1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Strange videos and pdf's popping up on desktop

Discussion in 'Virus & Other Malware Removal' started by Meggi, Apr 30, 2015.

Thread Status:
Not open for further replies.
Advertisement
  1. Meggi

    Meggi Thread Starter

    Joined:
    Jan 8, 2015
    Messages:
    4
    Tech Support Guy System Info Utility version 1.0.0.2
    OS Version: Microsoft Windows 7 Home Premium, Service Pack 1, 64 bit
    Processor: Intel(R) Core(TM) i5-2390T CPU @ 2.70GHz, Intel64 Family 6 Model 42 Stepping 7
    Processor Count: 4
    RAM: 8174 Mb
    Graphics Card: ASUS EAH6450 Series, -2048 Mb
    Hard Drives: C: Total - 942252 MB, Free - 751745 MB; D: Total - 11513 MB, Free - 1374 MB; J: Total - 476937 MB, Free - 131268 MB;
    Motherboard: PEGATRON CORPORATION, 2AC2
    Antivirus: PC Cleaner Pro, Updated: Yes, Actually using: Avira On-Demand Scanner: Disabled


    Hello, I am having some strange problems which I believe to be related and are most likely not a virus. The first involves internet speed issues. I have fast internet through a cable provider but for quite a while now it has been slow and quite often refuses to respond. I originally thought the problem might be with the provider but their tests show no problems on their end. At the same time I started having internet trouble strange ads would randomly appear on my desktop. They were either pdf files or video (some of the images are attached). I haven't been able to find any of the "files" anywhere on my computer and once I close Adobe or Media Player the open files are gone. The other strange thing is unsent drafts are appearing in outlook. They are not addressed to anyone. The only thing they contain is a link to some other site. I have noticed that several of these indicate that they are sent via "shareaholic". I have installed and run SpyBot but it was not able to find anything. Any help is greatly appreciated. Thanks!
     

    Attached Files:

  2. JSntgRvr

    JSntgRvr Retired Moderator and Malware Specialist

    Joined:
    Jul 1, 2003
    Messages:
    18,552
    First Name:
    José
    Welcome :)

    Please download Farbar Recovery Scan Tool and save it to your desktop.

    Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
    • Double-click to run it. When the tool opens click Yes to disclaimer.
    • Make sure that under Optional Scans, there is a checkmark on Addition.txt.
    • Press Scan button.
    • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
    • The tool will also produce another log (Addition.txt ). Please attach this to your reply.
     
  3. Meggi

    Meggi Thread Starter

    Joined:
    Jan 8, 2015
    Messages:
    4
    Thank you. I followed your directions and ran Farbar Recovery. This is the first log:


    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-04-2015 01
    Ran by Us (administrator) on HOME on 30-04-2015 18:05:49
    Running from C:\Users\Us\Desktop
    Loaded Profiles: Us (Available profiles: Us)
    Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
    Internet Explorer Version 11 (Default browser: IE)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
    ==================== Processes (Whitelisted) =================
    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
    (IBM Corp.) C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe
    (AMD) C:\Windows\System32\atiesrxx.exe
    (AMD) C:\Windows\System32\atieclxx.exe
    (Microsoft Corporation) C:\Windows\System32\wlanext.exe
    (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
    (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
    (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    (IBM Corp.) C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe
    (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (Ellora Assets Corp.) C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe
    (Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
    (Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    (Mindspark) C:\Program Files (x86)\GamingWonderland\bar\1.bin\gtbarsvc.exe
    (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
    (Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
    (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
    () C:\Users\Us\AppData\Local\Amazon Music\Amazon Music Helper.exe
    (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
    (iWin Inc.) C:\Program Files (x86)\MSN Games\MSNTrusted.exe
    (Desksware) C:\Program Files\desksware\Desktop iCalendar Lite\Desktop iCalendar.exe
    (PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
    (AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
    (Microsoft Corporation) C:\Windows\System32\StikyNot.exe
    (Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry.exe
    (Ralink Technology, Inc.) C:\Program Files (x86)\Ralink\Common\RaWiFi.exe
    (Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe
    (Mindspark) C:\Program Files (x86)\GamingWonderland\bar\1.bin\APPINTEGRATOR.EXE
    (Mindspark) C:\Program Files (x86)\GamingWonderland\bar\1.bin\AppIntegrator64.exe
    (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
    (Microsoft Corporation) C:\Windows\System32\rundll32.exe
    (AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
    (Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
    (Hewlett-Packard) C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
    (Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
    (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    (Roxio) C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe
    (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
    (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
    (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
    (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
    (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
    (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
    (Microsoft Corporation) C:\Windows\System32\alg.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    (Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.EXE
    (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    (Microsoft Corporation) C:\Windows\System32\msiexec.exe
    (Microsoft Corporation) C:\Windows\System32\msiexec.exe
    (Microsoft Corporation) C:\Windows\System32\cmd.exe
    (Microsoft Corporation) C:\Windows\System32\PresentationHost.exe
    (Microsoft Corporation) C:\Windows\System32\msiexec.exe
    (Microsoft Corporation) C:\Windows\System32\rundll32.exe

    ==================== Registry (Whitelisted) ==================
    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
    HKLM\...\Run: [hpsysdrv] => c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
    HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation)
    HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
    HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3091224 2013-07-31] (Logitech, Inc.)
    HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-07] (Apple Inc.)
    HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [656920 2011-02-01] (PDF Complete Inc)
    HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-03-20] (Apple Inc.)
    HKLM-x32\...\Run: [GamingWonderland EPM Support] => C:\Program Files (x86)\GamingWonderland\bar\1.bin\gtmedint.exe [12872 2014-09-08] (Mindspark)
    HKLM-x32\...\Run: [GamingWonderland AppIntegrator 32-bit] => C:\Program Files (x86)\GamingWonderland\bar\1.bin\AppIntegrator.exe [225864 2014-09-08] (Mindspark)
    HKLM-x32\...\Run: [GamingWonderland AppIntegrator 64-bit] => C:\Program Files (x86)\GamingWonderland\bar\1.bin\AppIntegrator64.exe [258632 2014-09-08] (Mindspark)
    HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [726320 2015-03-31] (Avira Operations GmbH & Co. KG)
    HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41360 2014-12-03] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840592 2014-12-03] (Adobe Systems Inc.)
    HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
    HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
    HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
    HKLM-x32\...\Run: [] => [X]
    HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
    Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
    Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
    HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\Run: [Amazon Music] => C:\Users\Us\AppData\Local\Amazon Music\Amazon Music Helper.exe [6277952 2014-11-18] ()
    HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\Run: [Desktop iCalendar Lite.exe] => C:\Program Files\desksware\Desktop iCalendar Lite\Desktop iCalendar.exe [1721856 2014-12-09] (Desksware)
    HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\Run: [HydraVisionDesktopManager] => C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [389120 2013-12-06] (AMD)
    HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-13] (Microsoft Corporation)
    HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\MountPoints2: {cdc83530-0339-11e1-ac5c-e069958c6914} - J:\LaunchU3.exe -a
    HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\MountPoints2: {e7d3f360-efa9-11e1-90c8-e069958c6914} - J:\setup.exe -a
    HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\ss3dfish.scr [6111744 2010-04-30] ()
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk [2015-04-07]
    ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files (x86)\Ralink\Common\RaWiFi.exe (Ralink Technology, Inc.)
    Startup: C:\Users\Us\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Photosmart 7520 series.lnk [2015-02-02]
    ShortcutTarget: Monitor Ink Alerts - HP Photosmart 7520 series.lnk -> C:\Program Files\hp\HP Photosmart 7520 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
    BootExecute: autocheck autochk * sdnclean64.exe
    ==================== Internet (Whitelisted) ====================
    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
    ProxyEnable: [S-1-5-21-1551027734-1051973675-1866321763-1001] => Internet Explorer proxy is enabled.
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
    HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
    HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com
    HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp
    HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = www.live.com
    HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.microsoft.com/search/lobby/search.asp
    HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
    HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\Software\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.msn.com/
    URLSearchHook: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001 - (No Name) - {a8625cb7-85fe-4936-92a4-b2a7c925209e} - No File
    SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
    SearchScopes: HKLM -> {3d29c02b-bf3e-4d3b-8a7a-e0e7d0f6dbab} URL = http://search.mywebsearch.com/myweb...x8YiA&st=sb&n=77de5e3a&searchfor={searchTerms}
    SearchScopes: HKLM -> {ABADF295-606F-4D49-8321-AAAEDC4CF706} URL = http://www.amazon.com/s/ref=azs_osd...code=qs&index=aps&field-keywords={searchTerms}
    SearchScopes: HKLM -> {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = http://www.ask.com/web?&o=101881&l=dis&q={SEARCHTERMS}
    SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
    SearchScopes: HKLM -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
    SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-30572-11896-1/4?mpre=http://shop.ebay.com/?_nkw={searchTerms}
    SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
    SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
    SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
    SearchScopes: HKLM-x32 -> {3d29c02b-bf3e-4d3b-8a7a-e0e7d0f6dbab} URL = http://search.tb.ask.com/search/GGm...90821&st=sb&n=780c9645&searchfor={searchTerms}
    SearchScopes: HKLM-x32 -> {ABADF295-606F-4D49-8321-AAAEDC4CF706} URL = http://www.amazon.com/s/ref=azs_osd...code=qs&index=aps&field-keywords={searchTerms}
    SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
    SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
    SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-30572-11896-1/4?mpre=http://shop.ebay.com/?_nkw={searchTerms}
    SearchScopes: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL =
    SearchScopes: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
    SearchScopes: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001 -> {3d29c02b-bf3e-4d3b-8a7a-e0e7d0f6dbab} URL = http://search.tb.ask.com/search/GGm...90821&st=sb&n=780c9645&searchfor={searchTerms}
    SearchScopes: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001 -> {ABADF295-606F-4D49-8321-AAAEDC4CF706} URL = http://www.amazon.com/s/ref=azs_osd...code=qs&index=aps&field-keywords={searchTerms}
    SearchScopes: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001 -> {ABD93EAF-D775-BC54-E63B-2804F22FD156} URL = http://search.startnow.com/s/?q={se...os_version=6.1-x64-SP1&iesrc={referrer:source}
    SearchScopes: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001 -> {B0F6A9E6-A20E-2078-1826-6C700C6E8C1D} URL = http://www.bing.com/search?q={searchTerms}&pc=Z045&form=ZGAIDF
    SearchScopes: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = https://search.yahoo.com/search?p={...e=W3i_DS,136,0_0,Search,20150102,20028,0,31,0
    SearchScopes: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001 -> {BC364A77-1EA2-BC9C-F6F5-CC73E1D83A10} URL = http://www.bing.com/search?q={searc...&install_date=20110902&iesrc={referrer:source}
    SearchScopes: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
    SearchScopes: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-30572-11896-1/4?mpre=http://shop.ebay.com/?_nkw={searchTerms}
    SearchScopes: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001 -> {FBD9499A-91EC-C593-1D50-7512683B52A6} URL = http://www.bing.com/search?q={searc...&install_date=20110902&iesrc={referrer:source}
    BHO: No Name -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -> No File
    BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
    BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll [2013-07-31] (Logitech, Inc.)
    BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
    BHO: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.)
    BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
    BHO-x32: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File
    BHO-x32: No Name -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -> No File
    BHO-x32: Somoto Toolbar -> {652853ad-5592-4231-88c6-706613a52e61} -> C:\Program Files (x86)\somototoolbar\vmntemplateX.dll [2011-07-21] ()
    BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
    BHO-x32: No Name -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> No File
    BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2014-12-03] (Adobe Systems Incorporated)
    BHO-x32: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll [2013-07-31] (Logitech, Inc.)
    BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
    BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.)
    BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
    BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2014-12-03] (Adobe Systems Incorporated)
    Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.)
    Toolbar: HKLM-x32 - No Name - {5911488E-9D1E-40ec-8CBB-06B231CC153F} - No File
    Toolbar: HKLM-x32 - Somoto Toolbar - {652853ad-5592-4231-88c6-706613a52e61} - C:\Program Files (x86)\somototoolbar\vmntemplateX.dll [2011-07-21] ()
    Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.)
    Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2014-12-03] (Adobe Systems Incorporated)
    Toolbar: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
    Toolbar: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
    DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab
    Tcpip\Parameters: [DhcpNameServer] 75.75.76.76 75.75.75.75
    FireFox:
    ========
    FF ProfilePath: C:\Users\Us\AppData\Roaming\Mozilla\Firefox\Profiles\rM12jeXc.default
    FF Plugin: @microsoft.com/GENUINE -> disabled No File
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll [2014-12-11] ( Microsoft Corporation)
    FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
    FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
    FF Plugin-x32: @GamingWonderland.com/Plugin -> C:\Program Files (x86)\GamingWonderland\bar\1.bin\NPgtStub.dll No File
    FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.31211.0\npctrl.dll [2014-12-11] ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
    FF Plugin-x32: @oberon-media.com/ONCAdapter -> C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll [2011-05-24] (Oberon-Media )
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-04] (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-04] (Google Inc.)
    FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll [2014-11-14] ()
    FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
    FF Plugin HKU\S-1-5-21-1551027734-1051973675-1866321763-1001: @citrixonline.com/appdetectorplugin -> C:\Users\Us\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2014-06-26] (Citrix Online)
    FF Plugin HKU\S-1-5-21-1551027734-1051973675-1866321763-1001: @hulu.com/Hulu Desktop -> C:\Windows\..\Users\Default\AppData\Local\HuluDesktop\instances\0.9.13.1\npHDPlg.dll [2010-04-09] (Hulu LLC)
    FF Plugin HKU\S-1-5-21-1551027734-1051973675-1866321763-1001: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll [2013-01-23] (Amazon.com, Inc.)
    FF Extension: Avira Browser Safety - C:\Users\Us\AppData\Roaming\Mozilla\Firefox\Profiles\rM12jeXc.default\Extensions\[email protected] [2014-11-25]
    FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
    FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2013-10-12]
    FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
    FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2014-11-29]
    Chrome:
    =======
    CHR Profile: C:\Users\Us\AppData\Local\Google\Chrome\User Data\Default
    CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
    CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
    ==================== Services (Whitelisted) =================
    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
    R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [815920 2015-03-23] (Avira Operations GmbH & Co. KG)
    R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-03-23] (Avira Operations GmbH & Co. KG)
    R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-03-23] (Avira Operations GmbH & Co. KG)
    R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1004280 2015-03-31] (Avira Operations GmbH & Co. KG)
    R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
    R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
    R2 FreemakeVideoCapture; C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe [9216 2014-10-09] (Ellora Assets Corp.) [File not signed]
    S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [347200 2015-03-19] (WildTangent)
    R2 GamingWonderlandService; C:\Program Files (x86)\GamingWonderland\bar\1.bin\gtbarsvc.exe [90696 2014-09-08] (Mindspark)
    R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
    R2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-11-22] (Hewlett-Packard Company) [File not signed]
    R2 MSNTrusted; C:\Program Files (x86)\MSN Games\MSNTrusted.exe [538968 2014-12-09] (iWin Inc.)
    S2 ogmservice; C:\Program Files (x86)\Online Games Manager\ogmservice.exe [581568 2014-03-27] (RealNetworks, Inc.)
    R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1127448 2011-02-01] (PDF Complete Inc)
    R2 RalinkRegistryWriter; C:\Program Files (x86)\Ralink\Common\RaRegistry.exe [372736 2012-07-04] (Ralink Technology, Corp.) [File not signed]
    R2 RalinkRegistryWriter64; C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe [447488 2012-07-04] (Ralink Technology, Corp.) [File not signed]
    S2 RaMediaServer; C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe [1859584 2012-07-04] (Ralink) [File not signed]
    R2 RapportMgmtService; C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [1919256 2015-02-12] (IBM Corp.)
    R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
    S2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
    R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
    S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
    ==================== Drivers (Whitelisted) ====================
    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
    R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-10] (Avira Operations GmbH & Co. KG)
    R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-03-10] (Avira Operations GmbH & Co. KG)
    R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-10-22] (Avira Operations GmbH & Co. KG)
    R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-10] (Avira Operations GmbH & Co. KG)
    R2 npf; C:\Windows\System32\drivers\npf.sys [35344 2011-02-11] (CACE Technologies, Inc.)
    R1 RapportCerberus_80128; C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_80128.sys [844440 2015-02-23] (IBM Corp.)
    R1 RapportEI64; C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [445816 2015-02-12] (IBM Corp.)
    R0 RapportKE64; C:\Windows\System32\Drivers\RapportKE64.sys [535576 2015-02-12] (IBM Corp.)
    R1 RapportPG64; C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [558872 2015-02-12] (IBM Corp.)
    ==================== NetSvcs (Whitelisted) ===================
    (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

