49EFDFF400652C34E0227C8] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1152840 2016-08-02] (Google Inc.)
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-05-21] (IvoSoft)
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-05-21] (IvoSoft)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.254.254
Tcpip\..\Interfaces\{1AF619BF-12CC-461E-93BC-22751F7E5501}: [DhcpNameServer] 192.168.254.254

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com/?pc=TNJB
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com/?pc=TNJB
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com/?pc=TNJB
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://mystart.toshiba.com
SearchScopes: HKU\S-1-5-21-1534849743-2360249728-2914029306-1001 -> DefaultScope {7C65B0C5-B202-40E1-A4B2-C6F57D5CE4D9} URL =
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2016-06-23] (Microsoft Corporation)
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-05-21] (IvoSoft)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2016-06-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2016-06-23] (Microsoft Corporation)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2016-05-21] (IvoSoft)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-05-21] (IvoSoft)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2016-06-23] (Microsoft Corporation)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2016-05-21] (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-05-21] (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-05-21] (IvoSoft)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2016-06-23] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2012-06-01] (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\lisa\AppData\Roaming\Mozilla\Firefox\Profiles\y6umi16h.default
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_22_0_0_209.dll [2016-08-09] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_209.dll [2016-08-09] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-02-15] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-02-15] (Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2016-06-23] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2012-10-12] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.)
FF Extension: WOT - C:\Users\lisa\AppData\Roaming\Mozilla\Firefox\Profiles\y6umi16h.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2016-06-29]
FF Extension: Share Button for Pinterest - C:\Users\lisa\AppData\Roaming\Mozilla\Firefox\Profiles\y6umi16h.default\Extensions\{677a8f98-fd64-40b0-a883-b8c95d0cbf17}.xpi [2016-08-15]

Chrome:
=======
CHR Profile: C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-07-13]
CHR Extension: (Google Docs) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-07-13]
CHR Extension: (Google Drive) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-07-13]
CHR Extension: (YouTube) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-07-13]
CHR Extension: (Google Sheets) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-07-13]
CHR Extension: (Google Docs Offline) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-07-16]
CHR Extension: (Pinterest Save Button) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdjojdkbbmdfjfahjcgigfpmkopogic [2016-07-21]
CHR Extension: (Chrome Web Store Payments) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-07-13]
CHR Extension: (Gmail) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-07-13]
CHR Extension: (Chrome Media Router) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-08-17]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 DACoreService; C:\Program Files (x86)\Nuance\Dragon Assistant\Core\DACore.exe [432528 2013-05-02] (Nuance Communications, Inc.)
R2 dts_apo_service; C:\Program Files (x86)\DTS, Inc\DTS Studio Sound\dts_apo_service.exe [16720 2013-04-15] ()
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [29760 2016-07-04] (HP Inc.)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319888 2014-12-31] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [732160 2012-12-10] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129848 2013-02-22] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [167736 2013-02-22] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-28] ()
R2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1854056 2012-12-07] (Microsoft Corporation)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S4 THAccelSvc; C:\Program Files\TOSHIBA\HDD Accelerator\THAccelSvc.exe [216976 2013-03-26] (TOSHIBA CORPORATION)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2016-06-20] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2016-06-20] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-28] (Intel® Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\Netwew00.sys [3345376 2013-10-08] (Intel Corporation)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [288328 2013-01-23] (Realtek Semiconductor Corp.)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33008 2013-04-05] (Synaptics Incorporated)
R0 THAccel; C:\Windows\System32\DRIVERS\THAccel.sys [110976 2013-03-25] (TOSHIBA Corporation)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [28272 2016-08-17] ()
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [48024 2013-01-28] (Windows (R) Win 7 DDK provider)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44560 2016-06-20] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [270168 2016-06-20] (Microsoft Corporation)
R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2016-06-20] (Microsoft Corporation)
R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [194456 2013-01-28] (Windows (R) Win 7 DDK provider)
S1 MpKsld8b5291b; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{6B79FDBD-B9D1-4DFA-ABFC-D649711AAB81}\MpKsld8b5291b.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-17 16:19 - 2016-08-17 16:19 - 00019202 _____ C:\Users\lisa\Downloads\FRST.txt
2016-08-17 16:17 - 2016-08-17 16:17 - 02394624 _____ (Farbar) C:\Users\lisa\Downloads\FRST64.exe
2016-08-17 15:35 - 2016-08-17 15:35 - 00028272 _____ C:\WINDOWS\system32\Drivers\TrueSight.sys
2016-08-17 15:34 - 2016-08-17 15:34 - 00000881 _____ C:\Users\Public\Desktop\RogueKiller.lnk
2016-08-17 15:34 - 2016-08-17 15:34 - 00000000 ____D C:\Users\lisa\AppData\Local\CrashDumps
2016-08-17 15:34 - 2016-08-17 15:34 - 00000000 ____D C:\ProgramData\RogueKiller
2016-08-17 15:34 - 2016-08-17 15:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
2016-08-17 15:34 - 2016-08-17 15:34 - 00000000 ____D C:\Program Files\RogueKiller
2016-08-17 15:28 - 2016-08-17 15:34 - 34636056 _____ (Adlice Software ) C:\Users\lisa\Downloads\setup.exe
2016-08-17 15:16 - 2016-08-17 15:16 - 03784256 _____ C:\Users\lisa\Downloads\adwcleaner_6.000.exe
2016-08-15 21:54 - 2016-08-15 21:57 - 00000000 ____D C:\Users\lisa\Downloads\Stranger.Things.S01E02.WEBRip.x264-TURBO[ettv]
2016-08-15 20:22 - 2016-08-16 09:02 - 00000000 ____D C:\Users\lisa\AppData\Roaming\vlc
2016-08-15 19:42 - 2016-08-15 19:42 - 00001097 _____ C:\Users\Public\Desktop\VLC media player.lnk
2016-08-15 19:42 - 2016-08-15 19:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2016-08-15 19:42 - 2016-08-15 19:42 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2016-08-15 19:12 - 2016-08-15 19:15 - 30533688 _____ C:\Users\lisa\Downloads\vlc-2.2.4-win32.exe
2016-08-15 18:30 - 2016-08-15 19:09 - 00000000 ____D C:\Users\lisa\Downloads\Stranger.Things.S01E01.WEBRip.x264-TURBO[ettv]
2016-08-15 09:46 - 2016-08-15 09:47 - 14205112 _____ (HOW Inc. ) C:\Users\lisa\Downloads\FYTDSetup (3).exe
2016-08-13 10:15 - 2016-08-17 15:25 - 00000000 ____D C:\Users\lisa\AppData\LocalLow\BitTorrent
2016-08-12 15:20 - 2016-08-12 15:20 - 04337689 _____ C:\Users\lisa\Downloads\video-1471029581.mp4
2016-08-12 14:50 - 2016-08-12 14:50 - 04222057 _____ C:\Users\lisa\Downloads\video-1471027608.mp4
2016-08-10 01:16 - 2016-06-18 16:06 - 00590688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fvevol.sys
2016-08-10 01:16 - 2016-06-18 16:06 - 00072408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpfve.sys
2016-08-10 01:16 - 2016-06-11 15:52 - 00379232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2016-08-10 01:16 - 2016-06-11 15:52 - 00057184 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\stornvme.sys
2016-08-10 01:16 - 2016-06-11 14:05 - 00216576 _____ (Microsoft Corporation) C:\WINDOWS\system32\gpresult.exe
2016-08-10 01:16 - 2016-06-11 12:50 - 00987136 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2016-08-10 01:16 - 2016-06-11 12:46 - 00482304 _____ (Microsoft Corporation) C:\WINDOWS\system32\tpmvsc.dll
2016-08-10 01:16 - 2016-06-11 12:44 - 00509440 _____ (Microsoft Corporation) C:\WINDOWS\system32\webio.dll
2016-08-10 01:16 - 2016-06-11 12:37 - 00796672 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll
2016-08-10 01:16 - 2016-06-11 12:24 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2016-08-10 01:16 - 2016-06-11 12:20 - 00413184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webio.dll
2016-08-10 01:16 - 2016-06-11 12:16 - 00626176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll
2016-08-10 01:16 - 2016-06-10 23:44 - 00107984 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptsslp.dll
2016-08-10 01:16 - 2016-06-10 23:44 - 00091416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptsslp.dll
2016-08-10 01:16 - 2016-06-10 16:07 - 03820544 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2016-08-10 01:16 - 2016-06-10 16:03 - 00432128 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2016-08-10 01:16 - 2016-06-10 15:04 - 03547136 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2016-08-10 01:16 - 2016-06-10 14:11 - 06521800 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
2016-08-10 01:16 - 2016-06-10 14:11 - 01487992 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2016-08-10 01:16 - 2016-06-10 14:11 - 00261376 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll
2016-08-10 01:16 - 2016-06-10 14:11 - 00125024 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptxml.dll
2016-08-10 01:16 - 2016-06-10 14:10 - 00099136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptxml.dll
2016-08-10 01:16 - 2016-06-10 14:07 - 03273728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2016-08-10 01:16 - 2016-06-10 14:04 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2016-08-10 01:16 - 2016-06-09 15:32 - 00228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebClnt.dll
2016-08-10 01:16 - 2016-06-09 14:18 - 00199168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebClnt.dll
2016-08-10 01:16 - 2016-06-03 20:38 - 01613528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2016-08-10 01:16 - 2016-06-03 20:37 - 01970968 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2016-08-10 01:16 - 2016-05-29 03:08 - 22361344 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-08-10 01:16 - 2016-05-28 14:31 - 19788688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2016-08-10 01:16 - 2016-05-18 16:56 - 01291776 _____ (Microsoft Corporation) C:\WINDOWS\system32\certutil.exe
2016-08-10 01:16 - 2016-05-18 16:28 - 02635264 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertEnroll.dll
2016-08-10 01:16 - 2016-05-18 16:16 - 02317824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnroll.dll
2016-08-10 01:16 - 2016-05-14 16:26 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2016-08-10 01:16 - 2016-05-14 01:19 - 01134768 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2016-08-10 01:16 - 2016-05-13 19:08 - 00111616 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidclass.sys
2016-08-10 01:16 - 2016-05-13 19:08 - 00032768 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidusb.sys
2016-08-10 01:16 - 2016-05-13 18:24 - 00862720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2016-08-10 01:16 - 2016-05-13 17:42 - 03667968 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2016-08-10 01:16 - 2016-05-13 17:27 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2016-08-10 01:16 - 2016-05-13 17:26 - 02230784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2016-08-10 01:16 - 2016-05-13 17:26 - 00897024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2016-08-10 01:16 - 2016-05-13 17:16 - 00727040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2016-08-10 01:16 - 2016-05-12 14:36 - 00034600 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserAccountBroker.exe
2016-08-10 01:16 - 2016-05-12 13:39 - 00030984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserAccountBroker.exe
2016-08-10 01:16 - 2016-05-06 17:59 - 00331608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Classpnp.sys
2016-08-10 01:16 - 2016-05-06 13:13 - 00138240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dfsc.sys
2016-08-10 01:16 - 2016-05-05 14:28 - 01661072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2016-08-10 01:16 - 2016-05-05 13:39 - 01212256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2016-08-10 01:16 - 2016-05-05 13:18 - 00065024 _____ (Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe
2016-08-10 01:16 - 2016-05-05 13:02 - 03320832 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2016-08-10 01:16 - 2016-05-05 12:37 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msiexec.exe
2016-08-10 01:16 - 2016-05-05 12:29 - 03607040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2016-08-10 01:16 - 2016-04-16 09:56 - 01080320 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2016-08-10 01:16 - 2016-04-10 01:35 - 00551256 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2016-08-10 01:16 - 2016-04-09 18:15 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\system32\wfapigp.dll
2016-08-10 01:16 - 2016-04-09 18:14 - 00306176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Geolocation.dll
2016-08-10 01:16 - 2016-04-09 18:10 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2016-08-10 01:16 - 2016-04-09 18:09 - 00754176 _____ (Microsoft Corporation) C:\WINDOWS\system32\FirewallAPI.dll
2016-08-10 01:16 - 2016-04-09 18:02 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationApi.dll
2016-08-10 01:16 - 2016-04-09 17:59 - 00218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Geolocation.dll
2016-08-10 01:16 - 2016-04-09 17:56 - 00543232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FirewallAPI.dll
2016-08-10 01:16 - 2016-04-09 17:55 - 00881152 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2016-08-10 01:16 - 2016-04-09 17:52 - 00281088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LocationApi.dll
2016-08-10 01:16 - 2016-04-07 12:06 - 00927744 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll
2016-08-10 01:16 - 2016-04-06 17:21 - 00114528 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mup.sys
2016-08-10 01:16 - 2016-04-06 14:20 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2016-08-10 01:16 - 2016-04-06 14:17 - 18825216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2016-08-10 01:16 - 2016-04-06 12:25 - 15158272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2016-08-10 01:16 - 2016-04-05 18:37 - 00205824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndiswan.sys
2016-08-10 01:16 - 2016-04-02 09:58 - 00108032 _____ (Microsoft Corporation) C:\WINDOWS\system32\BdeHdCfgLib.dll
2016-08-10 01:15 - 2016-06-11 13:14 - 00192512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gpresult.exe
2016-08-10 01:15 - 2016-06-07 14:10 - 00083456 _____ (Microsoft Corporation) C:\WINDOWS\system32\hbaapi.dll
2016-08-10 01:15 - 2016-06-07 13:13 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hbaapi.dll
2016-08-10 01:15 - 2016-05-18 17:54 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\certenc.dll
2016-08-10 01:15 - 2016-05-18 17:15 - 00044032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certenc.dll
2016-08-10 01:15 - 2016-05-18 16:33 - 01060352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certutil.exe
2016-08-10 01:15 - 2016-05-13 19:08 - 00032512 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidparse.sys
2016-08-10 01:15 - 2016-05-13 17:30 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2016-08-10 01:15 - 2016-05-13 17:29 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2016-08-10 01:15 - 2016-05-13 17:27 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2016-08-10 01:15 - 2016-05-13 17:18 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2016-08-10 01:15 - 2016-05-13 17:18 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2016-08-10 01:15 - 2016-05-13 17:16 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2016-08-10 01:15 - 2016-05-05 12:34 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2016-08-10 01:15 - 2016-05-05 11:28 - 02778624 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2016-08-10 01:15 - 2016-05-05 11:16 - 02464768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2016-08-10 01:15 - 2016-04-09 17:59 - 00020480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wfapigp.dll
2016-08-10 01:15 - 2016-04-01 13:40 - 00322048 _____ (Microsoft Corporation) C:\WINDOWS\system32\fvecpl.dll
2016-08-10 01:15 - 2016-04-01 12:53 - 00348672 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdesvc.dll
2016-08-10 01:15 - 2016-04-01 12:50 - 00737280 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2016-08-10 01:15 - 2016-02-04 12:57 - 00018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\httpprxp.dll
2016-08-10 01:15 - 2016-02-04 12:49 - 00125440 _____ (Microsoft Corporation) C:\WINDOWS\system32\httpprxm.dll
2016-08-10 01:15 - 2016-02-04 12:39 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\system32\adhsvc.dll
2016-08-10 01:12 - 2016-08-02 02:54 - 25808384 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-08-10 01:12 - 2016-07-08 10:32 - 01753600 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2016-08-10 01:12 - 2016-07-08 10:25 - 01491456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2016-08-10 01:12 - 2016-07-08 10:22 - 01445376 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-08-10 01:12 - 2016-07-08 10:18 - 04169216 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2016-08-10 01:12 - 2016-07-07 18:33 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2016-08-10 01:12 - 2016-07-07 17:53 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2016-08-10 01:12 - 2016-07-07 16:06 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2016-08-10 01:12 - 2016-07-06 10:26 - 07793152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2016-08-10 01:12 - 2016-07-06 10:26 - 07075328 _____ (Microsoft Corporation) C:\WINDOWS\system32\glcndFilter.dll
2016-08-10 01:12 - 2016-07-06 10:23 - 05270016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\glcndFilter.dll
2016-08-10 01:12 - 2016-07-06 10:21 - 05265920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2016-08-10 01:12 - 2016-05-18 19:18 - 00563024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2016-08-10 01:12 - 2016-05-18 19:18 - 00397232 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2016-08-10 01:12 - 2016-05-18 19:16 - 00178016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2016-08-10 01:12 - 2016-05-18 18:28 - 00340880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2016-08-10 01:11 - 2016-08-02 02:32 - 02894336 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-08-10 01:11 - 2016-08-02 02:31 - 00572416 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2016-08-10 01:11 - 2016-08-02 02:20 - 00615936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2016-08-10 01:11 - 2016-08-02 02:18 - 06047744 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-08-10 01:11 - 2016-08-02 02:18 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2016-08-10 01:11 - 2016-08-02 01:55 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2016-08-10 01:11 - 2016-08-02 01:54 - 20343808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-08-10 01:11 - 2016-08-02 01:51 - 00497664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2016-08-10 01:11 - 2016-08-02 01:47 - 02286592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-08-10 01:11 - 2016-08-02 01:46 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2016-08-10 01:11 - 2016-08-02 01:41 - 00663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2016-08-10 01:11 - 2016-08-02 01:40 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2016-08-10 01:11 - 2016-08-02 01:39 - 00378880 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2016-08-10 01:11 - 2016-08-02 01:38 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2016-08-10 01:11 - 2016-08-02 01:38 - 00724992 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2016-08-10 01:11 - 2016-08-02 01:36 - 02131456 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2016-08-10 01:11 - 2016-08-02 01:28 - 15412224 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-08-10 01:11 - 2016-08-02 01:23 - 02868224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-08-10 01:11 - 2016-08-02 01:21 - 04608000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-08-10 01:11 - 2016-08-02 01:20 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2016-08-10 01:11 - 2016-08-02 01:15 - 00692736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2016-08-10 01:11 - 2016-08-02 01:15 - 00330752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2016-08-10 01:11 - 2016-08-02 01:14 - 02055680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2016-08-10 01:11 - 2016-08-02 01:11 - 13808128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-08-10 01:11 - 2016-08-02 01:10 - 01550848 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-08-10 01:11 - 2016-08-02 00:59 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2016-08-10 01:11 - 2016-08-02 00:56 - 02393088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-08-10 01:11 - 2016-08-02 00:53 - 01316352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-08-10 01:11 - 2016-08-02 00:51 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2016-08-10 01:10 - 2016-07-08 20:09 - 00442712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2016-08-10 01:10 - 2016-07-08 20:08 - 00332632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2016-08-10 01:10 - 2016-07-08 10:19 - 00840704 _____ (Microsoft Corporation) C:\WINDOWS\system32\netlogon.dll
2016-08-10 01:10 - 2016-07-08 10:17 - 00696832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netlogon.dll
2016-08-10 01:07 - 2016-07-12 10:08 - 00175616 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2016-08-09 17:04 - 2016-08-09 17:04 - 00000000 ____D C:\Users\lisa\AppData\Local\Macromedia
2016-08-06 14:53 - 2016-08-06 14:53 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2016-08-01 20:18 - 2016-08-12 10:14 - 00000000 ____D C:\Users\lisa\Downloads\Astrology for lovers
2016-08-01 11:28 - 2016-08-01 11:29 - 16834831 _____ C:\Users\lisa\Downloads\blog-08-01-2016.xml
2016-07-27 16:48 - 2016-07-27 16:48 - 01500438 _____ C:\Users\lisa\Downloads\KingoRoot.apk
2016-07-27 16:48 - 2016-07-27 16:48 - 00339162 _____ C:\Users\lisa\Downloads\IMG_3155(1).3gp
2016-07-27 16:48 - 2016-07-27 16:48 - 00100235 _____ C:\Users\lisa\Downloads\MOV_1947(2).3gp
2016-07-27 16:48 - 2016-07-27 16:48 - 00098020 _____ C:\Users\lisa\Downloads\MOV_6110(1).3gp
2016-07-27 16:00 - 2016-07-27 16:00 - 01555675 _____ C:\Users\lisa\Downloads\QuickCam_1469149944992(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 01524059 _____ C:\Users\lisa\Downloads\QuickCam_1469146931104(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 01460013 _____ C:\Users\lisa\Downloads\QuickCam_1469150351247(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 01310407 _____ C:\Users\lisa\Downloads\QuickCam_1469149138677(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 01300086 _____ C:\Users\lisa\Downloads\QuickCam_1469146323829(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00925942 _____ C:\Users\lisa\Downloads\QuickCam_1469583005771(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00865049 _____ C:\Users\lisa\Downloads\QuickCam_1469582316237(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00792216 _____ C:\Users\lisa\Downloads\QuickCam_1469147171539(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00700849 _____ C:\Users\lisa\Downloads\QuickCam_1469149345732(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00680240 _____ C:\Users\lisa\Downloads\QuickCam_1469147029437(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00669743 _____ C:\Users\lisa\Downloads\QuickCam_1469582275506(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00619124 _____ C:\Users\lisa\Downloads\QuickCam_1469582950245(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00352489 _____ C:\Users\lisa\Downloads\QuickCam_1469150052159(1).mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01555675 _____ C:\Users\lisa\Downloads\QuickCam_1469149944992.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01524059 _____ C:\Users\lisa\Downloads\QuickCam_1469146931104.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01460013 _____ C:\Users\lisa\Downloads\QuickCam_1469150351247.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01310407 _____ C:\Users\lisa\Downloads\QuickCam_1469149138677.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01300086 _____ C:\Users\lisa\Downloads\QuickCam_1469146323829.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00925942 _____ C:\Users\lisa\Downloads\QuickCam_1469583005771.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00865049 _____ C:\Users\lisa\Downloads\QuickCam_1469582316237.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00792216 _____ C:\Users\lisa\Downloads\QuickCam_1469147171539.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00700849 _____ C:\Users\lisa\Downloads\QuickCam_1469149345732.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00680240 _____ C:\Users\lisa\Downloads\QuickCam_1469147029437.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00669743 _____ C:\Users\lisa\Downloads\QuickCam_1469582275506.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00619124 _____ C:\Users\lisa\Downloads\QuickCam_1469582950245.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00352489 _____ C:\Users\lisa\Downloads\QuickCam_1469150052159.mp4
2016-07-25 11:55 - 2016-07-25 11:55 - 00000000 ___SD C:\Users\lisa\Documents\My Data Sources
2016-07-20 06:31 - 2016-07-20 06:31 - 00000000 ____D C:\WINDOWS\EOONotify

