1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

My In-Laws computer has been hacked...I believe

Discussion in 'Virus & Other Malware Removal' started by TruckerRon1, Apr 4, 2015.

Thread Status:
Not open for further replies.
Advertisement
  1. TruckerRon1

    TruckerRon1 Thread Starter

    Joined:
    Apr 4, 2015
    Messages:
    5
    Techguys,

    My Mother-in-law has been hacked as we believe that she clicked on a link in an e-mail that she received. Shortly thereafter she received a blue screen of death (approx 3/23/15). She called her internet provider who was able to get her back up and running. She asked me to look at it and I have she has more an additional user(s) under the section that shows you the permissions and administrators. Lenovo N585 Windows 7 Home Premium SP1.

    I have run AVG virus scan and spybot to know avail I have found out she is in a homegroup with one of the computers named "xbox" Anyways over my head and I seek your help

    Thanks for your help
    Ron

    Tech Support Guy System Info Utility version 1.0.0.2
    OS Version: Microsoft Windows 7 Home Premium, Service Pack 1, 64 bit
    Processor: AMD E1-1200 APU with Radeon(tm) HD Graphics, AMD64 Family 20 Model 2 Stepping 0
    Processor Count: 2
    RAM: 3689 Mb
    Graphics Card: AMD Radeon HD 7310M, 384 Mb
    Hard Drives: C: Total - 258962 MB, Free - 213414 MB; D: Total - 26079 MB, Free - 24275 MB;
    Motherboard: LENOVO, Lenovo IdeaPad N585
    Antivirus: AVG AntiVirus Free Edition 2015, Updated and Enabled
     
  2. CatByte

    CatByte Malware Specialist

    Joined:
    Feb 24, 2009
    Messages:
    3,930
    Welcome to Tech Support Guy,

    Please run the following:

    Please download the appropriate version of Farbar Recovery Scan Tool (FRST.exe) from here:
    http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ (for 32bit systems)
    http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ (for 64bit systems)
    save it to your desktop.
    Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
    • Double-click to run it.
    • Press Scan button.
    • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
    • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.


    NEXT

    Please download Malwarebytes Anti-Rootkit (MBAR) from here and save it to your desktop.
    • Doubleclick on the MBAR file you downloaded and approve the UAC prompt in Vista and newer operating systems.
    • Click OK on the next screen, to allow the package to extract the contents of the file to its own folder, mbar.
    • mbar.exe will launch automatically. On some systems, this may take a few extra seconds. Please be patient and wait for the program to open.
    • After reading the Introduction, click 'Next' if you agree.
    • On the Update Database screen, click on the 'Update' button.
    • Once you see 'Success: Database was successfully updated' click on 'Next'.
    • Click the 'Scan' button.
    With some infections, you may see two messages boxes.
    1. 'Could not load protection driver'. Click 'OK'.
    2. 'Could not load DDA driver'. Click 'Yes' to this message, to allow the driver to load after a restart. Allow the computer to restart. Continue with the rest of these instructions.

    If malware is found, do NOT press the Cleanup button when the scan completes. Click EXIT. (I would just like to see the log first before we bewgin cleaning, so I know what we are dealing with)
    Then, please send the following logs as attachments to your reply.
    These logs are located in the mbar folder on your desktop where the tool extracted itself to.
    mbar-log-2013-xx-xx(xx-xx-xx).txt (where xx-xx(xx-xx-xx) is the date and time of the scan)
    system-log.txt
     
  3. TruckerRon1

    TruckerRon1 Thread Starter

    Joined:
    Apr 4, 2015
    Messages:
    5
    Catbyte

    First of all thank you for all your help.

    here are the results from farbar:

    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
    Ran by Argie (administrator) on ARGIE-PC on 05-04-2015 11:59:00
    Running from C:\Users\Argie\Downloads
    Loaded Profiles: Argie (Available profiles: Argie)
    Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
    Internet Explorer Version 9 (Default browser: Chrome)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe
    (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe
    (AMD) C:\Windows\System32\atiesrxx.exe
    (AMD) C:\Windows\System32\atieclxx.exe
    (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
    (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe
    (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
    (Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
    () C:\Program Files (x86)\LG Electronics\LGE LTE Driver\LGVL600SVC.exe
    (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
    (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
    (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
    (Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
    (Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
    (Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
    (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
    (Google Inc.) C:\Users\Argie\AppData\Local\Google\Update\GoogleUpdate.exe
    (Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    ( ) C:\Program Files (x86)\LockKey\LockKey.exe
    (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
    (Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
    (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe
    (CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
    (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


    ==================== Registry (Whitelisted) ==================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2809856 2012-01-16] (ELAN Microelectronics Corp.)
    HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [564352 2012-03-01] (Conexant Systems, Inc.)
    HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [8071680 2012-06-22] (Lenovo (Beijing) Limited)
    HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [6193152 2012-06-22] (Lenovo(beijing) Limited)
    HKLM\...\Run: [Lenovo EE Boot Optimizer] => C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [206176 2012-06-22] (Lenovo)
    HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-03-22] (Advanced Micro Devices, Inc.)
    HKLM-x32\...\Run: [LockKey] => C:\Program Files (x86)\LockKey\LockKey.exe [337776 2011-08-25] ( )
    HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [507744 2011-12-20] (Dolby Laboratories Inc.)
    HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2010-07-26] (CyberLink Corp.)
    HKLM-x32\...\Run: [UpdatePRCShortCut] => C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.)
    HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3723728 2015-03-25] (AVG Technologies CZ, s.r.o.)
    HKU\S-1-5-21-1320467341-2631465177-708088720-1001\...\Run: [Google Update] => C:\Users\Argie\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-11-01] (Google Inc.)
    HKU\S-1-5-21-1320467341-2631465177-708088720-1001\...\Run: [ROC_ROC_APR2013_AV] => C:\Users\Argie\AppData\Roaming\AVG April 2013 Campaign\AVG-Secure-Search-Update.exe /PROMPT --mid 3cd7f11f1a6147d0bfec0d47e71d61aa-662966797f58dea588396e5bdd50abf9b35b5877 --CMPID ROC_APR2013_AV --CMP (the data entry has 12 more characters).
    HKU\S-1-5-21-1320467341-2631465177-708088720-1001\...\Run: [AVG-Secure-Search-Update_0913a] => C:\Users\Argie\AppData\Roaming\AVG 0913a Campaign\AVG-Secure-Search-Update-0913a.exe /PROMPT --mid 3cd7f11f1a6147d0bfec0d47e71d61aa-662966797f58dea588396e5bdd50abf9b35b5877 --CMPID 0913a
    HKU\S-1-5-21-1320467341-2631465177-708088720-1001\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-06-22] (Google Inc.)
    HKU\S-1-5-21-1320467341-2631465177-708088720-1001\...\MountPoints2: {de769c5e-e5c7-11e2-a15e-806e6f6e6963} - E:\menu.exe
    ShellIconOverlayIdentifiers: [VeriFace Enc] -> {771C7324-DA80-49D3-8017-753B0AF60951} => C:\Windows\system32\IcnOvrly.dll ()

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://lenovo.msn.com
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://lenovo.msn.com
    HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
    HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
    HKU\S-1-5-21-1320467341-2631465177-708088720-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN
    HKU\S-1-5-21-1320467341-2631465177-708088720-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com
    HKU\S-1-5-21-1320467341-2631465177-708088720-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN
    SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
    SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
    SearchScopes: HKU\S-1-5-21-1320467341-2631465177-708088720-1001 -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENN_enUS634
    SearchScopes: HKU\S-1-5-21-1320467341-2631465177-708088720-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
    SearchScopes: HKU\S-1-5-21-1320467341-2631465177-708088720-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENN_enUS634
    BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
    BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-04-04] (Google Inc.)
    BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-09-05] (Adobe Systems Incorporated)
    BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> E:\Spybot - Search & Destroy\SDHelper.dll No File
    BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
    BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-04-04] (Google Inc.)
    Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-04-04] (Google Inc.)
    Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-04-04] (Google Inc.)
    Toolbar: HKU\S-1-5-21-1320467341-2631465177-708088720-1001 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-04-04] (Google Inc.)
    Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 208.67.220.220