    ==================== One Month Created Files and Folders ========
    (If an entry is included in the fixlist, the file\folder will be moved.)
    2015-04-30 18:05 - 2015-04-30 18:07 - 00030057 _____ () C:\Users\Us\Desktop\FRST.txt
    2015-04-30 18:05 - 2015-04-30 18:06 - 00000000 ____D () C:\FRST
    2015-04-30 17:26 - 2015-04-30 17:27 - 02101248 _____ (Farbar) C:\Users\Us\Desktop\FRST64.exe
    2015-04-30 11:43 - 2015-04-30 11:43 - 00509440 _____ (Tech Support Guy System) C:\Users\Us\Downloads\SysInfo (1).exe
    2015-04-29 08:55 - 2015-04-29 08:55 - 00001797 _____ () C:\Users\Us\Desktop\Crime Solitaire.lnk
    2015-04-24 10:00 - 2015-04-24 10:00 - 00000000 ____D () C:\Users\Us\AppData\Roaming\ERS Game Studios
    2015-04-23 14:21 - 2015-04-23 14:21 - 00000000 ____D () C:\Users\Us\.prefs
    2015-04-23 11:59 - 2015-04-23 12:07 - 00009203 _____ () C:\Users\Us\Documents\WiFi and Hotspot.xlsx
    2015-04-23 11:25 - 2015-04-23 11:25 - 00012380 _____ () C:\Users\Us\Documents\folder labels.xlsx
    2015-04-21 12:51 - 2015-04-21 12:51 - 00001786 _____ () C:\Users\Us\Desktop\Ted the Jumper.lnk
    2015-04-15 10:17 - 2015-04-15 10:18 - 00000000 ____D () C:\Users\Us\AppData\Roaming\Laruaville2
    2015-04-15 05:46 - 2015-03-24 21:24 - 03298816 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
    2015-04-15 05:46 - 2015-03-24 21:24 - 02553856 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
    2015-04-15 05:46 - 2015-03-24 21:24 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
    2015-04-15 05:46 - 2015-03-24 21:24 - 00191488 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
    2015-04-15 05:46 - 2015-03-24 21:24 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
    2015-04-15 05:46 - 2015-03-24 21:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
    2015-04-15 05:46 - 2015-03-24 21:24 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
    2015-04-15 05:46 - 2015-03-24 21:24 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
    2015-04-15 05:46 - 2015-03-24 21:23 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
    2015-04-15 05:46 - 2015-03-24 21:23 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
    2015-04-15 05:46 - 2015-03-24 21:23 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
    2015-04-15 05:46 - 2015-03-24 21:00 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
    2015-04-15 05:46 - 2015-03-24 21:00 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
    2015-04-15 05:46 - 2015-03-24 21:00 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
    2015-04-15 05:46 - 2015-03-24 21:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
    2015-04-15 05:46 - 2015-03-24 21:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
    2015-04-15 05:46 - 2015-03-22 21:25 - 00769536 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
    2015-04-15 05:46 - 2015-03-22 21:25 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
    2015-04-15 05:46 - 2015-03-22 21:24 - 00957952 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
    2015-04-15 05:46 - 2015-03-22 21:24 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
    2015-04-15 05:46 - 2015-03-22 21:24 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
    2015-04-15 05:46 - 2015-03-22 21:24 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
    2015-04-15 05:46 - 2015-03-22 21:24 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
    2015-04-15 05:46 - 2015-03-22 21:17 - 01111552 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
    2015-04-15 05:46 - 2015-03-09 21:25 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
    2015-04-15 05:46 - 2015-03-09 21:21 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
    2015-04-15 05:46 - 2015-03-09 21:08 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
    2015-04-15 05:46 - 2015-03-09 21:05 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
    2015-04-15 05:46 - 2015-03-04 23:12 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
    2015-04-15 05:46 - 2015-03-04 22:05 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
    2015-04-15 05:45 - 2015-04-01 18:17 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
    2015-04-15 05:45 - 2015-04-01 17:49 - 00342704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
    2015-04-15 05:45 - 2015-03-16 23:22 - 05557696 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
    2015-04-15 05:45 - 2015-03-16 23:22 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
    2015-04-15 05:45 - 2015-03-16 23:22 - 00095672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
    2015-04-15 05:45 - 2015-03-16 23:19 - 01727904 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
    2015-04-15 05:45 - 2015-03-16 23:17 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
    2015-04-15 05:45 - 2015-03-16 23:17 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
    2015-04-15 05:45 - 2015-03-16 23:17 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
    2015-04-15 05:45 - 2015-03-16 23:16 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
    2015-04-15 05:45 - 2015-03-16 23:16 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
    2015-04-15 05:45 - 2015-03-16 23:16 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
    2015-04-15 05:45 - 2015-03-16 23:16 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
    2015-04-15 05:45 - 2015-03-16 23:16 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
    2015-04-15 05:45 - 2015-03-16 23:16 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
    2015-04-15 05:45 - 2015-03-16 23:16 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
    2015-04-15 05:45 - 2015-03-16 23:16 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
    2015-04-15 05:45 - 2015-03-16 23:16 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
    2015-04-15 05:45 - 2015-03-16 23:16 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
    2015-04-15 05:45 - 2015-03-16 23:16 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
    2015-04-15 05:45 - 2015-03-16 23:16 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
    2015-04-15 05:45 - 2015-03-16 23:16 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
    2015-04-15 05:45 - 2015-03-16 23:16 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
    2015-04-15 05:45 - 2015-03-16 23:16 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
    2015-04-15 05:45 - 2015-03-16 23:16 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
    2015-04-15 05:45 - 2015-03-16 23:16 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
    2015-04-15 05:45 - 2015-03-16 23:16 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
    2015-04-15 05:45 - 2015-03-16 23:16 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
    2015-04-15 05:45 - 2015-03-16 23:16 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
    2015-04-15 05:45 - 2015-03-16 23:15 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
    2015-04-15 05:45 - 2015-03-16 23:15 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
    2015-04-15 05:45 - 2015-03-16 23:15 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
    2015-04-15 05:45 - 2015-03-16 23:13 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
    2015-04-15 05:45 - 2015-03-16 23:13 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 23:01 - 03976632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
    2015-04-15 05:45 - 2015-03-16 23:01 - 03920824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
    2015-04-15 05:45 - 2015-03-16 22:59 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
    2015-04-15 05:45 - 2015-03-16 22:57 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
    2015-04-15 05:45 - 2015-03-16 22:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
    2015-04-15 05:45 - 2015-03-16 22:57 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
    2015-04-15 05:45 - 2015-03-16 22:57 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
    2015-04-15 05:45 - 2015-03-16 22:57 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
    2015-04-15 05:45 - 2015-03-16 22:57 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
    2015-04-15 05:45 - 2015-03-16 22:57 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
    2015-04-15 05:45 - 2015-03-16 22:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
    2015-04-15 05:45 - 2015-03-16 22:57 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
    2015-04-15 05:45 - 2015-03-16 22:56 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
    2015-04-15 05:45 - 2015-03-16 22:56 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
    2015-04-15 05:45 - 2015-03-16 22:56 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
    2015-04-15 05:45 - 2015-03-16 22:56 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
    2015-04-15 05:45 - 2015-03-16 22:56 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
    2015-04-15 05:45 - 2015-03-16 22:56 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
    2015-04-15 05:45 - 2015-03-16 22:56 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
    2015-04-15 05:45 - 2015-03-16 22:53 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
    2015-04-15 05:45 - 2015-03-16 22:53 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 21:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
    2015-04-15 05:45 - 2015-03-16 21:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
    2015-04-15 05:45 - 2015-03-16 21:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 21:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 21:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-16 21:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
    2015-04-15 05:45 - 2015-03-12 22:32 - 24980480 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2015-04-15 05:45 - 2015-03-12 22:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2015-04-15 05:45 - 2015-03-12 22:25 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
    2015-04-15 05:45 - 2015-03-12 22:09 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
    2015-04-15 05:45 - 2015-03-12 22:08 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
    2015-04-15 05:45 - 2015-03-12 22:08 - 00417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
    2015-04-15 05:45 - 2015-03-12 22:08 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
    2015-04-15 05:45 - 2015-03-12 22:07 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2015-04-15 05:45 - 2015-03-12 22:06 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
    2015-04-15 05:45 - 2015-03-12 22:00 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2015-04-15 05:45 - 2015-03-12 21:59 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
    2015-04-15 05:45 - 2015-03-12 21:55 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2015-04-15 05:45 - 2015-03-12 21:54 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
    2015-04-15 05:45 - 2015-03-12 21:54 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
    2015-04-15 05:45 - 2015-03-12 21:53 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
    2015-04-15 05:45 - 2015-03-12 21:50 - 06025216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2015-04-15 05:45 - 2015-03-12 21:44 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
    2015-04-15 05:45 - 2015-03-12 21:42 - 19695616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2015-04-15 05:45 - 2015-03-12 21:42 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2015-04-15 05:45 - 2015-03-12 21:40 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
    2015-04-15 05:45 - 2015-03-12 21:32 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
    2015-04-15 05:45 - 2015-03-12 21:28 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
    2015-04-15 05:45 - 2015-03-12 21:28 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
    2015-04-15 05:45 - 2015-03-12 21:27 - 00340992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
    2015-04-15 05:45 - 2015-03-12 21:27 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
    2015-04-15 05:45 - 2015-03-12 21:27 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
    2015-04-15 05:45 - 2015-03-12 21:26 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
    2015-04-15 05:45 - 2015-03-12 21:26 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
    2015-04-15 05:45 - 2015-03-12 21:23 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
    2015-04-15 05:45 - 2015-03-12 21:22 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2015-04-15 05:45 - 2015-03-12 21:20 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2015-04-15 05:45 - 2015-03-12 21:20 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
    2015-04-15 05:45 - 2015-03-12 21:17 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2015-04-15 05:45 - 2015-03-12 21:16 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
    2015-04-15 05:45 - 2015-03-12 21:15 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
    2015-04-15 05:45 - 2015-03-12 21:08 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
    2015-04-15 05:45 - 2015-03-12 21:07 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2015-04-15 05:45 - 2015-03-12 21:06 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
    2015-04-15 05:45 - 2015-03-12 21:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
    2015-04-15 05:45 - 2015-03-12 21:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
    2015-04-15 05:45 - 2015-03-12 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
    2015-04-15 05:45 - 2015-03-12 21:00 - 14397440 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2015-04-15 05:45 - 2015-03-12 20:57 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
    2015-04-15 05:45 - 2015-03-12 20:56 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
    2015-04-15 05:45 - 2015-03-12 20:54 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
    2015-04-15 05:45 - 2015-03-12 20:49 - 04305408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2015-04-15 05:45 - 2015-03-12 20:45 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2015-04-15 05:45 - 2015-03-12 20:44 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2015-04-15 05:45 - 2015-03-12 20:43 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
    2015-04-15 05:45 - 2015-03-12 20:42 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
    2015-04-15 05:45 - 2015-03-12 20:34 - 12825600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2015-04-15 05:45 - 2015-03-12 20:33 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2015-04-15 05:45 - 2015-03-12 20:22 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
    2015-04-15 05:45 - 2015-03-12 20:20 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2015-04-15 05:45 - 2015-03-12 20:16 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2015-04-15 05:45 - 2015-03-12 20:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
    2015-04-15 05:45 - 2015-03-03 22:55 - 00367552 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
    2015-04-15 05:45 - 2015-03-03 22:41 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
    2015-04-15 05:45 - 2015-03-03 22:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
    2015-04-15 05:45 - 2015-02-24 21:18 - 00754688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
    2015-04-11 16:38 - 2015-04-11 16:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
    2015-04-11 16:37 - 2015-04-11 16:38 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
    2015-04-11 16:37 - 2015-04-11 16:38 - 00000000 ____D () C:\Program Files\iTunes
    2015-04-11 16:37 - 2015-04-11 16:37 - 00000000 ____D () C:\Program Files\iPod
    2015-04-11 16:37 - 2015-04-11 16:37 - 00000000 ____D () C:\Program Files (x86)\iTunes
    2015-04-07 11:55 - 2015-04-30 13:39 - 00000432 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
    2015-04-07 11:53 - 2015-04-07 11:53 - 00000000 ____D () C:\Users\Us\Documents\Media Share
    2015-04-07 11:53 - 2015-04-07 11:53 - 00000000 ____D () C:\ProgramData\Ralink
    2015-04-05 03:00 - 2015-04-05 03:00 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
    2015-04-05 03:00 - 2015-04-05 03:00 - 00000000 ___SD () C:\Windows\system32\GWX
    2015-04-04 15:28 - 2015-04-29 15:28 - 00003168 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForUs
    2015-04-04 15:28 - 2015-04-29 15:28 - 00000320 _____ () C:\Windows\Tasks\HPCeeScheduleForUs.job
    2015-04-04 12:39 - 2015-04-04 12:39 - 00000000 ____D () C:\Users\Us\AppData\Local\{BCC78533-7E23-4DD9-88DF-280C7FDE01D5}
    ==================== One Month Modified Files and Folders =======
    (If an entry is included in the fixlist, the file\folder will be moved.)
    2015-04-30 18:03 - 2011-09-21 13:21 - 00000000 ____D () C:\Users\Us\Documents\Outlook Files
    2015-04-30 17:39 - 2013-04-02 10:35 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
    2015-04-30 13:44 - 2009-07-13 22:45 - 00024608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2015-04-30 13:44 - 2009-07-13 22:45 - 00024608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2015-04-30 13:41 - 2011-09-02 02:44 - 01651567 _____ () C:\Windows\WindowsUpdate.log
    2015-04-30 13:39 - 2011-05-02 21:36 - 00000000 ____D () C:\ProgramData\PDFC
    2015-04-30 13:36 - 2014-10-25 09:52 - 00000000 ___HD () C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}
    2015-04-30 13:36 - 2013-01-24 17:50 - 00000354 _____ () C:\Windows\Tasks\ROC_JAN2013_TB_rmv.job
    2015-04-30 13:36 - 2012-10-01 20:19 - 00356938 _____ () C:\Windows\setupact.log
    2015-04-30 13:36 - 2012-09-20 18:52 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2015-04-30 13:36 - 2009-07-13 23:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
    2015-04-30 12:47 - 2015-01-10 18:27 - 00000000 ____D () C:\Users\Us\Documents\Web Page
    2015-04-30 10:52 - 2011-09-04 10:52 - 00003898 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{44063024-7A63-4E70-BCF7-D2EBDE0E5580}
    2015-04-29 16:42 - 2011-10-22 14:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GameHouse
    2015-04-29 16:42 - 2011-07-19 08:28 - 00000000 ____D () C:\GameHouse Games
    2015-04-29 08:55 - 2014-08-08 17:21 - 00000000 ____D () C:\Users\Us\AppData\Local\com.gamehouse.acid
    2015-04-28 07:16 - 2011-09-02 14:58 - 00000000 ____D () C:\Users\Us\AppData\Local\CrashDumps
    2015-04-27 11:41 - 2015-01-12 19:55 - 00000000 ____D () C:\Users\Us\Documents\work computer
    2015-04-27 06:43 - 2012-09-23 12:51 - 00000404 _____ () C:\Windows\Tasks\RegCure Pro.job
    2015-04-25 15:17 - 2011-09-03 18:58 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
    2015-04-25 14:39 - 2009-07-13 23:08 - 00032652 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
    2015-04-23 14:21 - 2011-09-02 02:45 - 00000000 ____D () C:\Users\Us
    2015-04-17 20:30 - 2015-02-02 12:07 - 00000000 ____D () C:\Users\Us\Documents\Trips
    2015-04-17 18:53 - 2014-01-02 18:38 - 00000000 ____D () C:\Users\Us\AppData\Roaming\MysteryTag
    2015-04-17 16:29 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\AppCompat
    2015-04-17 16:22 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\rescache
    2015-04-16 17:48 - 2012-07-13 15:05 - 00003210 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForHOME$
    2015-04-16 17:48 - 2012-07-13 15:05 - 00000334 _____ () C:\Windows\Tasks\HPCeeScheduleForHOME$.job
    2015-04-16 06:48 - 2014-12-10 04:30 - 00000000 ____D () C:\Windows\system32\appraiser
    2015-04-16 06:48 - 2014-05-06 07:48 - 00000000 ___SD () C:\Windows\system32\CompatTel
    2015-04-16 06:48 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
    2015-04-15 21:10 - 2011-09-02 17:20 - 00000000 ____D () C:\ProgramData\Microsoft Help
    2015-04-15 21:09 - 2011-02-11 11:15 - 00778744 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
    2015-04-15 21:09 - 2009-07-13 23:13 - 00778744 _____ () C:\Windows\system32\PerfStringBackup.INI
    2015-04-15 21:06 - 2013-08-11 11:55 - 00000000 ____D () C:\Windows\system32\MRT
    2015-04-15 21:00 - 2011-09-07 06:47 - 128913832 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
    2015-04-15 20:59 - 2009-07-13 20:34 - 00000478 _____ () C:\Windows\win.ini
    2015-04-15 10:39 - 2013-04-02 10:35 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
    2015-04-15 10:39 - 2012-05-14 18:57 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
    2015-04-15 10:39 - 2011-09-17 13:49 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
    2015-04-14 17:02 - 2011-09-04 13:43 - 00000000 ____D () C:\Users\Us\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
    2015-04-11 16:37 - 2014-10-04 08:57 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
    2015-04-11 16:37 - 2011-09-10 15:57 - 00000000 ____D () C:\Program Files\Common Files\Apple
    2015-04-10 15:58 - 2015-01-30 11:57 - 00000000 ____D () C:\ProgramData\Meridian93
    2015-04-10 15:53 - 2015-01-30 11:50 - 00000000 ____D () C:\Users\Us\AppData\Roaming\Meridian93
    2015-04-08 14:27 - 2013-05-14 14:05 - 00000000 ____D () C:\Users\Us\AppData\Roaming\8floor
    2015-04-08 05:34 - 2014-11-25 18:37 - 00000000 ____D () C:\ProgramData\Package Cache
    2015-04-08 05:33 - 2014-11-25 18:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
    2015-04-08 05:33 - 2014-11-25 18:37 - 00000000 ____D () C:\Program Files (x86)\Avira
    2015-04-07 12:00 - 2009-07-13 21:20 - 00000000 __RHD () C:\Users\Public\Libraries
    2015-04-04 12:43 - 2015-01-03 16:57 - 00000000 ____D () C:\Users\Us\AppData\Roaming\Casual Arts
    2015-04-01 05:31 - 2010-11-20 21:47 - 00982908 _____ () C:\Windows\PFRO.log
    ==================== Files in the root of some directories =======
    2012-08-05 14:36 - 2012-08-05 14:44 - 0000000 _____ () C:\Users\Us\AppData\Roaming\bibstats
    2015-02-23 21:37 - 2015-02-23 22:57 - 0000115 _____ () C:\Users\Us\AppData\Roaming\LogFile.txt
    2015-01-07 13:58 - 2015-01-07 13:58 - 0003584 _____ () C:\Users\Us\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2015-02-02 17:18 - 2015-02-02 17:18 - 0000057 _____ () C:\ProgramData\Ament.ini
    2014-07-26 09:14 - 2001-07-16 08:38 - 0007680 ___SH () C:\ProgramData\xp342user.exe
    2013-11-25 21:07 - 2013-12-01 13:45 - 0000149 _____ () C:\ProgramData\zen_msaveg.log
    Files to move or delete:
    ====================
    C:\ProgramData\xp342user.exe
    C:\Users\Us\QuickCareSetup2.exe