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-17 16:19 - 2015-05-19 12:57 - 00000000 ____D C:\FRST
2016-08-17 16:13 - 2016-06-19 06:54 - 00000000 ____D C:\Users\lisa\AppData\Local\ClassicShell
2016-08-17 15:40 - 2016-06-19 06:01 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1534849743-2360249728-2914029306-1001
2016-08-17 15:37 - 2016-06-23 20:20 - 00004990 _____ C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for LISASCOMPUTER-lisa LisasComputer
2016-08-17 15:30 - 2016-07-04 09:57 - 00000000 ____D C:\Users\lisa\AppData\Roaming\BitTorrent
2016-08-17 15:28 - 2016-07-13 17:11 - 00000934 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2016-08-17 15:24 - 2016-07-13 17:11 - 00000930 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2016-08-17 15:24 - 2016-06-20 21:46 - 00000000 __RDO C:\Users\lisa\OneDrive
2016-08-17 15:24 - 2016-06-20 21:43 - 00000000 __SHD C:\Users\lisa\IntelGraphicsProfiles
2016-08-17 15:23 - 2013-08-22 10:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-08-17 15:22 - 2013-08-22 09:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2016-08-17 15:21 - 2015-05-19 19:22 - 00000000 ____D C:\AdwCleaner
2016-08-17 13:43 - 2016-07-13 16:36 - 00003942 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{A0ACBCB3-23B6-4FE2-92CB-7E0E8DA1AEF0}
2016-08-17 08:47 - 2012-07-26 03:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-08-17 00:14 - 2014-03-07 15:25 - 117961216 ___SH C:\Users\lisa\Downloads\Thumbs.db
2016-08-15 14:11 - 2014-11-21 04:44 - 00863592 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-08-15 14:11 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\Inf
2016-08-13 08:04 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\rescache
2016-08-12 10:12 - 2013-08-22 10:44 - 05133264 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-08-12 10:07 - 2013-08-22 11:36 - 00000000 ___RD C:\WINDOWS\ToastData
2016-08-12 10:07 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\system32\SecureBootUpdates
2016-08-10 05:13 - 2013-08-22 11:36 - 00000000 ___HD C:\Program Files\WindowsApps
2016-08-10 05:13 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-08-10 05:09 - 2016-06-19 08:02 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-08-10 05:03 - 2016-06-19 08:02 - 147640136 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-08-09 17:04 - 2016-06-19 06:11 - 00000000 ____D C:\Users\lisa\AppData\Local\Adobe
2016-08-09 16:49 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2016-08-09 16:49 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\system32\Macromed
2016-08-07 21:30 - 2016-06-19 05:53 - 00000000 ____D C:\Users\lisa\AppData\Local\Packages
2016-08-04 18:29 - 2016-07-13 17:14 - 00002226 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-08-04 18:29 - 2016-07-13 17:14 - 00002214 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-08-01 16:18 - 2016-07-03 15:33 - 00003072 ____H C:\Users\lisa\Desktop\photothumb.db
2016-07-28 19:23 - 2016-07-13 17:11 - 00003906 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2016-07-28 19:23 - 2016-07-13 17:11 - 00003670 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2016-07-27 15:25 - 2016-06-20 10:40 - 00504488 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2016-07-25 19:44 - 2016-06-20 18:29 - 00000000 ____D C:\Users\lisa
2016-07-20 06:34 - 2016-06-24 00:12 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX
2016-07-20 06:34 - 2016-06-24 00:12 - 00000000 ___SD C:\WINDOWS\system32\GWX
2016-07-19 09:03 - 2014-08-31 21:31 - 00113152 ___SH C:\Users\lisa\Desktop\Thumbs.db

==================== Files in the root of some directories =======

2016-07-08 11:23 - 2016-07-13 14:19 - 0000132 _____ () C:\Users\lisa\AppData\Roaming\Adobe PNG Format CS6 Prefs
2016-06-25 18:43 - 2016-06-25 18:43 - 0000057 _____ () C:\ProgramData\Ament.ini
2016-07-03 14:33 - 2016-07-03 14:33 - 0000016 _____ () C:\ProgramData\mntemp
2016-07-03 14:33 - 2016-07-03 14:33 - 0004864 _____ () C:\ProgramData\oqztiqep.adk

Some files in TEMP:
====================
C:\Users\lisa\AppData\Local\Temp\dllnt_dump.dll
C:\Users\lisa\AppData\Local\Temp\libeay32.dll
C:\Users\lisa\AppData\Local\Temp\msvcr120.dll
C:\Users\lisa\AppData\Local\Temp\OfficeSetup.exe
C:\Users\lisa\AppData\Local\Temp\SetupO365HomePremRetail.x86.en-US_O365HomePremRetail_4VB9X-YNMP2-33RMG-F8788-Q67JR_act_1_.exe
C:\Users\lisa\AppData\Local\Temp\sqlite3.dll

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-08-11 03:57

==================== End of FRST.txt ============================Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 17-08-2016
Ran by [removed] (administrator) on LISASCOMPUTER (17-08-2016 16:19:28)
Running from C:\Users\[removed]\Downloads
[removed] Platform: Windows 8.1 (Update) (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\Dragon Assistant\Core\DACore.exe
() C:\Program Files (x86)\DTS, Inc\DTS Studio Sound\dts_apo_service.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Toshiba Corporation) C:\Program Files\Toshiba\Teco\TecoService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Hotkey\TCrdMain_Win8.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Teco\TecoResident.exe
() C:\Program Files\Toshiba\Hotkey\Hotkey\TCrdKBB.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Program Files (x86)\Toshiba\System Setting\TSleepSrv.exe
() C:\Program Files (x86)\Toshiba\System Setting\TODDMain.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3510 series\Bin\HPNetworkCommunicator.exe
(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA Service Station\ToshibaServiceStation.exe
(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE
(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA Service Station\TMachInfo.exe
() C:\Program Files\RogueKiller\RogueKiller64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_22_0_0_209.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_22_0_0_209.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [HotKeysCmds] => C:\windows\system32\hkcmd.exe
HKLM\…\Run: [Persistence] => C:\windows\system32\igfxpers.exe
HKLM\…\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [894048 2013-01-11] (Conexant Systems, Inc.)
HKLM\…\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\…\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2565472 2013-04-22] (TOSHIBA Corporation)
HKLM\…\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [170848 2013-01-28] (TOSHIBA Corporation)
HKLM\…\Run: [ThpSrv] => C:\windows\system32\thpsrv /logon
HKLM\…\Run: [TSleepSrv] => C:\Program Files (x86)\TOSHIBA\System Setting\TSleepSrv.exe [1549392 2013-03-04] (TOSHIBA Corporation)
HKLM\…\Run: [TODDMain] => C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] ()
HKLM\…\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161240 2016-05-21] (IvoSoft)
HKLM\…\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3050736 2013-04-05] (Synaptics Incorporated)
HKLM\…\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\…\Run: [] => [X]
HKLM-x32\…\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\…\Run: [HP Deskjet 3510 series (NET)] => C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\…\Run: [BitTorrent] => C:\Users\lisa\AppData\Roaming\BitTorrent\BitTorrent.exe [2140680 2016-08-13] (BitTorrent Inc.)
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\…\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\…\Run: [GoogleChromeAutoLaunch_9D01F335F49EFDFF400652C34E0227C8] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1152840 2016-08-02] (Google Inc.)
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-05-21] (IvoSoft)
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-05-21] (IvoSoft)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.254.254
Tcpip\..\Interfaces\{1AF619BF-12CC-461E-93BC-22751F7E5501}: [DhcpNameServer] 192.168.254.254

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com/?pc=TNJB
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com/?pc=TNJB
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com/?pc=TNJB
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://mystart.toshiba.com
SearchScopes: HKU\S-1-5-21-1534849743-2360249728-2914029306-1001 -> DefaultScope {7C65B0C5-B202-40E1-A4B2-C6F57D5CE4D9} URL =
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2016-06-23] (Microsoft Corporation)
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-05-21] (IvoSoft)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2016-06-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2016-06-23] (Microsoft Corporation)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2016-05-21] (IvoSoft)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-05-21] (IvoSoft)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2016-06-23] (Microsoft Corporation)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2016-05-21] (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-05-21] (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-05-21] (IvoSoft)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2016-06-23] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2012-06-01] (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\lisa\AppData\Roaming\Mozilla\Firefox\Profiles\y6umi16h.default
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_22_0_0_209.dll [2016-08-09] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_209.dll [2016-08-09] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-02-15] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-02-15] (Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2016-06-23] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2012-10-12] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.)
FF Extension: WOT - C:\Users\lisa\AppData\Roaming\Mozilla\Firefox\Profiles\y6umi16h.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2016-06-29]
FF Extension: Share Button for Pinterest - C:\Users\lisa\AppData\Roaming\Mozilla\Firefox\Profiles\y6umi16h.default\Extensions\{677a8f98-fd64-40b0-a883-b8c95d0cbf17}.xpi [2016-08-15]