    FireFox:
    ========
    FF Plugin: @microsoft.com/GENUINE -> disabled No File
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2011-09-05] (Adobe Systems Inc.)
    FF Plugin HKU\S-1-5-21-1320467341-2631465177-708088720-1001: @talk.google.com/GoogleTalkPlugin -> C:\Users\Argie\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-01-27] (Google)
    FF Plugin HKU\S-1-5-21-1320467341-2631465177-708088720-1001: @talk.google.com/O1DPlugin -> C:\Users\Argie\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-01-27] (Google)
    FF Plugin HKU\S-1-5-21-1320467341-2631465177-708088720-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Argie\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
    FF Plugin HKU\S-1-5-21-1320467341-2631465177-708088720-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Argie\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Users\Argie\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-01-27] (Google)
    FF Plugin ProgramFiles/Appdata: C:\Users\Argie\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-01-27] (Google)

    Chrome:
    =======
    CHR HomePage: Default -> hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN
    CHR StartupUrls: Default -> "hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN", "chrome://apps/"
    CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\PepperFlash\pepflashplayer.dll ()
    CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
    CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\ppGoogleNaClPluginChrome.dll No File
    CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\pdf.dll ()
    CHR Plugin: (McAfee SiteAdvisor) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.50.146.2_0\McChPlg.dll No File
    CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll No File
    CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
    CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
    CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll No File
    CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File
    CHR Profile: C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default
    CHR Extension: (Bejeweled) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\adpkifcfcacgmnggcbpbjbkdijciiigm [2012-11-01]
    CHR Extension: (Bible) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\adplcelpohamiijahbaanmoimmnoaiaf [2013-01-20]
    CHR Extension: (GardenPuzzle - Garden Planner) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\aelbbmmnbhhejifmacegolomcmdggnfc [2013-01-20]
    CHR Extension: (Word Search Puzzle) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\alcobafdkcddhiabfgnongafffchimnl [2014-10-17]
    CHR Extension: (YouTube) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-11-01]
    CHR Extension: (Solitaire) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpebaehgfgkcmmjjknibibbjacnplim [2012-11-22]
    CHR Extension: (Christmas Mahjong) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\coconnhpdpfcoglmhjniaoipnmklkmhf [2012-11-01]
    CHR Extension: (Google Search) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-11-02]
    CHR Extension: (Word Search) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnjkggjhcbohgnikmegjkodmakmimlkj [2013-09-28]
    CHR Extension: (Thanksgiving Mahjong) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\eeicaanmfhildjegalkgallfkbfigdjg [2012-11-01]
    CHR Extension: (Davitily Math Academy) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehdgkencbhniekejnjmlkpfmcambmikj [2013-08-16]
    CHR Extension: (Your Daily Proverb From the Bible) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejhlfngechbambobpefemmjkmggfdmjh [2013-01-20]
    CHR Extension: (Winter Holiday Theme) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\eopgaaccllppmdjnjmbflkcbknfohodn [2014-12-16]
    CHR Extension: (Couples memory solitaire) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\epafcdcignheipookeefcdbpheapdfib [2012-11-22]
    CHR Extension: (Pandora) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbangkleohkafngihneedemihgfeikcl [2012-11-01]
    CHR Extension: (Web Store) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcmhlciplkdngpmnaholobffnkkfpkgm [2014-12-28]
    CHR Extension: (Bible Classes & Devotionals) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\ganheamaoodpofjfhhhfojnlaadioefg [2013-01-20]
    CHR Extension: (Christmas Mahjong) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghmebaamjdfjkhaaifophgklodieiflm [2013-10-18]
    CHR Extension: (Bookmark Manager) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-01-24]
    CHR Extension: (Candy Crush Saga Online Game) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibgkbggaefdfeoodcfancaenecfejahk [2014-04-13]
    CHR Extension: (The Weather Channel for Chrome) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\iflpcokdamgefbghpdipcibmhlkdopop [2012-11-01]
    CHR Extension: (BBC Good Food) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\jnkffnoliaheoidfeejcmnidkkgilkja [2012-11-01]
    CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-14]
    CHR Extension: (3D Table Tennis) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\lggegdhfphffaeipfpocijebeakpmcih [2012-11-22]
    CHR Extension: (Poppit!) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi [2012-11-01]
    CHR Extension: (Fall Solitaire) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\meiofaocnmolemfkmefcgakiiinllgip [2013-10-18]
    CHR Extension: (Jungle Shooter) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndopneeileblgbhecimdjpojkkgohkpf [2012-11-22]
    CHR Extension: (Google Wallet) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-01]
    CHR Extension: (Picky Wallpapers) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\odklcfojpedohplkimfdpcamkjnhanaj [2013-01-20]
    CHR Extension: (My Chrome Theme) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\oehpjpccmlcalbenfhnacjeocbjdonic [2012-11-01]
    CHR Extension: (Mahjong Master) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\oghchjojloakfbboibnfnleloeamkkgf [2013-10-18]
    CHR Extension: (eBible.com) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbiepkkgdpkbnahmpobfkflbeafennef [2013-01-20]
    CHR Extension: (Math Training by MathPapa.com) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbmoknopocldmkmlfdjmfnfejccnljop [2013-08-16]
    CHR Extension: (Gmail) - C:\Users\Argie\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-20]

    ==================== Services (Whitelisted) =================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-03-21] (Advanced Micro Devices, Inc.) [File not signed]
    R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3416016 2015-03-25] (AVG Technologies CZ, s.r.o.)
    R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [309232 2015-03-25] (AVG Technologies CZ, s.r.o.)
    R2 LGE NDIS Connection Service; C:\Program Files (x86)\LG Electronics\LGE LTE Driver\LGVL600SVC.exe [140224 2010-12-13] ()
    S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
    S4 McMPFSvc; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [X]

    ==================== Drivers (Whitelisted) ====================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)
    R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [281056 2015-03-25] (AVG Technologies CZ, s.r.o.)
    R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [203544 2014-11-18] (AVG Technologies CZ, s.r.o.)
    R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.)
    R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [341472 2015-02-03] (AVG Technologies CZ, s.r.o.)
    R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [133088 2015-02-05] (AVG Technologies CZ, s.r.o.)
    R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)
    R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [284128 2015-02-25] (AVG Technologies CZ, s.r.o.)
    S3 LGELTEBus; C:\Windows\System32\DRIVERS\LGELTEBus.sys [42496 2011-02-16] (LG Electronics )
    S3 LGELTEmdm; C:\Windows\System32\DRIVERS\LGELTEmdm.sys [116480 2011-02-16] (LG Electronics )
    S3 LGELTEMux; C:\Windows\System32\DRIVERS\LGELTEMux.sys [47104 2011-02-16] (LG Electronics )
    S3 LGELTENdis; C:\Windows\System32\DRIVERS\LGELTENdis.sys [52736 2011-02-16] (LG Electronics )
    S3 LGELTEprt; C:\Windows\System32\DRIVERS\LGELTEprt.sys [117120 2011-02-16] (LG Electronics )
    U3 BcmSqlStartupSvc; No ImagePath
    U2 CLKMSVC10_3A60B698; No ImagePath
    U2 CLKMSVC10_C3B3B687; No ImagePath
    U2 DriverService; No ImagePath
    U2 IAStorDataMgrSvc; No ImagePath
    U2 iATAgentService; No ImagePath
    U2 idealife Update Service; No ImagePath
    U3 IGRS; No ImagePath
    U2 IviRegMgr; No ImagePath
    U2 nvUpdatusService; No ImagePath
    U2 Oasis2Service; No ImagePath
    U2 PCCarerService; No ImagePath
    U2 ReadyComm.DirectRouter; No ImagePath
    U2 RichVideo; No ImagePath
    U2 RtLedService; No ImagePath
    U2 SeaPort; No ImagePath
    U2 SoftwareService; No ImagePath
    U3 SQLWriter; No ImagePath