    Some content of TEMP:
    ====================
    C:\Users\Us\AppData\Local\Temp\avgnt.exe
    C:\Users\Us\AppData\Local\Temp\ose00000.exe

    ==================== Bamital & volsnap Check =================
    (There is no automatic fix for files that do not pass verification.)
    C:\Windows\System32\winlogon.exe => File is digitally signed
    C:\Windows\System32\wininit.exe => File is digitally signed
    C:\Windows\SysWOW64\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\System32\services.exe => File is digitally signed
    C:\Windows\System32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\System32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed
    C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

    LastRegBack: 2015-04-30 14:30
    ==================== End Of Log ============================
     
  4. Meggi

    Meggi Thread Starter

    Joined:
    Jan 8, 2015
    Messages:
    4
    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-04-2015 01
    Ran by Us at 2015-04-30 18:07:18
    Running from C:\Users\Us\Desktop
    Boot Mode: Normal
    ==========================================================

    ==================== Accounts: =============================
    Administrator (S-1-5-21-1551027734-1051973675-1866321763-500 - Administrator - Disabled)
    Guest (S-1-5-21-1551027734-1051973675-1866321763-501 - Limited - Enabled)
    HomeGroupUser$ (S-1-5-21-1551027734-1051973675-1866321763-1007 - Limited - Enabled)
    Us (S-1-5-21-1551027734-1051973675-1866321763-1001 - Administrator - Enabled) => C:\Users\Us
    ==================== Security Center ========================
    (If an entry is included in the fixlist, it will be removed.)
    AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
    AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
    AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
    ==================== Installed Programs ======================
    (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
    1001 Jigsaw Earth Chronicles 2 (HKLM-x32\...\0ffb9313c3ef955c84ea76c3668fa945) (Version: - GameHouse)
    1912 Titanic Mystery (HKLM-x32\...\adafc5dc823222fcc5a6a83cdf9896ca) (Version: - GameHouse)
    3D Fish School Screen Saver 4.96 (HKLM-x32\...\3D Fish School 4 Screen Saver_is1) (Version: 4.96 - Gelios Software)
    Abandoned: Chestnut Lodge Asylum (x32 Version: 3.0.2.59 - WildTangent) Hidden
    Abyss - The Wraiths of Eden Premium Edition (HKLM-x32\...\am-abyssthewraithsofedenpremiumedition) (Version: - gamehouse)
    Adobe Acrobat X Pro (HKLM-x32\...\{AC76BA86-1033-0000-7760-000000000005}) (Version: 10.1.13 - Adobe Systems)
    Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.5.1.17730 - Adobe Systems Inc.)
    Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
    Adventure Ball (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11142490}) (Version: - Oberon Media)
    Agatha Christie - Peril at End House (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Amazing Adventures Around the World™ (HKLM-x32\...\dcb6556a7600f493c25e2ae27c631327) (Version: - GameHouse)
    Amazing Adventures Riddle of the Two Knights(TM) (HKLM-x32\...\d31244852e842eea974dd47f906548ac) (Version: - GameHouse)
    Amazon MP3 Downloader 1.0.17 (HKLM-x32\...\Amazon MP3 Downloader) (Version: 1.0.17 - Amazon Services LLC)
    Amazon Music (HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\Amazon Amazon Music) (Version: 3.7.0.693 - Amazon Services LLC)
    Amazon Music Importer (HKLM-x32\...\com.amazon.music.uploader) (Version: 2.0.1 - Amazon Services LLC)
    Amazon Music Importer (x32 Version: 2.0.1 - Amazon Services LLC) Hidden
    AMD Catalyst Install Manager (HKLM\...\{22E2B25B-2FFE-1A69-E591-55DD72BC5F5B}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
    Any Video To DVD FileBulldog Toolbar (HKLM-x32\...\Any Video To DVD FileBulldog Toolbar) (Version: - )
    Apothecarium Premium Edition (HKLM-x32\...\99586613c1307df4de5d03c67521ead1) (Version: - GameHouse)
    Apple Application Support (32-bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
    Apple Application Support (64-bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)
    Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
    Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
    Aquaball (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111720130}) (Version: - Oberon Media)
    Aquascapes Premium Edition (HKLM-x32\...\29ba4b79f39908a7a051c6a8ee54ba00) (Version: - GameHouse)
    AquaSphere (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-114769570}) (Version: - Oberon Media)
    Asian Riddles 3 (HKLM-x32\...\7a04947ea2fbfd4ab5eb1571993cea10) (Version: - GameHouse)
    ATI Stream SDK v2 Developer (HKLM\...\{80C27FE9-C6C4-F5C8-EAD3-09E7E0102E78}) (Version: 2.2.0.0 - ATI Technologies Inc.)
    Atlantic Quest Solitaire (HKLM-x32\...\5875d4ca5717af0f5a5d6f8deb1eb4e4) (Version: - GameHouse)
    AVG PC TuneUp Language Pack (en-US) (x32 Version: 12.0.4020.9 - AVG Technologies) Hidden
    Avira (HKLM-x32\...\{b5675cc4-ab8b-4945-8c1d-4c5479556d6a}) (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG)
    Avira (x32 Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG) Hidden
    Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.9.504 - Avira Operations GmbH & Co. KG)
    Aztec Ball (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112385927}) (Version: - Oberon Media)
    Barn Yarn Premium Edition (HKLM-x32\...\am-barnyarnpremiumedition) (Version: - gamehouse)
    Battleship Fleet Command (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113105857}) (Version: - Oberon Media)
    Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Bejeweled 3 (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Big City Adventure - Istanbul (HKLM-x32\...\36be4e8682db628a9eedcd00cd7dcbe4) (Version: - GameHouse)
    Big City Adventure - Tokyo (HKLM-x32\...\14dc79984a5a2ed556794b5802fff030) (Version: - GameHouse)
    Big City Adventure(TM) - London Premium Edition (HKLM-x32\...\am-bigcityadventuretmlondonpremiumedition) (Version: - )
    Big City Adventure(TM) - Paris Classic (HKLM-x32\...\am-bigcityadventuretmparisclassic) (Version: - gamehouse)
    Big City Adventure(TM) - Vancouver (HKLM-x32\...\am-bigcityadventuretmvancouver) (Version: - )
    Big City Adventures Double Pack (HKLM-x32\...\am-bigcityadventuresdoublepack) (Version: - )
    Bing Bar (HKLM-x32\...\{3365E735-48A6-4194-9988-CE59AC5AE503}) (Version: 7.3.132.0 - Microsoft Corporation)
    Bing Rewards Client Installer (x32 Version: 16.0.345.0 - Microsoft Corporation) Hidden
    Blackhawk Striker 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Blasterball 3 (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Blio (HKLM-x32\...\{9368DDD5-CE7F-4BD7-A83A-F00FABE338EC}) (Version: 2.2.6699 - K-NFB Reading Technology, Inc.)
    Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
    Boom Voyage (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111722310}) (Version: - Oberon Media)
    Bounce Symphony (x32 Version: 2.2.0.95 - WildTangent) Hidden
    BreakQuest (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110346950}) (Version: - Oberon Media)
    Brickquest (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111982970}) (Version: - Oberon Media)
    Bricks of Egypt 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11144067}) (Version: - Oberon Media)
    Brink of Consciousness - Dorian Gray Syndrome Platinum Edition (HKLM-x32\...\19b7948a62cd4352199927827822b714) (Version: - GameHouse)
    Brink of Consciousness - The Lonely Hearts Murders (HKLM-x32\...\am-brinkofconsciousnessthelonelyheartsmurders) (Version: - gamehouse)
    Call Of Atlantis (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115704307}) (Version: - Oberon Media)
    Castle - Never Judge a Book by Its Cover (HKLM-x32\...\07c049be8e1ec6220fecd760dd9b7b0b) (Version: - GameHouse)
    Christmas Patchwork - Frozen (HKLM-x32\...\789240172eeeb855e16eb0039eb799ce) (Version: - GameHouse)
    Christmas Wonderland 4 (HKLM-x32\...\21073e22cf3ad01a2246f6408f9e184c) (Version: - GameHouse)
    Christmas Wonderland 5 (HKLM-x32\...\fb51f5ca116ad6d20ad624c4d3a15edd) (Version: - GameHouse)
    Chronicle Keepers: The Dreaming Garden Collector's Edition (x32 Version: 3.0.2.59 - WildTangent) Hidden
    Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
    Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
    Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
    Citrix Online Launcher (HKLM-x32\...\{3E7E6F1E-7376-475A-8BC9-E3126B20CF5F}) (Version: 1.0.198 - Citrix)
    Clutter II - He Said, She Said (HKLM-x32\...\am-clutteriihesaidshesaid) (Version: - )
    Clutter III - Who is the Void (HKLM-x32\...\da5dad92d1a73d7db776209a4252f6f8) (Version: - GameHouse)
    Clutter IV - Minigame Madness Tour (HKLM-x32\...\f90f080c9e311bae7c73d4d1e78d8ffd) (Version: - GameHouse)
    Cosmic Bugs (HKLM-x32\...\Cosmic Bugs_is1) (Version: - )
    Coyote Stencil Shop (HKLM-x32\...\{153556C3-443E-4CCF-A9F5-FE3BC44C77F2}) (Version: 2.05 - Carving Technologies, LLC)
    Crime Solitaire (HKLM-x32\...\810bcf749bcfa09addb7a99cd70acf40) (Version: - GameHouse)
    Cursed Fates - The Headless Horseman Premium Edition (HKLM-x32\...\am-cursedfatestheheadlesshorsemanpremiumedition) (Version: - gamehouse)
    D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
    Dark Arcana - The Carnival Premium Edition (HKLM-x32\...\am-darkarcanathecarnivalpremiumedition) (Version: - gamehouse)
    Dark Mysteries - The Soul Keeper (HKLM-x32\...\am-darkmysteriesthesoulkeeper) (Version: - gamehouse)
    Dark Parables - The Exiled Prince (HKLM-x32\...\am-darkparablestheexiledprince) (Version: - gamehouse)
    Demon Hunter - Chronicles from Beyond (HKLM-x32\...\378efb680c2b58cc6b1af95937bfdc8a) (Version: - GameHouse)
    Desktop iCalendar Lite (HKLM\...\Desktop iCalendar Lite_is1) (Version: - Desksware, Inc.)
    Dream Hills - Captured Magic (HKLM-x32\...\812937d576d1c55320c526cb31a3fcf3) (Version: - GameHouse)
    Dream Hills: Captured Magic (x32 Version: 3.0.2.59 - WildTangent) Hidden
    Dreamscapes - The Sandman Premium Edition (HKLM-x32\...\am-dreamscapesthesandmanpremiumedition) (Version: - gamehouse)
    Easter Riddles (HKLM-x32\...\ce8282e7f4027f9972c979686222585d) (Version: - GameHouse)
    Echoes of Sorrow 2 (HKLM-x32\...\a7dee3827e44ee815edf3b5436fee84c) (Version: - GameHouse)
    Eden's Quest - The Hunt for Akua (HKLM-x32\...\am-edensquestthehuntforakua) (Version: - gamehouse)
    eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
    Esoterica - Hollow Earth (HKLM-x32\...\969847f4bae9b713cc7212de0aafd1b7) (Version: - GameHouse)
    Eternal Journey - New Atlantis Platinum Edition (HKLM-x32\...\am-eternaljourneynewatlantisplatinumedition) (Version: - )
    Family Vacation - California (HKLM-x32\...\ea855e18ab46ebfdf4b63215c1cffc1b) (Version: - GameHouse)
    Family Vacation 2 - Road Trip (HKLM-x32\...\b758bfc18b389827a297cd86b43c7422) (Version: - GameHouse)
    Farmington Tales 2 - Winter Crop (HKLM-x32\...\07f3c6eca4e2b6ea828f2738c11dd6e2) (Version: - GameHouse)
    FATE - The Traitor Soul (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Fishdom H2O - Hidden Odyssey (HKLM-x32\...\2562ef87536d0f92839e0a8fec2fa475) (Version: - GameHouse)
    Forbidden Secrets - Alien Town Platinum Edition (HKLM-x32\...\am-forbiddensecretsalientownplatinumedition) (Version: - gamehouse)
    Freemake Video Downloader (HKLM-x32\...\Freemake Video Downloader_is1) (Version: 3.7.1 - Ellora Assets Corporation)
    Funkiball (remove only) (HKLM-x32\...\Funkiball) (Version: - )
    GameHouse Sudoku (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112369430}) (Version: - Oberon Media)
    Gardenscapes - Mansion Makeover Premium Edition (HKLM-x32\...\am-gardenscapesmansionmakeoverpremiumedition) (Version: - gamehouse)
    Gardenscapes 2 Premium Edition (HKLM-x32\...\am-gardenscapes2premiumedition) (Version: - gamehouse)
    Gizmos - Riddle of the Universe (HKLM-x32\...\a7eb50c0e6cca41f067f9f2fed560f10) (Version: - GameHouse)
    Golden Trails 2 - The Lost Legacy (HKLM-x32\...\am-goldentrails2thelostlegacy) (Version: - gamehouse)