Chrome:
=======
CHR Profile: C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-07-13]
CHR Extension: (Google Docs) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-07-13]
CHR Extension: (Google Drive) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-07-13]
CHR Extension: (YouTube) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-07-13]
CHR Extension: (Google Sheets) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-07-13]
CHR Extension: (Google Docs Offline) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-07-16]
CHR Extension: (Pinterest Save Button) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdjojdkbbmdfjfahjcgigfpmkopogic [2016-07-21]
CHR Extension: (Chrome Web Store Payments) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-07-13]
CHR Extension: (Gmail) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-07-13]
CHR Extension: (Chrome Media Router) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-08-17]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 DACoreService; C:\Program Files (x86)\Nuance\Dragon Assistant\Core\DACore.exe [432528 2013-05-02] (Nuance Communications, Inc.)
R2 dts_apo_service; C:\Program Files (x86)\DTS, Inc\DTS Studio Sound\dts_apo_service.exe [16720 2013-04-15] ()
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [29760 2016-07-04] (HP Inc.)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319888 2014-12-31] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [732160 2012-12-10] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129848 2013-02-22] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [167736 2013-02-22] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-28] ()
R2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1854056 2012-12-07] (Microsoft Corporation)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S4 THAccelSvc; C:\Program Files\TOSHIBA\HDD Accelerator\THAccelSvc.exe [216976 2013-03-26] (TOSHIBA CORPORATION)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2016-06-20] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2016-06-20] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-28] (Intel® Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\Netwew00.sys [3345376 2013-10-08] (Intel Corporation)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [288328 2013-01-23] (Realtek Semiconductor Corp.)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33008 2013-04-05] (Synaptics Incorporated)
R0 THAccel; C:\Windows\System32\DRIVERS\THAccel.sys [110976 2013-03-25] (TOSHIBA Corporation)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [28272 2016-08-17] ()
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [48024 2013-01-28] (Windows (R) Win 7 DDK provider)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44560 2016-06-20] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [270168 2016-06-20] (Microsoft Corporation)
R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2016-06-20] (Microsoft Corporation)
R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [194456 2013-01-28] (Windows (R) Win 7 DDK provider)
S1 MpKsld8b5291b; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{6B79FDBD-B9D1-4DFA-ABFC-D649711AAB81}\MpKsld8b5291b.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-17 16:19 - 2016-08-17 16:19 - 00019202 _____ C:\Users\lisa\Downloads\FRST.txt
2016-08-17 16:17 - 2016-08-17 16:17 - 02394624 _____ (Farbar) C:\Users\lisa\Downloads\FRST64.exe
2016-08-17 15:35 - 2016-08-17 15:35 - 00028272 _____ C:\WINDOWS\system32\Drivers\TrueSight.sys
2016-08-17 15:34 - 2016-08-17 15:34 - 00000881 _____ C:\Users\Public\Desktop\RogueKiller.lnk
2016-08-17 15:34 - 2016-08-17 15:34 - 00000000 ____D C:\Users\lisa\AppData\Local\CrashDumps
2016-08-17 15:34 - 2016-08-17 15:34 - 00000000 ____D C:\ProgramData\RogueKiller
2016-08-17 15:34 - 2016-08-17 15:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
2016-08-17 15:34 - 2016-08-17 15:34 - 00000000 ____D C:\Program Files\RogueKiller
2016-08-17 15:28 - 2016-08-17 15:34 - 34636056 _____ (Adlice Software ) C:\Users\lisa\Downloads\setup.exe
2016-08-17 15:16 - 2016-08-17 15:16 - 03784256 _____ C:\Users\lisa\Downloads\adwcleaner_6.000.exe
2016-08-15 21:54 - 2016-08-15 21:57 - 00000000 ____D C:\Users\lisa\Downloads\Stranger.Things.S01E02.WEBRip.x264-TURBO[ettv]
2016-08-15 20:22 - 2016-08-16 09:02 - 00000000 ____D C:\Users\lisa\AppData\Roaming\vlc
2016-08-15 19:42 - 2016-08-15 19:42 - 00001097 _____ C:\Users\Public\Desktop\VLC media player.lnk
2016-08-15 19:42 - 2016-08-15 19:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2016-08-15 19:42 - 2016-08-15 19:42 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2016-08-15 19:12 - 2016-08-15 19:15 - 30533688 _____ C:\Users\lisa\Downloads\vlc-2.2.4-win32.exe
2016-08-15 18:30 - 2016-08-15 19:09 - 00000000 ____D C:\Users\lisa\Downloads\Stranger.Things.S01E01.WEBRip.x264-TURBO[ettv]
2016-08-15 09:46 - 2016-08-15 09:47 - 14205112 _____ (HOW Inc. ) C:\Users\lisa\Downloads\FYTDSetup (3).exe
2016-08-13 10:15 - 2016-08-17 15:25 - 00000000 ____D C:\Users\lisa\AppData\LocalLow\BitTorrent
2016-08-12 15:20 - 2016-08-12 15:20 - 04337689 _____ C:\Users\lisa\Downloads\video-1471029581.mp4
2016-08-12 14:50 - 2016-08-12 14:50 - 04222057 _____ C:\Users\lisa\Downloads\video-1471027608.mp4
2016-08-10 01:16 - 2016-06-18 16:06 - 00590688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fvevol.sys
2016-08-10 01:16 - 2016-06-18 16:06 - 00072408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpfve.sys
2016-08-10 01:16 - 2016-06-11 15:52 - 00379232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2016-08-10 01:16 - 2016-06-11 15:52 - 00057184 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\stornvme.sys
2016-08-10 01:16 - 2016-06-11 14:05 - 00216576 _____ (Microsoft Corporation) C:\WINDOWS\system32\gpresult.exe
2016-08-10 01:16 - 2016-06-11 12:50 - 00987136 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2016-08-10 01:16 - 2016-06-11 12:46 - 00482304 _____ (Microsoft Corporation) C:\WINDOWS\system32\tpmvsc.dll
2016-08-10 01:16 - 2016-06-11 12:44 - 00509440 _____ (Microsoft Corporation) C:\WINDOWS\system32\webio.dll
2016-08-10 01:16 - 2016-06-11 12:37 - 00796672 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll
2016-08-10 01:16 - 2016-06-11 12:24 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2016-08-10 01:16 - 2016-06-11 12:20 - 00413184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webio.dll
2016-08-10 01:16 - 2016-06-11 12:16 - 00626176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll
2016-08-10 01:16 - 2016-06-10 23:44 - 00107984 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptsslp.dll
2016-08-10 01:16 - 2016-06-10 23:44 - 00091416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptsslp.dll
2016-08-10 01:16 - 2016-06-10 16:07 - 03820544 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2016-08-10 01:16 - 2016-06-10 16:03 - 00432128 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2016-08-10 01:16 - 2016-06-10 15:04 - 03547136 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2016-08-10 01:16 - 2016-06-10 14:11 - 06521800 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
2016-08-10 01:16 - 2016-06-10 14:11 - 01487992 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2016-08-10 01:16 - 2016-06-10 14:11 - 00261376 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll
2016-08-10 01:16 - 2016-06-10 14:11 - 00125024 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptxml.dll
2016-08-10 01:16 - 2016-06-10 14:10 - 00099136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptxml.dll
2016-08-10 01:16 - 2016-06-10 14:07 - 03273728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2016-08-10 01:16 - 2016-06-10 14:04 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2016-08-10 01:16 - 2016-06-09 15:32 - 00228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebClnt.dll
2016-08-10 01:16 - 2016-06-09 14:18 - 00199168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebClnt.dll
2016-08-10 01:16 - 2016-06-03 20:38 - 01613528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2016-08-10 01:16 - 2016-06-03 20:37 - 01970968 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2016-08-10 01:16 - 2016-05-29 03:08 - 22361344 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-08-10 01:16 - 2016-05-28 14:31 - 19788688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2016-08-10 01:16 - 2016-05-18 16:56 - 01291776 _____ (Microsoft Corporation) C:\WINDOWS\system32\certutil.exe
2016-08-10 01:16 - 2016-05-18 16:28 - 02635264 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertEnroll.dll
2016-08-10 01:16 - 2016-05-18 16:16 - 02317824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnroll.dll
2016-08-10 01:16 - 2016-05-14 16:26 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2016-08-10 01:16 - 2016-05-14 01:19 - 01134768 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2016-08-10 01:16 - 2016-05-13 19:08 - 00111616 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidclass.sys
2016-08-10 01:16 - 2016-05-13 19:08 - 00032768 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidusb.sys
2016-08-10 01:16 - 2016-05-13 18:24 - 00862720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2016-08-10 01:16 - 2016-05-13 17:42 - 03667968 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2016-08-10 01:16 - 2016-05-13 17:27 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2016-08-10 01:16 - 2016-05-13 17:26 - 02230784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2016-08-10 01:16 - 2016-05-13 17:26 - 00897024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2016-08-10 01:16 - 2016-05-13 17:16 - 00727040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2016-08-10 01:16 - 2016-05-12 14:36 - 00034600 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserAccountBroker.exe
2016-08-10 01:16 - 2016-05-12 13:39 - 00030984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserAccountBroker.exe
2016-08-10 01:16 - 2016-05-06 17:59 - 00331608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Classpnp.sys
2016-08-10 01:16 - 2016-05-06 13:13 - 00138240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dfsc.sys
2016-08-10 01:16 - 2016-05-05 14:28 - 01661072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2016-08-10 01:16 - 2016-05-05 13:39 - 01212256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2016-08-10 01:16 - 2016-05-05 13:18 - 00065024 _____ (Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe
2016-08-10 01:16 - 2016-05-05 13:02 - 03320832 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2016-08-10 01:16 - 2016-05-05 12:37 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msiexec.exe
2016-08-10 01:16 - 2016-05-05 12:29 - 03607040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2016-08-10 01:16 - 2016-04-16 09:56 - 01080320 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2016-08-10 01:16 - 2016-04-10 01:35 - 00551256 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2016-08-10 01:16 - 2016-04-09 18:15 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\system32\wfapigp.dll
2016-08-10 01:16 - 2016-04-09 18:14 - 00306176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Geolocation.dll
2016-08-10 01:16 - 2016-04-09 18:10 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2016-08-10 01:16 - 2016-04-09 18:09 - 00754176 _____ (Microsoft Corporation) C:\WINDOWS\system32\FirewallAPI.dll
2016-08-10 01:16 - 2016-04-09 18:02 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationApi.dll
2016-08-10 01:16 - 2016-04-09 17:59 - 00218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Geolocation.dll
2016-08-10 01:16 - 2016-04-09 17:56 - 00543232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FirewallAPI.dll
2016-08-10 01:16 - 2016-04-09 17:55 - 00881152 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2016-08-10 01:16 - 2016-04-09 17:52 - 00281088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LocationApi.dll
2016-08-10 01:16 - 2016-04-07 12:06 - 00927744 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll
2016-08-10 01:16 - 2016-04-06 17:21 - 00114528 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mup.sys
2016-08-10 01:16 - 2016-04-06 14:20 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2016-08-10 01:16 - 2016-04-06 14:17 - 18825216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2016-08-10 01:16 - 2016-04-06 12:25 - 15158272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2016-08-10 01:16 - 2016-04-05 18:37 - 00205824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndiswan.sys
2016-08-10 01:16 - 2016-04-02 09:58 - 00108032 _____ (Microsoft Corporation) C:\WINDOWS\system32\BdeHdCfgLib.dll
2016-08-10 01:15 - 2016-06-11 13:14 - 00192512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gpresult.exe
2016-08-10 01:15 - 2016-06-07 14:10 - 00083456 _____ (Microsoft Corporation) C:\WINDOWS\system32\hbaapi.dll
2016-08-10 01:15 - 2016-06-07 13:13 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hbaapi.dll
2016-08-10 01:15 - 2016-05-18 17:54 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\certenc.dll
2016-08-10 01:15 - 2016-05-18 17:15 - 00044032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certenc.dll
2016-08-10 01:15 - 2016-05-18 16:33 - 01060352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certutil.exe
2016-08-10 01:15 - 2016-05-13 19:08 - 00032512 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidparse.sys
2016-08-10 01:15 - 2016-05-13 17:30 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2016-08-10 01:15 - 2016-05-13 17:29 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2016-08-10 01:15 - 2016-05-13 17:27 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2016-08-10 01:15 - 2016-05-13 17:18 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2016-08-10 01:15 - 2016-05-13 17:18 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2016-08-10 01:15 - 2016-05-13 17:16 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2016-08-10 01:15 - 2016-05-05 12:34 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2016-08-10 01:15 - 2016-05-05 11:28 - 02778624 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2016-08-10 01:15 - 2016-05-05 11:16 - 02464768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2016-08-10 01:15 - 2016-04-09 17:59 - 00020480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wfapigp.dll
2016-08-10 01:15 - 2016-04-01 13:40 - 00322048 _____ (Microsoft Corporation) C:\WINDOWS\system32\fvecpl.dll
2016-08-10 01:15 - 2016-04-01 12:53 - 00348672 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdesvc.dll
2016-08-10 01:15 - 2016-04-01 12:50 - 00737280 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2016-08-10 01:15 - 2016-02-04 12:57 - 00018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\httpprxp.dll
2016-08-10 01:15 - 2016-02-04 12:49 - 00125440 _____ (Microsoft Corporation) C:\WINDOWS\system32\httpprxm.dll
2016-08-10 01:15 - 2016-02-04 12:39 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\system32\adhsvc.dll
2016-08-10 01:12 - 2016-08-02 02:54 - 25808384 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-08-10 01:12 - 2016-07-08 10:32 - 01753600 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2016-08-10 01:12 - 2016-07-08 10:25 - 01491456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2016-08-10 01:12 - 2016-07-08 10:22 - 01445376 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-08-10 01:12 - 2016-07-08 10:18 - 04169216 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2016-08-10 01:12 - 2016-07-07 18:33 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2016-08-10 01:12 - 2016-07-07 17:53 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2016-08-10 01:12 - 2016-07-07 16:06 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2016-08-10 01:12 - 2016-07-06 10:26 - 07793152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2016-08-10 01:12 - 2016-07-06 10:26 - 07075328 _____ (Microsoft Corporation) C:\WINDOWS\system32\glcndFilter.dll
2016-08-10 01:12 - 2016-07-06 10:23 - 05270016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\glcndFilter.dll
2016-08-10 01:12 - 2016-07-06 10:21 - 05265920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2016-08-10 01:12 - 2016-05-18 19:18 - 00563024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2016-08-10 01:12 - 2016-05-18 19:18 - 00397232 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2016-08-10 01:12 - 2016-05-18 19:16 - 00178016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2016-08-10 01:12 - 2016-05-18 18:28 - 00340880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2016-08-10 01:11 - 2016-08-02 02:32 - 02894336 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-08-10 01:11 - 2016-08-02 02:31 - 00572416 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2016-08-10 01:11 - 2016-08-02 02:20 - 00615936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2016-08-10 01:11 - 2016-08-02 02:18 - 06047744 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-08-10 01:11 - 2016-08-02 02:18 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2016-08-10 01:11 - 2016-08-02 01:55 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2016-08-10 01:11 - 2016-08-02 01:54 - 20343808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-08-10 01:11 - 2016-08-02 01:51 - 00497664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2016-08-10 01:11 - 2016-08-02 01:47 - 02286592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-08-10 01:11 - 2016-08-02 01:46 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2016-08-10 01:11 - 2016-08-02 01:41 - 00663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2016-08-10 01:11 - 2016-08-02 01:40 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2016-08-10 01:11 - 2016-08-02 01:39 - 00378880 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2016-08-10 01:11 - 2016-08-02 01:38 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2016-08-10 01:11 - 2016-08-02 01:38 - 00724992 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2016-08-10 01:11 - 2016-08-02 01:36 - 02131456 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2016-08-10 01:11 - 2016-08-02 01:28 - 15412224 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-08-10 01:11 - 2016-08-02 01:23 - 02868224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-08-10 01:11 - 2016-08-02 01:21 - 04608000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-08-10 01:11 - 2016-08-02 01:20 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2016-08-10 01:11 - 2016-08-02 01:15 - 00692736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2016-08-10 01:11 - 2016-08-02 01:15 - 00330752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2016-08-10 01:11 - 2016-08-02 01:14 - 02055680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2016-08-10 01:11 - 2016-08-02 01:11 - 13808128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-08-10 01:11 - 2016-08-02 01:10 - 01550848 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-08-10 01:11 - 2016-08-02 00:59 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2016-08-10 01:11 - 2016-08-02 00:56 - 02393088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-08-10 01:11 - 2016-08-02 00:53 - 01316352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-08-10 01:11 - 2016-08-02 00:51 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2016-08-10 01:10 - 2016-07-08 20:09 - 00442712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2016-08-10 01:10 - 2016-07-08 20:08 - 00332632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2016-08-10 01:10 - 2016-07-08 10:19 - 00840704 _____ (Microsoft Corporation) C:\WINDOWS\system32\netlogon.dll
2016-08-10 01:10 - 2016-07-08 10:17 - 00696832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netlogon.dll
2016-08-10 01:07 - 2016-07-12 10:08 - 00175616 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2016-08-09 17:04 - 2016-08-09 17:04 - 00000000 ____D C:\Users\lisa\AppData\Local\Macromedia
2016-08-06 14:53 - 2016-08-06 14:53 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2016-08-01 20:18 - 2016-08-12 10:14 - 00000000 ____D C:\Users\lisa\Downloads\Astrology for lovers
2016-08-01 11:28 - 2016-08-01 11:29 - 16834831 _____ C:\Users\lisa\Downloads\blog-08-01-2016.xml
2016-07-27 16:48 - 2016-07-27 16:48 - 01500438 _____ C:\Users\lisa\Downloads\KingoRoot.apk
2016-07-27 16:48 - 2016-07-27 16:48 - 00339162 _____ C:\Users\lisa\Downloads\IMG_3155(1).3gp
2016-07-27 16:48 - 2016-07-27 16:48 - 00100235 _____ C:\Users\lisa\Downloads\MOV_1947(2).3gp
2016-07-27 16:48 - 2016-07-27 16:48 - 00098020 _____ C:\Users\lisa\Downloads\MOV_6110(1).3gp
2016-07-27 16:00 - 2016-07-27 16:00 - 01555675 _____ C:\Users\lisa\Downloads\QuickCam_1469149944992(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 01524059 _____ C:\Users\lisa\Downloads\QuickCam_1469146931104(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 01460013 _____ C:\Users\lisa\Downloads\QuickCam_1469150351247(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 01310407 _____ C:\Users\lisa\Downloads\QuickCam_1469149138677(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 01300086 _____ C:\Users\lisa\Downloads\QuickCam_1469146323829(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00925942 _____ C:\Users\lisa\Downloads\QuickCam_1469583005771(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00865049 _____ C:\Users\lisa\Downloads\QuickCam_1469582316237(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00792216 _____ C:\Users\lisa\Downloads\QuickCam_1469147171539(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00700849 _____ C:\Users\lisa\Downloads\QuickCam_1469149345732(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00680240 _____ C:\Users\lisa\Downloads\QuickCam_1469147029437(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00669743 _____ C:\Users\lisa\Downloads\QuickCam_1469582275506(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00619124 _____ C:\Users\lisa\Downloads\QuickCam_1469582950245(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00352489 _____ C:\Users\lisa\Downloads\QuickCam_1469150052159(1).mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01555675 _____ C:\Users\lisa\Downloads\QuickCam_1469149944992.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01524059 _____ C:\Users\lisa\Downloads\QuickCam_1469146931104.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01460013 _____ C:\Users\lisa\Downloads\QuickCam_1469150351247.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01310407 _____ C:\Users\lisa\Downloads\QuickCam_1469149138677.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01300086 _____ C:\Users\lisa\Downloads\QuickCam_1469146323829.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00925942 _____ C:\Users\lisa\Downloads\QuickCam_1469583005771.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00865049 _____ C:\Users\lisa\Downloads\QuickCam_1469582316237.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00792216 _____ C:\Users\lisa\Downloads\QuickCam_1469147171539.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00700849 _____ C:\Users\lisa\Downloads\QuickCam_1469149345732.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00680240 _____ C:\Users\lisa\Downloads\QuickCam_1469147029437.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00669743 _____ C:\Users\lisa\Downloads\QuickCam_1469582275506.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00619124 _____ C:\Users\lisa\Downloads\QuickCam_1469582950245.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00352489 _____ C:\Users\lisa\Downloads\QuickCam_1469150052159.mp4
2016-07-25 11:55 - 2016-07-25 11:55 - 00000000 ___SD C:\Users\lisa\Documents\My Data Sources
2016-07-20 06:31 - 2016-07-20 06:31 - 00000000 ____D C:\WINDOWS\EOONotify