    ==================== NetSvcs (Whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


    ==================== One Month Created Files and Folders ========

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2015-04-05 11:59 - 2015-04-05 12:00 - 00022550 _____ () C:\Users\Argie\Downloads\FRST.txt
    2015-04-05 11:58 - 2015-04-05 11:59 - 00000000 ____D () C:\FRST
    2015-04-05 11:57 - 2015-04-05 11:58 - 02095616 _____ (Farbar) C:\Users\Argie\Downloads\FRST64.exe
    2015-04-04 21:14 - 2015-04-04 21:14 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
    2015-04-04 21:14 - 2015-04-04 21:14 - 00000000 ___SD () C:\Windows\system32\GWX
    2015-04-04 20:35 - 2015-04-04 20:35 - 00011264 ___SH () C:\Users\Argie\Desktop\Thumbs.db
    2015-04-04 19:54 - 2015-04-04 19:54 - 00509440 _____ (Tech Support Guy System) C:\Users\Argie\Downloads\SysInfo.exe
    2015-04-04 19:32 - 2015-04-04 19:32 - 00000000 ____D () C:\Users\Argie\AppData\Roaming\Google
    2015-04-04 18:42 - 2015-02-02 20:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
    2015-04-04 18:42 - 2015-02-02 20:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
    2015-04-04 18:42 - 2015-02-02 20:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
    2015-04-04 18:42 - 2015-02-02 20:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
    2015-04-04 18:42 - 2015-02-02 20:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
    2015-04-04 18:42 - 2015-02-02 20:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
    2015-04-04 18:42 - 2015-02-02 20:31 - 02644992 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
    2015-04-04 18:42 - 2015-02-02 20:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
    2015-04-04 18:42 - 2015-02-02 20:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
    2015-04-04 18:42 - 2015-02-02 20:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
    2015-04-04 18:42 - 2015-02-02 20:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
    2015-04-04 18:42 - 2015-02-02 20:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
    2015-04-04 18:42 - 2015-02-02 20:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
    2015-04-04 18:42 - 2015-02-02 20:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
    2015-04-04 18:42 - 2015-02-02 20:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
    2015-04-04 18:42 - 2015-02-02 20:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
    2015-04-04 18:42 - 2015-02-02 20:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
    2015-04-04 18:42 - 2015-02-02 20:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
    2015-04-04 18:42 - 2015-02-02 20:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
    2015-04-04 18:42 - 2015-02-02 20:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
    2015-04-04 18:42 - 2015-02-02 20:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
    2015-04-04 18:42 - 2015-02-02 20:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
    2015-04-04 18:42 - 2015-02-02 20:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
    2015-04-04 18:42 - 2015-02-02 20:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
    2015-04-04 18:42 - 2015-02-02 20:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
    2015-04-04 18:42 - 2015-02-02 20:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
    2015-04-04 18:42 - 2015-02-02 20:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
    2015-04-04 18:42 - 2015-02-02 20:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
    2015-04-04 18:42 - 2015-02-02 20:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
    2015-04-04 18:42 - 2015-02-02 20:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
    2015-04-04 18:42 - 2015-02-02 20:12 - 02135040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
    2015-04-04 18:42 - 2015-02-02 20:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
    2015-04-04 18:42 - 2015-02-02 20:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
    2015-04-04 18:42 - 2015-02-02 20:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
    2015-04-04 18:42 - 2015-02-02 20:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
    2015-04-04 18:42 - 2015-02-02 20:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
    2015-04-04 18:42 - 2015-02-02 20:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
    2015-04-04 18:42 - 2015-02-02 20:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
    2015-04-04 18:42 - 2015-02-02 20:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
    2015-04-04 18:42 - 2015-02-02 20:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
    2015-04-04 18:42 - 2015-02-02 20:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
    2015-04-04 18:42 - 2015-02-02 20:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
    2015-04-04 18:42 - 2015-02-02 20:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
    2015-04-04 18:42 - 2015-02-02 20:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
    2015-04-04 18:42 - 2015-02-02 20:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
    2015-04-04 18:42 - 2014-10-31 15:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
    2015-04-04 18:42 - 2014-06-27 17:21 - 00532176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
    2015-04-04 18:42 - 2014-06-27 17:21 - 00457400 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
    2015-04-04 18:41 - 2015-02-12 22:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
    2015-04-04 18:41 - 2015-02-12 22:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
    2015-04-04 18:41 - 2015-02-02 20:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
    2015-04-04 18:41 - 2015-02-02 20:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
    2015-04-04 18:41 - 2015-02-02 20:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
    2015-04-04 18:41 - 2015-02-02 20:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
    2015-04-04 18:41 - 2015-02-02 20:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
    2015-04-04 18:41 - 2015-02-02 20:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
    2015-04-04 18:41 - 2015-02-02 20:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
    2015-04-04 18:41 - 2015-02-02 20:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
    2015-04-04 18:41 - 2015-02-02 20:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
    2015-04-04 18:41 - 2015-02-02 20:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
    2015-04-04 18:41 - 2015-02-02 20:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
    2015-04-04 18:41 - 2015-02-02 20:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
    2015-04-04 18:41 - 2015-02-02 20:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
    2015-04-04 18:41 - 2015-02-02 20:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
    2015-04-04 18:41 - 2015-02-02 20:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
    2015-04-04 18:41 - 2015-02-02 20:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
    2015-04-04 18:41 - 2015-02-02 20:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
    2015-04-04 18:41 - 2015-02-02 20:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
    2015-04-04 18:41 - 2015-02-02 20:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
    2015-04-04 18:41 - 2015-02-02 20:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
    2015-04-04 18:41 - 2015-02-02 20:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
    2015-04-04 18:41 - 2015-02-02 20:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
    2015-04-04 18:41 - 2015-02-02 20:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
    2015-04-04 18:41 - 2015-02-02 20:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
    2015-04-04 18:41 - 2015-02-02 20:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
    2015-04-04 18:41 - 2015-02-02 20:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
    2015-04-04 18:41 - 2015-02-02 20:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
    2015-04-04 18:41 - 2015-02-02 20:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
    2015-04-04 18:41 - 2015-02-02 20:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
    2015-04-04 18:41 - 2015-02-02 20:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
    2015-04-04 18:41 - 2015-02-02 20:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
    2015-04-04 18:41 - 2015-02-02 20:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
    2015-04-04 18:41 - 2015-02-02 20:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
    2015-04-04 18:41 - 2015-02-02 20:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
    2015-04-04 18:41 - 2015-02-02 20:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
    2015-04-04 18:41 - 2015-02-02 20:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
    2015-04-04 18:41 - 2015-02-02 20:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
    2015-04-04 18:41 - 2015-02-02 20:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
    2015-04-04 18:41 - 2015-02-02 20:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
    2015-04-04 18:41 - 2015-02-02 20:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
    2015-04-04 18:41 - 2015-02-02 20:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
    2015-04-04 18:41 - 2015-02-02 20:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
    2015-04-04 18:41 - 2015-02-02 20:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
    2015-04-04 18:41 - 2015-02-02 20:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
    2015-04-04 18:41 - 2015-02-02 20:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
    2015-04-04 18:41 - 2015-02-02 19:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
    2015-04-04 18:40 - 2015-03-05 22:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
    2015-04-04 18:40 - 2015-03-05 22:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
    2015-04-04 18:40 - 2015-03-05 22:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
    2015-04-04 18:40 - 2015-03-05 22:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
    2015-04-04 18:40 - 2015-03-05 22:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
    2015-04-04 18:40 - 2015-03-05 22:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
    2015-04-04 18:40 - 2015-03-05 22:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
    2015-04-04 18:40 - 2015-03-05 22:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
    2015-04-04 18:40 - 2015-03-05 22:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
    2015-04-04 18:40 - 2015-03-05 22:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
    2015-04-04 18:40 - 2015-03-05 22:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
    2015-04-04 18:40 - 2015-03-05 22:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
    2015-04-04 18:40 - 2015-03-05 22:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
    2015-04-04 18:40 - 2015-03-05 22:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
    2015-04-04 18:40 - 2015-03-05 22:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
    2015-04-04 18:40 - 2015-03-05 22:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
    2015-04-04 18:40 - 2015-03-05 22:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
    2015-04-04 18:40 - 2015-03-05 22:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
    2015-04-04 18:40 - 2015-03-05 22:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
    2015-04-04 18:40 - 2015-03-05 22:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
    2015-04-04 18:40 - 2015-03-05 22:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
    2015-04-04 18:40 - 2015-03-05 22:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
    2015-04-04 18:40 - 2015-03-05 22:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
    2015-04-04 18:40 - 2015-03-05 22:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
    2015-04-04 18:40 - 2015-03-05 22:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
    2015-04-04 18:40 - 2015-03-05 22:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
    2015-04-04 18:40 - 2015-03-05 22:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
    2015-04-04 18:40 - 2015-03-05 22:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
    2015-04-04 18:40 - 2015-03-05 22:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
    2015-04-04 18:40 - 2015-03-05 22:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
    2015-04-04 18:40 - 2015-03-05 22:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
    2015-04-04 18:40 - 2015-01-30 16:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
    2015-04-04 18:39 - 2015-02-21 12:17 - 17882624 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2015-04-04 18:39 - 2015-02-21 12:07 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
    2015-04-04 18:39 - 2015-02-21 12:02 - 10931200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2015-04-04 18:39 - 2015-02-21 12:00 - 02339840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2015-04-04 18:39 - 2015-02-21 11:54 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2015-04-04 18:39 - 2015-02-21 11:54 - 01388032 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2015-04-04 18:39 - 2015-02-21 11:53 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
    2015-04-04 18:39 - 2015-02-21 11:52 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
    2015-04-04 18:39 - 2015-02-21 11:52 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
    2015-04-04 18:39 - 2015-02-21 11:52 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2015-04-04 18:39 - 2015-02-21 11:51 - 02157568 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2015-04-04 18:39 - 2015-02-21 11:51 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
    2015-04-04 18:39 - 2015-02-21 11:51 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2015-04-04 18:39 - 2015-02-21 11:51 - 00598528 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
    2015-04-04 18:39 - 2015-02-21 11:51 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
    2015-04-04 18:39 - 2015-02-21 11:51 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
    2015-04-04 18:39 - 2015-02-21 11:51 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
    2015-04-04 18:39 - 2015-02-21 11:51 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
    2015-04-04 18:39 - 2015-02-21 11:50 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2015-04-04 18:39 - 2015-02-21 11:50 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2015-04-04 18:39 - 2015-02-21 11:50 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
    2015-04-04 18:39 - 2015-02-21 11:50 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
    2015-04-04 18:39 - 2015-02-21 10:37 - 12375040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2015-04-04 18:39 - 2015-02-21 10:34 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
    2015-04-04 18:39 - 2015-02-21 10:29 - 09747968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2015-04-04 18:39 - 2015-02-21 10:28 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2015-04-04 18:39 - 2015-02-21 10:22 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2015-04-04 18:39 - 2015-02-21 10:21 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
    2015-04-04 18:39 - 2015-02-21 10:21 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2015-04-04 18:39 - 2015-02-21 10:20 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
    2015-04-04 18:39 - 2015-02-21 10:20 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2015-04-04 18:39 - 2015-02-21 10:19 - 01803264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2015-04-04 18:39 - 2015-02-21 10:19 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
    2015-04-04 18:39 - 2015-02-21 10:19 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2015-04-04 18:39 - 2015-02-21 10:19 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
    2015-04-04 18:39 - 2015-02-21 10:19 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
    2015-04-04 18:39 - 2015-02-21 10:18 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2015-04-04 18:39 - 2015-02-21 10:18 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
    2015-04-04 18:39 - 2015-02-21 10:18 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
    2015-04-04 18:39 - 2015-02-21 10:18 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
    2015-04-04 18:39 - 2015-02-21 10:18 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
    2015-04-04 18:39 - 2015-02-21 10:18 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
    2015-04-04 18:39 - 2015-02-21 10:18 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
    2015-04-04 18:39 - 2015-02-21 10:17 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2015-04-04 18:39 - 2015-02-19 21:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
    2015-04-04 18:39 - 2015-02-19 21:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
    2015-04-04 18:39 - 2015-02-19 21:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
    2015-04-04 18:39 - 2015-02-19 21:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
    2015-04-04 18:39 - 2015-02-19 21:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
    2015-04-04 18:39 - 2015-02-19 21:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
    2015-04-04 18:39 - 2015-02-19 21:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
    2015-04-04 18:39 - 2015-02-19 21:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
    2015-04-04 18:39 - 2015-02-19 20:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
    2015-04-04 18:39 - 2015-02-19 20:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
    2015-04-04 18:39 - 2015-02-02 20:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
    2015-04-04 18:39 - 2015-02-02 20:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
    2015-04-04 18:39 - 2015-01-30 20:48 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
    2015-04-04 18:39 - 2015-01-30 20:48 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
    2015-04-04 18:39 - 2015-01-30 16:56 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
    2015-04-04 18:30 - 2015-02-25 20:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
    2015-04-04 18:30 - 2015-02-03 20:16 - 00392192 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
    2015-04-04 18:30 - 2015-02-03 19:54 - 00318464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
    2015-04-04 18:30 - 2015-02-02 20:31 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
    2015-04-04 18:30 - 2015-02-02 20:12 - 01011200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
    2015-04-04 18:30 - 2015-01-16 19:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
    2015-04-04 18:30 - 2015-01-16 19:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
    2015-04-04 16:46 - 2015-04-04 16:46 - 00000000 ____D () C:\Users\Argie\AppData\Roaming\AVG2015
    2015-04-04 16:44 - 2015-04-04 16:44 - 00000976 _____ () C:\Users\Public\Desktop\AVG 2015.lnk
    2015-04-04 16:42 - 2015-04-04 16:45 - 00000000 ____D () C:\ProgramData\AVG2015
    2015-04-04 16:25 - 2015-04-04 17:31 - 00000000 ____D () C:\Users\Argie\AppData\Local\Avg2015
    2015-04-04 03:06 - 2015-04-04 03:14 - 00000000 ____D () C:\Spybot - Search & Destroy
    2015-04-04 02:10 - 2015-04-04 02:10 - 00000000 ____D () C:\Users\Argie\AppData\Local\Adobe
    2015-04-03 23:13 - 2015-04-03 23:13 - 00000000 ____D () C:\Users\Argie\AppData\Local\{A08D1483-18E5-4055-B7B7-1598C7776672}
    2015-04-03 08:59 - 2015-04-03 08:59 - 00000000 ____D () C:\Users\Argie\AppData\Local\{34398E05-BDE7-4DE8-85E9-7C33667A2F3E}
    2015-04-01 17:22 - 2015-04-01 17:22 - 00701442 _____ () C:\Users\Argie\Downloads\20150331_151740.jpeg
    2015-03-31 08:24 - 2015-03-31 08:24 - 00812431 _____ () C:\Users\Argie\Downloads\20150327_150338 (1).jpeg
    2015-03-31 07:57 - 2015-03-31 07:57 - 00000000 ____D () C:\Users\Argie\AppData\Local\{93796907-8A94-40B1-8DE9-4DB10F037903}
    2015-03-30 18:32 - 2015-03-30 18:32 - 00812431 _____ () C:\Users\Argie\Downloads\20150327_150338.jpeg
    2015-03-25 11:21 - 2015-03-25 11:21 - 00281056 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys
    2015-03-23 09:59 - 2015-03-23 09:59 - 00000000 ____D () C:\Users\Argie\AppData\Local\{BD15A950-9CF5-4C4F-B4B9-B2E47E4A4BEF}
    2015-03-21 09:01 - 2015-03-21 09:02 - 00000000 ____D () C:\Users\Argie\AppData\Local\{958A3FD3-AC08-4300-8A66-470F4BA94006}
    2015-03-11 07:37 - 2015-03-11 07:37 - 00000000 ____D () C:\Users\Argie\AppData\Local\{3132F8B5-6C48-4A47-BA27-8EE2A22C3D76}