    Golden Trails 3 - The Guardian's Creed (HKLM-x32\...\am-goldentrails3theguardianscreed) (Version: - gamehouse)
    Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
    Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
    Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
    Greed - Forbidden Experiments (HKLM-x32\...\f9204bbb29d285af431052a0c47d2430) (Version: - GameHouse)
    Grim Tales: The Legacy (x32 Version: 3.0.2.126 - WildTangent) Hidden
    Guardians of Magic - Amanda's Awakening (HKLM-x32\...\am-guardiansofmagicamandasawakening) (Version: - gamehouse)
    Haunted Hidden Object Double Pack (HKLM-x32\...\am-hauntedhiddenobjectdoublepack) (Version: - )
    Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
    Hidden Memories of a Bright Summer (x32 Version: 3.0.2.59 - WildTangent) Hidden
    Hidden Object - Home Makeover (HKLM-x32\...\b383777770d963e4749b9c15faee1c31) (Version: - GameHouse)
    Hidden Object 10-in-1 Bundle (HKLM-x32\...\am-hiddenobject10in1bundle) (Version: - gamehouse)
    Hidden Path of Faery (HKLM-x32\...\am-hiddenpathoffaery) (Version: - gamehouse)
    Hidden Stories Collection (HKLM-x32\...\9c47fb6bec921b64f4ce5e1f950b7901) (Version: - GameHouse)
    Holiday Solitaire Easter (HKLM-x32\...\474f1f286b711c086972e6f19c3a9c20) (Version: - GameHouse)
    House of 1,000 Doors - Family Secrets Platinum Edition (HKLM-x32\...\am-houseof1000doorsfamilysecretsplatinumedition) (Version: - )
    HOYLE Card Games 2012 (HKLM-x32\...\2c02527a75fc8431a683659482685097) (Version: - GameHouse)
    Hoyle® Backgammon (remove only) (HKLM-x32\...\HBDL) (Version: - )
    HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)
    HP LinkUp (HKLM-x32\...\{C1AD9241-3ADD-483F-914D-071F3E50855A}) (Version: 2.01.026 - Hewlett-Packard)
    HP MediaSmart/TouchSmart Netflix (HKLM-x32\...\{BB760C1D-98F4-4E38-8CC4-3B67329AA981}) (Version: 1.0.6.0 - Hewlett-Packard)
    HP MovieStore (HKLM-x32\...\{9008D736-35CA-40DB-A2BE-5F32D954E5AA}) (Version: 2.0 - Hewlett-Packard)
    HP Odometer (HKLM-x32\...\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)
    HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)
    HP Photosmart 7520 series Basic Device Software (HKLM\...\{27ABA988-D480-4F44-B0FD-45E5656D2CFE}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
    HP Photosmart 7520 series Help (HKLM-x32\...\{08295D09-E002-48F8-905D-34E4B08509BA}) (Version: 28.0.0 - Hewlett Packard)
    HP Photosmart 7520 series Product Improvement Study (HKLM\...\{16B872EE-C458-41BD-BEAE-52758A3F3168}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
    HP Setup (HKLM-x32\...\{210A03F5-B2ED-4947-B27E-516F50CBB292}) (Version: 8.6.4530.3651 - Hewlett-Packard Company)
    HP Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.1.13253.3682 - Hewlett-Packard Company)
    HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
    HP Support Information (HKLM-x32\...\{7F2A11F4-EAE8-4325-83EC-E3E99F85169E}) (Version: 10.1.1000 - Hewlett-Packard)
    HP Support Solutions Framework (HKLM-x32\...\{E35601C0-BA8E-4F32-919A-C7EF4CA81F67}) (Version: 11.51.0048 - Hewlett-Packard Company)
    HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
    HP Vision Hardware Diagnostics (HKLM\...\{D79A02E9-6713-4335-9668-AAC7474C0C0E}) (Version: 2.5.0.0 - Hewlett-Packard)
    Hulu Desktop (HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\HuluDesktop) (Version: 0.9.13 - Hulu LLC)
    HydraVision (x32 Version: 4.2.252.0 - Advanced Micro Devices, Inc.) Hidden
    iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
    Inbetween Land (HKLM-x32\...\am-inbetweenland) (Version: - gamehouse)
    Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
    iTunes (HKLM\...\{93F2A022-6C37-48B8-B241-FFABD9F60C30}) (Version: 12.1.2.27 - Apple Inc.)
    Jane Austen's Estate of Affairs (HKLM-x32\...\477cab9d36feb8e2051341aa7194c252) (Version: - GameHouse)
    Jewel Quest® Solitaire (HKLM-x32\...\facbf9dc205f44a699f9c0dfa99639cc) (Version: - GameHouse)
    Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Knight Solitaire 2 (HKLM-x32\...\5b5026c14b395e3c9cdca8e06f399c3c) (Version: - GameHouse)
    Kobo (HKLM-x32\...\Kobo) (Version: 1.6 - Kobo Inc.)
    LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.3609 - CyberLink Corp.)
    LabelPrint (x32 Version: 2.5.3609 - CyberLink Corp.) Hidden
    Lake House - Children of Silence Platinum Edition (HKLM-x32\...\am-lakehousechildrenofsilenceplatinumedition) (Version: - gamehouse)
    Left in the Dark: No One on Board (x32 Version: 3.0.2.59 - WildTangent) Hidden
    Legacy - Witch Island (HKLM-x32\...\35c474105074ec9fac693c2767f65a38) (Version: - GameHouse)
    LightScribe System Software (HKLM-x32\...\{FD7F0DB8-0E96-4D64-AD4D-9B5A936AF2A8}) (Version: 1.18.20.1 - LightScribe)
    Living Legends - Frozen Beauty (HKLM-x32\...\e61fafbffbbeed9aba37f44e09269ee3) (Version: - GameHouse)
    Logitech SetPoint 6.61 (HKLM\...\sp6) (Version: 6.61.15 - Logitech)
    Lost Fortunes (HKLM-x32\...\abc90e326be0d2f6ce27a7257df92b39) (Version: - GameHouse)
    Lost Souls - Timeless Fables (HKLM-x32\...\e83dbe408ad2a2a678732ca428972f7f) (Version: - GameHouse)
    Luxor Adventures (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117864357}) (Version: - Oberon Media)
    Magic Cards Solitaire (HKLM-x32\...\1a65ab13a9498448e140bb438ee218c0) (Version: - GameHouse)
    Magic Encyclopedia - Illusions (HKLM-x32\...\am-magicencyclopediaillusions) (Version: - )
    Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Manor Memoirs Platinum Edition (HKLM-x32\...\a9298694529eecc397b070f2661a9477) (Version: - GameHouse)
    Marooned 2 - Secrets of the Akoni (HKLM-x32\...\am-marooned2secretsoftheakoni) (Version: - gamehouse)
    Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
    Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
    Microsoft IntelliPoint 8.2 (HKLM\...\Microsoft IntelliPoint 8.2) (Version: 8.20.468.0 - Microsoft Corporation)
    Microsoft Office Home and Business 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
    Microsoft Picture It! Photo 7.0 (HKLM-x32\...\{369B36BE-3D64-4641-9AEA-808D436FE132}) (Version: 7.0.0.0000 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.31211.0 - Microsoft Corporation)
    Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
    Microsoft SQL Server 2008 Native Client (HKLM\...\{BBDE8A3D-64A2-43A6-95F3-C27B87DF7AC1}) (Version: 10.1.2531.0 - Microsoft Corporation)
    Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
    Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
    Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
    Monopoly (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113606753}) (Version: - Oberon Media)
    Mosaic - Game of Gods (HKLM-x32\...\5340abbe338f7d03c64bcfcc39ffd425) (Version: - GameHouse)
    Mosaics Galore (HKLM-x32\...\ce2208cbc41e9b67d57b6072bfd60ae2) (Version: - GameHouse)
    MotoHelper MergeModules (x32 Version: 1.2.0 - Motorola) Hidden
    Mountain Crime - Requital (HKLM-x32\...\am-mountaincrimerequital) (Version: - )
    MSN Games (HKLM-x32\...\MSNArcade) (Version: 1.0 - )
    MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
    Mystery Expedition: Prisoners of Ice (x32 Version: 3.0.2.59 - WildTangent) Hidden
    Mystery Murders - Jack the Ripper (HKLM-x32\...\a502237a94a42f08c9d8bcee51abd280) (Version: - GameHouse)
    Mystery Murders - The Sleeping Palace (HKLM-x32\...\d2377ea1d4dc3690d5b71f82fa4cd7e9) (Version: - GameHouse)
    Mystery P.I. - Stolen in San Francisco (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Nat Geo Traveler Pack (HKLM-x32\...\am-natgeotravelerpack) (Version: - gamehouse)
    Nightfall Mysteries Double Pack (HKLM-x32\...\am-nightfallmysteriesdoublepack) (Version: - )
    Online Games Manager v1.30 (HKLM-x32\...\Online Games Manager) (Version: 1.30.14 - Real Networks, Inc.)
    PDF Complete Special Edition (HKLM-x32\...\PDF Complete) (Version: 4.0.35 - PDF Complete, Inc)
    Pirate's Solitaire 2 (HKLM-x32\...\45f4fe50c18bbf9f24ca0235fe3df4f0) (Version: - GameHouse)
    PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
    PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
    Poker Superstars III (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.4817 - CyberLink Corp.)
    Power2Go (x32 Version: 6.1.4817 - CyberLink Corp.) Hidden
    PressReader (HKLM-x32\...\{912CED74-88D3-4C5B-ACB0-132318649765}) (Version: 5.10.1217.0 - NewspaperDirect Inc.)
    Questerium - Sinister Trinity Platinum Edition (HKLM-x32\...\af2d0f4fe2e4b8fc742e3e5eb337aa3f) (Version: - GameHouse)
    QuickTime (HKLM-x32\...\{C9E14402-3631-4182-B377-6B0DFB1C0339}) (Version: 7.70.80.34 - Apple Inc.)
    Rainbow Web 2 (HKLM-x32\...\am-rainbowweb2) (Version: - gamehouse)
    Ralink 802.11n Wireless LAN Card (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 4.0.3.0 - Ralink)
    Rapport (x32 Version: 3.5.1404.75 - Trusteer) Hidden
    Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6387 - Realtek Semiconductor Corp.)
    Reaxxion (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112027253}) (Version: - Oberon Media)
    Recovery Manager (x32 Version: 5.5.3621 - CyberLink Corp.) Hidden
    Regency Solitaire (HKLM-x32\...\Regency Solitaire) (Version: - iWin.com)
    Remote Graphics Receiver (HKLM-x32\...\{16FC3056-90C0-4757-8A68-64D8DA846ADA}) (Version: 5.4.5 - Hewlett-Packard)
    Renovate & Relocate - Miami (HKLM-x32\...\01bd96b273f8d2b689784af5a55d2535) (Version: - GameHouse)
    Rhapsody (HKLM-x32\...\Rhapsody) (Version: - )
    Ricochet (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110028110}) (Version: - Oberon Media)
    RoxioNow Player (HKLM-x32\...\{0EDEB615-1A60-425E-8306-0E10519C7B55}) (Version: 1.9.5.103 - RoxioNow)
    Sacra Terra - Kiss of Death Platinum Edition (HKLM-x32\...\am-sacraterrakissofdeathplatinumedition) (Version: - gamehouse)
    SCRABBLE (HKLM-x32\...\am-scrabble) (Version: - gamehouse)
    Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
    Silent Scream II - the Bride (HKLM-x32\...\am-silentscreamiithebride) (Version: - gamehouse)
    Smilebox (HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\Smilebox) (Version: - )
    Solid YouTube Downloader Free Edition 4.8.5 (HKLM-x32\...\{66712EEE-ECBC-4CA6-A474-youtube-downloader-and-~51B146F2_is1) (Version: - TopVideoSoft,Inc.)
    Solitaire Game: Halloween (x32 Version: 3.0.2.59 - WildTangent) Hidden
    Solitaire Mystery - Four Seasons (HKLM-x32\...\c9f79b14db0870c3a4326e4cf94baa46) (Version: - GameHouse)
    Solitaire Mystery Four Seasons (x32 Version: 3.0.2.51 - WildTangent) Hidden
    Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.1.21 - Safer-Networking Ltd.)
    Super GameHouse BlackJack (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111434127}) (Version: - Oberon Media)
    Super Granny 3 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112395410}) (Version: - Oberon Media)
    Super Jigsaw Landscapes (HKLM-x32\...\Super Jigsaw Landscapes) (Version: - GameHouse, Inc.)
    Tales of Lagoona - Orphans of the Ocean (HKLM-x32\...\6c67c1db1d844c34a1d88d113f22da45) (Version: - GameHouse)
    Tales of Lagoona 2 - Peril at Poseidon Park (HKLM-x32\...\e5ca5ffe79cf7db4021e9324dc6e4d42) (Version: - GameHouse)
    TeamViewer 7 (HKLM-x32\...\TeamViewer 7) (Version: 7.0.14563 - TeamViewer)
    Ted the Jumper (HKLM-x32\...\dbc30db9aa2e1b35845d418e58acb962) (Version: - GameHouse)
    The Big Secret of a Small Town (HKLM-x32\...\47599aec7f3050c68875aad3ec6debb8) (Version: - GameHouse)
    The Chronicles of Emerland Solitaire (x32 Version: 3.0.2.51 - WildTangent) Hidden
    The Curse of Silent Marshes (HKLM-x32\...\137e1a39536cf70764d43e0668b71dbd) (Version: - GameHouse)
    The Curse of Silent Marshes (HKLM-x32\...\663b27f42301795a315425e1176dd51f) (Version: - GameHouse)
    The Free YouTube Downloader (HKLM-x32\...\The Free YouTube Downloader) (Version: 4.0 - TrafficSpace, LLC)
    The Mirror Mysteries - Forgotten Kingdoms (HKLM-x32\...\am-themirrormysteriesforgottenkingdoms) (Version: - gamehouse)
    The Other Side: Tower Of Souls (x32 Version: 3.0.2.59 - WildTangent) Hidden
    The Price is Right (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-114767253}) (Version: - Oberon Media)