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-17 16:19 - 2015-05-19 12:57 - 00000000 ____D C:\FRST
2016-08-17 16:13 - 2016-06-19 06:54 - 00000000 ____D C:\Users\lisa\AppData\Local\ClassicShell
2016-08-17 15:40 - 2016-06-19 06:01 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1534849743-2360249728-2914029306-1001
2016-08-17 15:37 - 2016-06-23 20:20 - 00004990 _____ C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for LISASCOMPUTER-lisa LisasComputer
2016-08-17 15:30 - 2016-07-04 09:57 - 00000000 ____D C:\Users\lisa\AppData\Roaming\BitTorrent
2016-08-17 15:28 - 2016-07-13 17:11 - 00000934 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2016-08-17 15:24 - 2016-07-13 17:11 - 00000930 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2016-08-17 15:24 - 2016-06-20 21:46 - 00000000 __RDO C:\Users\lisa\OneDrive
2016-08-17 15:24 - 2016-06-20 21:43 - 00000000 __SHD C:\Users\lisa\IntelGraphicsProfiles
2016-08-17 15:23 - 2013-08-22 10:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-08-17 15:22 - 2013-08-22 09:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2016-08-17 15:21 - 2015-05-19 19:22 - 00000000 ____D C:\AdwCleaner
2016-08-17 13:43 - 2016-07-13 16:36 - 00003942 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{A0ACBCB3-23B6-4FE2-92CB-7E0E8DA1AEF0}
2016-08-17 08:47 - 2012-07-26 03:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-08-17 00:14 - 2014-03-07 15:25 - 117961216 ___SH C:\Users\lisa\Downloads\Thumbs.db
2016-08-15 14:11 - 2014-11-21 04:44 - 00863592 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-08-15 14:11 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\Inf
2016-08-13 08:04 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\rescache
2016-08-12 10:12 - 2013-08-22 10:44 - 05133264 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-08-12 10:07 - 2013-08-22 11:36 - 00000000 ___RD C:\WINDOWS\ToastData
2016-08-12 10:07 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\system32\SecureBootUpdates
2016-08-10 05:13 - 2013-08-22 11:36 - 00000000 ___HD C:\Program Files\WindowsApps
2016-08-10 05:13 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-08-10 05:09 - 2016-06-19 08:02 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-08-10 05:03 - 2016-06-19 08:02 - 147640136 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-08-09 17:04 - 2016-06-19 06:11 - 00000000 ____D C:\Users\lisa\AppData\Local\Adobe
2016-08-09 16:49 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2016-08-09 16:49 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\system32\Macromed
2016-08-07 21:30 - 2016-06-19 05:53 - 00000000 ____D C:\Users\lisa\AppData\Local\Packages
2016-08-04 18:29 - 2016-07-13 17:14 - 00002226 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-08-04 18:29 - 2016-07-13 17:14 - 00002214 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-08-01 16:18 - 2016-07-03 15:33 - 00003072 ____H C:\Users\lisa\Desktop\photothumb.db
2016-07-28 19:23 - 2016-07-13 17:11 - 00003906 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2016-07-28 19:23 - 2016-07-13 17:11 - 00003670 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2016-07-27 15:25 - 2016-06-20 10:40 - 00504488 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2016-07-25 19:44 - 2016-06-20 18:29 - 00000000 ____D C:\Users\lisa
2016-07-20 06:34 - 2016-06-24 00:12 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX
2016-07-20 06:34 - 2016-06-24 00:12 - 00000000 ___SD C:\WINDOWS\system32\GWX
2016-07-19 09:03 - 2014-08-31 21:31 - 00113152 ___SH C:\Users\lisa\Desktop\Thumbs.db

==================== Files in the root of some directories =======

2016-07-08 11:23 - 2016-07-13 14:19 - 0000132 _____ () C:\Users\lisa\AppData\Roaming\Adobe PNG Format CS6 Prefs
2016-06-25 18:43 - 2016-06-25 18:43 - 0000057 _____ () C:\ProgramData\Ament.ini
2016-07-03 14:33 - 2016-07-03 14:33 - 0000016 _____ () C:\ProgramData\mntemp
2016-07-03 14:33 - 2016-07-03 14:33 - 0004864 _____ () C:\ProgramData\oqztiqep.adk

Some files in TEMP:
====================
C:\Users\lisa\AppData\Local\Temp\dllnt_dump.dll
C:\Users\lisa\AppData\Local\Temp\libeay32.dll
C:\Users\lisa\AppData\Local\Temp\msvcr120.dll
C:\Users\lisa\AppData\Local\Temp\OfficeSetup.exe
C:\Users\lisa\AppData\Local\Temp\SetupO365HomePremRetail.x86.en-US_O365HomePremRetail_4VB9X-YNMP2-33RMG-F8788-Q67JR_act_1_.exe
C:\Users\lisa\AppData\Local\Temp\sqlite3.dll

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-08-11 03:57

==================== End of FRST.txt ============================Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 17-08-2016
Ran by [removed] (administrator) on LISASCOMPUTER (17-08-2016 16:19:28)
Running from C:\Users\[removed]\Downloads
[removed] Platform: Windows 8.1 (Update) (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\Dragon Assistant\Core\DACore.exe
() C:\Program Files (x86)\DTS, Inc\DTS Studio Sound\dts_apo_service.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Toshiba Corporation) C:\Program Files\Toshiba\Teco\TecoService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Hotkey\TCrdMain_Win8.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Teco\TecoResident.exe
() C:\Program Files\Toshiba\Hotkey\Hotkey\TCrdKBB.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Program Files (x86)\Toshiba\System Setting\TSleepSrv.exe
() C:\Program Files (x86)\Toshiba\System Setting\TODDMain.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3510 series\Bin\HPNetworkCommunicator.exe
(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA Service Station\ToshibaServiceStation.exe
(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE
(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA Service Station\TMachInfo.exe
() C:\Program Files\RogueKiller\RogueKiller64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_22_0_0_209.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_22_0_0_209.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [HotKeysCmds] => C:\windows\system32\hkcmd.exe
HKLM\…\Run: [Persistence] => C:\windows\system32\igfxpers.exe
HKLM\…\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [894048 2013-01-11] (Conexant Systems, Inc.)
HKLM\…\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\…\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2565472 2013-04-22] (TOSHIBA Corporation)
HKLM\…\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [170848 2013-01-28] (TOSHIBA Corporation)
HKLM\…\Run: [ThpSrv] => C:\windows\system32\thpsrv /logon
HKLM\…\Run: [TSleepSrv] => C:\Program Files (x86)\TOSHIBA\System Setting\TSleepSrv.exe [1549392 2013-03-04] (TOSHIBA Corporation)
HKLM\…\Run: [TODDMain] => C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] ()
HKLM\…\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161240 2016-05-21] (IvoSoft)
HKLM\…\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3050736 2013-04-05] (Synaptics Incorporated)
HKLM\…\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\…\Run: [] => [X]
HKLM-x32\…\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\…\Run: [HP Deskjet 3510 series (NET)] => C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\…\Run: [BitTorrent] => C:\Users\lisa\AppData\Roaming\BitTorrent\BitTorrent.exe [2140680 2016-08-13] (BitTorrent Inc.)
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\…\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\…\Run: [GoogleChromeAutoLaunch_9D01F335F49EFDFF400652C34E0227C8] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1152840 2016-08-02] (Google Inc.)
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-05-21] (IvoSoft)
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-05-21] (IvoSoft)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.254.254
Tcpip\..\Interfaces\{1AF619BF-12CC-461E-93BC-22751F7E5501}: [DhcpNameServer] 192.168.254.254

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com/?pc=TNJB
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com/?pc=TNJB
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com/?pc=TNJB
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://mystart.toshiba.com
SearchScopes: HKU\S-1-5-21-1534849743-2360249728-2914029306-1001 -> DefaultScope {7C65B0C5-B202-40E1-A4B2-C6F57D5CE4D9} URL =
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2016-06-23] (Microsoft Corporation)
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-05-21] (IvoSoft)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2016-06-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2016-06-23] (Microsoft Corporation)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2016-05-21] (IvoSoft)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-05-21] (IvoSoft)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2016-06-23] (Microsoft Corporation)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2016-05-21] (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-05-21] (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-05-21] (IvoSoft)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2016-06-23] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2012-06-01] (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\lisa\AppData\Roaming\Mozilla\Firefox\Profiles\y6umi16h.default
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_22_0_0_209.dll [2016-08-09] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_209.dll [2016-08-09] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-02-15] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-02-15] (Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2016-06-23] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2012-10-12] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.)
FF Extension: WOT - C:\Users\lisa\AppData\Roaming\Mozilla\Firefox\Profiles\y6umi16h.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2016-06-29]
FF Extension: Share Button for Pinterest - C:\Users\lisa\AppData\Roaming\Mozilla\Firefox\Profiles\y6umi16h.default\Extensions\{677a8f98-fd64-40b0-a883-b8c95d0cbf17}.xpi [2016-08-15]

Chrome:
=======
CHR Profile: C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-07-13]
CHR Extension: (Google Docs) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-07-13]
CHR Extension: (Google Drive) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-07-13]
CHR Extension: (YouTube) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-07-13]
CHR Extension: (Google Sheets) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-07-13]
CHR Extension: (Google Docs Offline) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-07-16]
CHR Extension: (Pinterest Save Button) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdjojdkbbmdfjfahjcgigfpmkopogic [2016-07-21]
CHR Extension: (Chrome Web Store Payments) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-07-13]
CHR Extension: (Gmail) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-07-13]
CHR Extension: (Chrome Media Router) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-08-17]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 DACoreService; C:\Program Files (x86)\Nuance\Dragon Assistant\Core\DACore.exe [432528 2013-05-02] (Nuance Communications, Inc.)
R2 dts_apo_service; C:\Program Files (x86)\DTS, Inc\DTS Studio Sound\dts_apo_service.exe [16720 2013-04-15] ()
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [29760 2016-07-04] (HP Inc.)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319888 2014-12-31] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [732160 2012-12-10] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129848 2013-02-22] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [167736 2013-02-22] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-28] ()
R2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1854056 2012-12-07] (Microsoft Corporation)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S4 THAccelSvc; C:\Program Files\TOSHIBA\HDD Accelerator\THAccelSvc.exe [216976 2013-03-26] (TOSHIBA CORPORATION)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2016-06-20] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2016-06-20] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-28] (Intel® Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\Netwew00.sys [3345376 2013-10-08] (Intel Corporation)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [288328 2013-01-23] (Realtek Semiconductor Corp.)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33008 2013-04-05] (Synaptics Incorporated)
R0 THAccel; C:\Windows\System32\DRIVERS\THAccel.sys [110976 2013-03-25] (TOSHIBA Corporation)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [28272 2016-08-17] ()
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [48024 2013-01-28] (Windows (R) Win 7 DDK provider)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44560 2016-06-20] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [270168 2016-06-20] (Microsoft Corporation)
R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2016-06-20] (Microsoft Corporation)
R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [194456 2013-01-28] (Windows (R) Win 7 DDK provider)
S1 MpKsld8b5291b; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{6B79FDBD-B9D1-4DFA-ABFC-D649711AAB81}\MpKsld8b5291b.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-17 16:19 - 2016-08-17 16:19 - 00019202 _____ C:\Users\lisa\Downloads\FRST.txt
2016-08-17 16:17 - 2016-08-17 16:17 - 02394624 _____ (Farbar) C:\Users\lisa\Downloads\FRST64.exe
2016-08-17 15:35 - 2016-08-17 15:35 - 00028272 _____ C:\WINDOWS\system32\Drivers\TrueSight.sys
2016-08-17 15:34 - 2016-08-17 15:34 - 00000881 _____ C:\Users\Public\Desktop\RogueKiller.lnk
2016-08-17 15:34 - 2016-08-17 15:34 - 00000000 ____D C:\Users\lisa\AppData\Local\CrashDumps
2016-08-17 15:34 - 2016-08-17 15:34 - 00000000 ____D C:\ProgramData\RogueKiller
2016-08-17 15:34 - 2016-08-17 15:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
2016-08-17 15:34 - 2016-08-17 15:34 - 00000000 ____D C:\Program Files\RogueKiller
2016-08-17 15:28 - 2016-08-17 15:34 - 34636056 _____ (Adlice Software ) C:\Users\lisa\Downloads\setup.exe
2016-08-17 15:16 - 2016-08-17 15:16 - 03784256 _____ C:\Users\lisa\Downloads\adwcleaner_6.000.exe
2016-08-15 21:54 - 2016-08-15 21:57 - 00000000 ____D C:\Users\lisa\Downloads\Stranger.Things.S01E02.WEBRip.x264-TURBO[ettv]
2016-08-15 20:22 - 2016-08-16 09:02 - 00000000 ____D C:\Users\lisa\AppData\Roaming\vlc
2016-08-15 19:42 - 2016-08-15 19:42 - 00001097 _____ C:\Users\Public\Desktop\VLC media player.lnk
2016-08-15 19:42 - 2016-08-15 19:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2016-08-15 19:42 - 2016-08-15 19:42 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2016-08-15 19:12 - 2016-08-15 19:15 - 30533688 _____ C:\Users\lisa\Downloads\vlc-2.2.4-win32.exe
2016-08-15 18:30 - 2016-08-15 19:09 - 00000000 ____D C:\Users\lisa\Downloads\Stranger.Things.S01E01.WEBRip.x264-TURBO[ettv]
2016-08-15 09:46 - 2016-08-15 09:47 - 14205112 _____ (HOW Inc. ) C:\Users\lisa\Downloads\FYTDSetup (3).exe
2016-08-13 10:15 - 2016-08-17 15:25 - 00000000 ____D C:\Users\lisa\AppData\LocalLow\BitTorrent
2016-08-12 15:20 - 2016-08-12 15:20 - 04337689 _____ C:\Users\lisa\Downloads\video-1471029581.mp4
2016-08-12 14:50 - 2016-08-12 14:50 - 04222057 _____ C:\Users\lisa\Downloads\video-1471027608.mp4
2016-08-10 01:16 - 2016-06-18 16:06 - 00590688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fvevol.sys
2016-08-10 01:16 - 2016-06-18 16:06 - 00072408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpfve.sys
2016-08-10 01:16 - 2016-06-11 15:52 - 00379232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2016-08-10 01:16 - 2016-06-11 15:52 - 00057184 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\stornvme.sys
2016-08-10 01:16 - 2016-06-11 14:05 - 00216576 _____ (Microsoft Corporation) C:\WINDOWS\system32\gpresult.exe
2016-08-10 01:16 - 2016-06-11 12:50 - 00987136 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2016-08-10 01:16 - 2016-06-11 12:46 - 00482304 _____ (Microsoft Corporation) C:\WINDOWS\system32\tpmvsc.dll
2016-08-10 01:16 - 2016-06-11 12:44 - 00509440 _____ (Microsoft Corporation) C:\WINDOWS\system32\webio.dll
2016-08-10 01:16 - 2016-06-11 12:37 - 00796672 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll
2016-08-10 01:16 - 2016-06-11 12:24 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2016-08-10 01:16 - 2016-06-11 12:20 - 00413184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webio.dll
2016-08-10 01:16 - 2016-06-11 12:16 - 00626176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll
2016-08-10 01:16 - 2016-06-10 23:44 - 00107984 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptsslp.dll
2016-08-10 01:16 - 2016-06-10 23:44 - 00091416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptsslp.dll
2016-08-10 01:16 - 2016-06-10 16:07 - 03820544 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2016-08-10 01:16 - 2016-06-10 16:03 - 00432128 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2016-08-10 01:16 - 2016-06-10 15:04 - 03547136 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2016-08-10 01:16 - 2016-06-10 14:11 - 06521800 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
2016-08-10 01:16 - 2016-06-10 14:11 - 01487992 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2016-08-10 01:16 - 2016-06-10 14:11 - 00261376 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll
2016-08-10 01:16 - 2016-06-10 14:11 - 00125024 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptxml.dll
2016-08-10 01:16 - 2016-06-10 14:10 - 00099136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptxml.dll
2016-08-10 01:16 - 2016-06-10 14:07 - 03273728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2016-08-10 01:16 - 2016-06-10 14:04 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2016-08-10 01:16 - 2016-06-09 15:32 - 00228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebClnt.dll
2016-08-10 01:16 - 2016-06-09 14:18 - 00199168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebClnt.dll
2016-08-10 01:16 - 2016-06-03 20:38 - 01613528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2016-08-10 01:16 - 2016-06-03 20:37 - 01970968 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2016-08-10 01:16 - 2016-05-29 03:08 - 22361344 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-08-10 01:16 - 2016-05-28 14:31 - 19788688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2016-08-10 01:16 - 2016-05-18 16:56 - 01291776 _____ (Microsoft Corporation) C:\WINDOWS\system32\certutil.exe
2016-08-10 01:16 - 2016-05-18 16:28 - 02635264 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertEnroll.dll
2016-08-10 01:16 - 2016-05-18 16:16 - 02317824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnroll.dll
2016-08-10 01:16 - 2016-05-14 16:26 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2016-08-10 01:16 - 2016-05-14 01:19 - 01134768 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2016-08-10 01:16 - 2016-05-13 19:08 - 00111616 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidclass.sys
2016-08-10 01:16 - 2016-05-13 19:08 - 00032768 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidusb.sys
2016-08-10 01:16 - 2016-05-13 18:24 - 00862720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2016-08-10 01:16 - 2016-05-13 17:42 - 03667968 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2016-08-10 01:16 - 2016-05-13 17:27 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2016-08-10 01:16 - 2016-05-13 17:26 - 02230784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2016-08-10 01:16 - 2016-05-13 17:26 - 00897024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2016-08-10 01:16 - 2016-05-13 17:16 - 00727040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2016-08-10 01:16 - 2016-05-12 14:36 - 00034600 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserAccountBroker.exe
2016-08-10 01:16 - 2016-05-12 13:39 - 00030984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserAccountBroker.exe
2016-08-10 01:16 - 2016-05-06 17:59 - 00331608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Classpnp.sys
2016-08-10 01:16 - 2016-05-06 13:13 - 00138240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dfsc.sys
2016-08-10 01:16 - 2016-05-05 14:28 - 01661072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2016-08-10 01:16 - 2016-05-05 13:39 - 01212256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2016-08-10 01:16 - 2016-05-05 13:18 - 00065024 _____ (Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe
2016-08-10 01:16 - 2016-05-05 13:02 - 03320832 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2016-08-10 01:16 - 2016-05-05 12:37 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msiexec.exe
2016-08-10 01:16 - 2016-05-05 12:29 - 03607040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2016-08-10 01:16 - 2016-04-16 09:56 - 01080320 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2016-08-10 01:16 - 2016-04-10 01:35 - 00551256 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2016-08-10 01:16 - 2016-04-09 18:15 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\system32\wfapigp.dll
2016-08-10 01:16 - 2016-04-09 18:14 - 00306176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Geolocation.dll
2016-08-10 01:16 - 2016-04-09 18:10 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2016-08-10 01:16 - 2016-04-09 18:09 - 00754176 _____ (Microsoft Corporation) C:\WINDOWS\system32\FirewallAPI.dll
2016-08-10 01:16 - 2016-04-09 18:02 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationApi.dll
2016-08-10 01:16 - 2016-04-09 17:59 - 00218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Geolocation.dll
2016-08-10 01:16 - 2016-04-09 17:56 - 00543232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FirewallAPI.dll
2016-08-10 01:16 - 2016-04-09 17:55 - 00881152 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2016-08-10 01:16 - 2016-04-09 17:52 - 00281088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LocationApi.dll
2016-08-10 01:16 - 2016-04-07 12:06 - 00927744 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll
2016-08-10 01:16 - 2016-04-06 17:21 - 00114528 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mup.sys
2016-08-10 01:16 - 2016-04-06 14:20 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2016-08-10 01:16 - 2016-04-06 14:17 - 18825216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2016-08-10 01:16 - 2016-04-06 12:25 - 15158272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2016-08-10 01:16 - 2016-04-05 18:37 - 00205824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndiswan.sys
2016-08-10 01:16 - 2016-04-02 09:58 - 00108032 _____ (Microsoft Corporation) C:\WINDOWS\system32\BdeHdCfgLib.dll
2016-08-10 01:15 - 2016-06-11 13:14 - 00192512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gpresult.exe
2016-08-10 01:15 - 2016-06-07 14:10 - 00083456 _____ (Microsoft Corporation) C:\WINDOWS\system32\hbaapi.dll
2016-08-10 01:15 - 2016-06-07 13:13 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hbaapi.dll
2016-08-10 01:15 - 2016-05-18 17:54 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\certenc.dll
2016-08-10 01:15 - 2016-05-18 17:15 - 00044032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certenc.dll
2016-08-10 01:15 - 2016-05-18 16:33 - 01060352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certutil.exe
2016-08-10 01:15 - 2016-05-13 19:08 - 00032512 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidparse.sys
2016-08-10 01:15 - 2016-05-13 17:30 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2016-08-10 01:15 - 2016-05-13 17:29 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2016-08-10 01:15 - 2016-05-13 17:27 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2016-08-10 01:15 - 2016-05-13 17:18 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2016-08-10 01:15 - 2016-05-13 17:18 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2016-08-10 01:15 - 2016-05-13 17:16 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2016-08-10 01:15 - 2016-05-05 12:34 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2016-08-10 01:15 - 2016-05-05 11:28 - 02778624 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2016-08-10 01:15 - 2016-05-05 11:16 - 02464768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2016-08-10 01:15 - 2016-04-09 17:59 - 00020480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wfapigp.dll
2016-08-10 01:15 - 2016-04-01 13:40 - 00322048 _____ (Microsoft Corporation) C:\WINDOWS\system32\fvecpl.dll
2016-08-10 01:15 - 2016-04-01 12:53 - 00348672 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdesvc.dll
2016-08-10 01:15 - 2016-04-01 12:50 - 00737280 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2016-08-10 01:15 - 2016-02-04 12:57 - 00018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\httpprxp.dll
2016-08-10 01:15 - 2016-02-04 12:49 - 00125440 _____ (Microsoft Corporation) C:\WINDOWS\system32\httpprxm.dll
2016-08-10 01:15 - 2016-02-04 12:39 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\system32\adhsvc.dll
2016-08-10 01:12 - 2016-08-02 02:54 - 25808384 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-08-10 01:12 - 2016-07-08 10:32 - 01753600 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2016-08-10 01:12 - 2016-07-08 10:25 - 01491456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2016-08-10 01:12 - 2016-07-08 10:22 - 01445376 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-08-10 01:12 - 2016-07-08 10:18 - 04169216 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2016-08-10 01:12 - 2016-07-07 18:33 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2016-08-10 01:12 - 2016-07-07 17:53 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2016-08-10 01:12 - 2016-07-07 16:06 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2016-08-10 01:12 - 2016-07-06 10:26 - 07793152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2016-08-10 01:12 - 2016-07-06 10:26 - 07075328 _____ (Microsoft Corporation) C:\WINDOWS\system32\glcndFilter.dll
2016-08-10 01:12 - 2016-07-06 10:23 - 05270016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\glcndFilter.dll
2016-08-10 01:12 - 2016-07-06 10:21 - 05265920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2016-08-10 01:12 - 2016-05-18 19:18 - 00563024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2016-08-10 01:12 - 2016-05-18 19:18 - 00397232 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2016-08-10 01:12 - 2016-05-18 19:16 - 00178016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2016-08-10 01:12 - 2016-05-18 18:28 - 00340880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2016-08-10 01:11 - 2016-08-02 02:32 - 02894336 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-08-10 01:11 - 2016-08-02 02:31 - 00572416 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2016-08-10 01:11 - 2016-08-02 02:20 - 00615936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2016-08-10 01:11 - 2016-08-02 02:18 - 06047744 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-08-10 01:11 - 2016-08-02 02:18 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2016-08-10 01:11 - 2016-08-02 01:55 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2016-08-10 01:11 - 2016-08-02 01:54 - 20343808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-08-10 01:11 - 2016-08-02 01:51 - 00497664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2016-08-10 01:11 - 2016-08-02 01:47 - 02286592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-08-10 01:11 - 2016-08-02 01:46 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2016-08-10 01:11 - 2016-08-02 01:41 - 00663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2016-08-10 01:11 - 2016-08-02 01:40 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2016-08-10 01:11 - 2016-08-02 01:39 - 00378880 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2016-08-10 01:11 - 2016-08-02 01:38 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2016-08-10 01:11 - 2016-08-02 01:38 - 00724992 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2016-08-10 01:11 - 2016-08-02 01:36 - 02131456 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2016-08-10 01:11 - 2016-08-02 01:28 - 15412224 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-08-10 01:11 - 2016-08-02 01:23 - 02868224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-08-10 01:11 - 2016-08-02 01:21 - 04608000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-08-10 01:11 - 2016-08-02 01:20 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2016-08-10 01:11 - 2016-08-02 01:15 - 00692736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2016-08-10 01:11 - 2016-08-02 01:15 - 00330752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2016-08-10 01:11 - 2016-08-02 01:14 - 02055680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2016-08-10 01:11 - 2016-08-02 01:11 - 13808128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-08-10 01:11 - 2016-08-02 01:10 - 01550848 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-08-10 01:11 - 2016-08-02 00:59 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2016-08-10 01:11 - 2016-08-02 00:56 - 02393088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-08-10 01:11 - 2016-08-02 00:53 - 01316352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-08-10 01:11 - 2016-08-02 00:51 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2016-08-10 01:10 - 2016-07-08 20:09 - 00442712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2016-08-10 01:10 - 2016-07-08 20:08 - 00332632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2016-08-10 01:10 - 2016-07-08 10:19 - 00840704 _____ (Microsoft Corporation) C:\WINDOWS\system32\netlogon.dll
2016-08-10 01:10 - 2016-07-08 10:17 - 00696832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netlogon.dll
2016-08-10 01:07 - 2016-07-12 10:08 - 00175616 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2016-08-09 17:04 - 2016-08-09 17:04 - 00000000 ____D C:\Users\lisa\AppData\Local\Macromedia
2016-08-06 14:53 - 2016-08-06 14:53 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2016-08-01 20:18 - 2016-08-12 10:14 - 00000000 ____D C:\Users\lisa\Downloads\Astrology for lovers
2016-08-01 11:28 - 2016-08-01 11:29 - 16834831 _____ C:\Users\lisa\Downloads\blog-08-01-2016.xml
2016-07-27 16:48 - 2016-07-27 16:48 - 01500438 _____ C:\Users\lisa\Downloads\KingoRoot.apk
2016-07-27 16:48 - 2016-07-27 16:48 - 00339162 _____ C:\Users\lisa\Downloads\IMG_3155(1).3gp
2016-07-27 16:48 - 2016-07-27 16:48 - 00100235 _____ C:\Users\lisa\Downloads\MOV_1947(2).3gp
2016-07-27 16:48 - 2016-07-27 16:48 - 00098020 _____ C:\Users\lisa\Downloads\MOV_6110(1).3gp
2016-07-27 16:00 - 2016-07-27 16:00 - 01555675 _____ C:\Users\lisa\Downloads\QuickCam_1469149944992(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 01524059 _____ C:\Users\lisa\Downloads\QuickCam_1469146931104(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 01460013 _____ C:\Users\lisa\Downloads\QuickCam_1469150351247(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 01310407 _____ C:\Users\lisa\Downloads\QuickCam_1469149138677(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 01300086 _____ C:\Users\lisa\Downloads\QuickCam_1469146323829(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00925942 _____ C:\Users\lisa\Downloads\QuickCam_1469583005771(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00865049 _____ C:\Users\lisa\Downloads\QuickCam_1469582316237(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00792216 _____ C:\Users\lisa\Downloads\QuickCam_1469147171539(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00700849 _____ C:\Users\lisa\Downloads\QuickCam_1469149345732(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00680240 _____ C:\Users\lisa\Downloads\QuickCam_1469147029437(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00669743 _____ C:\Users\lisa\Downloads\QuickCam_1469582275506(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00619124 _____ C:\Users\lisa\Downloads\QuickCam_1469582950245(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00352489 _____ C:\Users\lisa\Downloads\QuickCam_1469150052159(1).mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01555675 _____ C:\Users\lisa\Downloads\QuickCam_1469149944992.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01524059 _____ C:\Users\lisa\Downloads\QuickCam_1469146931104.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01460013 _____ C:\Users\lisa\Downloads\QuickCam_1469150351247.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01310407 _____ C:\Users\lisa\Downloads\QuickCam_1469149138677.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01300086 _____ C:\Users\lisa\Downloads\QuickCam_1469146323829.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00925942 _____ C:\Users\lisa\Downloads\QuickCam_1469583005771.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00865049 _____ C:\Users\lisa\Downloads\QuickCam_1469582316237.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00792216 _____ C:\Users\lisa\Downloads\QuickCam_1469147171539.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00700849 _____ C:\Users\lisa\Downloads\QuickCam_1469149345732.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00680240 _____ C:\Users\lisa\Downloads\QuickCam_1469147029437.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00669743 _____ C:\Users\lisa\Downloads\QuickCam_1469582275506.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00619124 _____ C:\Users\lisa\Downloads\QuickCam_1469582950245.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00352489 _____ C:\Users\lisa\Downloads\QuickCam_1469150052159.mp4
2016-07-25 11:55 - 2016-07-25 11:55 - 00000000 ___SD C:\Users\lisa\Documents\My Data Sources
2016-07-20 06:31 - 2016-07-20 06:31 - 00000000 ____D C:\WINDOWS\EOONotify

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-17 16:19 - 2015-05-19 12:57 - 00000000 ____D C:\FRST
2016-08-17 16:13 - 2016-06-19 06:54 - 00000000 ____D C:\Users\lisa\AppData\Local\ClassicShell
2016-08-17 15:40 - 2016-06-19 06:01 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1534849743-2360249728-2914029306-1001
2016-08-17 15:37 - 2016-06-23 20:20 - 00004990 _____ C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for LISASCOMPUTER-lisa LisasComputer
2016-08-17 15:30 - 2016-07-04 09:57 - 00000000 ____D C:\Users\lisa\AppData\Roaming\BitTorrent
2016-08-17 15:28 - 2016-07-13 17:11 - 00000934 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2016-08-17 15:24 - 2016-07-13 17:11 - 00000930 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2016-08-17 15:24 - 2016-06-20 21:46 - 00000000 __RDO C:\Users\lisa\OneDrive
2016-08-17 15:24 - 2016-06-20 21:43 - 00000000 __SHD C:\Users\lisa\IntelGraphicsProfiles
2016-08-17 15:23 - 2013-08-22 10:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-08-17 15:22 - 2013-08-22 09:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2016-08-17 15:21 - 2015-05-19 19:22 - 00000000 ____D C:\AdwCleaner
2016-08-17 13:43 - 2016-07-13 16:36 - 00003942 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{A0ACBCB3-23B6-4FE2-92CB-7E0E8DA1AEF0}
2016-08-17 08:47 - 2012-07-26 03:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-08-17 00:14 - 2014-03-07 15:25 - 117961216 ___SH C:\Users\lisa\Downloads\Thumbs.db
2016-08-15 14:11 - 2014-11-21 04:44 - 00863592 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-08-15 14:11 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\Inf
2016-08-13 08:04 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\rescache
2016-08-12 10:12 - 2013-08-22 10:44 - 05133264 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-08-12 10:07 - 2013-08-22 11:36 - 00000000 ___RD C:\WINDOWS\ToastData
2016-08-12 10:07 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\system32\SecureBootUpdates
2016-08-10 05:13 - 2013-08-22 11:36 - 00000000 ___HD C:\Program Files\WindowsApps
2016-08-10 05:13 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-08-10 05:09 - 2016-06-19 08:02 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-08-10 05:03 - 2016-06-19 08:02 - 147640136 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-08-09 17:04 - 2016-06-19 06:11 - 00000000 ____D C:\Users\lisa\AppData\Local\Adobe
2016-08-09 16:49 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2016-08-09 16:49 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\system32\Macromed
2016-08-07 21:30 - 2016-06-19 05:53 - 00000000 ____D C:\Users\lisa\AppData\Local\Packages
2016-08-04 18:29 - 2016-07-13 17:14 - 00002226 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-08-04 18:29 - 2016-07-13 17:14 - 00002214 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-08-01 16:18 - 2016-07-03 15:33 - 00003072 ____H C:\Users\lisa\Desktop\photothumb.db
2016-07-28 19:23 - 2016-07-13 17:11 - 00003906 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2016-07-28 19:23 - 2016-07-13 17:11 - 00003670 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2016-07-27 15:25 - 2016-06-20 10:40 - 00504488 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2016-07-25 19:44 - 2016-06-20 18:29 - 00000000 ____D C:\Users\lisa
2016-07-20 06:34 - 2016-06-24 00:12 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX
2016-07-20 06:34 - 2016-06-24 00:12 - 00000000 ___SD C:\WINDOWS\system32\GWX
2016-07-19 09:03 - 2014-08-31 21:31 - 00113152 ___SH C:\Users\lisa\Desktop\Thumbs.db

==================== Files in the root of some directories =======

2016-07-08 11:23 - 2016-07-13 14:19 - 0000132 _____ () C:\Users\lisa\AppData\Roaming\Adobe PNG Format CS6 Prefs
2016-06-25 18:43 - 2016-06-25 18:43 - 0000057 _____ () C:\ProgramData\Ament.ini
2016-07-03 14:33 - 2016-07-03 14:33 - 0000016 _____ () C:\ProgramData\mntemp
2016-07-03 14:33 - 2016-07-03 14:33 - 0004864 _____ () C:\ProgramData\oqztiqep.adk

Some files in TEMP:
====================
C:\Users\lisa\AppData\Local\Temp\dllnt_dump.dll
C:\Users\lisa\AppData\Local\Temp\libeay32.dll
C:\Users\lisa\AppData\Local\Temp\msvcr120.dll
C:\Users\lisa\AppData\Local\Temp\OfficeSetup.exe
C:\Users\lisa\AppData\Local\Temp\SetupO365HomePremRetail.x86.en-US_O365HomePremRetail_4VB9X-YNMP2-33RMG-F8788-Q67JR_act_1_.exe
C:\Users\lisa\AppData\Local\Temp\sqlite3.dll

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-08-11 03:57

==================== End of FRST.txt ============================

lisavvvv

Post #6August 17, 2016, 8:49 PM UTC

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 17-08-2016
Ran by [removed] (administrator) on LISASCOMPUTER (17-08-2016 16:26:15)
Running from C:\Users\[removed]\Downloads
[removed] Platform: Windows 8.1 (Update) (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\Dragon Assistant\Core\DACore.exe
() C:\Program Files (x86)\DTS, Inc\DTS Studio Sound\dts_apo_service.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Toshiba Corporation) C:\Program Files\Toshiba\Teco\TecoService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Hotkey\TCrdMain_Win8.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Teco\TecoResident.exe
() C:\Program Files\Toshiba\Hotkey\Hotkey\TCrdKBB.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Program Files (x86)\Toshiba\System Setting\TSleepSrv.exe
() C:\Program Files (x86)\Toshiba\System Setting\TODDMain.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3510 series\Bin\HPNetworkCommunicator.exe
(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA Service Station\ToshibaServiceStation.exe
(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE
(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA Service Station\TMachInfo.exe
() C:\Program Files\RogueKiller\RogueKiller64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_22_0_0_209.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_22_0_0_209.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [HotKeysCmds] => C:\windows\system32\hkcmd.exe
HKLM\…\Run: [Persistence] => C:\windows\system32\igfxpers.exe
HKLM\…\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [894048 2013-01-11] (Conexant Systems, Inc.)
HKLM\…\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\…\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2565472 2013-04-22] (TOSHIBA Corporation)
HKLM\…\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [170848 2013-01-28] (TOSHIBA Corporation)
HKLM\…\Run: [ThpSrv] => C:\windows\system32\thpsrv /logon
HKLM\…\Run: [TSleepSrv] => C:\Program Files (x86)\TOSHIBA\System Setting\TSleepSrv.exe [1549392 2013-03-04] (TOSHIBA Corporation)
HKLM\…\Run: [TODDMain] => C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] ()
HKLM\…\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161240 2016-05-21] (IvoSoft)
HKLM\…\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3050736 2013-04-05] (Synaptics Incorporated)
HKLM\…\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\…\Run: [] => [X]
HKLM-x32\…\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\…\Run: [HP Deskjet 3510 series (NET)] => C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\…\Run: [BitTorrent] => C:\Users\lisa\AppData\Roaming\BitTorrent\BitTorrent.exe [2140680 2016-08-13] (BitTorrent Inc.)
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\…\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\…\Run: [GoogleChromeAutoLaunch_9D01F335F49EFDFF400652C34E0227C8] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1152840 2016-08-02] (Google Inc.)
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-05-21] (IvoSoft)
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-05-21] (IvoSoft)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.254.254
Tcpip\..\Interfaces\{1AF619BF-12CC-461E-93BC-22751F7E5501}: [DhcpNameServer] 192.168.254.254