    ==================== One Month Modified Files and Folders =======

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2015-04-05 11:53 - 2012-06-22 15:58 - 01984018 _____ () C:\Windows\WindowsUpdate.log
    2015-04-05 11:51 - 2009-07-13 21:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2015-04-05 11:51 - 2009-07-13 21:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2015-04-05 11:49 - 2009-07-13 22:13 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI
    2015-04-05 11:48 - 2012-11-01 13:30 - 00000000 ____D () C:\ProgramData\MFAData
    2015-04-05 11:43 - 2012-10-28 07:49 - 03705059 _____ () C:\FaceProv.log
    2015-04-05 11:43 - 2012-06-22 16:56 - 00183774 _____ () C:\Windows\system32\fastboot.set
    2015-04-05 11:43 - 2012-06-22 16:52 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2015-04-05 11:43 - 2009-07-13 22:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
    2015-04-05 11:43 - 2009-07-13 21:51 - 00120182 _____ () C:\Windows\setupact.log
    2015-04-04 20:33 - 2012-06-22 16:52 - 00000000 ____D () C:\ProgramData\Partner
    2015-04-04 20:33 - 2010-11-20 20:47 - 00197002 _____ () C:\Windows\PFRO.log
    2015-04-04 20:18 - 2012-06-22 16:52 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2015-04-04 19:35 - 2013-07-05 17:04 - 00000000 ____D () C:\Users\Argie\AppData\Local\Deployment
    2015-04-04 19:32 - 2012-11-01 12:31 - 00000000 ____D () C:\Users\Argie\AppData\Local\Google
    2015-04-04 19:26 - 2009-07-13 22:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
    2015-04-04 19:21 - 2009-07-13 22:08 - 00032570 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
    2015-04-04 19:21 - 2009-07-13 21:45 - 00263640 _____ () C:\Windows\system32\FNTCACHE.DAT
    2015-04-04 19:17 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
    2015-04-04 19:17 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\system32\Dism
    2015-04-04 19:02 - 2013-08-15 21:59 - 00000000 ____D () C:\Windows\system32\MRT
    2015-04-04 18:55 - 2012-11-01 13:08 - 00000000 ____D () C:\ProgramData\Skype
    2015-04-04 18:46 - 2012-10-28 21:44 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
    2015-04-04 16:48 - 2012-11-01 13:54 - 00000000 ____D () C:\Program Files (x86)\AVG
    2015-04-04 16:45 - 2014-11-19 10:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
    2015-04-04 16:45 - 2012-11-01 13:55 - 00000000 ___HD () C:\$AVG
    2015-04-04 03:52 - 2014-05-31 19:22 - 00000000 ____D () C:\Program Files (x86)\SearchProtect
    2015-04-04 03:52 - 2014-04-19 12:53 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
    2015-04-04 03:06 - 2014-04-19 12:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
    2015-04-04 03:05 - 2013-12-06 11:11 - 01546752 ___SH () C:\Users\Argie\Downloads\Thumbs.db
    2015-04-04 02:10 - 2012-11-01 12:31 - 00000000 ____D () C:\Users\Argie\AppData\Roaming\Adobe
    2015-04-04 01:24 - 2014-12-11 08:58 - 00000000 ____D () C:\Windows\system32\appraiser
    2015-04-04 01:24 - 2014-04-30 08:18 - 00000000 ___SD () C:\Windows\system32\CompatTel
    2015-04-04 01:24 - 2012-10-28 07:49 - 00000000 ____D () C:\Users\Argie
    2015-04-04 01:24 - 2009-07-13 22:32 - 00000000 ____D () C:\Windows\addins
    2015-04-04 01:24 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\system32\Setup
    2015-04-04 01:24 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\rescache
    2015-04-04 01:23 - 2015-02-02 18:15 - 00000000 ____D () C:\Users\Argie\AppData\Roaming\Mozilla
    2015-04-04 01:23 - 2013-02-18 16:02 - 00000000 ____D () C:\Users\Argie\Downloads\Autoruns
    2015-04-04 01:23 - 2013-02-18 15:19 - 00000000 ____D () C:\Users\Argie\AppData\Roaming\PeerNetworking
    2015-04-04 01:23 - 2012-11-01 13:09 - 00000000 ____D () C:\Users\Argie\AppData\Roaming\Skype
    2015-04-04 01:23 - 2012-10-28 07:55 - 00000000 ____D () C:\Users\Argie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center
    2015-04-04 01:23 - 2012-10-28 07:49 - 00000000 ___RD () C:\Users\Argie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
    2015-04-04 01:23 - 2012-10-28 07:49 - 00000000 ___RD () C:\Users\Argie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
    2015-04-04 01:23 - 2012-10-28 07:49 - 00000000 ____D () C:\Users\Argie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
    2015-04-04 01:23 - 2012-06-22 16:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
    2015-04-04 01:23 - 2011-10-10 01:19 - 00000000 ___RD () C:\Users\Public\Recorded TV
    2015-04-04 01:23 - 2009-07-13 20:20 - 00000000 __RHD () C:\Users\Public\Libraries
    2015-04-04 01:23 - 2009-07-13 20:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
    2015-04-04 01:23 - 2009-07-13 20:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
    2015-04-04 01:22 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\registration
    2015-04-04 01:20 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\SysWOW64\NetworkList
    2015-04-04 01:20 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\SysWOW64\Msdtc
    2015-04-04 01:20 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\system32\NetworkList
    2015-04-04 01:19 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\system32\Msdtc
    2015-04-04 01:12 - 2012-11-03 21:47 - 00000000 ____D () C:\Users\Argie\AppData\Local\Microsoft Games
    2015-04-03 23:56 - 2014-07-01 09:39 - 00029431 _____ () C:\Users\Argie\Documents\My Movie.wlmp
    2015-04-03 23:16 - 2014-05-31 16:36 - 00027753 _____ () C:\Users\Argie\Downloads\20140531_144935.jpeg
    2015-03-31 08:26 - 2014-02-24 10:18 - 00000000 ____D () C:\Users\Argie\AppData\Local\Windows Live
    2015-03-11 07:39 - 2013-12-22 15:12 - 00000000 ____D () C:\Users\Argie\Desktop\photos
    2015-03-07 09:20 - 2013-01-20 15:14 - 00000856 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1320467341-2631465177-708088720-1001Core.job

    ==================== Files in the root of some directories =======

    2013-02-18 15:19 - 2014-10-17 19:15 - 0088380 _____ () C:\Users\Argie\AppData\Local\RAContactHistory.xml

    ==================== Bamital & volsnap Check =================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\System32\winlogon.exe => File is digitally signed
    C:\Windows\System32\wininit.exe => File is digitally signed
    C:\Windows\SysWOW64\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\System32\services.exe => File is digitally signed
    C:\Windows\System32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\System32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed
    C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2015-04-04 16:19

    ==================== End Of Log ============================
    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
    Ran by Argie at 2015-04-05 12:02:10
    Running from C:\Users\Argie\Downloads
    Boot Mode: Normal
    ==========================================================


    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}
    AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}

    ==================== Installed Programs ======================

    (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    Adobe Flash Player 10 ActiveX (HKLM-x32\...\{48DB5914-8772-472D-B8DF-E2092BE598F6}) (Version: 10.3.181.34 - Adobe Systems Incorporated)
    Adobe Reader X (10.1.1) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.1 - Adobe Systems Incorporated)
    AMD Catalyst Install Manager (HKLM\...\{71CE3EA7-7F86-9C09-9E2D-F280FD66DAB5}) (Version: 3.0.859.0 - Advanced Micro Devices, Inc.)
    Atheros WLAN Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 7.0 - Atheros)
    AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5863 - AVG Technologies)
    AVG 2015 (Version: 15.0.4321 - AVG Technologies) Hidden
    AVG 2015 (Version: 15.0.5863 - AVG Technologies) Hidden
    Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.54.34.0 - Conexant)
    D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
    Dolby Advanced Audio v2 (HKLM-x32\...\{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}) (Version: 7.2.7000.11 - Dolby Laboratories Inc)
    Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 7.0.3.3 - Lenovo)
    Energy Management (x32 Version: 7.0.3.3 - Lenovo) Hidden
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 41.0.2272.118 - Google Inc.)
    Google Talk Plugin (HKLM-x32\...\{C77CC230-7417-3F01-B70D-52583DC9FEC9}) (Version: 5.40.2.0 - Google)
    Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.4.3607.2246 - Google Inc.)
    Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
    Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
    Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
    Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Lenovo EasyCamera (HKLM-x32\...\{ADE16A9D-FBDC-4ECC-B6BD-9C31E51D0333}) (Version: 1.12.204.1 - Lenovo EasyCamera)
    Lenovo EE Boot Optimizer (HKLM\...\Lenovo EE Boot Optimizer) (Version: 0.0.1.9 - Lenovo)
    Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 7.0.0.3712 - CyberLink Corp.)
    Lenovo OneKey Recovery (Version: 7.0.0.3712 - CyberLink Corp.) Hidden
    Lenovo pointing device (HKLM\...\Elantech) (Version: 10.4.2.8 - ELAN Microelectronic Corp.)
    Lenovo YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.1.3728 - CyberLink Corp.)
    Lenovo YouCam (x32 Version: 3.1.3728 - CyberLink Corp.) Hidden
    LGE LTE Driver Package (HKLM-x32\...\{DCAFB0C6-387A-4B49-AB77-03D50268D4E5}) (Version: 2.3.0.0218 - LG Electronics)
    LGNPST_VL600 (HKLM-x32\...\{D2833105-2F01-4940-B966-1B43F3F6F509}) (Version: 0.2.6.0 - LG Electronics)
    LockKey (HKLM-x32\...\InstallShield_{AF192694-4B15-4AC1-92F3-1B02E98C08BD}) (Version: 1.38.1.2 - Lenovo)
    LockKey (x32 Version: 1.38.1.2 - Lenovo) Hidden
    Malwarebytes Anti-Malware version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
    Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
    Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
    Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
    Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.0.7303 - CyberLink Corp.)
    PowerXpressHybrid (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
    Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.54.309.2012 - Realtek)
    Realtek USB 2.0 Reader Driver (HKLM-x32\...\{62BBB2F0-E220-4821-A564-730807D2C34D}) (Version: 6.1.7601.39016 - Realtek Semiconductor Corp.)
    Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
    UserGuide (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 1.0.0.6 - Lenovo)
    UserGuide (x32 Version: 1.0.0.6 - Lenovo) Hidden
    VeriFace (HKLM-x32\...\VeriFace) (Version: 4.0.1.1230 - Lenovo)
    Verizon Wireless VL600 Firmware Updates (HKLM-x32\...\{9312D58D-1924-41E3-88A9-72CCA85F94B2}) (Version: 1.0.6 - Smith Micro Software, Inc.)
    Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
    Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
    Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
    VZAccess Manager (HKLM-x32\...\{47FA241E-C575-4528-9611-A395067D2DC0}) (Version: 7.7.1.9 - Smith Micro Software Inc.)
    Windows Driver Package - Lenovo (ACPIVPC) System (12/15/2011 7.1.0.1) (HKLM\...\99841829BE839365AA67B2AD0E50D371F59F8A1E) (Version: 12/15/2011 7.1.0.1 - Lenovo)
    Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
    Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)

    ==================== Custom CLSID (selected items): ==========================

    (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

    CustomCLSID: HKU\S-1-5-21-1320467341-2631465177-708088720-1001_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Argie\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No File
    CustomCLSID: HKU\S-1-5-21-1320467341-2631465177-708088720-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Argie\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
    CustomCLSID: HKU\S-1-5-21-1320467341-2631465177-708088720-1001_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Argie\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
    CustomCLSID: HKU\S-1-5-21-1320467341-2631465177-708088720-1001_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\Argie\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-1320467341-2631465177-708088720-1001_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Argie\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll No File
    CustomCLSID: HKU\S-1-5-21-1320467341-2631465177-708088720-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Argie\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-1320467341-2631465177-708088720-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Argie\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File

    ==================== Restore Points =========================

    19-03-2015 11:48:59 Scheduled Checkpoint
    21-03-2015 08:29:46 Windows Update
    29-03-2015 10:52:59 Scheduled Checkpoint
    03-04-2015 20:42:42 Windows Update
    04-04-2015 16:41:05 Installed AVG 2015
    04-04-2015 16:42:16 Installed AVG 2015
    04-04-2015 18:43:48 Windows Update
    04-04-2015 20:16:28 Windows Modules Installer
    04-04-2015 21:13:10 Windows Update

    ==================== Hosts content: ==========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2009-07-13 19:34 - 2009-06-10 14:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

    ==================== Scheduled Tasks (whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

    Task: {1945BC4E-9D0D-4D13-A3D8-0A585F4F4495} - System32\Tasks\MirageAgent => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [2011-01-28] (CyberLink)
    Task: {2BDDD4EA-3176-463A-9F99-3BAE2D84EC1F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-18] (Google Inc.)
    Task: {3E719720-64A4-403E-8FEF-CD304B71E331} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
    Task: {46C8FC48-EBFC-4719-993B-6E8199B8878E} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
    Task: {BB7E90B4-CC1D-4353-A161-293E5BDF3FC5} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-24] (Microsoft Corporation)
    Task: {BD164698-2EC2-49E4-B345-28179CDD889C} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1320467341-2631465177-708088720-1001UA => C:\Users\Argie\AppData\Local\Google\Update\GoogleUpdate.exe [2012-11-01] (Google Inc.)
    Task: {C434134F-C2E8-4CB7-B3B0-DA9CB3442C59} - System32\Tasks\ROC_REG_JAN_DELETE => C:\ProgramData\AVG January 2013 Campaign\ROC.exe [2013-01-17] ()
    Task: {C86D0093-88D0-474A-85DF-8F7D908B3598} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1320467341-2631465177-708088720-1001Core => C:\Users\Argie\AppData\Local\Google\Update\GoogleUpdate.exe [2012-11-01] (Google Inc.)
    Task: {DFAED2EC-14A9-4142-B914-1A65C1FFF1E2} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-18] (Google Inc.)
    Task: {F3E50574-AEBC-406A-BD0D-27934E9ED411} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1320467341-2631465177-708088720-1001Core.job => C:\Users\Argie\AppData\Local\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1320467341-2631465177-708088720-1001UA.job => C:\Users\Argie\AppData\Local\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\ROC_REG_JAN_DELETE.job => C:\ProgramData\AVG January 2013 Campaign\ROC.exe

    ==================== Loaded Modules (whitelisted) ==============

    2012-03-21 22:30 - 2012-03-21 22:30 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
    2012-06-22 16:35 - 2012-06-22 16:35 - 01508192 _____ () C:\Windows\system32\IcnOvrly.dll
    2010-12-13 19:10 - 2010-12-13 19:10 - 00140224 _____ () C:\Program Files (x86)\LG Electronics\LGE LTE Driver\LGVL600SVC.exe
    2008-12-20 03:20 - 2012-06-22 16:55 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
    2012-02-21 13:06 - 2012-06-22 16:55 - 01490944 _____ () C:\Program Files (x86)\Lenovo\Energy Management\EMWpfUI.dll
    2008-12-20 03:20 - 2012-06-22 16:55 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
    2012-03-21 22:30 - 2012-03-21 22:30 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
    2011-11-09 09:55 - 2011-11-09 09:55 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
    2012-03-21 22:09 - 2012-03-21 22:09 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
    2015-04-04 19:43 - 2015-03-30 14:07 - 01174856 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\libglesv2.dll
    2015-04-04 19:43 - 2015-03-30 14:07 - 00080200 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\libegl.dll
    2015-04-04 19:43 - 2015-03-30 14:07 - 09279304 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\pdf.dll
    2015-04-04 19:43 - 2015-03-30 14:07 - 14974280 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\PepperFlash\pepflashplayer.dll

    ==================== Alternate Data Streams (whitelisted) =========

    (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


    ==================== Safe Mode (whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"

    ==================== EXE Association (whitelisted) ===============

    (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-1320467341-2631465177-708088720-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Argie\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
    DNS Servers: 192.168.1.1 - 208.67.220.220

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    (Currently there is no automatic fix for this section.)

    MSCONFIG\startupreg: 332BigDog => C:\Program Files (x86)\USB Camera2\VM332_STI.EXE
    MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    MSCONFIG\startupreg: VeriFaceManager => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
    MSCONFIG\startupreg: YouCam Mirage => "C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe"
    MSCONFIG\startupreg: YouCam Tray => "C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe" /s

    ==================== Accounts: =============================

    Administrator (S-1-5-21-1320467341-2631465177-708088720-500 - Administrator - Disabled)
    Argie (S-1-5-21-1320467341-2631465177-708088720-1001 - Administrator - Enabled) => C:\Users\Argie
    Guest (S-1-5-21-1320467341-2631465177-708088720-501 - Limited - Disabled)
    HomeGroupUser$ (S-1-5-21-1320467341-2631465177-708088720-1004 - Limited - Enabled)

    ==================== Faulty Device Manager Devices =============


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (04/05/2015 11:44:15 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (04/04/2015 08:35:31 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (04/04/2015 07:35:05 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: chrome.exe, version: 40.0.2214.115, time stamp: 0x54e3aecf
    Faulting module name: chrome.dll, version: 40.0.2214.115, time stamp: 0x54e3aaab
    Exception code: 0x80000003
    Fault offset: 0x00539aca
    Faulting process id: 0x1358
    Faulting application start time: 0xchrome.exe0
    Faulting application path: chrome.exe1
    Faulting module path: chrome.exe2
    Report Id: chrome.exe3

    Error: (04/04/2015 07:30:51 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: chrome.exe, version: 40.0.2214.115, time stamp: 0x54e3aecf
    Faulting module name: chrome.dll, version: 40.0.2214.115, time stamp: 0x54e3aaab
    Exception code: 0x80000003
    Fault offset: 0x00539aca
    Faulting process id: 0x12d8
    Faulting application start time: 0xchrome.exe0
    Faulting application path: chrome.exe1
    Faulting module path: chrome.exe2
    Report Id: chrome.exe3

    Error: (04/04/2015 07:26:05 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (04/04/2015 07:22:21 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (04/04/2015 07:12:41 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: chrome.exe, version: 40.0.2214.115, time stamp: 0x54e3aecf
    Faulting module name: chrome.dll, version: 40.0.2214.115, time stamp: 0x54e3aaab
    Exception code: 0x80000003
    Fault offset: 0x00539aca
    Faulting process id: 0x5f4
    Faulting application start time: 0xchrome.exe0
    Faulting application path: chrome.exe1
    Faulting module path: chrome.exe2
    Report Id: chrome.exe3

    Error: (04/04/2015 07:10:58 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: chrome.exe, version: 40.0.2214.115, time stamp: 0x54e3aecf
    Faulting module name: chrome.dll, version: 40.0.2214.115, time stamp: 0x54e3aaab
    Exception code: 0x80000003
    Fault offset: 0x00539aca
    Faulting process id: 0xa04
    Faulting application start time: 0xchrome.exe0
    Faulting application path: chrome.exe1
    Faulting module path: chrome.exe2
    Report Id: chrome.exe3

    Error: (04/04/2015 07:10:38 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: chrome.exe, version: 40.0.2214.115, time stamp: 0x54e3aecf
    Faulting module name: chrome.dll, version: 40.0.2214.115, time stamp: 0x54e3aaab
    Exception code: 0x80000003
    Fault offset: 0x00539aca
    Faulting process id: 0x708
    Faulting application start time: 0xchrome.exe0
    Faulting application path: chrome.exe1
    Faulting module path: chrome.exe2
    Report Id: chrome.exe3

    Error: (04/04/2015 06:49:06 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: chrome.exe, version: 40.0.2214.115, time stamp: 0x54e3aecf
    Faulting module name: chrome.dll, version: 40.0.2214.115, time stamp: 0x54e3aaab
    Exception code: 0x80000003
    Fault offset: 0x00539aca
    Faulting process id: 0x4b8
    Faulting application start time: 0xchrome.exe0
    Faulting application path: chrome.exe1
    Faulting module path: chrome.exe2
    Report Id: chrome.exe3


    System errors:
    =============
    Error: (04/04/2015 05:22:19 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
    Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
    %%1068

    Error: (04/04/2015 05:22:19 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
    Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
    %%1068

    Error: (04/04/2015 05:22:19 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
    Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
    %%1068

    Error: (04/04/2015 05:22:19 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
    Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
    %%1068

    Error: (04/04/2015 05:22:19 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
    Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
    %%1068

    Error: (04/04/2015 05:22:19 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
    Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
    %%1068

    Error: (04/04/2015 05:22:17 PM) (Source: DCOM) (EventID: 10005) (User: )
    Description: 1084WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}

    Error: (04/04/2015 05:22:17 PM) (Source: DCOM) (EventID: 10005) (User: )
    Description: 1084WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

    Error: (04/04/2015 05:22:15 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
    Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
    %%1068

    Error: (04/04/2015 05:22:15 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
    Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
    %%1068


    Microsoft Office Sessions:
    =========================
    Error: (04/05/2015 11:44:15 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (04/04/2015 08:35:31 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (04/04/2015 07:35:05 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: chrome.exe40.0.2214.11554e3aecfchrome.dll40.0.2214.11554e3aaab8000000300539aca135801d06f491d677be2C:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\chrome.dll5db4b37d-db3c-11e4-8b2a-dc0ea1f98859

    Error: (04/04/2015 07:30:51 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: chrome.exe40.0.2214.11554e3aecfchrome.dll40.0.2214.11554e3aaab8000000300539aca12d801d06f4886c9da9bC:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\chrome.dllc6358b3d-db3b-11e4-8b2a-dc0ea1f98859

    Error: (04/04/2015 07:26:05 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (04/04/2015 07:22:21 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (04/04/2015 07:12:41 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: chrome.exe40.0.2214.11554e3aecfchrome.dll40.0.2214.11554e3aaab8000000300539aca5f401d06f45fe3204a5C:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\chrome.dll3cb31dfd-db39-11e4-8fbc-dc0ea1f98859

    Error: (04/04/2015 07:10:58 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: chrome.exe40.0.2214.11554e3aecfchrome.dll40.0.2214.11554e3aaab8000000300539acaa0401d06f45c145e7beC:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\chrome.dllff6754b0-db38-11e4-8fbc-dc0ea1f98859

    Error: (04/04/2015 07:10:38 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: chrome.exe40.0.2214.11554e3aecfchrome.dll40.0.2214.11554e3aaab8000000300539aca70801d06f45b4633376C:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\chrome.dllf39fe4d5-db38-11e4-8fbc-dc0ea1f98859

    Error: (04/04/2015 06:49:06 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: chrome.exe40.0.2214.11554e3aecfchrome.dll40.0.2214.11554e3aaab8000000300539aca4b801d06f42b23c331dC:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\chrome.dllf182c79c-db35-11e4-8fbc-dc0ea1f98859


    ==================== Memory info ===========================

    Processor: AMD E1-1200 APU with Radeon(tm) HD Graphics
    Percentage of memory in use: 43%
    Total physical RAM: 3689.37 MB
    Available physical RAM: 2069.43 MB
    Total Pagefile: 7376.92 MB
    Available Pagefile: 5081.13 MB
    Total Virtual: 8192 MB
    Available Virtual: 8191.84 MB

    ==================== Drives ================================

    Drive c: (Windows7_OS) (Fixed) (Total:252.89 GB) (Free:207.77 GB) NTFS ==>[System with boot components (obtained from reading drive)]
    Drive d: (LENOVO) (Fixed) (Total:25.47 GB) (Free:23.71 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 7D95A85C)
    Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
    Partition 2: (Not Active) - (Size=252.9 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=25.5 GB) - (Type=07 NTFS)
    Partition 4: (Not Active) - (Size=19.5 GB) - (Type=12)

    ==================== End Of Log ============================
     
  4. TruckerRon1

    TruckerRon1 Thread Starter

    Joined:
    Apr 4, 2015
    Messages:
    5
    here is mbar results

    Malwarebytes Anti-Rootkit BETA 1.09.1.1004
    www.malwarebytes.org

    Database version:
    main: v2015.04.05.03
    rootkit: v2015.03.31.01

    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 9.0.8112.16421
    Argie :: ARGIE-PC [administrator]

    4/5/2015 12:17:43 PM
    mbar-log-2015-04-05 (12-17-43).txt

    Scan type: Quick scan
    Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
    Scan options disabled:
    Objects scanned: 332569
    Time elapsed: 19 minute(s), 49 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    Physical Sectors Detected: 0
    (No malicious items detected)

    (end)
     
  5. CatByte

    CatByte Malware Specialist

    Joined:
    Feb 24, 2009
    Messages:
    3,930
    There are no obvious signs of any malware in the logs

    how is the computer behaving?

    Please run the following:


    Please run a free online scan with the ESET Online Scanner

    US Link: http://www.eset.com/us/online-scanner/
    EU Link: http://www.eset.eu/online-scanner/

    Windows Vista/Windows 7/Windows 8 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator
    • Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
    • Turn off the real time scanner of any existing antivirus program while performing the online scan.
    • Click the blue Run ESET Online Scanner button
    • Tick the box next to YES, I accept the Terms of Use.
    • Click Start
    • When asked, allow the program to install the "OnlineScanner.cab" activex control by clicking the Install button
    • Once the activex control is installed, on the next screen click on Enable detection of potentially unwanted applications
    • Click on Advanced Settings
    • Make sure that the option Remove found threats is unticked.
    • Ensure these options are ticked
    ○ Scan archives
    ○ Scan for potentially unsafe applications
    ○ Enable Anti-Stealth technology
    • Click Start
    • Wait for the scan to finish
    • When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file..."
    • Save that text file on your desktop. Attach the log as a reply to your next reply..
    • Close the ESET online scan, and let me know how things are now.
     
  6. TruckerRon1

    TruckerRon1 Thread Starter

    Joined:
    Apr 4, 2015
    Messages:
    5
    Catbyte
    The computer is very slow took over an hour to finish scan. I first noticed that her computer was part of a homegroup which I never set up,nor does she have the knowledge to do this on her own. I had noticed that one of the computer names was "xbox" I have since disabled the homegroup option.


    This was the only threat found.



    C:\Users\Argie\Downloads\ZipExtractorSetup.exe a variant of Win32/InstallCore.GZ potentially unwanted application


    I really appreciate your help

    TruckerRon1
     
  7. CatByte

    CatByte Malware Specialist

    Joined:
    Feb 24, 2009
    Messages:
    3,930
    The detection by ESET is an installation file that is bundled with adware, so if you no longer need it then delete it.

    How does she connect, via modem/router? make sure that she has a strong password so no one can piggyback on her internet connection.

    (You may need to contact her internet service provider to check on the status of her connection and change the password to it)

    That may explain the mysterious user, but it's hard to know for sure.


    she should probably reset the browsers and reset the router and flush the DNS just as a precaution:


    Reset all the browsers back to default:

    Instructions on how to backup your Favourites/Bookmarks and other data can be found below.

    Backup Internet Explorer Bookmarks
    http://www.wikihow.com/Back-Up-Favorites-in-Internet-Explorer
    Backup Firefox Bookmarks
    https://support.mozilla.org/en-US/kb/export-firefox-bookmarks-to-backup-or-transfer
    Backup Chrome Bookmarks
    http://www.wikihow.com/Export-Bookmarks-from-Chrome

    Proceed with the reset once done.

    I.E.

    Open Internet Explorer, click on the gear icon at the top (far right), then click again on Internet Options.
    In the Internet Options dialog box, click on the Advanced tab, then click on the Reset button.
    Reset Internet Explorer
    In the Reset Internet Explorer settings section, check the Delete personal settings box, then click on Reset Internet Explorer back to its default settings
    When Internet Explorer finishes resetting, click Close in the confirmation dialogue box and then click OK.
    Close Internet Explorer.

    Firefox

    At the top of the Firefox window, click the Firefox button, go over to the Help sub-menu and select Troubleshooting Information.
    Click the Reset Firefox button in the upper-right corner of the Troubleshooting Information page.
    To continue, click Reset Firefox in the confirmation window that opens.
    Firefox will close and be reset. When it’s done, a window will list the information that was imported. Click Finish

    Google Chrome

    enter the following into the Chrome address bar:

    chrome://settings/personal

    • and at the bottom click on "Advanced Settings"
    • At the very bottom of the page click on "Reset Browser Settings"

    Then if you use the sync feature, check the section for "delete your synced data from your Google Account " at the bottom of this page
    http://support.google.com/chrome/bin/answer.py?hl=en&answer=185277



    NEXT

    Reset your Router:

    This can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled "reset" located on the back of the router.
    Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds).
    If you don’t know the router's default password, you can look it up. HERE http://www.routerpasswords.com/
    You also need to reconfigure any security settings you had in place prior to the reset. << good time to set a secure password on the router.

    You may also need to consult with your Internet service provider to find out which DNS servers your network should be using.

    NEXT

    Please do the following:

    Click the Microsoft Start logo in the bottom left corner of the screen
    Click All Programs
    Click Accessories
    RIGHT-click on Command Prompt
    Select Run As Administrator
    In the command window type the following and then hit enter:

    ipconfig /flushdns

    You will see the following confirmation:

    "Windows IP Configuration
    Successfully flushed the DNS Resolver Cache."


    NEXT


    If her hard drive is not SSD, then have her run a defrag, it may speed things up:

    First open an elevated Command Prompt
    • Go to Start > All Programs > Accessories
    • right click on the Command Prompt and choose &#8220;Run as administrator&#8221;
    • Type the following see how much your hard drive is fragmented (in this example, your C:\ drive):
    • defrag c: -a (be patient, this can take a while)
    • The resulting analysis will tell you a &#8220;Percent file fragmentation&#8221; and at the bottom, if you need to defragment the drive or not.
    • To fully defragment your C:\ drive type the following:
    • defrag c: -w
    • Give it time to run (it can take a while, best to leave the computer alone) and then you&#8217;re done!
     
  8. TruckerRon1

    TruckerRon1 Thread Starter

    Joined:
    Apr 4, 2015
    Messages:
    5
    Catbyte
    I just want to let you know that I did everything in your last post except resetting the router, I will have to do that next time I'm at the in laws house. it seems to be running a little better I didn't have any issues so I just want to thank you for all your help I will go ahead and Mark this post as solved and once again I really appreciate what you have done

    Truckerron1
     
  9. CatByte

    CatByte Malware Specialist

    Joined:
    Feb 24, 2009
    Messages:
    3,930
    You are quite welcome.

    You can right click and delete the MBAR folder and the FRST logs and program from the PC and you should be good to go.

    Regards

    ~CB
     
  10. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/1146016

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice