DCdavid28

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-02-2015 Ran by David at 2015-02-23 17:27:54 Running from C:\Users\David\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) 7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - ) Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated) Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.4.154 - Adobe Systems, Inc.) CCleaner (HKLM\...\CCleaner) (Version: 4.17 - Piriform) D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd) Deluge 1.3.7 (HKLM-x32\...\Deluge) (Version: - ) File Association Helper (HKLM\...\{C168639F-5810-4EC8-B1E8-0251AA8A771C}) (Version: 1.2.225.65451 - WinZip Computing International, LLC) Foxit Cloud (HKLM-x32\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 2.3.25.1124 - Foxit Software Inc.) Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 7.0.6.1126 - Foxit Software Inc.) GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team) GIMP Extensions 2.8.20140204 (HKLM\...\GIMP Extensions) (Version: 2.8.20140204 - Pedro Cunha) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.115 - Google Inc.) Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation) K-Lite Codec Pack 10.6.5 Full (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.6.5 - ) KMSpico v9.1.3 (HKLM\...\KMSpico_is1) (Version: 9.1.3 - ) LibreOffice 4.3 Help Pack (English (United States)) (HKLM-x32\...\{6B888EAE-4BA5-4422-A059-542A8D1A24AE}) (Version: 4.3.5.2 - The Document Foundation) LibreOffice 4.3.2.2 (HKLM-x32\...\{9C13F99C-6E1A-4126-AE91-EAA2DADE08D6}) (Version: 4.3.2.2 - The Document Foundation) Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation) Microsoft OneDrive (HKU\S-1-5-21-1072971881-875114510-2009490154-1006\...\OneDriveSetup.exe) (Version: 17.3.1229.0918 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.31211.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation) Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Sierra Utilities (HKLM-x32\...\Sierra Utilities) (Version: - ) spritesaga 0.975.000 (HKLM-x32\...\{2E1AFAD8-DEEC-40B8-995C-858C32D31EEE}_is1) (Version: 0.975.000 - Gsoft) swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden Unity Web Player (HKU\S-1-5-21-1072971881-875114510-2009490154-1006\...\UnityWebPlayer) (Version: 4.6.0f3 - Unity Technologies ApS) Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies) Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.) Winamp (HKLM-x32\...\Winamp) (Version: 5.666 - Nullsoft, Inc) Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation) WinZip 19.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240E7}) (Version: 19.0.11294 - WinZip Computing, S.L. ) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-1072971881-875114510-2009490154-1006_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\David\AppData\Local\Microsoft\SkyDrive\17.3.1229.0918\amd64\FileSyncApi64.dll (Microsoft Corporation) ==================== Restore Points ========================= 07-02-2015 06:10:50 Windows Update 11-02-2015 07:15:40 Windows Update 14-02-2015 09:21:09 Windows Update 19-02-2015 09:22:39 Windows Update 23-02-2015 13:25:10 Windows Update ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2013-08-22 08:25 - 2014-09-11 18:37 - 00000912 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 tools.bvrp.com 127.0.0.1 tools.avanquest.com 127.0.0.1 217.195.25.72 ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {13852AC2-1CB0-4797-9F41-435393EBCF39} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-02-15] (Microsoft Corporation) Task: {15A86F7D-4350-4003-958B-07DF3BA72FE2} - \Installer_iwebar No Task File <==== ATTENTION Task: {3222AE65-342D-465E-9420-34D4C72077D0} - System32\Tasks\{29598C84-B397-4C55-A8BE-9BD51D7E098E} => pcalua.exe -a C:\Users\David\AppData\Local\Akamai\uninstall.exe Task: {35297494-E294-42C1-8B05-0029235404E5} - System32\Tasks\ProPCCleaner_Start => C:\Program Files (x86)\Pro PC Cleaner\ProPCCleaner.exe Task: {4E605022-6F87-46F6-8122-328250209C46} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1072971881-875114510-2009490154-1006 => %localappdata%\Microsoft\SkyDrive\SkyDrive.exe Task: {62936A41-7820-4425-9604-037C6F2349BD} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION Task: {83CDDFAC-88F8-43D4-B95F-5C015B970416} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-25] (Google Inc.) Task: {89125F0A-E505-406D-9268-E0CE739CF11F} - System32\Tasks\{E5C4BC33-F4FA-43A9-9E9F-A588FAF76DAA} => pcalua.exe -a C:\solosolitaire\install.exe -d C:\solosolitaire Task: {A87F2757-28C6-4B7D-85E3-8C53E2A45491} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-25] (Google Inc.) Task: {B25121F5-3423-4E37-AE99-7BE064A429DB} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION Task: {BFB38514-BE0F-4405-9BAF-FD7E897FE467} - System32\Tasks\{BEBC0AB3-F182-46DD-A08D-1EF77E5E2E0D} => pcalua.exe -a C:\Users\David\Downloads\NetFx64.exe -d C:\Users\David\Downloads Task: {C4E66A2D-1712-4BE5-8EC8-1F5F84495B1C} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-08-21] (Piriform Ltd) Task: {CD6E88DE-E622-40DA-91BB-41574C1915B8} - System32\Tasks\ProPCCleaner_Popup => C:\Program Files (x86)\Pro PC Cleaner\Splash.exe Task: {D1E7F58C-3DC5-4EC5-A43E-C41C45229690} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1072971881-875114510-2009490154-1006 => C:\Program Files (x86)\RealNetworks\RealDownloader\RealUpgrade.exe Task: {DA25E576-7947-4E01-B814-DFBB0B4D8346} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04] (Adobe Systems Incorporated) Task: {DC65F719-23D5-4B70-9AD1-FB10DD3877EF} - System32\Tasks\AutoPico Daily Restart => C:\Program Files\KMSpico\AutoPico.exe [2013-12-11] () Task: {DCC2EED4-59B0-405B-B852-4C0F6A9E4696} - System32\Tasks\Driver Robot => C:\Program Files (x86)\Driver Robot\Driver Robot.lnk Task: {E23B7050-46A3-4F18-9302-10B52A6EEE83} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION Task: {E8758278-E722-4478-A1E0-80A6B198A435} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1072971881-875114510-2009490154-1006 => C:\Program Files (x86)\RealNetworks\RealDownloader\RealUpgrade.exe Task: {EE9695C2-11F2-48F9-9ABA-ED0F94AC0560} - System32\Tasks\{39EFDC52-7C42-42C6-B49B-721AEC72628A} => pcalua.exe -a C:\Users\MrKline\Desktop\Installers\DELL_TOUCHPAD----POINTING-ST_A13_R250328.exe -d C:\Users\MrKline\Desktop\Installers Task: {F1E55262-F476-42CF-81DD-A31531C29CCB} - System32\Tasks\Installer_cr => C:\Users\System Control\AppData\Local\Installer\Installcr_10787\DC8289.tmp Task: {F674D895-6226-43BF-AE94-8DDE36AEB2AC} - \DonutQuotes No Task File <==== ATTENTION Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION Task: C:\Windows\Tasks\Driver Robot.job => C:\Program Files (x86)\Driver Robot\Driver Robot.lnk Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============== 2015-02-23 10:30 - 2015-02-23 10:30 - 10964568 _____ () C:\Users\David\AppData\Local\XYZSOFT\MOKA\client.exe 2015-02-23 10:30 - 2015-02-23 10:30 - 00030208 _____ () C:\Users\David\AppData\Local\XYZSOFT\MOKA\libvorbisfile-3.dll 2015-02-23 10:30 - 2015-02-23 10:30 - 00016896 _____ () C:\Users\David\AppData\Local\XYZSOFT\MOKA\libogg-0.dll 2015-02-23 10:30 - 2015-02-23 10:30 - 00157184 _____ () C:\Users\David\AppData\Local\XYZSOFT\MOKA\libvorbis-0.dll 2015-02-20 11:47 - 2015-02-17 17:44 - 01117512 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\libglesv2.dll 2015-02-20 11:47 - 2015-02-17 17:44 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\libegl.dll 2015-02-20 11:47 - 2015-02-17 17:44 - 09171272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\pdf.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) AlternateDataStreams: C:\ProgramData\Temp:CE2C623F ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) =============== (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-1072971881-875114510-2009490154-1006\Control Panel\Desktop\\Wallpaper -> C:\Users\David\AppData\Roaming\Microsoft\Windows Photo Viewer\Windows Photo Viewer Wallpaper.jpg DNS Servers: 192.168.1.254 ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) HKU\S-1-5-21-1072971881-875114510-2009490154-1006\...\StartupApproved\Run: => "msnmsgr" ==================== Accounts: ============================= Administrator (S-1-5-21-1072971881-875114510-2009490154-500 - Administrator - Disabled) David (S-1-5-21-1072971881-875114510-2009490154-1006 - Administrator - Enabled) => C:\Users\David Guest (S-1-5-21-1072971881-875114510-2009490154-501 - Limited - Disabled) ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (02/23/2015 08:15:18 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: wmprph.exe, version: 12.0.9600.16384, time stamp: 0x5215ef9d Faulting module name: ntdll.dll, version: 6.3.9600.17630, time stamp: 0x54b0e17a Exception code: 0xc0000005 Fault offset: 0x0000000000039a5a Faulting process id: 0x59c Faulting application start time: 0xwmprph.exe0 Faulting application path: wmprph.exe1 Faulting module path: wmprph.exe2 Report Id: wmprph.exe3 Faulting package full name: wmprph.exe4 Faulting package-relative application ID: wmprph.exe5 Error: (02/23/2015 08:14:56 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: wmprph.exe, version: 12.0.9600.16384, time stamp: 0x5215ef9d Faulting module name: jscript.dll, version: 5.8.9600.17631, time stamp: 0x54b332a9 Exception code: 0xc000041d Fault offset: 0x0000000000011e04 Faulting process id: 0x918 Faulting application start time: 0xwmprph.exe0 Faulting application path: wmprph.exe1 Faulting module path: wmprph.exe2 Report Id: wmprph.exe3 Faulting package full name: wmprph.exe4 Faulting package-relative application ID: wmprph.exe5 Error: (02/23/2015 08:14:49 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: wmprph.exe, version: 12.0.9600.16384, time stamp: 0x5215ef9d Faulting module name: jscript.dll, version: 5.8.9600.17631, time stamp: 0x54b332a9 Exception code: 0xc0000005 Fault offset: 0x0000000000011e04 Faulting process id: 0x918 Faulting application start time: 0xwmprph.exe0 Faulting application path: wmprph.exe1 Faulting module path: wmprph.exe2 Report Id: wmprph.exe3 Faulting package full name: wmprph.exe4 Faulting package-relative application ID: wmprph.exe5 Error: (02/23/2015 08:11:30 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: wmprph.exe, version: 12.0.9600.16384, time stamp: 0x5215ef9d Faulting module name: ntdll.dll, version: 6.3.9600.17630, time stamp: 0x54b0e17a Exception code: 0xc0000005 Fault offset: 0x0000000000039a5a Faulting process id: 0x918 Faulting application start time: 0xwmprph.exe0 Faulting application path: wmprph.exe1 Faulting module path: wmprph.exe2 Report Id: wmprph.exe3 Faulting package full name: wmprph.exe4 Faulting package-relative application ID: wmprph.exe5 Error: (02/22/2015 06:46:18 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: Service_KMS.exe, version: 11.0.0.0, time stamp: 0x52a8d15d Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0x00000000 Fault offset: 0x00007ffd053e0565 Faulting process id: 0x768 Faulting application start time: 0xService_KMS.exe0 Faulting application path: Service_KMS.exe1 Faulting module path: Service_KMS.exe2 Report Id: Service_KMS.exe3 Faulting package full name: Service_KMS.exe4 Faulting package-relative application ID: Service_KMS.exe5 Error: (02/22/2015 05:57:49 PM) (Source: Chrome) (EventID: 1) (User: NT AUTHORITY) Description: Chrome has encountered a fatal error. ver=40.0.2214.115;lang=;guid=10164DDF51D44F00AB76E2DC48E65FFF;is_machine=1;oop=1;upload=1;minidump=C:\Program Files (x86)\Google\CrashReports\3a15ca5b-53a0-4682-a6ae-097baced74dd.dmp Error: (02/21/2015 07:26:51 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: wmprph.exe, version: 12.0.9600.16384, time stamp: 0x5215ef9d Faulting module name: ntdll.dll, version: 6.3.9600.17630, time stamp: 0x54b0e17a Exception code: 0xc0000005 Fault offset: 0x0000000000039a5a Faulting process id: 0xcf4 Faulting application start time: 0xwmprph.exe0 Faulting application path: wmprph.exe1 Faulting module path: wmprph.exe2 Report Id: wmprph.exe3 Faulting package full name: wmprph.exe4 Faulting package-relative application ID: wmprph.exe5 Error: (02/21/2015 07:26:14 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: wmprph.exe, version: 12.0.9600.16384, time stamp: 0x5215ef9d Faulting module name: jscript.dll, version: 5.8.9600.17631, time stamp: 0x54b332a9 Exception code: 0xc000041d Fault offset: 0x0000000000011e74 Faulting process id: 0x58c Faulting application start time: 0xwmprph.exe0 Faulting application path: wmprph.exe1 Faulting module path: wmprph.exe2 Report Id: wmprph.exe3 Faulting package full name: wmprph.exe4 Faulting package-relative application ID: wmprph.exe5 Error: (02/21/2015 07:26:09 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: wmprph.exe, version: 12.0.9600.16384, time stamp: 0x5215ef9d Faulting module name: jscript.dll, version: 5.8.9600.17631, time stamp: 0x54b332a9 Exception code: 0xc0000005 Fault offset: 0x0000000000011e74 Faulting process id: 0x58c Faulting application start time: 0xwmprph.exe0 Faulting application path: wmprph.exe1 Faulting module path: wmprph.exe2 Report Id: wmprph.exe3 Faulting package full name: wmprph.exe4 Faulting package-relative application ID: wmprph.exe5 Error: (02/21/2015 06:01:25 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: The program 78AC.exe version 0.0.0.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: 984 Start Time: 01d04dc57cc99852 Termination Time: 4294967295 Application Path: C:\Users\David\AppData\Local\Temp\78AC.exe Report Id: f984692e-b9b8-11e4-8289-001d09a9470f Faulting package full name: Faulting package-relative application ID: System errors: ============= Error: (02/23/2015 01:46:12 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY) Description: Installation Failure: Windows failed to install the following update with error 0x80073712: Security Update for Internet Explorer Flash Player for Windows 8.1 for x64-based Systems (KB3021953). Error: (02/22/2015 06:46:46 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: The Service KMSELDI service terminated unexpectedly. It has done this 1 time(s). Error: (02/22/2015 06:45:11 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: A timeout was reached (30000 milliseconds) while waiting for the Optimizer Pro Crash Monitor service to connect. Error: (02/21/2015 01:08:35 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY) Description: Installation Failure: Windows failed to install the following update with error 0x80073712: Security Update for Internet Explorer Flash Player for Windows 8.1 for x64-based Systems (KB3021953). Error: (02/19/2015 00:39:29 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: The Service KMSELDI service terminated unexpectedly. It has done this 1 time(s). Error: (02/19/2015 00:37:42 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: A timeout was reached (30000 milliseconds) while waiting for the Optimizer Pro Crash Monitor service to connect. Error: (02/19/2015 00:35:55 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY) Description: Installation Failure: Windows failed to install the following update with error 0x80073712: Security Update for Internet Explorer Flash Player for Windows 8.1 for x64-based Systems (KB3021953). Error: (02/19/2015 00:26:17 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: The Service KMSELDI service terminated unexpectedly. It has done this 1 time(s). Error: (02/19/2015 00:24:49 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: A timeout was reached (30000 milliseconds) while waiting for the Optimizer Pro Crash Monitor service to connect. Error: (02/19/2015 00:22:58 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY) Description: Installation Failure: Windows failed to install the following update with error 0x8024001e: Definition Update for Windows Defender - KB2267602 (Definition 1.193.281.0). Microsoft Office Sessions: ========================= Error: (02/23/2015 08:15:18 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: wmprph.exe12.0.9600.163845215ef9dntdll.dll6.3.9600.1763054b0e17ac00000050000000000039a5a59c01d04f6ac281d960C:\Program Files\Windows Media Player\wmprph.exeC:\Windows\SYSTEM32\ntdll.dll0300d2b6-bb5e-11e4-828a-001d09a9470f Error: (02/23/2015 08:14:56 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: wmprph.exe12.0.9600.163845215ef9djscript.dll5.8.9600.1763154b332a9c000041d0000000000011e0491801d04f6a3b042cfeC:\Program Files\Windows Media Player\wmprph.exeC:\Windows\System32\jscript.dllf595d2de-bb5d-11e4-828a-001d09a9470f Error: (02/23/2015 08:14:49 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: wmprph.exe12.0.9600.163845215ef9djscript.dll5.8.9600.1763154b332a9c00000050000000000011e0491801d04f6a3b042cfeC:\Program Files\Windows Media Player\wmprph.exeC:\Windows\System32\jscript.dllf12918c7-bb5d-11e4-828a-001d09a9470f Error: (02/23/2015 08:11:30 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: wmprph.exe12.0.9600.163845215ef9dntdll.dll6.3.9600.1763054b0e17ac00000050000000000039a5a91801d04f6a3b042cfeC:\Program Files\Windows Media Player\wmprph.exeC:\Windows\SYSTEM32\ntdll.dll7a968bf1-bb5d-11e4-828a-001d09a9470f Error: (02/22/2015 06:46:18 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Service_KMS.exe11.0.0.052a8d15dunknown0.0.0.0000000000000000000007ffd053e056576801d04ef99b369f92C:\Program Files\KMSpico\Service_KMS.exeunknownfe75586a-baec-11e4-828a-001d09a9470f Error: (02/22/2015 05:57:49 PM) (Source: Chrome) (EventID: 1) (User: NT AUTHORITY) Description: Chrome has encountered a fatal error. ver=40.0.2214.115;lang=;guid=10164DDF51D44F00AB76E2DC48E65FFF;is_machine=1;oop=1;upload=1;minidump=C:\Program Files (x86)\Google\CrashReports\3a15ca5b-53a0-4682-a6ae-097baced74dd.dmp Error: (02/21/2015 07:26:51 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: wmprph.exe12.0.9600.163845215ef9dntdll.dll6.3.9600.1763054b0e17ac00000050000000000039a5acf401d04e36402e4414C:\Program Files\Windows Media Player\wmprph.exeC:\Windows\SYSTEM32\ntdll.dll7e471294-ba29-11e4-8289-001d09a9470f Error: (02/21/2015 07:26:14 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: wmprph.exe12.0.9600.163845215ef9djscript.dll5.8.9600.1763154b332a9c000041d0000000000011e7458c01d04c8e06af2eafC:\Program Files\Windows Media Player\wmprph.exeC:\Windows\System32\jscript.dll686300f9-ba29-11e4-8289-001d09a9470f Error: (02/21/2015 07:26:09 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: wmprph.exe12.0.9600.163845215ef9djscript.dll5.8.9600.1763154b332a9c00000050000000000011e7458c01d04c8e06af2eafC:\Program Files\Windows Media Player\wmprph.exeC:\Windows\System32\jscript.dll657a517c-ba29-11e4-8289-001d09a9470f Error: (02/21/2015 06:01:25 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: 78AC.exe0.0.0.098401d04dc57cc998524294967295C:\Users\David\AppData\Local\Temp\78AC.exef984692e-b9b8-11e4-8289-001d09a9470f CodeIntegrity Errors: =================================== Date: 2014-11-23 14:42:12.090 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-11-23 14:42:11.512 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-11-22 06:45:46.620 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-11-22 06:45:46.417 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-11-22 06:45:46.090 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-11-22 06:45:45.871 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-11-22 06:45:45.543 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-11-22 06:45:45.324 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-11-22 06:45:45.012 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-11-22 06:45:44.777 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. ==================== Memory info =========================== Processor: Intel® Core2 Duo CPU T7250 @ 2.00GHz Percentage of memory in use: 54% Total physical RAM: 4086.36 MB Available physical RAM: 1858.29 MB Total Pagefile: 6006.36 MB Available Pagefile: 3473.99 MB Total Virtual: 131072 MB Available Virtual: 131071.8 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:70.2 GB) (Free:37.77 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 74.5 GB) (Disk ID: 000573B9) Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=70.2 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=4 GB) - (Type=05) ==================== End Of Log ============================

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-02-2015 Ran by David (administrator) on FAMCOMP-13210 on 23-02-2015 17:26:11 Running from C:\Users\David\Downloads Loaded Profiles: David (Available profiles: David) Platform: Windows 8.1 Pro (X64) OS Language: English (United States) Internet Explorer Version 11 (Default browser: Chrome) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe (Foxit Software Inc.) C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe (Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe (Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmprph.exe () C:\Users\David\AppData\Local\XYZSOFT\MOKA\client.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [729272 2014-01-28] (Nico Mak Computing) HKLM-x32\...\Run: [WinampAgent] => C:\Program Files (x86)\Winamp\winampa.exe [85600 2013-12-12] (Nullsoft, Inc.) HKU\S-1-5-21-1072971881-875114510-2009490154-1006\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd) Startup: C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Download.lnk ShortcutTarget: Download.lnk -> C:\ProgramData\{6e8e309c-4d80-fc2a-6e8e-e309c4d8c271}\Download.exe (No File) Startup: C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\In_The_End_-_Linkin_Park_(Lyrics)_[HD].mp3.lnk ShortcutTarget: In_The_End_-_Linkin_Park_(Lyrics)_[HD].mp3.lnk -> C:\ProgramData\{e27ef54a-a9a9-aea9-e27e-ef54aa9ad52a}\In_The_End_-_Linkin_Park_(Lyrics)_[HD].mp3.exe (No File) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) ProxyServer: [HKLM] => http=127.0.0.1:63940;https=127.0.0.1:63940 ProxyServer: [HKLM-x32] => http=127.0.0.1:63940;https=127.0.0.1:63940 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com HKU\S-1-5-21-1072971881-875114510-2009490154-1006\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/ SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://Lasaoren.com/results.php?f=4&q={searchTerms}&a=lrn_file_14_46_ch&cd=2XzuyEtN2Y1L1QzutDtDtC0EyE0CtCyDtDyDtA0BzyzyyB0BtN0D0Tzu0StCtDyEyCtN1L2XzutAtFyCtFtCtFtCtN1L1CzutCyEtBzytDyD1V1OtN1L1G1B1V1N2Y1L1Qzu2StD0EtAzztCzyyDtCtGtCyDyCyEtGyE0DtAyDtGyEzzyEyDtGtAzy0CyB0ByEyEyB0FtDtB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAyE0C0EyD0D0EyEtG0DzyyBtDtGyEzy0B0FtG0AtDzzyBtGtD0F0E0D0AyD0E0AyD0CyB0D2Q&cr=1612888535&ir= SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://Lasaoren.com/results.php?f=4&q={searchTerms}&a=lrn_file_14_46_ch&cd=2XzuyEtN2Y1L1QzutDtDtC0EyE0CtCyDtDyDtA0BzyzyyB0BtN0D0Tzu0StCtDyEyCtN1L2XzutAtFyCtFtCtFtCtN1L1CzutCyEtBzytDyD1V1OtN1L1G1B1V1N2Y1L1Qzu2StD0EtAzztCzyyDtCtGtCyDyCyEtGyE0DtAyDtGyEzzyEyDtGtAzy0CyB0ByEyEyB0FtDtB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAyE0C0EyD0D0EyEtG0DzyyBtDtGyEzy0B0FtG0AtDzzyBtGtD0F0E0D0AyD0E0AyD0CyB0D2Q&cr=1612888535&ir= Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 StartMenuInternet: IEXPLORE.EXE - iexplore.exe FireFox: ======== FF ProfilePath: C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\5ju3egmb.default FF DefaultSearchEngine: Bing FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1214154.dll (Adobe Systems, Inc.) FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation) FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKU\S-1-5-21-1072971881-875114510-2009490154-1006: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\David\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF Plugin HKU\S-1-5-21-1072971881-875114510-2009490154-1006: xyzgl-plugin@xyz-soft.com -> C:\Program Files (x86)\spritesaga\npxyzgl.dll (XYZ-SOFT Inc.) FF user.js: detected! => C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\5ju3egmb.default\user.js FF Extension: jid09XfBwUWnvPx4wWsfBWMCm4Jj69Ejetpack - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\5ju3egmb.default\Extensions\jid0-9XfBwUWnvPx4wWsfBWMCm4Jj69E@jetpack [2014-11-25] FF Extension: jid1CxAfu9DDH0Q8gQjetpack - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\5ju3egmb.default\Extensions\jid1-CxAfu9DDH0Q8gQ@jetpack [2014-11-25] FF Extension: shoppingassistookongcom - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\5ju3egmb.default\Extensions\shoppingassist@ookong.com [2014-11-29] FF Extension: FfChrome - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\5ju3egmb.default\Extensions\{9bc51d13-3849-4541-a69c-da418934ca05}.xpi [2014-11-15] FF Extension: Adblock Plus - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\5ju3egmb.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-15] FF Extension: No Name - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\5ju3egmb.default\extensions\b6e4f54065ff48dd97db30ca@c9b45f807bf54a45a4669e51c.com [Not Found] Chrome: ======= CHR dev: Chrome dev build detected! <======= ATTENTION CHR DefaultSearchKeyword: Default -> bing.com CHR DefaultSearchURL: Default -> https://www.bing.com/search?setmkt=en-US&q={searchTerms} CHR DefaultNewTabURL: Default -> https://www.bing.com/chrome/newtab?setmkt=en-US CHR DefaultSuggestURL: Default -> http://api.bing.com/osjson.aspx?query={searchTerms}&language={language} CHR Profile: C:\Users\David\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Magic Actions for YouTube™) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\abjcfabbhafbcdfjoecdgepllmpfceif [2014-11-27] CHR Extension: (Google Drive) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-13] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-24] CHR Extension: (YouTube) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-24] CHR Extension: (Adblock Plus) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-11-26] CHR Extension: (Pandora) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbangkleohkafngihneedemihgfeikcl [2015-01-16] CHR Extension: (Bing Rewards Helper) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\neodenankcjdlhndmpcffjmcealafaig [2014-12-02] CHR Extension: (Google Wallet) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-07] CHR Extension: (Gmail) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-24] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 FoxitCloudUpdateService; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [244448 2014-10-28] (Foxit Software Inc.) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [1050904 2013-12-11] () [File not signed] R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-21] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-21] (Microsoft Corporation) S2 51cdb72; "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro 3.11\OptProCrash.dll",ENT ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63al.sys [5170176 2013-07-01] (Broadcom Corporation) U3 dtscsidrv; C:\Windows\System32\Drivers\dtscsidrv.sys [309248 2014-09-22] (Disc Soft Ltd) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-23] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation) S3 RTL8187B; C:\Windows\system32\DRIVERS\rtl8187B.sys [459336 2013-06-18] (Realtek Semiconductor Corporation ) R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-09-22] (Duplex Secure Ltd.) S3 SWDUMon; C:\Windows\system32\DRIVERS\SWDUMon.sys [16152 2015-01-07] () R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-21] (Microsoft Corporation) S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X] S1 MpKsl3c1f0b06; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DED0355E-B37C-4821-8AA3-3608D0429618}\MpKsl3c1f0b06.sys [X] S3 pmem; \??\C:\Users\David\AppData\Local\Temp\_MEI30922\drivers\winpmem64.sys [X] S3 X6va027; \??\C:\Windows\SysWOW64\Drivers\X6va027 [X] S3 xhunter1; \??\C:\Windows\xhunter1.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-23 17:26 - 2015-02-23 17:26 - 00013554 _____ () C:\Users\David\Downloads\FRST.txt 2015-02-23 17:26 - 2015-02-23 17:26 - 00000000 ____D () C:\FRST 2015-02-23 17:25 - 2015-02-23 17:25 - 02087424 _____ (Farbar) C:\Users\David\Downloads\FRST64.exe 2015-02-23 10:30 - 2015-02-23 10:30 - 00000000 ____D () C:\Users\David\AppData\Local\XYZSOFT 2015-02-23 10:29 - 2015-02-23 10:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\spritesaga 2015-02-23 10:29 - 2015-02-23 10:29 - 00000000 ____D () C:\Program Files (x86)\spritesaga 2015-02-23 10:28 - 2015-02-23 10:29 - 00755008 _____ (Gsoft ) C:\Users\David\Downloads\spritesaga_3D_Engine.exe 2015-02-23 08:08 - 2015-02-23 08:08 - 09736372 _____ () C:\Users\David\Downloads\WD0223.wmv 2015-02-22 18:11 - 2015-02-23 17:14 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-02-22 18:11 - 2015-02-22 18:11 - 00001114 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2015-02-22 18:11 - 2015-02-22 18:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2015-02-22 18:10 - 2015-02-22 18:11 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2015-02-22 18:10 - 2015-02-22 18:10 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-02-22 18:10 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-02-22 18:10 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-02-22 18:10 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-02-22 18:08 - 2015-02-22 18:10 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\David\Downloads\mbam-setup-2.0.4.1028.exe 2015-02-21 06:01 - 2015-02-21 06:01 - 00000000 ____D () C:\ProgramData\982148118371213435 2015-02-21 06:00 - 2015-02-21 06:00 - 00000000 ____D () C:\ProgramData\pffacjkkbccnegojpeibnlfniacnaljg 2015-02-21 05:59 - 2015-02-22 18:42 - 00000000 ____D () C:\ProgramData\{e27ef54a-a9a9-aea9-e27e-ef54aa9ad52a} 2015-02-19 16:02 - 2015-02-22 18:42 - 00000000 ____D () C:\ProgramData\{6e8e309c-4d80-fc2a-6e8e-e309c4d8c271} 2015-02-19 12:18 - 2015-02-19 12:18 - 00003102 _____ () C:\Windows\System32\Tasks\{29598C84-B397-4C55-A8BE-9BD51D7E098E} 2015-02-18 08:40 - 2015-02-18 08:40 - 00000000 ____D () C:\Users\Default\AppData\Roaming\TuneUp Software 2015-02-18 08:40 - 2015-02-18 08:40 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\TuneUp Software 2015-02-17 19:39 - 2015-01-22 23:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-02-17 19:39 - 2015-01-22 22:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-02-14 10:55 - 2015-01-15 17:43 - 00563504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2015-02-14 10:55 - 2015-01-15 17:43 - 00177984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-02-14 10:55 - 2015-01-13 23:22 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll 2015-02-14 10:55 - 2015-01-13 22:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll 2015-02-14 10:55 - 2014-10-28 21:51 - 00154112 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2015-02-14 10:55 - 2014-10-28 21:50 - 00736768 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2015-02-14 10:55 - 2014-10-28 21:06 - 00736768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2015-02-14 10:55 - 2014-10-28 21:06 - 00154112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2015-02-14 10:55 - 2014-10-28 20:31 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-02-14 10:54 - 2015-01-13 17:11 - 01762840 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2015-02-14 10:54 - 2015-01-13 17:04 - 01489072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2015-02-14 10:54 - 2015-01-11 22:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-02-14 10:54 - 2015-01-11 21:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-02-14 10:54 - 2015-01-11 21:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-02-14 10:54 - 2015-01-11 21:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2015-02-14 10:54 - 2015-01-11 21:34 - 00816128 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-02-14 10:54 - 2015-01-11 21:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-02-14 10:54 - 2015-01-11 21:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-02-14 10:54 - 2015-01-11 21:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-02-14 10:54 - 2015-01-11 21:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-02-14 10:54 - 2015-01-11 21:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2015-02-14 10:54 - 2015-01-11 21:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-02-14 10:54 - 2015-01-11 20:58 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll 2015-02-14 10:54 - 2015-01-11 20:55 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2015-02-14 10:54 - 2015-01-11 20:51 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2015-02-14 10:54 - 2015-01-11 20:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-02-14 10:54 - 2015-01-11 20:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-02-14 10:54 - 2015-01-11 20:48 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-02-14 10:54 - 2015-01-11 20:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-02-14 10:54 - 2015-01-11 20:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-02-14 10:54 - 2015-01-11 20:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-02-14 10:54 - 2015-01-11 20:34 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2015-02-14 10:54 - 2015-01-11 20:30 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll 2015-02-14 10:54 - 2015-01-11 20:27 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll 2015-02-14 10:54 - 2015-01-11 20:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-02-14 10:54 - 2015-01-11 20:25 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2015-02-14 10:54 - 2015-01-11 20:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-02-14 10:54 - 2015-01-11 20:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-02-14 10:54 - 2015-01-11 20:23 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-02-14 10:54 - 2015-01-11 20:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-02-14 10:54 - 2015-01-11 20:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-02-14 10:54 - 2015-01-11 20:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-02-14 10:54 - 2015-01-11 20:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-02-14 10:54 - 2015-01-11 19:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-02-14 10:54 - 2015-01-11 19:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-02-14 10:54 - 2015-01-10 04:10 - 07472960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-02-14 10:54 - 2015-01-10 04:10 - 01733440 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2015-02-14 10:54 - 2015-01-10 03:28 - 01498360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2015-02-14 10:54 - 2015-01-10 02:00 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2015-02-14 10:54 - 2015-01-10 01:38 - 00359424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2015-02-14 10:54 - 2014-12-19 03:57 - 00788680 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2015-02-14 10:54 - 2014-12-19 03:25 - 00602776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2015-02-14 10:54 - 2014-12-08 22:45 - 00393728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll 2015-02-14 10:54 - 2014-12-08 20:56 - 00538624 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll 2015-02-14 10:54 - 2014-12-08 18:12 - 00391526 _____ () C:\Windows\system32\ApnDatabase.xml 2015-02-14 10:54 - 2014-10-28 21:02 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2015-02-14 10:54 - 2014-10-28 21:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll 2015-02-14 10:54 - 2014-10-28 20:57 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll 2015-02-14 10:54 - 2014-10-28 20:15 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2015-02-14 10:54 - 2014-10-28 20:15 - 00005632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2015-02-14 10:54 - 2014-10-28 20:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2015-02-14 10:54 - 2014-10-28 20:13 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2015-02-14 10:54 - 2014-10-28 20:13 - 00008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2015-02-14 10:53 - 2015-01-10 03:22 - 04175872 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-02-14 10:52 - 2015-01-19 13:42 - 01487976 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll 2015-02-06 22:11 - 2015-02-06 22:36 - 00000000 ____D () C:\Users\David\AppData\Roaming\Audacity 2015-02-06 22:09 - 2015-02-06 22:09 - 00000064 _____ () C:\Users\David\AppData\Local\0e5971fa8907c5fa1fa1f90ce7b319dc 2015-02-06 05:55 - 2015-02-06 05:55 - 00000000 ____D () C:\Users\Public\Documents\Baidu 2015-02-06 05:55 - 2015-02-06 05:55 - 00000000 ____D () C:\ProgramData\Baidu 2015-02-06 05:55 - 2015-02-06 05:55 - 00000000 ____D () C:\FFOutput 2015-02-06 05:54 - 2015-02-06 05:54 - 00000000 ____D () C:\Program Files (x86)\FreeTime 2015-01-31 22:20 - 2015-01-31 22:20 - 00003100 _____ () C:\Windows\System32\Tasks\{E5C4BC33-F4FA-43A9-9E9F-A588FAF76DAA} 2015-01-31 10:03 - 2015-02-21 11:55 - 00000000 ____D () C:\Users\David\Documents\FimFiction 2015-01-30 03:32 - 2014-04-15 18:35 - 00028352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aspnet_counters.dll 2015-01-30 03:32 - 2014-04-15 18:34 - 00029888 _____ (Microsoft Corporation) C:\Windows\system32\aspnet_counters.dll 2015-01-26 15:33 - 2015-01-26 15:50 - 00001390 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk 2015-01-26 15:33 - 2015-01-26 15:50 - 00001321 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk 2015-01-26 15:33 - 2015-01-26 15:33 - 00000000 ____D () C:\Windows\en 2015-01-26 15:33 - 2015-01-26 15:33 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server Compact Edition 2015-01-26 15:32 - 2015-01-26 15:33 - 00000000 ____D () C:\Program Files (x86)\Windows Live 2015-01-26 15:32 - 2015-01-26 15:32 - 00000000 ____D () C:\Windows\PCHEALTH 2015-01-25 22:51 - 2015-01-25 22:51 - 00001406 _____ () C:\Users\David\Desktop\Legends of Equestria.lnk 2015-01-25 22:44 - 2015-01-26 15:16 - 00000000 ____D () C:\Users\David\Documents\LoE-Windows_32 2015-01-22 2015-01-24 00:49 - 2015-01-24 00:49 - 00000000 ____D () C:\Users\David\AppData\Roaming\TuneUp Software 2015-01-24 00:40 - 2015-02-19 12:23 - 00000000 ____D () C:\ProgramData\MFAData 2015-01-24 00:40 - 2015-01-24 00:40 - 00000000 ____D () C:\Users\David\AppData\Local\MFAData ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-23 17:08 - 2014-11-16 02:16 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-02-23 17:00 - 2013-08-22 10:36 - 00000000 ____D () C:\Windows\system32\sru 2015-02-23 16:45 - 2014-11-25 17:33 - 00000928 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-02-23 13:52 - 2013-08-22 10:20 - 00000000 ____D () C:\Windows\CbsTemp 2015-02-23 10:35 - 2014-11-07 12:19 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1072971881-875114510-2009490154-1006 2015-02-22 18:44 - 2013-08-22 09:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-02-22 08:30 - 2013-08-22 10:36 - 00000000 ____D () C:\Windows\AppReadiness 2015-02-22 04:05 - 2015-01-07 17:23 - 00000352 _____ () C:\Windows\Tasks\Driver Robot.job 2015-02-20 16:41 - 2014-11-10 15:01 - 00000000 ____D () C:\Users\David\AppData\Local\Windows Live 2015-02-19 12:19 - 2013-08-22 10:36 - 00000000 ___HD () C:\Windows\ELAMBKUP 2015-02-19 12:10 - 2013-08-22 10:36 - 00000000 ____D () C:\Windows\system32\NDF 2015-02-17 09:16 - 2013-08-22 09:44 - 00400712 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-02-17 09:14 - 2013-08-22 08:25 - 00786432 ___SH () C:\Windows\system32\config\BBI 2015-02-17 08:53 - 2014-11-07 12:13 - 00000000 ____D () C:\Users\David 2015-02-15 08:20 - 2014-09-03 19:37 - 00000000 ____D () C:\Windows\system32\MRT 2015-02-15 08:15 - 2014-09-03 19:37 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-02-14 10:52 - 2013-08-22 08:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM 2015-02-06 06:05 - 2015-01-10 22:52 - 00000000 ____D () C:\Users\David\AppData\Roaming\uTorrent 2015-02-05 04:34 - 2015-01-20 15:10 - 00000000 ____D () C:\Users\David\AppData\Local\WinZip 2015-02-04 16:40 - 2014-11-25 17:33 - 00003900 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2015-02-04 16:40 - 2014-11-25 17:33 - 00003664 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2015-02-04 16:40 - 2014-11-25 17:33 - 00000924 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-02-04 14:08 - 2014-11-16 02:16 - 00003718 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-01-31 22:17 - 2014-11-07 12:13 - 00000000 ____D () C:\Users\David\AppData\Local\Packages 2015-01-31 10:09 - 2014-12-07 04:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LockHunter 2015-01-26 15:33 - 2013-08-22 10:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared ==================== Files in the root of some directories ======= 2015-01-23 05:01 - 2015-01-23 05:01 - 0000111 _____ () C:\Users\David\AppData\Roaming\sdole32.ini 2015-02-06 22:09 - 2015-02-06 22:09 - 0000064 _____ () C:\Users\David\AppData\Local\0e5971fa8907c5fa1fa1f90ce7b319dc 2015-01-14 19:41 - 2015-01-14 19:41 - 0007891 _____ () C:\Users\David\AppData\Local\recently-used.xbel Files to move or delete: ==================== C:\Users\David\jagex_cl_runescape_LIVE.dat C:\Users\David\random.dat C:\Users\Public\cc_20140923_180027.reg ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-06 10:40 ==================== End Of Log ============================