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com/?pc=TNJB
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com/?pc=TNJB
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com/?pc=TNJB
HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://mystart.toshiba.com
SearchScopes: HKU\S-1-5-21-1534849743-2360249728-2914029306-1001 -> DefaultScope {7C65B0C5-B202-40E1-A4B2-C6F57D5CE4D9} URL =
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2016-06-23] (Microsoft Corporation)
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-05-21] (IvoSoft)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2016-06-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2016-06-23] (Microsoft Corporation)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2016-05-21] (IvoSoft)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-05-21] (IvoSoft)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2016-06-23] (Microsoft Corporation)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2016-05-21] (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-05-21] (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-05-21] (IvoSoft)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2016-06-23] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2012-06-01] (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\lisa\AppData\Roaming\Mozilla\Firefox\Profiles\y6umi16h.default
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_22_0_0_209.dll [2016-08-09] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_209.dll [2016-08-09] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-02-15] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-02-15] (Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2016-06-23] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2012-10-12] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.)
FF Extension: WOT - C:\Users\lisa\AppData\Roaming\Mozilla\Firefox\Profiles\y6umi16h.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2016-06-29]
FF Extension: Share Button for Pinterest - C:\Users\lisa\AppData\Roaming\Mozilla\Firefox\Profiles\y6umi16h.default\Extensions\{677a8f98-fd64-40b0-a883-b8c95d0cbf17}.xpi [2016-08-15]

Chrome:
=======
CHR Profile: C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-07-13]
CHR Extension: (Google Docs) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-07-13]
CHR Extension: (Google Drive) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-07-13]
CHR Extension: (YouTube) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-07-13]
CHR Extension: (Google Sheets) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-07-13]
CHR Extension: (Google Docs Offline) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-07-16]
CHR Extension: (Pinterest Save Button) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdjojdkbbmdfjfahjcgigfpmkopogic [2016-07-21]
CHR Extension: (Chrome Web Store Payments) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-07-13]
CHR Extension: (Gmail) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-07-13]
CHR Extension: (Chrome Media Router) - C:\Users\lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-08-17]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 DACoreService; C:\Program Files (x86)\Nuance\Dragon Assistant\Core\DACore.exe [432528 2013-05-02] (Nuance Communications, Inc.)
R2 dts_apo_service; C:\Program Files (x86)\DTS, Inc\DTS Studio Sound\dts_apo_service.exe [16720 2013-04-15] ()
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [29760 2016-07-04] (HP Inc.)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319888 2014-12-31] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [732160 2012-12-10] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129848 2013-02-22] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [167736 2013-02-22] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-28] ()
R2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1854056 2012-12-07] (Microsoft Corporation)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S4 THAccelSvc; C:\Program Files\TOSHIBA\HDD Accelerator\THAccelSvc.exe [216976 2013-03-26] (TOSHIBA CORPORATION)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2016-06-20] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2016-06-20] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-28] (Intel® Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\Netwew00.sys [3345376 2013-10-08] (Intel Corporation)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [288328 2013-01-23] (Realtek Semiconductor Corp.)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33008 2013-04-05] (Synaptics Incorporated)
R0 THAccel; C:\Windows\System32\DRIVERS\THAccel.sys [110976 2013-03-25] (TOSHIBA Corporation)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [28272 2016-08-17] ()
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [48024 2013-01-28] (Windows (R) Win 7 DDK provider)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44560 2016-06-20] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [270168 2016-06-20] (Microsoft Corporation)
R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2016-06-20] (Microsoft Corporation)
R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [194456 2013-01-28] (Windows (R) Win 7 DDK provider)
S1 MpKsld8b5291b; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{6B79FDBD-B9D1-4DFA-ABFC-D649711AAB81}\MpKsld8b5291b.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-17 16:19 - 2016-08-17 16:26 - 00019088 _____ C:\Users\lisa\Downloads\FRST.txt
2016-08-17 16:17 - 2016-08-17 16:17 - 02394624 _____ (Farbar) C:\Users\lisa\Downloads\FRST64.exe
2016-08-17 15:35 - 2016-08-17 15:35 - 00028272 _____ C:\WINDOWS\system32\Drivers\TrueSight.sys
2016-08-17 15:34 - 2016-08-17 15:34 - 00000881 _____ C:\Users\Public\Desktop\RogueKiller.lnk
2016-08-17 15:34 - 2016-08-17 15:34 - 00000000 ____D C:\Users\lisa\AppData\Local\CrashDumps
2016-08-17 15:34 - 2016-08-17 15:34 - 00000000 ____D C:\ProgramData\RogueKiller
2016-08-17 15:34 - 2016-08-17 15:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
2016-08-17 15:34 - 2016-08-17 15:34 - 00000000 ____D C:\Program Files\RogueKiller
2016-08-17 15:28 - 2016-08-17 15:34 - 34636056 _____ (Adlice Software ) C:\Users\lisa\Downloads\setup.exe
2016-08-17 15:16 - 2016-08-17 15:16 - 03784256 _____ C:\Users\lisa\Downloads\adwcleaner_6.000.exe
2016-08-15 21:54 - 2016-08-15 21:57 - 00000000 ____D C:\Users\lisa\Downloads\Stranger.Things.S01E02.WEBRip.x264-TURBO[ettv]
2016-08-15 20:22 - 2016-08-16 09:02 - 00000000 ____D C:\Users\lisa\AppData\Roaming\vlc
2016-08-15 19:42 - 2016-08-15 19:42 - 00001097 _____ C:\Users\Public\Desktop\VLC media player.lnk
2016-08-15 19:42 - 2016-08-15 19:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2016-08-15 19:42 - 2016-08-15 19:42 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2016-08-15 19:12 - 2016-08-15 19:15 - 30533688 _____ C:\Users\lisa\Downloads\vlc-2.2.4-win32.exe
2016-08-15 18:30 - 2016-08-15 19:09 - 00000000 ____D C:\Users\lisa\Downloads\Stranger.Things.S01E01.WEBRip.x264-TURBO[ettv]
2016-08-15 09:46 - 2016-08-15 09:47 - 14205112 _____ (HOW Inc. ) C:\Users\lisa\Downloads\FYTDSetup (3).exe
2016-08-13 10:15 - 2016-08-17 15:25 - 00000000 ____D C:\Users\lisa\AppData\LocalLow\BitTorrent
2016-08-12 15:20 - 2016-08-12 15:20 - 04337689 _____ C:\Users\lisa\Downloads\video-1471029581.mp4
2016-08-12 14:50 - 2016-08-12 14:50 - 04222057 _____ C:\Users\lisa\Downloads\video-1471027608.mp4
2016-08-10 01:16 - 2016-06-18 16:06 - 00590688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fvevol.sys
2016-08-10 01:16 - 2016-06-18 16:06 - 00072408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpfve.sys
2016-08-10 01:16 - 2016-06-11 15:52 - 00379232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2016-08-10 01:16 - 2016-06-11 15:52 - 00057184 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\stornvme.sys
2016-08-10 01:16 - 2016-06-11 14:05 - 00216576 _____ (Microsoft Corporation) C:\WINDOWS\system32\gpresult.exe
2016-08-10 01:16 - 2016-06-11 12:50 - 00987136 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2016-08-10 01:16 - 2016-06-11 12:46 - 00482304 _____ (Microsoft Corporation) C:\WINDOWS\system32\tpmvsc.dll
2016-08-10 01:16 - 2016-06-11 12:44 - 00509440 _____ (Microsoft Corporation) C:\WINDOWS\system32\webio.dll
2016-08-10 01:16 - 2016-06-11 12:37 - 00796672 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll
2016-08-10 01:16 - 2016-06-11 12:24 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2016-08-10 01:16 - 2016-06-11 12:20 - 00413184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webio.dll
2016-08-10 01:16 - 2016-06-11 12:16 - 00626176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll
2016-08-10 01:16 - 2016-06-10 23:44 - 00107984 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptsslp.dll
2016-08-10 01:16 - 2016-06-10 23:44 - 00091416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptsslp.dll
2016-08-10 01:16 - 2016-06-10 16:07 - 03820544 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2016-08-10 01:16 - 2016-06-10 16:03 - 00432128 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2016-08-10 01:16 - 2016-06-10 15:04 - 03547136 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2016-08-10 01:16 - 2016-06-10 14:11 - 06521800 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
2016-08-10 01:16 - 2016-06-10 14:11 - 01487992 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2016-08-10 01:16 - 2016-06-10 14:11 - 00261376 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll
2016-08-10 01:16 - 2016-06-10 14:11 - 00125024 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptxml.dll
2016-08-10 01:16 - 2016-06-10 14:10 - 00099136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptxml.dll
2016-08-10 01:16 - 2016-06-10 14:07 - 03273728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2016-08-10 01:16 - 2016-06-10 14:04 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2016-08-10 01:16 - 2016-06-09 15:32 - 00228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebClnt.dll
2016-08-10 01:16 - 2016-06-09 14:18 - 00199168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebClnt.dll
2016-08-10 01:16 - 2016-06-03 20:38 - 01613528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2016-08-10 01:16 - 2016-06-03 20:37 - 01970968 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2016-08-10 01:16 - 2016-05-29 03:08 - 22361344 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-08-10 01:16 - 2016-05-28 14:31 - 19788688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2016-08-10 01:16 - 2016-05-18 16:56 - 01291776 _____ (Microsoft Corporation) C:\WINDOWS\system32\certutil.exe
2016-08-10 01:16 - 2016-05-18 16:28 - 02635264 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertEnroll.dll
2016-08-10 01:16 - 2016-05-18 16:16 - 02317824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnroll.dll
2016-08-10 01:16 - 2016-05-14 16:26 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2016-08-10 01:16 - 2016-05-14 01:19 - 01134768 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2016-08-10 01:16 - 2016-05-13 19:08 - 00111616 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidclass.sys
2016-08-10 01:16 - 2016-05-13 19:08 - 00032768 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidusb.sys
2016-08-10 01:16 - 2016-05-13 18:24 - 00862720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2016-08-10 01:16 - 2016-05-13 17:42 - 03667968 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2016-08-10 01:16 - 2016-05-13 17:27 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2016-08-10 01:16 - 2016-05-13 17:26 - 02230784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2016-08-10 01:16 - 2016-05-13 17:26 - 00897024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2016-08-10 01:16 - 2016-05-13 17:16 - 00727040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2016-08-10 01:16 - 2016-05-12 14:36 - 00034600 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserAccountBroker.exe
2016-08-10 01:16 - 2016-05-12 13:39 - 00030984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserAccountBroker.exe
2016-08-10 01:16 - 2016-05-06 17:59 - 00331608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Classpnp.sys
2016-08-10 01:16 - 2016-05-06 13:13 - 00138240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dfsc.sys
2016-08-10 01:16 - 2016-05-05 14:28 - 01661072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2016-08-10 01:16 - 2016-05-05 13:39 - 01212256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2016-08-10 01:16 - 2016-05-05 13:18 - 00065024 _____ (Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe
2016-08-10 01:16 - 2016-05-05 13:02 - 03320832 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2016-08-10 01:16 - 2016-05-05 12:37 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msiexec.exe
2016-08-10 01:16 - 2016-05-05 12:29 - 03607040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2016-08-10 01:16 - 2016-04-16 09:56 - 01080320 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2016-08-10 01:16 - 2016-04-10 01:35 - 00551256 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2016-08-10 01:16 - 2016-04-09 18:15 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\system32\wfapigp.dll
2016-08-10 01:16 - 2016-04-09 18:14 - 00306176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Geolocation.dll
2016-08-10 01:16 - 2016-04-09 18:10 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2016-08-10 01:16 - 2016-04-09 18:09 - 00754176 _____ (Microsoft Corporation) C:\WINDOWS\system32\FirewallAPI.dll
2016-08-10 01:16 - 2016-04-09 18:02 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationApi.dll
2016-08-10 01:16 - 2016-04-09 17:59 - 00218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Geolocation.dll
2016-08-10 01:16 - 2016-04-09 17:56 - 00543232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FirewallAPI.dll
2016-08-10 01:16 - 2016-04-09 17:55 - 00881152 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2016-08-10 01:16 - 2016-04-09 17:52 - 00281088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LocationApi.dll
2016-08-10 01:16 - 2016-04-07 12:06 - 00927744 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll
2016-08-10 01:16 - 2016-04-06 17:21 - 00114528 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mup.sys
2016-08-10 01:16 - 2016-04-06 14:20 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2016-08-10 01:16 - 2016-04-06 14:17 - 18825216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2016-08-10 01:16 - 2016-04-06 12:25 - 15158272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2016-08-10 01:16 - 2016-04-05 18:37 - 00205824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndiswan.sys
2016-08-10 01:16 - 2016-04-02 09:58 - 00108032 _____ (Microsoft Corporation) C:\WINDOWS\system32\BdeHdCfgLib.dll
2016-08-10 01:15 - 2016-06-11 13:14 - 00192512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gpresult.exe
2016-08-10 01:15 - 2016-06-07 14:10 - 00083456 _____ (Microsoft Corporation) C:\WINDOWS\system32\hbaapi.dll
2016-08-10 01:15 - 2016-06-07 13:13 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hbaapi.dll
2016-08-10 01:15 - 2016-05-18 17:54 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\certenc.dll
2016-08-10 01:15 - 2016-05-18 17:15 - 00044032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certenc.dll
2016-08-10 01:15 - 2016-05-18 16:33 - 01060352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certutil.exe
2016-08-10 01:15 - 2016-05-13 19:08 - 00032512 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidparse.sys
2016-08-10 01:15 - 2016-05-13 17:30 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2016-08-10 01:15 - 2016-05-13 17:29 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2016-08-10 01:15 - 2016-05-13 17:27 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2016-08-10 01:15 - 2016-05-13 17:18 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2016-08-10 01:15 - 2016-05-13 17:18 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2016-08-10 01:15 - 2016-05-13 17:16 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2016-08-10 01:15 - 2016-05-05 12:34 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2016-08-10 01:15 - 2016-05-05 11:28 - 02778624 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2016-08-10 01:15 - 2016-05-05 11:16 - 02464768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2016-08-10 01:15 - 2016-04-09 17:59 - 00020480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wfapigp.dll
2016-08-10 01:15 - 2016-04-01 13:40 - 00322048 _____ (Microsoft Corporation) C:\WINDOWS\system32\fvecpl.dll
2016-08-10 01:15 - 2016-04-01 12:53 - 00348672 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdesvc.dll
2016-08-10 01:15 - 2016-04-01 12:50 - 00737280 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2016-08-10 01:15 - 2016-02-04 12:57 - 00018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\httpprxp.dll
2016-08-10 01:15 - 2016-02-04 12:49 - 00125440 _____ (Microsoft Corporation) C:\WINDOWS\system32\httpprxm.dll
2016-08-10 01:15 - 2016-02-04 12:39 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\system32\adhsvc.dll
2016-08-10 01:12 - 2016-08-02 02:54 - 25808384 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-08-10 01:12 - 2016-07-08 10:32 - 01753600 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2016-08-10 01:12 - 2016-07-08 10:25 - 01491456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2016-08-10 01:12 - 2016-07-08 10:22 - 01445376 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-08-10 01:12 - 2016-07-08 10:18 - 04169216 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2016-08-10 01:12 - 2016-07-07 18:33 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2016-08-10 01:12 - 2016-07-07 17:53 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2016-08-10 01:12 - 2016-07-07 16:06 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2016-08-10 01:12 - 2016-07-06 10:26 - 07793152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2016-08-10 01:12 - 2016-07-06 10:26 - 07075328 _____ (Microsoft Corporation) C:\WINDOWS\system32\glcndFilter.dll
2016-08-10 01:12 - 2016-07-06 10:23 - 05270016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\glcndFilter.dll
2016-08-10 01:12 - 2016-07-06 10:21 - 05265920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2016-08-10 01:12 - 2016-05-18 19:18 - 00563024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2016-08-10 01:12 - 2016-05-18 19:18 - 00397232 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2016-08-10 01:12 - 2016-05-18 19:16 - 00178016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2016-08-10 01:12 - 2016-05-18 18:28 - 00340880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2016-08-10 01:11 - 2016-08-02 02:32 - 02894336 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-08-10 01:11 - 2016-08-02 02:31 - 00572416 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2016-08-10 01:11 - 2016-08-02 02:20 - 00615936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2016-08-10 01:11 - 2016-08-02 02:18 - 06047744 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-08-10 01:11 - 2016-08-02 02:18 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2016-08-10 01:11 - 2016-08-02 01:55 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2016-08-10 01:11 - 2016-08-02 01:54 - 20343808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-08-10 01:11 - 2016-08-02 01:51 - 00497664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2016-08-10 01:11 - 2016-08-02 01:47 - 02286592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-08-10 01:11 - 2016-08-02 01:46 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2016-08-10 01:11 - 2016-08-02 01:41 - 00663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2016-08-10 01:11 - 2016-08-02 01:40 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2016-08-10 01:11 - 2016-08-02 01:39 - 00378880 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2016-08-10 01:11 - 2016-08-02 01:38 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2016-08-10 01:11 - 2016-08-02 01:38 - 00724992 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2016-08-10 01:11 - 2016-08-02 01:36 - 02131456 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2016-08-10 01:11 - 2016-08-02 01:28 - 15412224 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-08-10 01:11 - 2016-08-02 01:23 - 02868224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-08-10 01:11 - 2016-08-02 01:21 - 04608000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-08-10 01:11 - 2016-08-02 01:20 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2016-08-10 01:11 - 2016-08-02 01:15 - 00692736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2016-08-10 01:11 - 2016-08-02 01:15 - 00330752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2016-08-10 01:11 - 2016-08-02 01:14 - 02055680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2016-08-10 01:11 - 2016-08-02 01:11 - 13808128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-08-10 01:11 - 2016-08-02 01:10 - 01550848 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-08-10 01:11 - 2016-08-02 00:59 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2016-08-10 01:11 - 2016-08-02 00:56 - 02393088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-08-10 01:11 - 2016-08-02 00:53 - 01316352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-08-10 01:11 - 2016-08-02 00:51 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2016-08-10 01:10 - 2016-07-08 20:09 - 00442712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2016-08-10 01:10 - 2016-07-08 20:08 - 00332632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2016-08-10 01:10 - 2016-07-08 10:19 - 00840704 _____ (Microsoft Corporation) C:\WINDOWS\system32\netlogon.dll
2016-08-10 01:10 - 2016-07-08 10:17 - 00696832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netlogon.dll
2016-08-10 01:07 - 2016-07-12 10:08 - 00175616 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2016-08-09 17:04 - 2016-08-09 17:04 - 00000000 ____D C:\Users\lisa\AppData\Local\Macromedia
2016-08-06 14:53 - 2016-08-06 14:53 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2016-08-01 20:18 - 2016-08-12 10:14 - 00000000 ____D C:\Users\lisa\Downloads\Astrology for lovers
2016-08-01 11:28 - 2016-08-01 11:29 - 16834831 _____ C:\Users\lisa\Downloads\blog-08-01-2016.xml
2016-07-27 16:48 - 2016-07-27 16:48 - 01500438 _____ C:\Users\lisa\Downloads\KingoRoot.apk
2016-07-27 16:48 - 2016-07-27 16:48 - 00339162 _____ C:\Users\lisa\Downloads\IMG_3155(1).3gp
2016-07-27 16:48 - 2016-07-27 16:48 - 00100235 _____ C:\Users\lisa\Downloads\MOV_1947(2).3gp
2016-07-27 16:48 - 2016-07-27 16:48 - 00098020 _____ C:\Users\lisa\Downloads\MOV_6110(1).3gp
2016-07-27 16:00 - 2016-07-27 16:00 - 01555675 _____ C:\Users\lisa\Downloads\QuickCam_1469149944992(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 01524059 _____ C:\Users\lisa\Downloads\QuickCam_1469146931104(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 01460013 _____ C:\Users\lisa\Downloads\QuickCam_1469150351247(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 01310407 _____ C:\Users\lisa\Downloads\QuickCam_1469149138677(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 01300086 _____ C:\Users\lisa\Downloads\QuickCam_1469146323829(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00925942 _____ C:\Users\lisa\Downloads\QuickCam_1469583005771(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00865049 _____ C:\Users\lisa\Downloads\QuickCam_1469582316237(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00792216 _____ C:\Users\lisa\Downloads\QuickCam_1469147171539(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00700849 _____ C:\Users\lisa\Downloads\QuickCam_1469149345732(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00680240 _____ C:\Users\lisa\Downloads\QuickCam_1469147029437(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00669743 _____ C:\Users\lisa\Downloads\QuickCam_1469582275506(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00619124 _____ C:\Users\lisa\Downloads\QuickCam_1469582950245(1).mp4
2016-07-27 16:00 - 2016-07-27 16:00 - 00352489 _____ C:\Users\lisa\Downloads\QuickCam_1469150052159(1).mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01555675 _____ C:\Users\lisa\Downloads\QuickCam_1469149944992.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01524059 _____ C:\Users\lisa\Downloads\QuickCam_1469146931104.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01460013 _____ C:\Users\lisa\Downloads\QuickCam_1469150351247.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01310407 _____ C:\Users\lisa\Downloads\QuickCam_1469149138677.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 01300086 _____ C:\Users\lisa\Downloads\QuickCam_1469146323829.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00925942 _____ C:\Users\lisa\Downloads\QuickCam_1469583005771.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00865049 _____ C:\Users\lisa\Downloads\QuickCam_1469582316237.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00792216 _____ C:\Users\lisa\Downloads\QuickCam_1469147171539.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00700849 _____ C:\Users\lisa\Downloads\QuickCam_1469149345732.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00680240 _____ C:\Users\lisa\Downloads\QuickCam_1469147029437.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00669743 _____ C:\Users\lisa\Downloads\QuickCam_1469582275506.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00619124 _____ C:\Users\lisa\Downloads\QuickCam_1469582950245.mp4
2016-07-27 14:55 - 2016-07-27 14:55 - 00352489 _____ C:\Users\lisa\Downloads\QuickCam_1469150052159.mp4
2016-07-25 11:55 - 2016-07-25 11:55 - 00000000 ___SD C:\Users\lisa\Documents\My Data Sources
2016-07-20 06:31 - 2016-07-20 06:31 - 00000000 ____D C:\WINDOWS\EOONotify

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-17 16:26 - 2015-05-19 12:57 - 00000000 ____D C:\FRST
2016-08-17 16:13 - 2016-06-19 06:54 - 00000000 ____D C:\Users\lisa\AppData\Local\ClassicShell
2016-08-17 15:40 - 2016-06-19 06:01 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1534849743-2360249728-2914029306-1001
2016-08-17 15:37 - 2016-06-23 20:20 - 00004990 _____ C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for LISASCOMPUTER-lisa LisasComputer
2016-08-17 15:28 - 2016-07-13 17:11 - 00000934 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2016-08-17 15:24 - 2016-07-13 17:11 - 00000930 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2016-08-17 15:24 - 2016-06-20 21:46 - 00000000 __RDO C:\Users\lisa\OneDrive
2016-08-17 15:24 - 2016-06-20 21:43 - 00000000 __SHD C:\Users\lisa\IntelGraphicsProfiles
2016-08-17 15:23 - 2013-08-22 10:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-08-17 15:22 - 2013-08-22 09:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2016-08-17 15:21 - 2015-05-19 19:22 - 00000000 ____D C:\AdwCleaner
2016-08-17 13:43 - 2016-07-13 16:36 - 00003942 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{A0ACBCB3-23B6-4FE2-92CB-7E0E8DA1AEF0}
2016-08-17 08:47 - 2012-07-26 03:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-08-17 00:14 - 2014-03-07 15:25 - 117961216 ___SH C:\Users\lisa\Downloads\Thumbs.db
2016-08-15 14:11 - 2014-11-21 04:44 - 00863592 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-08-15 14:11 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\Inf
2016-08-13 08:04 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\rescache
2016-08-12 10:12 - 2013-08-22 10:44 - 05133264 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-08-12 10:07 - 2013-08-22 11:36 - 00000000 ___RD C:\WINDOWS\ToastData
2016-08-12 10:07 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\system32\SecureBootUpdates
2016-08-10 05:13 - 2013-08-22 11:36 - 00000000 ___HD C:\Program Files\WindowsApps
2016-08-10 05:13 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-08-10 05:09 - 2016-06-19 08:02 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-08-10 05:03 - 2016-06-19 08:02 - 147640136 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-08-09 17:04 - 2016-06-19 06:11 - 00000000 ____D C:\Users\lisa\AppData\Local\Adobe
2016-08-09 16:49 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2016-08-09 16:49 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\system32\Macromed
2016-08-07 21:30 - 2016-06-19 05:53 - 00000000 ____D C:\Users\lisa\AppData\Local\Packages
2016-08-04 18:29 - 2016-07-13 17:14 - 00002226 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-08-04 18:29 - 2016-07-13 17:14 - 00002214 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-08-01 16:18 - 2016-07-03 15:33 - 00003072 ____H C:\Users\lisa\Desktop\photothumb.db
2016-07-28 19:23 - 2016-07-13 17:11 - 00003906 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2016-07-28 19:23 - 2016-07-13 17:11 - 00003670 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2016-07-27 15:25 - 2016-06-20 10:40 - 00504488 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2016-07-25 19:44 - 2016-06-20 18:29 - 00000000 ____D C:\Users\lisa
2016-07-20 06:34 - 2016-06-24 00:12 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX
2016-07-20 06:34 - 2016-06-24 00:12 - 00000000 ___SD C:\WINDOWS\system32\GWX
2016-07-19 09:03 - 2014-08-31 21:31 - 00113152 ___SH C:\Users\lisa\Desktop\Thumbs.db

==================== Files in the root of some directories =======

2016-07-08 11:23 - 2016-07-13 14:19 - 0000132 _____ () C:\Users\lisa\AppData\Roaming\Adobe PNG Format CS6 Prefs
2016-06-25 18:43 - 2016-06-25 18:43 - 0000057 _____ () C:\ProgramData\Ament.ini
2016-07-03 14:33 - 2016-07-03 14:33 - 0000016 _____ () C:\ProgramData\mntemp
2016-07-03 14:33 - 2016-07-03 14:33 - 0004864 _____ () C:\ProgramData\oqztiqep.adk

Some files in TEMP:
====================
C:\Users\lisa\AppData\Local\Temp\dllnt_dump.dll
C:\Users\lisa\AppData\Local\Temp\libeay32.dll
C:\Users\lisa\AppData\Local\Temp\msvcr120.dll
C:\Users\lisa\AppData\Local\Temp\OfficeSetup.exe
C:\Users\lisa\AppData\Local\Temp\SetupO365HomePremRetail.x86.en-US_O365HomePremRetail_4VB9X-YNMP2-33RMG-F8788-Q67JR_act_1_.exe
C:\Users\lisa\AppData\Local\Temp\sqlite3.dll

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-08-11 03:57

==================== End of FRST.txt ============================

lisavvvv

Post #7August 17, 2016, 8:49 PM UTC

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-08-2016
Ran by [removed] (17-08-2016 16:27:33)
Running from C:\Users\[removed]\Downloads
Windows 8.1 (Update) (X64) (2016-06-21 01:43:35)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-1534849743-2360249728-2914029306-500 - Administrator - Disabled) => C:\Users\Administrator
Guest (S-1-5-21-1534849743-2360249728-2914029306-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1534849743-2360249728-2914029306-1007 - Limited - Enabled)
lisa (S-1-5-21-1534849743-2360249728-2914029306-1001 - Administrator - Enabled) => C:\Users\lisa

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 22 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 22.0.0.209 - Adobe Systems Incorporated)
Adobe Photoshop CS6 (HKLM-x32\…\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
Adobe Reader XI MUI (HKLM-x32\…\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.00 - Adobe Systems Incorporated)
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
BitTorrent (HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\…\BitTorrent) (Version: 7.9.8.42450 - BitTorrent Inc.)
Classic Shell (HKLM\…\{D4B3454F-7529-4F5F-851D-2C36933F7D64}) (Version: 4.2.5 - IvoSoft)
Conexant HD Audio (HKLM\…\CNXT_AUDIO_HDA) (Version: 8.64.52.52 - Conexant)
Cook'n (HKLM-x32\…\Cook'n) (Version: - )
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Debut Video Capture Software (HKLM-x32\…\Debut) (Version: 3.01 - NCH Software)
Dragon Assistant Application en-US version 1.5.7 (HKLM-x32\…\{1CCBE73F-4948-4711-8D12-22E2FD65D706}_is1) (Version: 1.5.7 - Nuance Communications, Inc.)
Dragon Assistant Core Recognition Service version 1.1.10 (HKLM-x32\…\{E97BA7A6-46FC-4EBF-B24A-B8362948C696}_is1) (Version: 1.1.10 - Nuance Communications, Inc.)
Dragon Assistant Language Data en-US version 1.1.3 (HKLM-x32\…\{4C0C1E4E-D3B1-4496-98EC-DA14D45EC855}_is1) (Version: 1.1.3 - Nuance Communications, Inc.)
Dragon Assistant version 1.5.7 (HKLM-x32\…\{D57A8269-3BE5-4D10-B882-64D0F2D448BF}_is1) (Version: 1.5.7 - Nuance Communications, Inc.)
DTS Studio Sound (HKLM-x32\…\{F8EB8FFC-C535-49A1-A84D-CC75CB2D6ADA}) (Version: 1.00.0064 - DTS, Inc.)
Elementals - The Magic Key (x32 Version: 2.2.0.97 - WildTangent) Hidden
Free YouTube Downloader 4.1.528 (HKLM-x32\…\{A7E19604-93AF-4611-8C9F-CE509C2B286F}_is1) (Version: - HOW Inc.)
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 52.0.2743.116 - Google Inc.)
Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden
HP Deskjet 3510 series Basic Device Software (HKLM\…\{7F20F2D1-C425-4432-96BA-EBD0C2181493}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Photo Creations (HKLM-x32\…\HP Photo Creations) (Version: 1.0.0.7702 - HP)
HP Support Solutions Framework (HKLM-x32\…\{CE7447C2-EF12-4EF3-BE51-BFC3B049C0F6}) (Version: 12.5.26.37 - HP)
HP Update (HKLM-x32\…\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
Intel(R) Management Engine Components (HKLM-x32\…\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.0.1310 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4061 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\…\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.0.4.1001 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\…\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 3.0.0.63463 - Intel Corporation)
Intel(R) Update Manager (x32 Version: 1.5.0.87 - Intel Corporation) Hidden
Intel(R) WiDi (HKLM\…\{62E7C369-64FF-452C-8F46-6BE9B77FF097}) (Version: 4.0.18.0 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\…\{c9967fbd-e3c3-4ed0-992a-5b33260f2944}) (Version: 16.1.5 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\…\{fad118b4-798f-4755-9e67-a622eec95b62}) (Version: 15.6.1 - Intel Corporation)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
King Oddball (x32 Version: 3.0.2.48 - WildTangent) Hidden
Microsoft Office 365 Home Premium - en-us (HKLM\…\O365HomePremRetail - en-us) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\…\OneDriveSetup.exe) (Version: 17.3.6390.0509 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\…\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\…\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\…\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)
Movavi Screen Capture Studio 7 (HKLM-x32\…\Movavi Screen Capture Studio 7) (Version: 7.3.0 - Movavi)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 47.0 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 47.0 (x86 en-US)) (Version: 47.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 47.0 - Mozilla)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\…\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4454.1510 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4454.1510 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4454.1510 - Microsoft Corporation) Hidden
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
PhotoScape (HKLM-x32\…\PhotoScape) (Version: - )
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
PlayReady PC Runtime amd64 (HKLM\…\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Qualcomm Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\…\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.13 - Qualcomm Atheros Communications Inc.)
Realtek PCIE Card Reader (HKLM-x32\…\{0D61A55C-3ADC-409F-BF5B-A1766D1F5944}) (Version: 6.2.9200.29053 - Realtek Semiconductor Corp.)
RogueKiller version 12 (HKLM\…\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 12 - Adlice Software)
Synaptics Pointing Device Driver (HKLM\…\SynTPDeinstKey) (Version: 16.5.2.0 - Synaptics Incorporated)
TOSHIBA Application Installer (HKLM-x32\…\{970472D0-F5F9-4158-A6E3-1AE49EFEF2D3}) (Version: 9.0.1.5 - TOSHIBA)
TOSHIBA Audio Enhancement (HKLM\…\{1515F5E3-29EA-4CD1-A981-032D88880F09}) (Version: 2.0.15.4 - Toshiba Corporation)
Toshiba Book Place (HKLM-x32\…\{11244D6B-9842-440F-8579-6A4D771A0D9B}) (Version: 3.3.9661 - K-NFB Reading Technology, Inc.)
TOSHIBA eco Utility (HKLM\…\{5944B9D4-3C2A-48DE-931E-26B31714A2F7}) (Version: 2.0.4.6405 - Toshiba Corporation)
TOSHIBA Function Key (HKLM\…\{16562A90-71BC-41A0-B890-D91B0C267120}) (Version: 1.00.6630.6403 - Toshiba Corporation)
TOSHIBA HDD Accelerator (HKLM\…\{DB4D9937-0B14-4EF1-BF9A-BB7E3B9DCB04}) (Version: 2.0.0001 - Toshiba Corporation)
TOSHIBA HDD Protection (HKLM\…\{94A90C69-71C1-470A-88F5-AA47ECC96B40}) (Version: 2.5.1.2 - Toshiba Corporation)
TOSHIBA Password Utility (HKLM-x32\…\InstallShield_{26BB68BB-CF93-4A12-BC6D-A3B6F53AC8D9}) (Version: 4.0.5.0 - Toshiba Corporation)
TOSHIBA Quality Application (HKLM-x32\…\{E69992ED-A7F6-406C-9280-1C156417BC49}) (Version: 1.0.8 - TOSHIBA)
TOSHIBA Recovery Media Creator (HKLM-x32\…\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 3.0.01.55004008 - Toshiba Corporation)
TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\…\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.2.7.0 - Toshiba Corporation)
TOSHIBA Service Station (HKLM\…\{6499E894-43F8-458B-AE35-724F4732BCDE}) (Version: 2.5.6 - Toshiba Corporation)
TOSHIBA System Driver (HKLM-x32\…\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0020 - Toshiba Corporation)
TOSHIBA System Settings (HKLM-x32\…\{05A55927-DB9B-4E26-BA44-828EBFF829F0}) (Version: 1.00.0007.32003 - Toshiba Corporation)
TOSHIBA User's Guide (HKLM-x32\…\{3384E1D9-3F18-4A98-8655-180FEF0DFC02}) (Version: 1.00.02 - TOSHIBA)
TOSHIBA VIDEO PLAYER (HKLM\…\{FF07604E-C860-40E9-A230-E37FA41F103A}) (Version: 5.3.7.63 - Toshiba Corporation)
TOSHIBARegistration (HKLM-x32\…\{5AF550B4-BB67-4E7E-82F1-2C4300279050}) (Version: 1.1.6 - TOSHIBA)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
VLC media player (HKLM-x32\…\VLC media player) (Version: 2.2.4 - VideoLAN)
WildTangent Games (HKLM-x32\…\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App (Toshiba Games) (x32 Version: 4.0.10.15 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Wonderland Solitaire (x32 Version: 2.2.0.110 - WildTangent) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1534849743-2360249728-2914029306-1001_Classes\CLSID\{162C6FB5-44D3-435B-903D-E613FA093FB5}\InprocServer32 -> C:\Users\lisa\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileCoAuthLib64.dll ()
CustomCLSID: HKU\S-1-5-21-1534849743-2360249728-2914029306-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\lisa\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\FileCoAuth.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1534849743-2360249728-2914029306-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0C48BD55-7932-4B3E-8AD7-1E5543FF40FE} - System32\Tasks\Norton Anti-Theft\Norton Error Processor => C:\Program Files (x86)\Norton Anti-Theft\Engine\1.5.0.38\SymErr.exe
Task: {0CE984FA-7992-4D33-82FC-C9DC6F65090D} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2016-06-23] (Microsoft Corporation)
Task: {1155793D-4AEB-4FF3-80DA-F469169F34AE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-07-13] (Google Inc.)
Task: {16ACA9CE-A76D-49E8-B124-F7518DF2A41D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2016-05-09] (Hewlett-Packard)
Task: {1FD72181-D822-4BCB-B0DF-BEC38856DBA0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-07-13] (Google Inc.)
Task: {276B07BC-D5E9-4A79-BEEA-60F6E7A27193} - System32\Tasks\ISM-UpdateService-e57b59e7-5862-4250-9ce0-76fb411dc0d2 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\Bootstrap.exe [2012-11-23] (Intel Corporation)
Task: {3BC10EB6-5954-4AF1-B852-E8AA043BA740} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [2012-12-07] (Microsoft Corporation)
Task: {6B5B9229-25C9-41E9-96EA-7CC0074C793D} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1534849743-2360249728-2914029306-1001 => C:\Users\lisa\AppData\Local\Microsoft\OneDrive\OneDrive.exe [2016-06-22] (Microsoft Corporation)
Task: {6BCA22A2-F067-4A6D-AAA4-A019B18A2C20} - System32\Tasks\Norton Anti-Theft\Norton Error Analyzer => C:\Program Files (x86)\Norton Anti-Theft\Engine\1.5.0.38\SymErr.exe
Task: {6DD51425-4902-4C41-9877-0774B2336761} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2013-03-19] (TOSHIBA Corporation)
Task: {7752B75D-4EF7-4FB6-B482-EEA06401B6BE} - System32\Tasks\Microsoft Office 15 Sync Maintenance for LISASCOMPUTER-lisa LisasComputer => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2016-06-23] (Microsoft Corporation)
Task: {B3BAABB1-7AF4-4578-8C79-A6629B04AD20} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-06-28] (HP Inc.)
Task: {B7EA9D50-0DD5-4388-A37B-4AB89296274B} - System32\Tasks\ISM-UpdateService-e57b59e7-5862-4250-9ce0-76fb411dc0d2-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\Bootstrap.exe [2012-11-23] (Intel Corporation)
Task: {C1DFBF8F-B180-4839-A186-F8BB5CCD6D21} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-04-05] (Synaptics Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

Shortcut: C:\Users\lisa\Favorites\NCH Software Download Site.lnk -> hxxp://www.nchsoftware.com/index.html

==================== Loaded Modules (Whitelisted) ==============

2013-04-15 12:43 - 2013-04-15 12:43 - 00016720 _____ () C:\Program Files (x86)\DTS, Inc\DTS Studio Sound\dts_apo_service.exe
2016-06-23 19:06 - 2016-06-23 19:06 - 06522944 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2016-06-23 19:03 - 2012-11-24 17:13 - 00373312 _____ () C:\Program Files\Microsoft Office 15\ClientX64\c2rui.dll
2016-06-23 19:03 - 2012-12-07 07:04 - 00513616 _____ () C:\Program Files\Microsoft Office 15\ClientX64\c2r64.dll
2016-06-23 19:03 - 2012-12-07 07:05 - 00607312 _____ () C:\Program Files\Microsoft Office 15\ClientX64\StreamServer.dll
2012-07-18 21:38 - 2012-07-18 21:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll
2011-08-12 17:57 - 2011-08-12 17:57 - 00437632 _____ () C:\Program Files\TOSHIBA\Hotkey\Hotkey\TcrdKBB.exe
2012-08-04 18:01 - 2012-08-04 18:01 - 00213136 _____ () C:\Program Files (x86)\Toshiba\System Setting\TODDMain.exe
2016-08-04 18:29 - 2016-08-02 19:41 - 02366280 _____ () C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\libglesv2.dll
2016-08-04 18:29 - 2016-08-02 19:40 - 00107848 _____ () C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\libegl.dll
2016-08-17 15:34 - 2016-08-16 09:32 - 25364552 _____ () C:\Program Files\RogueKiller\RogueKiller64.exe
2013-10-22 08:24 - 2013-05-02 14:26 - 00387984 _____ () C:\Program Files (x86)\Nuance\Dragon Assistant\Core\fl_core.dll
2013-10-22 08:24 - 2013-05-02 14:26 - 01165712 _____ () C:\Program Files (x86)\Nuance\Dragon Assistant\Core\vocon3200_asr.dll
2013-10-22 08:24 - 2013-05-02 14:26 - 00199056 _____ () C:\Program Files (x86)\Nuance\Dragon Assistant\Core\vocon3200_base.dll
2013-10-22 08:24 - 2013-05-02 14:26 - 01132944 _____ () C:\Program Files (x86)\Nuance\Dragon Assistant\Core\vocon3200_pron.dll
2013-10-22 08:24 - 2013-05-02 14:26 - 00035216 _____ () C:\Program Files (x86)\Nuance\Dragon Assistant\Core\vocon3200_platform.dll
2013-10-22 08:24 - 2013-05-02 14:26 - 00229264 _____ () C:\Program Files (x86)\Nuance\Dragon Assistant\Core\sdxg.dll
2013-10-22 08:24 - 2013-05-02 14:25 - 00027648 _____ () C:\Program Files (x86)\Nuance\Dragon Assistant\Core\WASAPIResamplingStreamCOMServer.dll
2013-10-22 07:45 - 2013-02-15 19:17 - 01199576 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2016-06-23 19:03 - 2016-06-23 19:06 - 00312896 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll
2016-06-23 19:03 - 2016-06-23 19:06 - 00354368 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\c2r32.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 09:25 - 2013-08-22 09:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1534849743-2360249728-2914029306-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\lisa\Pictures\(0000 Lisa Viger ART)\000 finding your voice video\0000 1 intro ec.JPG
DNS Servers: 192.168.254.254
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{F5130EE6-6887-4A78-8475-32680F19F724}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{FE84ECA3-A193-4C7B-8875-257D5C49A8E7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{024E86BC-6C0A-4D2B-836E-F3F277E96EC7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{F2895DE0-E5E6-4D99-8AE0-E08213C769B0}] => (Allow) C:\Program Files\Intel Corporation\Intel WiDi\WiDiApp.exe
FirewallRules: [{2F380438-CF7C-4C62-A386-3A1815468E1C}] => (Allow) C:\Users\lisa\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{8FE0177C-D110-4D5C-8D0D-24B4F9774AD0}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{E6843B7E-FFE8-4F66-B949-09ECE9177787}] => (Allow) LPort=2869
FirewallRules: [{A3E094D2-047B-4F2D-9238-494776B10A6B}] => (Allow) LPort=1900
FirewallRules: [{F141A95C-1260-46E7-9AE3-7A80D8D26A77}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{97D08BA5-EAC2-4F6B-A9A7-98486B21E00B}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{EDB37D5C-8A22-4F21-AA92-D0BDB6034F97}] => (Allow) C:\Program Files\HP\HP Deskjet 3510 series\Bin\DeviceSetup.exe
FirewallRules: [{09752B1F-7540-4292-81F9-9456111EC0EA}] => (Allow) C:\Program Files\HP\HP Deskjet 3510 series\Bin\HPNetworkCommunicator.exe
FirewallRules: [{793ECFC0-FFBE-476A-966F-E4BC91F2C911}] => (Allow) C:\Program Files\HP\HP Deskjet 3510 series\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{0828102A-2671-4826-A355-CBE4C7629DC7}] => (Allow) C:\Users\lisa\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{262D93B1-FEC3-47B5-ABB1-F96E0CF52640}] => (Allow) C:\Users\lisa\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{8FC2753A-225C-43F4-AA34-30DB76416EE3}] => (Allow) C:\Users\lisa\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{027A8589-073E-4F7F-8755-9AB6444052EC}] => (Allow) C:\Users\lisa\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{E315AC0F-75F2-40AB-BC8E-712CB711D017}] => (Allow) C:\Users\lisa\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{40CD43FE-6015-4F7A-B2B0-3B30E2C49A0A}] => (Allow) C:\Users\lisa\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [TCP Query User{E5DF8D0F-BAD6-4691-9845-F3190D640CAB}C:\users\lisa\appdata\local\dvo\cook'n11app\cook'n.exe] => (Allow) C:\users\lisa\appdata\local\dvo\cook'n11app\cook'n.exe
FirewallRules: [UDP Query User{73A4F3E2-CDD8-422E-8306-DBB8A3F821C3}C:\users\lisa\appdata\local\dvo\cook'n11app\cook'n.exe] => (Allow) C:\users\lisa\appdata\local\dvo\cook'n11app\cook'n.exe
FirewallRules: [{512C1815-0951-407D-8F04-7A4D69DC716F}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

28-07-2016 06:13:07 Scheduled Checkpoint
04-08-2016 06:51:29 Scheduled Checkpoint
10-08-2016 04:52:46 Windows Update
17-08-2016 08:42:31 Windows Update

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (08/17/2016 03:34:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 47.0.0.5999, time stamp: 0x5753660e
Faulting module name: mozglue.dll, version: 47.0.0.5999, time stamp: 0x57535438
Exception code: 0x80000003
Fault offset: 0x0000f3ad
Faulting process id: 0x2f4
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3
Faulting package full name: plugin-container.exe4
Faulting package-relative application ID: plugin-container.exe5

Error: (08/16/2016 10:38:44 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 47.0.0.5999, time stamp: 0x5753660e
Faulting module name: mozglue.dll, version: 47.0.0.5999, time stamp: 0x57535438
Exception code: 0x80000003
Fault offset: 0x0000f3ad
Faulting process id: 0x2130
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3
Faulting package full name: plugin-container.exe4
Faulting package-relative application ID: plugin-container.exe5

Error: (08/16/2016 09:13:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Photoshop.exe, version: 13.0.0.0, time stamp: 0x4f61beba
Faulting module name: KERNELBASE.dll, version: 6.3.9600.18340, time stamp: 0x5736541b
Exception code: 0xc06d007e
Fault offset: 0x00014878
Faulting process id: 0x157c
Faulting application start time: 0xPhotoshop.exe0
Faulting application path: Photoshop.exe1
Faulting module path: Photoshop.exe2
Report Id: Photoshop.exe3
Faulting package full name: Photoshop.exe4
Faulting package-relative application ID: Photoshop.exe5

Error: (08/16/2016 08:13:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 47.0.0.5999, time stamp: 0x5753660e
Faulting module name: mozglue.dll, version: 47.0.0.5999, time stamp: 0x57535438
Exception code: 0x80000003
Fault offset: 0x0000f3ad
Faulting process id: 0x35f0
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3
Faulting package full name: plugin-container.exe4
Faulting package-relative application ID: plugin-container.exe5

Error: (08/16/2016 06:21:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 47.0.0.5999, time stamp: 0x5753660e
Faulting module name: mozglue.dll, version: 47.0.0.5999, time stamp: 0x57535438
Exception code: 0x80000003
Fault offset: 0x0000f3ad
Faulting process id: 0x1938
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3
Faulting package full name: plugin-container.exe4
Faulting package-relative application ID: plugin-container.exe5

Error: (08/16/2016 06:17:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 47.0.0.5999, time stamp: 0x5753660e
Faulting module name: mozglue.dll, version: 47.0.0.5999, time stamp: 0x57535438
Exception code: 0x80000003
Fault offset: 0x0000f3ad
Faulting process id: 0x1f58
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3
Faulting package full name: plugin-container.exe4
Faulting package-relative application ID: plugin-container.exe5

Error: (08/16/2016 05:47:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 47.0.0.5999, time stamp: 0x5753660e
Faulting module name: mozglue.dll, version: 47.0.0.5999, time stamp: 0x57535438
Exception code: 0x80000003
Fault offset: 0x0000f3ad
Faulting process id: 0x32ec
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3
Faulting package full name: plugin-container.exe4
Faulting package-relative application ID: plugin-container.exe5

Error: (08/16/2016 01:04:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 47.0.0.5999, time stamp: 0x5753660e
Faulting module name: mozglue.dll, version: 47.0.0.5999, time stamp: 0x57535438
Exception code: 0x80000003
Fault offset: 0x0000f3ad
Faulting process id: 0x2244
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3
Faulting package full name: plugin-container.exe4
Faulting package-relative application ID: plugin-container.exe5

Error: (08/16/2016 09:02:02 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 47.0.0.5999, time stamp: 0x5753660e
Faulting module name: mozglue.dll, version: 47.0.0.5999, time stamp: 0x57535438
Exception code: 0x80000003
Fault offset: 0x0000f3ad
Faulting process id: 0x300c
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3
Faulting package full name: plugin-container.exe4
Faulting package-relative application ID: plugin-container.exe5

Error: (08/15/2016 06:27:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 47.0.0.5999, time stamp: 0x5753660e
Faulting module name: mozglue.dll, version: 47.0.0.5999, time stamp: 0x57535438
Exception code: 0x80000003
Fault offset: 0x0000f3ad
Faulting process id: 0x1a18
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3
Faulting package full name: plugin-container.exe4
Faulting package-relative application ID: plugin-container.exe5

System errors:
=============
Error: (08/17/2016 03:42:39 PM) (Source: disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk0\DR0.

Error: (08/17/2016 03:22:47 PM) (Source: BTHUSB) (EventID: 30) (User: )
Description: The local adapter does not support an important Low Energy controller state. The minimum required supported state mask is 0x1f7fffff, got 0x1f3fffff. Low Energy functionality will be disabled.

Error: (08/17/2016 03:21:59 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.

Module Path: C:\WINDOWS\System32\IWMSSvc.dll

Error: (08/17/2016 03:21:59 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.

Module Path: C:\WINDOWS\System32\IWMSSvc.dll

Error: (08/17/2016 03:21:43 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.

Module Path: C:\WINDOWS\System32\IWMSSvc.dll

Error: (08/17/2016 03:20:16 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Media Player Network Sharing Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

Error: (08/17/2016 03:20:16 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Intel(R) Dynamic Application Loader Host Interface Service service terminated unexpectedly. It has done this 1 time(s).

Error: (08/17/2016 03:20:16 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The HP Support Solutions Framework Service service terminated unexpectedly. It has done this 1 time(s).

Error: (08/17/2016 03:20:16 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The TMachInfo service terminated unexpectedly. It has done this 1 time(s).

Error: (08/17/2016 03:20:16 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Intel(R) Management and Security Application Local Management Service service terminated unexpectedly. It has done this 1 time(s).

==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7-4700MQ CPU @ 2.40GHz
Percentage of memory in use: 70%
Total physical RAM: 8116.09 MB
Available physical RAM: 2417.57 MB
Total Virtual: 9396.09 MB
Available Virtual: 4992.11 MB

==================== Drives ================================

Drive c: (TI10671100B) (Fixed) (Total:684.67 GB) (Free:92.81 GB) NTFS
Drive d: (Jun 15 2016) (CDROM) (Total:4.38 GB) (Free:0.05 GB) UDF

==================== MBR & Partition Table ==================

==================== End of Addition.txt ============================

Satchfan

Post #8August 17, 2016, 9:21 PM UTC

Thanks for the logs.

It’ll take me time to look through them but an observation while I’m doing that:

P2P - I see you have P2P software, (BitTorrent ), installed on your machine. Although BitTorrent itself is a legitimate program, it is usually seen here in conjunction with other programs used for P2P file-sharing.

We are not here to pass judgment on file-sharing as a concept but we will warn you that engaging in this activity will always make your computer very susceptible to infection and re-infection.

===================================================

Meanwhile, please also run this and post the log.

Run CKScanner

Download CKScanner by askey127 from here & save it to your Desktop.

double-click CKScanner.exe then click Search For Files
when the cursor hourglass disappears, click Save List To File
a message box will verify the file saved
double-click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply.

Thanks

Satchfan

Post #9August 20, 2016, 9:08 PM UTC

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.htmland start a new topic

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Infected [Closed]

✨ Ask AI

Ask AI