    The Print Shop 3.0 Fonts (HKLM-x32\...\{2C3060F6-F0DC-4F63-A70F-2070BE57EEDC}) (Version: 1.0 - Encore)
    The Print Shop 3.0 Professional (HKLM-x32\...\{4B75C418-A7DF-4C11-B854-EB5EBFB07C88}) (Version: 3.0.6 - Encore)
    The Treasures of Mystery Island - The Ghost Ship (HKLM-x32\...\am-thetreasuresofmysteryislandtheghostship) (Version: - )
    True Detective Solitaire (HKLM-x32\...\f5605db23726b066afe70f7a54042fa0) (Version: - GameHouse)
    Trusteer Endpoint Protection (HKLM-x32\...\Rapport_msi) (Version: 3.5.1404.75 - Trusteer)
    Twisted Lands - Insomniac (HKLM-x32\...\am-twistedlandsinsomniac) (Version: - )
    Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
    Vacation Adventures - Cruise Director (HKLM-x32\...\b6d0b99be4055da17cd5e74ee99f729e) (Version: - GameHouse)
    Vacation Adventures - Park Ranger (HKLM-x32\...\68dd47a139949f12c842ef0b3daa1004) (Version: - GameHouse)
    Vacation Adventures - Park Ranger 2 (HKLM-x32\...\d9b4a73170343d1264d5ca8d7281b070) (Version: - GameHouse)
    Vacation Adventures - Park Ranger 3 (HKLM-x32\...\505a9a67762c525399afacc9ca9bb645) (Version: - GameHouse)
    Vacation Quest(TM) - Australia (HKLM-x32\...\4b935fb2e705be2426ce418f07efe6cf) (Version: - GameHouse)
    Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)
    Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
    Weird Park - Scary Tales (HKLM-x32\...\am-weirdparkscarytales) (Version: - gamehouse)
    Wheel of Fortune 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112731397}) (Version: - Oberon Media)
    WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
    WildTangent Games App (x32 Version: 4.0.11.14 - WildTangent) Hidden
    WildTangent Web Driver (HKLM-x32\...\WildTangent CDA) (Version: - )
    Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
    Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
    WinPcap 4.1.2 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2001 - CACE Technologies)
    World Famous Board Games v3 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111822157}) (Version: - Oberon Media)
    World Riddles - Animals (HKLM-x32\...\am-worldriddlesanimals) (Version: - )
    World Riddles - Secrets of the Ages (HKLM-x32\...\am-worldriddlessecretsoftheages) (Version: - )
    XFINITY Connect for Outlook (HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\FDA4072314474B1789C48753750737FBD9A9B87F) (Version: 1.1.1.1 - National Security Operations)
    Zen Mosaics (HKLM-x32\...\d162951bfac59494a8317abe76ab0f8f) (Version: - GameHouse)
    Zinio Reader 4 (HKLM-x32\...\ZinioReader4.9310D8F796442B71068C511E15D70529A702D19D.1) (Version: 4.0.3184 - Zinio LLC)
    Zinio Reader 4 (x32 Version: 4.0.3184 - Zinio LLC) Hidden
    Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
    ==================== Custom CLSID (selected items): ==========================
    (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
    CustomCLSID: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001_Classes\CLSID\{F6BF8414-962C-40FE-90F1-B80A7E72DB9A}\InprocServer32 -> C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\mpr.dll (Microsoft Corporation)
    ==================== Restore Points =========================
    19-04-2015 19:00:34 Windows Backup
    26-04-2015 19:00:27 Windows Backup
    ==================== Hosts content: ==========================
    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)
    2009-07-13 20:34 - 2009-06-10 15:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
    ==================== Scheduled Tasks (whitelisted) =============
    (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
    Task: {124E3A9A-8B05-4A05-8D04-9C5CC8F20573} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
    Task: {1784F755-8876-430E-9F0E-AD64381C408B} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
    Task: {1AD6EBAA-68D9-42D7-BC81-05FDF17D83CB} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
    Task: {1EBB2626-CEF3-430C-800A-96B800A1612C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Warranty Opt-In(Yes) => c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\Detection_PostWarrantyAlert.exe [2014-01-14] (Hewlett-Packard)
    Task: {2020021E-6289-40D3-BC5A-E7E4A4D626D4} - System32\Tasks\{4989B626-5CE8-4051-AE94-CE7C77ADF7FD} => C:\GameHouse Games\Twisted Lands - Insomniac\GH-TwistedLands2.exe [2013-03-23] ()
    Task: {23266E00-50D8-4410-A115-286D57F030EC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Warranty Opt-In(No) => c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\Detection_PostWarrantyAlert.exe [2014-01-14] (Hewlett-Packard)
    Task: {279FFD32-DDC7-4902-B514-6FC9BA2FB139} - System32\Tasks\HPCustParticipation HP Photosmart 7520 series => C:\Program Files\HP\HP Photosmart 7520 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
    Task: {2C8A119C-8065-4DFF-ABB7-CA6907FFE0ED} - System32\Tasks\RunAsStdUser Task => C:\Program Files (x86)\MSN Games\MSNGames.exe [2014-12-09] (iWin Inc.)
    Task: {377F7871-2EE9-4C26-8F82-C37DE4C8B0AB} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2013-05-16] (Safer-Networking Ltd.)
    Task: {3B19D8CC-03F0-40FB-9593-E9B6A08D3FD1} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
    Task: {4B9C887F-2FAD-4217-ADBF-8E0A2000D4AB} - System32\Tasks\{8271B889-A5AC-40CD-82DC-C78D692119B6} => pcalua.exe -a "C:\Program Files (x86)\MSN Games\Astro Pop\Uninstall.exe" -c "C:\Program Files (x86)\MSN Games\Astro Pop\install.log"
    Task: {549FD0C2-1389-4A75-86B6-3C654DD21612} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
    Task: {78BDA252-9699-4C35-A79C-3080F02140A5} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-04-14] (Hewlett-Packard)
    Task: {79219FE0-B276-4B24-A6C5-F0C44652B51B} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-24] (Microsoft Corporation)
    Task: {7F1784E7-69F6-458C-BFAF-B56CB9AE7FCE} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2013-05-16] (Safer-Networking Ltd.)
    Task: {8F8FB088-8B2A-4496-959C-44A14163BE6C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-09-20] (Google Inc.)
    Task: {90A5264B-6E9B-4D51-8172-36D2123A21AB} - System32\Tasks\HPCeeScheduleForUs => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
    Task: {967B184F-2588-480B-ADCE-04B184C7EB19} - System32\Tasks\{87B3F499-EE58-4B7F-92C5-4CC3303CCD40} => C:\GameHouse Games\Twisted Lands - Insomniac\GH-TwistedLands2.exe [2013-03-23] ()
    Task: {B401D36A-4D55-4029-9864-20E3DDED784F} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
    Task: {B8A48741-79AD-45E8-A641-D596A69DC71E} - System32\Tasks\Game Channel => C:\Program Files (x86)\WildTangent\Apps\GameChannel.exe
    Task: {BE5852D7-E35F-4065-B2E4-AF55F3F294DE} - System32\Tasks\HPCeeScheduleForHOME$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
    Task: {C416B9B0-008A-43AD-914D-0B8286EEBCD6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-15] (Adobe Systems Incorporated)
    Task: {C4B1AC0D-DE88-4360-9217-5A15F48842C2} - System32\Tasks\{4959B1AF-71A9-4AB8-9D01-10C60F1D0B72} => C:\GameHouse Games\Eternal Journey - New Atlantis Platinum Edition\GH-EternalJourney_NewAtlantisCE.exe [2012-08-26] ()
    Task: {C6F87FBE-6F95-4586-9FAB-7ED5D0FC67FC} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
    Task: {CA304B02-4B28-48BC-9719-804FC4D7A047} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2013-05-16] (Safer-Networking Ltd.)
    Task: {CBE5F1DE-F7F2-42DC-BDCD-7C31F6989B90} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => c:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation)
    Task: {CD0E2DFB-7C68-4DB2-93BC-F5900A8A95E8} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_TH44A721ZD05YY => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-04-14] (Hewlett-Packard)
    Task: {CD8E531E-7000-486F-B62E-B38B884CFDBB} - System32\Tasks\HP online update program => c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [2013-05-30] (Hewlett-Packard)
    Task: {D78FED59-4DBC-4D52-B297-7A6A521B1393} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-09-20] (Google Inc.)
    Task: {DCD1B26F-2A33-4276-952B-2653BF608D2F} - System32\Tasks\RegCure Pro => C:\Program Files (x86)\ParetoLogic\RegCure Pro\RegCurePro.exe [2012-08-27] (ParetoLogic, Inc.)
    Task: {E5A6F67A-7B25-40D9-A756-31F60538701B} - System32\Tasks\ROC_JAN2013_TB_rmv => C:\Program Files (x86)\AVG Secure Search\PostInstall\ROC.exe
    Task: {E7AC4FD0-775F-4495-90BB-09E97B4FFB40} - System32\Tasks\Games\UpdateCheck_S-1-5-21-1551027734-1051973675-1866321763-1001
    Task: {F7DDE76E-DA2B-4CD7-BAD2-2CE9F92AEC5E} - System32\Tasks\{9D4AED1B-DDC1-4387-94AE-535B7BEC5DFA} => C:\GameHouse Games\Eternal Journey - New Atlantis Platinum Edition\GH-EternalJourney_NewAtlantisCE.exe [2012-08-26] ()
    Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\HPCeeScheduleForHOME$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
    Task: C:\Windows\Tasks\HPCeeScheduleForUs.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
    Task: C:\Windows\Tasks\RegCure Pro.job => C:\Program Files (x86)\ParetoLogic\RegCure Pro\RegCurePro.exe
    Task: C:\Windows\Tasks\ROC_JAN2013_TB_rmv.job => C:\Program Files (x86)\AVG Secure Search\PostInstall\ROC.exe
    ==================== Loaded Modules (whitelisted) ==============
    2015-03-20 18:12 - 2015-03-20 18:12 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
    2015-03-20 18:12 - 2015-03-20 18:12 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
    2014-07-26 13:16 - 2014-11-18 18:55 - 06277952 _____ () C:\Users\Us\AppData\Local\Amazon Music\Amazon Music Helper.exe
    2013-06-05 16:51 - 2013-06-05 16:51 - 00430080 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingNet4.dll
    2013-06-05 16:51 - 2013-06-05 16:51 - 00032768 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingResourcesNet4.dll
    2014-03-23 17:04 - 2014-03-23 17:04 - 00557056 _____ () C:\Program Files (x86)\Trusteer\Rapport\bin\js32.dll
    2012-12-15 17:30 - 2012-07-06 16:29 - 01196032 _____ () C:\Program Files (x86)\Ralink\Common\RaWLAPI.dll
    2015-01-08 12:26 - 2013-05-16 11:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
    2015-01-08 12:26 - 2013-05-16 11:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
    2015-01-08 12:26 - 2013-05-16 11:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
    2015-01-08 12:26 - 2012-08-23 11:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
    2015-01-08 12:26 - 2012-04-03 18:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
    ==================== Alternate Data Streams (whitelisted) =========
    (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
    AlternateDataStreams: C:\ProgramData\Temp:17639624
    AlternateDataStreams: C:\ProgramData\Temp:1A3FC1C4
    AlternateDataStreams: C:\ProgramData\Temp:1B1330FD
    AlternateDataStreams: C:\ProgramData\Temp:23FA878E
    AlternateDataStreams: C:\ProgramData\Temp:2F3B25D5
    AlternateDataStreams: C:\ProgramData\Temp:418F8226
    AlternateDataStreams: C:\ProgramData\Temp:596DA995
    AlternateDataStreams: C:\ProgramData\Temp:5B132D3E
    AlternateDataStreams: C:\ProgramData\Temp:5B85C37B
    AlternateDataStreams: C:\ProgramData\Temp:63204A78
    AlternateDataStreams: C:\ProgramData\Temp:6E141455
    AlternateDataStreams: C:\ProgramData\Temp:710BBE5E
    AlternateDataStreams: C:\ProgramData\Temp:7E1F211D
    AlternateDataStreams: C:\ProgramData\Temp:89CC7FD8
    AlternateDataStreams: C:\ProgramData\Temp:9018F4B7
    AlternateDataStreams: C:\ProgramData\Temp:96F344DB
    AlternateDataStreams: C:\ProgramData\Temp:981884E7
    AlternateDataStreams: C:\ProgramData\Temp:A64A7256
    AlternateDataStreams: C:\ProgramData\Temp:AFC9DFB8
    AlternateDataStreams: C:\ProgramData\Temp:C8591AF9
    AlternateDataStreams: C:\ProgramData\Temp:C8A7CF18
    AlternateDataStreams: C:\ProgramData\Temp:D0F51BEA
    AlternateDataStreams: C:\ProgramData\Temp:DED60D49
    AlternateDataStreams: C:\ProgramData\Temp:EBA2EAED
    AlternateDataStreams: C:\ProgramData\Temp:F488E44F
    AlternateDataStreams: C:\ProgramData\Temp:FD7A985E
    ==================== Safe Mode (whitelisted) ===================
    (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

    ==================== EXE Association (whitelisted) ===============
    (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

    ==================== Internet Explorer trusted/restricted ===============
    (If an entry is included in the fixlist, the associated entry will be removed from the registry.)
    IE trusted site: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\real.com -> hxxps://rhap-app-4-0.real.com
    IE restricted site: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\007guard.com -> install.007guard.com
    IE restricted site: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\008i.com -> 008i.com
    IE restricted site: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\008k.com -> www.008k.com
    IE restricted site: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\00hq.com -> www.00hq.com
    IE restricted site: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\010402.com -> 010402.com
    IE restricted site: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
    IE restricted site: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\0scan.com -> www.0scan.com
    IE restricted site: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\1-2005-search.com -> www.1-2005-search.com
    IE restricted site: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\1-domains-registrations.com -> www.1-domains-registrations.com
    IE restricted site: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\1000gratisproben.com -> www.1000gratisproben.com
    IE restricted site: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\1001namen.com -> www.1001namen.com
    IE restricted site: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\100888290cs.com -> mir.100888290cs.com
    IE restricted site: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\100sexlinks.com -> www.100sexlinks.com
    IE restricted site: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\10sek.com -> www.10sek.com
    IE restricted site: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\12-26.net -> user1.12-26.net
    IE restricted site: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\12-27.net -> user1.12-27.net
    IE restricted site: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\123fporn.info -> www.123fporn.info
    IE restricted site: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
    IE restricted site: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\123moviedownload.com -> www.123moviedownload.com
    IE restricted site: HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\...\123simsen.com -> www.123simsen.com
    There are 7823 more restricted sites.
    ==================== Other Areas ============================
    (Currently there is no automatic fix for this section.)
    HKU\S-1-5-21-1551027734-1051973675-1866321763-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Us\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
    DNS Servers: 75.75.76.76 - 75.75.75.75
    ==================== MSCONFIG/TASK MANAGER disabled items ==
    (Currently there is no automatic fix for this section.)

    ==================== FirewallRules (whitelisted) ===============
    (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
    FirewallRules: [{B3285455-7F0F-4710-89A2-0485D7C14B80}] => (Allow) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
    FirewallRules: [{EEF98F1C-1B5F-4A0A-AF81-1E866D38E820}] => (Allow) C:\Program Files (x86)\Roxio\RoxioNow Player\RNowShell.exe
    FirewallRules: [{855B8969-5A4A-4C74-B0DF-C57432862033}] => (Allow) C:\Program Files (x86)\Roxio\RoxioNow Player\RNowShell.exe
    FirewallRules: [{92D6629E-F0F7-4A9B-ACA8-9181CEBD5B10}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\MediaSmart\RoxioNow\RNow.exe
    FirewallRules: [{E7528BD0-59E1-4D61-AA0D-2C63292901A3}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\MediaSmart\RoxioNow\RNow.exe
    FirewallRules: [{C1CBB3B5-BF1E-4A68-B0EA-0C67527729DB}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Remote Graphics Receiver\rgreceiver.exe
    FirewallRules: [{4F74DB54-A35D-4AAF-B522-7698CAD788F9}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Remote Graphics Receiver\rgreceiver.exe
    FirewallRules: [{08A70713-8D0A-4D52-A862-5FAE0C01DEC0}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP LinkUp\HP LinkUp Viewer.exe
    FirewallRules: [{AA5761B2-5C9F-4173-8D66-C8BCEFC1A49F}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP LinkUp\HP LinkUp Viewer.exe
    FirewallRules: [{39AD2DE7-C3D5-4DEA-AF5E-9FC2FC900A93}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
    FirewallRules: [{72D49270-F0F7-45C8-873D-46AE35BF93CC}] => (Allow) LPort=2869
    FirewallRules: [{F18CAE01-02FE-4B39-973F-5CB03AD8F0CE}] => (Allow) LPort=1900
    FirewallRules: [{667AADD9-4B12-4D18-BB26-3F2E02190720}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
    FirewallRules: [{493D1610-43E4-4311-9061-545622579E7F}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
    FirewallRules: [{68FBE385-8C71-4DFC-A4C3-942EFEF1CF21}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE
    FirewallRules: [{B8810E74-3D33-4CD9-9AE1-F3BA00C5CDE1}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE
    FirewallRules: [{7A581292-1141-4771-ABBC-DDE658A39812}] => (Allow) C:\Program Files (x86)\Rhapsody\rhapsody.exe
    FirewallRules: [{D291E1D2-3182-42B5-91CA-979ED5071011}] => (Allow) C:\Program Files (x86)\Rhapsody\rhapsody.exe
    FirewallRules: [{584EEE5A-2652-4D77-8D26-7B54DFD37D01}] => (Allow) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer.exe
    FirewallRules: [{E23CD255-6DED-45B0-8A7D-568EE5A52C4D}] => (Allow) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer.exe
    FirewallRules: [{67F5EDA4-782F-4AD0-9433-A73F0D10CD38}] => (Allow) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
    FirewallRules: [{AEB5DD28-64C0-41CC-BF2A-C7388D0822BF}] => (Allow) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
    FirewallRules: [{B137F0FD-2ECA-4A0C-9A7E-59831920BC69}] => (Allow) C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe
    FirewallRules: [{11022EBA-83C1-41FA-8383-BC84BDBAF0A1}] => (Allow) C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe
    FirewallRules: [{D5C7839E-7252-494F-B5AC-6D8BAA4B1587}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe
    FirewallRules: [{3E3D9EAF-5D11-45FB-A9A5-AF6A8F8932D1}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
    FirewallRules: [{F77141A5-67DE-44BE-AA5C-6D1C35A99EBC}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
    FirewallRules: [{92F8BCD6-8137-4AD2-997E-416ADEF0AFB0}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    FirewallRules: [{490A873A-41DD-4419-B8A6-A5F257485849}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    FirewallRules: [{D7412EC1-9004-461E-B170-4D8AF65A1791}] => (Allow) C:\Program Files (x86)\MSN Games\MSNGames.exe
    FirewallRules: [{07204F3E-4705-4EB8-B2A7-670C770E9BD7}] => (Allow) C:\Program Files (x86)\MSN Games\MSNGames.exe
    FirewallRules: [{05767C11-2E0F-4714-9FCD-4784429E3529}] => (Allow) C:\Program Files (x86)\MSN Games\WebUpdater.exe
    FirewallRules: [{38D9EA15-2FFE-4EA0-8DDC-8DC2D0D12345}] => (Allow) C:\Program Files (x86)\MSN Games\WebUpdater.exe
    FirewallRules: [{E49A5790-1DA6-43E3-8EAE-8D5FDD366F69}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\bin\FaxApplications.exe
    FirewallRules: [{26AD2904-5CDB-4E93-B644-EFBC2835AF79}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\bin\DigitalWizards.exe
    FirewallRules: [{A0D1C94C-E627-4ED4-AEFD-161F1A63ADF9}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\bin\SendAFax.exe
    FirewallRules: [{C9E614BB-E3FA-4ACD-9985-F965A2D01EB8}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\Bin\DeviceSetup.exe
    FirewallRules: [{300C5C19-CB0D-4A7C-AED0-BC9B49561F34}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\Bin\HPNetworkCommunicator.exe
    FirewallRules: [{39EFBC37-DF05-4F8D-8576-52F27AC9BC9C}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\Bin\HPNetworkCommunicatorCom.exe
    FirewallRules: [{46FD4E49-6A78-4AF1-A958-B0B43FA28B6F}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE
    FirewallRules: [{E139E0E7-0672-477C-8AA3-CB2D9D8942D9}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE
    FirewallRules: [{07451A00-91CE-484D-BD3E-9D1D2601F194}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office14\outlook.exe
    FirewallRules: [{B84DF0C4-A1A1-494C-8E3E-CE1C78034ABF}] => (Allow) C:\Program Files (x86)\Ralink\Common\RaWiFi.exe
    FirewallRules: [{17B7A924-4A13-44A9-B1CF-E616E7EEA70D}] => (Allow) C:\Program Files (x86)\Ralink\Common\RaWiFi.exe
    FirewallRules: [{5B844549-6735-4E7E-8E75-5834C14D7D9D}] => (Allow) C:\Program Files\iTunes\iTunes.exe
    FirewallRules: [{C4FCDDFC-253B-44B9-87D9-B3BAB61E6BE5}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPDeviceDetection3.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon
    StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service
    StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater
    StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service
    ==================== Faulty Device Manager Devices =============

    ==================== Event log errors: =========================
    Application errors:
    ==================
    Error: (04/30/2015 01:38:21 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
    Error: (04/30/2015 01:38:07 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: ogmservice.exe, version: 1.30.14.0, time stamp: 0x53341476
    Faulting module name: ogmservice.exe, version: 1.30.14.0, time stamp: 0x53341476
    Exception code: 0xc0000005
    Fault offset: 0x00004d20
    Faulting process id: 0x8c8
    Faulting application start time: 0xogmservice.exe0
    Faulting application path: ogmservice.exe1
    Faulting module path: ogmservice.exe2
    Report Id: ogmservice.exe3
    Error: (04/30/2015 11:38:45 AM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: The program IEXPLORE.EXE version 11.0.9600.17728 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
    Process ID: 624
    Start Time: 01d0836c6a34a0b8
    Termination Time: 15
    Application Path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    Report Id:
    Error: (04/30/2015 11:38:05 AM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: The program IEXPLORE.EXE version 11.0.9600.17728 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
    Process ID: 4750
    Start Time: 01d0836c53d2a2e9
    Termination Time: 31
    Application Path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    Report Id:
    Error: (04/30/2015 11:37:27 AM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: The program IEXPLORE.EXE version 11.0.9600.17728 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
    Process ID: 513c
    Start Time: 01d0836c3c25490c
    Termination Time: 31
    Application Path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    Report Id:
    Error: (04/30/2015 11:36:48 AM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: The program IEXPLORE.EXE version 11.0.9600.17728 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
    Process ID: 4768
    Start Time: 01d0835f9bc4d3c9
    Termination Time: 47
    Application Path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    Report Id:
    Error: (04/30/2015 06:47:32 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
    Error: (04/30/2015 06:46:56 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: ogmservice.exe, version: 1.30.14.0, time stamp: 0x53341476
    Faulting module name: ogmservice.exe, version: 1.30.14.0, time stamp: 0x53341476
    Exception code: 0xc0000005
    Fault offset: 0x00004d20
    Faulting process id: 0x858
    Faulting application start time: 0xogmservice.exe0
    Faulting application path: ogmservice.exe1
    Faulting module path: ogmservice.exe2
    Report Id: ogmservice.exe3
    Error: (04/29/2015 08:42:12 AM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: The program IEXPLORE.EXE version 11.0.9600.17728 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
    Process ID: 145c
    Start Time: 01d0828a10d75f3e
    Termination Time: 31
    Application Path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    Report Id:
    Error: (04/29/2015 07:24:09 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    System errors:
    =============
    Error: (04/30/2015 05:56:14 PM) (Source: ipnathlp) (EventID: 31004) (User: )
    Description: 0
    Error: (04/30/2015 05:55:13 PM) (Source: ipnathlp) (EventID: 31004) (User: )
    Description: 0
    Error: (04/30/2015 05:53:56 PM) (Source: ipnathlp) (EventID: 31004) (User: )
    Description: 0
    Error: (04/30/2015 04:49:58 PM) (Source: ipnathlp) (EventID: 31004) (User: )
    Description: 0
    Error: (04/30/2015 03:44:07 PM) (Source: ipnathlp) (EventID: 31004) (User: )
    Description: 0
    Error: (04/30/2015 03:08:34 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
    Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the eventlog service.
    Error: (04/30/2015 03:01:42 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
    Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the eventlog service.
    Error: (04/30/2015 02:41:55 PM) (Source: ipnathlp) (EventID: 31004) (User: )
    Description: 0
    Error: (04/30/2015 02:39:00 PM) (Source: ipnathlp) (EventID: 31004) (User: )
    Description: 0
    Error: (04/30/2015 02:35:25 PM) (Source: ipnathlp) (EventID: 31004) (User: )
    Description: 0

    Microsoft Office Sessions:
    =========================
    Error: (04/30/2015 01:38:21 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
    Error: (04/30/2015 01:38:07 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: ogmservice.exe1.30.14.053341476ogmservice.exe1.30.14.053341476c000000500004d208c801d0837cfbe71451C:\Program Files (x86)\Online Games Manager\ogmservice.exeC:\Program Files (x86)\Online Games Manager\ogmservice.exe6c80efee-ef70-11e4-9157-e069958c6914
    Error: (04/30/2015 11:38:45 AM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: IEXPLORE.EXE11.0.9600.1772862401d0836c6a34a0b815C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    Error: (04/30/2015 11:38:05 AM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: IEXPLORE.EXE11.0.9600.17728475001d0836c53d2a2e931C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    Error: (04/30/2015 11:37:27 AM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: IEXPLORE.EXE11.0.9600.17728513c01d0836c3c25490c31C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    Error: (04/30/2015 11:36:48 AM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: IEXPLORE.EXE11.0.9600.17728476801d0835f9bc4d3c947C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    Error: (04/30/2015 06:47:32 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
    Error: (04/30/2015 06:46:56 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: ogmservice.exe1.30.14.053341476ogmservice.exe1.30.14.053341476c000000500004d2085801d08343a70e112cC:\Program Files (x86)\Online Games Manager\ogmservice.exeC:\Program Files (x86)\Online Games Manager\ogmservice.exefb87713d-ef36-11e4-909d-e069958c6914
    Error: (04/29/2015 08:42:12 AM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: IEXPLORE.EXE11.0.9600.17728145c01d0828a10d75f3e31C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    Error: (04/29/2015 07:24:09 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    CodeIntegrity Errors:
    ===================================
    Date: 2014-08-31 11:48:23.162
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\RapportKE64.sys because the set of per-page image hashes could not be found on the system.
    Date: 2014-08-31 11:48:23.022
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\RapportKE64.sys because the set of per-page image hashes could not be found on the system.

    ==================== Memory info ===========================
    Processor: Intel(R) Core(TM) i5-2390T CPU @ 2.70GHz
    Percentage of memory in use: 31%
    Total physical RAM: 8174.55 MB
    Available physical RAM: 5617.75 MB
    Total Pagefile: 16347.29 MB
    Available Pagefile: 12569.39 MB
    Total Virtual: 8192 MB
    Available Virtual: 8191.81 MB
    ==================== Drives ================================
    Drive c: (OS) (Fixed) (Total:920.17 GB) (Free:733.07 GB) NTFS
    Drive d: (HP_RECOVERY) (Fixed) (Total:11.24 GB) (Free:1.34 GB) NTFS ==>[System with boot components (obtained from reading drive)]
    Drive j: (Iomega HDD) (Fixed) (Total:465.76 GB) (Free:128.19 GB) NTFS
    ==================== MBR & Partition Table ==================
    ========================================================
    Disk: 0 (Size: 931.5 GB) (Disk ID: 8DAADCE2)
    Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
    Partition 2: (Not Active) - (Size=920.2 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=11.2 GB) - (Type=07 NTFS)
    ========================================================
    Disk: 2 (MBR Code: Windows XP) (Size: 465.8 GB) (Disk ID: CB4A53FB)
    Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)
    ==================== End Of Log ============================
     
  5. JSntgRvr

    JSntgRvr Retired Moderator and Malware Specialist

    Joined:
    Jul 1, 2003
    Messages:
    18,552
    First Name:
    José
    Lost of adware.

    Lets scan the computer

    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.

    Download AdwCleaner from here. Save the file to the desktop.


    NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.

    Close all open windows and browsers.
    • XP users: Double click the AdwCleaner icon to start the program.
    • Vista/7/8 users: Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.
      You will see the following console:
    [​IMG]
    • Click the Scan button and wait for the scan to finish.
    • After the Scan has finished the window may or may not show what it found and above, in the progress bar, you will see: Pending. Please uncheck elements you don't want to remove.
    • Click the Clean button.
    • Everything checked will be deleted.
    • When the program has finished cleaning a report appears.Once done it will ask to reboot, allow this
    [​IMG]
    • On reboot a log will be produced please copy / paste that in your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[S0].txt

    [​IMG] Please download Malwarebytes Anti-Malware to your desktop
    • Double-click mbam-setup-version.exe and follow the prompts to install the program.
    • At the end, be sure a check-mark is placed next to the following:
      1. Enable free trial of Malwarebytes Anti-Malware Premium
      2. Launch Malwarebytes Anti-Malware
    • Then click Finish.
    • If an update is found, you will be prompted to download and install the latest version.
    • Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
    • When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
    • Reboot your computer if prompted.
    Extra Note:

    If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.

    The log is available throughout History ->Application logs. Please post it contents in your next reply.
     
  6. Meggi

    Meggi Thread Starter

    Joined:
    Jan 8, 2015
    Messages:
    4
    I followed each direction you gave and I couldn't be more pleased. My computer and internet is now running as it should. I have learned a valuable lesson and hopefully this will never be a problem again. You guys are the best!!
     
  7. JSntgRvr

    JSntgRvr Retired Moderator and Malware Specialist

    Joined:
    Jul 1, 2003
    Messages:
    18,552
    First Name:
    José
    Thanks for the feedback. :)


    We need to remove the tools we've used during cleaning your machine

    1. Download Delfix from here
    2. Ensure Remove disinfection tools is ticked
      Also tick:
      • Create registry backup
      • Purge system restore
      [​IMG]
    3. Click Run
     
  8. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/1147511

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice