Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-04-2014
Ran by Chris (administrator) on HOME on 16-04-2014 19:12:17
Running from C:\Users\Chris\AppData\Local\Microsoft\Windows\INetCache\IE\AYO9URQ0
Windows 8.1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version:
https://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html
Download link for 64-Bit Version:
https://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST:
==================== Processes (Whitelisted) =================
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) c:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\WINDOWS\system32\dashost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Atheros) C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Windows\System32\skydrive.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Reader_6.3.9654.17044_x64__8wekyb3d8bbwe\glcnd.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2012-06-12] (Realtek Semiconductor)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133440 2012-07-19] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [102928 2012-10-23] (CyberLink Corp.)
HKLM-x32\...\Run: [WRSVC] => C:\Program Files\Webroot\WRSA.exe [763512 2014-04-13] (Webroot)
HKLM-x32\...\Run: [NWEReboot] => [X]
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKLM\...\Policies\Explorer: [NoViewOnDrive] 0
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKLM\...\Policies\Explorer: [DisableLocalMachineRun] 0
HKLM\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0
HKLM\...\Policies\Explorer: [DisableCurrentUserRun] 0
HKLM\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0
HKLM\...\Policies\Explorer: [NoViewContextMenu] 0
HKLM\...\Policies\Explorer: [NoShellSearchButton] 0
HKLM\...\Policies\Explorer: [NoFind] 0
HKLM\...\Policies\Explorer: [NoFile] 0
HKLM\...\Policies\Explorer: [HideClock] 0
HKLM\...\Policies\Explorer: [NoTrayContextMenu] 0
HKLM\...\Policies\Explorer: [NoTrayItemsDisplay] 0
HKLM\...\Policies\Explorer: [NoSetFolders] 0
HKLM\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKLM\...\Policies\Explorer: [NoSetTaskbar] 0
HKLM\...\Policies\Explorer: [NoDeletePrinter] 0
HKLM\...\Policies\Explorer: [NoDFSTab] 0
HKLM\...\Policies\Explorer: [NoChangeStartMenu] 0
HKLM\...\Policies\Explorer: [NoLogoff] 0
HKLM\...\Policies\Explorer: [NoWindowsUpdate] 0
HKLM\...\Policies\Explorer: [NoEncryptOnMove] 0
HKLM\...\Policies\Explorer: [NoRunasInstallPrompt] 0
HKLM\...\Policies\Explorer: [NoResolveSearch] 0
HKLM\...\Policies\Explorer: [NoSaveSettings] 0
HKLM\...\Policies\Explorer: [NoHardwareTab] 0
HKLM\...\Policies\Explorer: [NoStartMenuSubFolders] 0
HKLM\...\Policies\Explorer: [NoDesktop] 0
HKU\.DEFAULT\...\Policies\system: [DisableCMD] 0
HKU\.DEFAULT\...\Policies\system: [NoDispAppearancePage] 0
HKU\.DEFAULT\...\Policies\system: [NoDispBackgroundPage] 0
HKU\.DEFAULT\...\Policies\system: [NoDispSettingsPage] 0
HKU\.DEFAULT\...\Policies\Explorer: [NoFolderOptions] 0
HKU\.DEFAULT\...\Policies\Explorer: [NoViewOnDrive] 0
HKU\.DEFAULT\...\Policies\Explorer: [NoControlPanel] 0
HKU\.DEFAULT\...\Policies\Explorer: [DisableLocalMachineRun] 0
HKU\.DEFAULT\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0
HKU\.DEFAULT\...\Policies\Explorer: [DisableCurrentUserRun] 0
HKU\.DEFAULT\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0
HKU\.DEFAULT\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\.DEFAULT\...\Policies\Explorer: [NoShellSearchButton] 0
HKU\.DEFAULT\...\Policies\Explorer: [NoFind] 0
HKU\.DEFAULT\...\Policies\Explorer: [NoFile] 0
HKU\.DEFAULT\...\Policies\Explorer: [HideClock] 0
HKU\.DEFAULT\...\Policies\Explorer: [NoTrayContextMenu] 0
HKU\.DEFAULT\...\Policies\Explorer: [NoTrayItemsDisplay] 0
HKU\.DEFAULT\...\Policies\Explorer: [NoSetFolders] 0
HKU\.DEFAULT\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKU\.DEFAULT\...\Policies\Explorer: [NoSetTaskbar] 0
HKU\.DEFAULT\...\Policies\Explorer: [NoDeletePrinter] 0
HKU\.DEFAULT\...\Policies\Explorer: [NoDFSTab] 0
HKU\.DEFAULT\...\Policies\Explorer: [NoChangeStartMenu] 0
HKU\.DEFAULT\...\Policies\Explorer: [NoLogoff] 0
HKU\.DEFAULT\...\Policies\Explorer: [NoWindowsUpdate] 0
HKU\.DEFAULT\...\Policies\Explorer: [NoEncryptOnMove] 0
HKU\.DEFAULT\...\Policies\Explorer: [NoRunasInstallPrompt] 0
HKU\.DEFAULT\...\Policies\Explorer: [NoResolveSearch] 0
HKU\.DEFAULT\...\Policies\Explorer: [NoSaveSettings] 0
HKU\.DEFAULT\...\Policies\Explorer: [NoHardwareTab] 0
HKU\.DEFAULT\...\Policies\Explorer: [NoStartMenuSubFolders] 0
HKU\S-1-5-19\...\Policies\system: [DisableCMD] 0
HKU\S-1-5-19\...\Policies\system: [NoDispAppearancePage] 0
HKU\S-1-5-19\...\Policies\system: [NoDispBackgroundPage] 0
HKU\S-1-5-19\...\Policies\system: [NoDispSettingsPage] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoFolderOptions] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoViewOnDrive] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-19\...\Policies\Explorer: [DisableLocalMachineRun] 0
HKU\S-1-5-19\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0
HKU\S-1-5-19\...\Policies\Explorer: [DisableCurrentUserRun] 0
HKU\S-1-5-19\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoShellSearchButton] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoFind] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoFile] 0
HKU\S-1-5-19\...\Policies\Explorer: [HideClock] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoTrayContextMenu] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoTrayItemsDisplay] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoSetFolders] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoSetTaskbar] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoDeletePrinter] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoDFSTab] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoChangeStartMenu] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoLogoff] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoWindowsUpdate] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoEncryptOnMove] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoRunasInstallPrompt] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoResolveSearch] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoSaveSettings] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoHardwareTab] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoStartMenuSubFolders] 0
HKU\S-1-5-20\...\Policies\system: [DisableCMD] 0
HKU\S-1-5-20\...\Policies\system: [NoDispAppearancePage] 0
HKU\S-1-5-20\...\Policies\system: [NoDispBackgroundPage] 0
HKU\S-1-5-20\...\Policies\system: [NoDispSettingsPage] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoFolderOptions] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoViewOnDrive] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-20\...\Policies\Explorer: [DisableLocalMachineRun] 0
HKU\S-1-5-20\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0
HKU\S-1-5-20\...\Policies\Explorer: [DisableCurrentUserRun] 0
HKU\S-1-5-20\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoShellSearchButton] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoFind] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoFile] 0
HKU\S-1-5-20\...\Policies\Explorer: [HideClock] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoTrayContextMenu] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoTrayItemsDisplay] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoSetFolders] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoSetTaskbar] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoDeletePrinter] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoDFSTab] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoChangeStartMenu] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoLogoff] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoWindowsUpdate] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoEncryptOnMove] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoRunasInstallPrompt] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoResolveSearch] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoSaveSettings] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoHardwareTab] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoStartMenuSubFolders] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\system: [NoDispAppearancePage] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\system: [NoDispBackgroundPage] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\system: [NoDispSettingsPage] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [NoFolderOptions] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [NoViewOnDrive] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [DisableLocalMachineRun] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [DisableCurrentUserRun] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [NoShellSearchButton] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [NoFind] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [NoFile] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [HideClock] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [NoTrayContextMenu] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [NoTrayItemsDisplay] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [NoSetFolders] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [NoSetTaskbar] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [NoDeletePrinter] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [NoDFSTab] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [NoChangeStartMenu] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [NoLogoff] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [NoWindowsUpdate] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [NoEncryptOnMove] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [NoRunasInstallPrompt] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [NoResolveSearch] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [NoSaveSettings] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [NoHardwareTab] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\Policies\Explorer: [NoStartMenuSubFolders] 0
HKU\S-1-5-21-3168965227-2949440566-1652333485-1001\...\MountPoints2: {7326f910-e74f-11e2-be6c-a41f727744fb} - "F:\WD SmartWare.exe" autoplay=true
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
ProxyEnable: Internet Explorer proxy is enabled.
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://bt.etree.org/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://dell13.msn.com
SearchScopes: HKLM - DefaultScope {CFE5631F-66A3-4849-8C88-DC820AE54612} URL =
http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MDDCJS
SearchScopes: HKLM - {CFE5631F-66A3-4849-8C88-DC820AE54612} URL =
http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MDDCJS
SearchScopes: HKLM-x32 - {CFE5631F-66A3-4849-8C88-DC820AE54612} URL =
http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MDDCJS
SearchScopes: HKCU - DefaultScope {CFE5631F-66A3-4849-8C88-DC820AE54612} URL =
SearchScopes: HKCU - {CFE5631F-66A3-4849-8C88-DC820AE54612} URL =
BHO: Webroot Vault - {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} - C:\ProgramData\WRData\pkg\LPBar64.dll (Webroot)
BHO: Webroot Filtering Extension - {C9C42510-9B41-42c1-9DCD-7282A2D07C61} - C:\Program Files\Webroot\WRData\PKG\Vistax64\wrflt.dll (Webroot)
BHO-x32: Webroot Vault - {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} - C:\ProgramData\WRData\pkg\LPBar.dll (Webroot)
BHO-x32: Webroot Filtering Extension - {C9C42510-9B41-42c1-9DCD-7282A2D07C61} - C:\Program Files\Webroot\WRData\PKG\Vistax86\wrflt.dll (Webroot)
Toolbar: HKLM - Webroot Toolbar - {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\ProgramData\WRData\pkg\LPBar64.dll (Webroot)
Toolbar: HKLM-x32 - Webroot Toolbar - {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\ProgramData\WRData\pkg\LPBar.dll (Webroot)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
FireFox:
========
FF Plugin: @mcafee.com/MSC,version=10 - C:\Program Files\mcafee\msc\npMcSnFFPl64.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 - C:\Program Files (x86)\McAfee\msc\npMcSnFFPl.dll No File
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF HKLM-x32\...\Thunderbird\Extensions: [
msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF HKCU\...\Firefox\Extensions: [{372479DD-B552-F0A8-F0E5-EEEEA6602285}] - C:\Program Files (x86)\Re-markit-soft\158.xpi
==================== Services (Whitelisted) =================
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-07-19] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [254512 2012-04-24] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [348392 2013-10-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2013-10-30] (Microsoft Corporation)
S2 WRSVC; C:\Program Files\Webroot\WRSA.exe [763512 2014-04-13] (Webroot)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe [77824 2012-06-19] (Atheros)
S2 vosr; C:\Users\Chris\AppData\Roaming\VOPackage\VOsrv.exe [X]
==================== Drivers (Whitelisted) ====================
S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-12] (Windows (R) Win 7 DDK provider)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197264 2012-05-28] (McAfee, Inc.)
S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-09] (Intel Corporation)
R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-10] (Microsoft Corporation)
S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [119512 2014-04-16] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
S3 mfencbdc; C:\Windows\system32\DRIVERS\mfencbdc.sys [337120 2013-02-18] (McAfee, Inc.)
S3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [95856 2013-02-18] (McAfee, Inc.)
R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)
S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-25] (Microsoft Corporation)
S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-11-23] (Microsoft Corporation)
S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124760 2013-10-30] (Microsoft Corporation)
R0 WRkrn; C:\Windows\System32\drivers\WRkrn.sys [114176 2014-04-13] (Webroot)
U0 SR;
U2 srservice;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-16 19:12 - 2014-04-16 19:12 - 00000000 ____D () C:\FRST
2014-04-16 19:09 - 2014-04-16 19:09 - 00000622 _____ () C:\Users\Chris\Desktop\JRT.txt
2014-04-16 19:06 - 2014-04-16 19:06 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-04-16 18:57 - 2014-04-16 18:59 - 00000000 ____D () C:\AdwCleaner
2014-04-15 19:46 - 2014-04-15 20:09 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-04-15 19:45 - 2014-04-15 20:09 - 00000000 ____D () C:\Users\Chris\Desktop\mbar
2014-04-15 19:42 - 2014-04-15 19:42 - 00002613 _____ () C:\Users\Chris\Desktop\RKreport[0]_D_04152014_194210.txt
2014-04-15 19:41 - 2014-04-15 19:41 - 00002493 _____ () C:\Users\Chris\Desktop\RKreport[0]_S_04152014_194151.txt
2014-04-15 19:39 - 2014-04-15 19:42 - 00000000 ____D () C:\Users\Chris\Desktop\RK_Quarantine
2014-04-15 18:07 - 2014-04-15 18:07 - 00003872 _____ () C:\Users\Chris\Desktop\scan1.txt
2014-04-15 17:50 - 2014-04-16 19:03 - 00119512 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-04-15 17:50 - 2014-04-15 19:58 - 00091352 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-04-15 17:50 - 2014-04-15 17:50 - 00001120 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-04-15 17:50 - 2014-04-15 17:50 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-15 17:50 - 2014-04-15 17:50 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-04-15 17:50 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-04-15 17:50 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-04-15 02:49 - 2014-04-16 06:02 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-15 02:49 - 2014-04-15 02:49 - 00001397 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-04-15 02:49 - 2014-04-15 02:49 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Safer-Networking
2014-04-15 02:49 - 2014-04-15 02:49 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-15 02:49 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean64.exe
2014-04-13 18:45 - 2014-04-16 18:46 - 00000378 _____ () C:\WINDOWS\Tasks\APSnotifierPP3.job
2014-04-13 18:45 - 2014-04-14 18:46 - 00000378 _____ () C:\WINDOWS\Tasks\APSnotifierPP2.job
2014-04-13 18:45 - 2014-04-13 19:06 - 00000380 _____ () C:\WINDOWS\Tasks\APSnotifierPP1.job
2014-04-13 18:45 - 2014-04-13 18:46 - 00002810 _____ () C:\WINDOWS\System32\Tasks\APSnotifierPP1
2014-04-13 18:45 - 2014-04-13 18:46 - 00002808 _____ () C:\WINDOWS\System32\Tasks\APSnotifierPP3
2014-04-13 18:45 - 2014-04-13 18:46 - 00002808 _____ () C:\WINDOWS\System32\Tasks\APSnotifierPP2
2014-04-13 18:45 - 2014-04-13 18:46 - 00000330 _____ () C:\Users\Chris\AppData\Roaming\aps.uninstall.scan.results
2014-04-13 18:44 - 2014-04-13 18:44 - 01097384 _____ (AnyProtect.com) C:\Users\Chris\AppData\Local\nsx4976.tmp
2014-04-13 18:43 - 2014-04-13 18:43 - 00000258 __RSH () C:\ProgramData\ntuser.pol
2014-04-10 16:25 - 2014-03-30 21:16 - 23134208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-04-10 16:25 - 2014-03-30 19:57 - 17073152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-04-10 16:25 - 2014-03-10 06:35 - 02008408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2014-04-10 16:25 - 2014-03-10 06:35 - 00377176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2014-04-10 16:25 - 2014-03-06 05:19 - 01287576 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll
2014-04-10 16:25 - 2014-03-06 05:02 - 01109424 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2014-04-10 16:25 - 2014-03-06 02:17 - 00835584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2014-04-10 16:25 - 2014-03-06 02:10 - 01036288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll
2014-04-10 16:22 - 2014-04-10 16:22 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2014-04-10 16:22 - 2014-04-10 16:22 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2014-03-24 16:23 - 2014-02-22 08:16 - 00139776 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2014-03-24 16:23 - 2014-02-22 07:24 - 00124416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2014-03-18 14:26 - 2014-01-02 19:54 - 00461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsGdiConverter.dll
2014-03-18 14:26 - 2013-12-27 04:57 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2014-03-18 14:26 - 2013-12-27 04:23 - 00749056 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2014-03-18 14:26 - 2013-12-27 03:03 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2014-03-18 14:26 - 2013-12-27 02:37 - 00588800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2014-03-18 14:26 - 2013-12-09 04:05 - 21199256 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2014-03-18 14:25 - 2014-01-07 21:46 - 00325464 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS
2014-03-18 14:25 - 2014-01-07 21:41 - 01530712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2014-03-18 14:25 - 2014-01-07 21:41 - 00382808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2014-03-18 14:25 - 2014-01-04 11:54 - 00138240 _____ () C:\WINDOWS\system32\OEMLicense.dll
2014-03-18 14:25 - 2014-01-04 11:08 - 00103936 _____ () C:\WINDOWS\SysWOW64\OEMLicense.dll
2014-03-18 14:25 - 2014-01-04 10:08 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll
2014-03-18 14:25 - 2014-01-04 09:53 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll
2014-03-18 14:25 - 2014-01-02 19:48 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsGdiConverter.dll
2014-03-18 14:25 - 2013-12-31 21:55 - 01720560 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2014-03-18 14:25 - 2013-12-31 21:52 - 00481944 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
2014-03-18 14:25 - 2013-12-31 20:56 - 01472048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2014-03-18 14:25 - 2013-12-31 20:55 - 00381168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2014-03-18 14:25 - 2013-12-31 19:59 - 00802816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2014-03-18 14:25 - 2013-12-31 19:57 - 01214976 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2014-03-18 14:25 - 2013-12-31 19:56 - 00960512 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2014-03-18 14:25 - 2013-12-30 19:34 - 00218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sti.dll
2014-03-18 14:25 - 2013-12-30 19:33 - 00770560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll
2014-03-18 14:25 - 2013-12-30 19:32 - 00303616 _____ (Microsoft Corporation) C:\WINDOWS\system32\sti.dll
2014-03-18 14:25 - 2013-12-30 19:31 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
2014-03-18 14:25 - 2013-12-30 19:31 - 00914944 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll
2014-03-18 14:25 - 2013-12-27 11:09 - 00419160 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2014-03-18 14:25 - 2013-12-27 04:57 - 00842752 _____ (Microsoft Corporation) C:\WINDOWS\system32\MsSpellCheckingFacility.dll
2014-03-18 14:25 - 2013-12-27 03:03 - 00630272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll
2014-03-18 14:25 - 2013-12-21 03:21 - 00376320 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnrpsvc.dll
2014-03-18 14:25 - 2013-12-17 03:21 - 00408576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2014-03-18 14:25 - 2013-12-14 02:31 - 13949440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2014-03-18 14:25 - 2013-12-14 02:19 - 18576384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2014-03-18 14:25 - 2013-12-13 06:54 - 00131160 _____ (Microsoft Corporation) C:\WINDOWS\system32\easinvoker.exe
2014-03-18 14:25 - 2013-12-13 02:36 - 00178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\easwrt.dll
2014-03-18 14:25 - 2013-12-13 01:32 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\easwrt.dll
2014-03-18 14:25 - 2013-12-09 00:51 - 18643560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
==================== One Month Modified Files and Folders =======
2014-04-16 19:12 - 2014-04-16 19:12 - 00000000 ____D () C:\FRST
2014-04-16 19:09 - 2014-04-16 19:09 - 00000622 _____ () C:\Users\Chris\Desktop\JRT.txt
2014-04-16 19:06 - 2014-04-16 19:06 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-04-16 19:03 - 2014-04-15 17:50 - 00119512 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-04-16 19:03 - 2013-11-23 12:00 - 00000000 __RDO () C:\Users\Chris\SkyDrive
2014-04-16 19:00 - 2013-11-23 11:41 - 00000761 _____ () C:\Users\Public\Desktop\Webroot SecureAnywhere.lnk
2014-04-16 19:00 - 2013-08-22 10:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-04-16 18:59 - 2014-04-16 18:57 - 00000000 ____D () C:\AdwCleaner
2014-04-16 18:59 - 2013-08-22 09:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-04-16 18:46 - 2014-04-13 18:45 - 00000378 _____ () C:\WINDOWS\Tasks\APSnotifierPP3.job
2014-04-16 18:23 - 2013-11-23 11:47 - 01595049 _____ () C:\WINDOWS\WindowsUpdate.log
2014-04-16 18:00 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-04-16 17:56 - 2013-11-23 12:02 - 00003910 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{7FBAFDF1-0F39-4438-B19F-15559A0C74BC}
2014-04-16 17:27 - 2013-07-07 17:35 - 00000000 ____D () C:\ProgramData\WRData
2014-04-16 17:08 - 2013-07-07 17:11 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3168965227-2949440566-1652333485-1001
2014-04-16 16:28 - 2013-09-29 23:55 - 00011458 _____ () C:\WINDOWS\PFRO.log
2014-04-16 16:27 - 2013-07-07 17:18 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\uTorrent
2014-04-16 16:13 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-04-16 06:02 - 2014-04-15 02:49 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-15 20:09 - 2014-04-15 19:46 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-04-15 20:09 - 2014-04-15 19:45 - 00000000 ____D () C:\Users\Chris\Desktop\mbar
2014-04-15 19:58 - 2014-04-15 17:50 - 00091352 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-04-15 19:42 - 2014-04-15 19:42 - 00002613 _____ () C:\Users\Chris\Desktop\RKreport[0]_D_04152014_194210.txt
2014-04-15 19:42 - 2014-04-15 19:39 - 00000000 ____D () C:\Users\Chris\Desktop\RK_Quarantine
2014-04-15 19:41 - 2014-04-15 19:41 - 00002493 _____ () C:\Users\Chris\Desktop\RKreport[0]_S_04152014_194151.txt
2014-04-15 18:07 - 2014-04-15 18:07 - 00003872 _____ () C:\Users\Chris\Desktop\scan1.txt
2014-04-15 17:50 - 2014-04-15 17:50 - 00001120 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-04-15 17:50 - 2014-04-15 17:50 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-15 17:50 - 2014-04-15 17:50 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-04-15 02:49 - 2014-04-15 02:49 - 00001397 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-04-15 02:49 - 2014-04-15 02:49 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Safer-Networking
2014-04-15 02:49 - 2014-04-15 02:49 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-14 18:46 - 2014-04-13 18:45 - 00000378 _____ () C:\WINDOWS\Tasks\APSnotifierPP2.job
2014-04-13 19:06 - 2014-04-13 18:45 - 00000380 _____ () C:\WINDOWS\Tasks\APSnotifierPP1.job
2014-04-13 18:50 - 2013-07-07 17:04 - 00000000 ___RD () C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-13 18:46 - 2014-04-13 18:45 - 00002810 _____ () C:\WINDOWS\System32\Tasks\APSnotifierPP1
2014-04-13 18:46 - 2014-04-13 18:45 - 00002808 _____ () C:\WINDOWS\System32\Tasks\APSnotifierPP3
2014-04-13 18:46 - 2014-04-13 18:45 - 00002808 _____ () C:\WINDOWS\System32\Tasks\APSnotifierPP2
2014-04-13 18:46 - 2014-04-13 18:45 - 00000330 _____ () C:\Users\Chris\AppData\Roaming\aps.uninstall.scan.results
2014-04-13 18:44 - 2014-04-13 18:44 - 01097384 _____ (AnyProtect.com) C:\Users\Chris\AppData\Local\nsx4976.tmp
2014-04-13 18:43 - 2014-04-13 18:43 - 00000258 __RSH () C:\ProgramData\ntuser.pol
2014-04-13 18:43 - 2013-08-22 11:36 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy
2014-04-13 18:43 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\GroupPolicy
2014-04-13 06:44 - 2013-07-07 17:36 - 00152744 _____ (Webroot) C:\WINDOWS\SysWOW64\WRusr.dll
2014-04-13 06:44 - 2013-07-07 17:36 - 00114176 _____ (Webroot) C:\WINDOWS\system32\Drivers\WRkrn.sys
2014-04-13 06:44 - 2013-07-07 17:36 - 00103816 _____ (Webroot) C:\WINDOWS\system32\WRusr.dll
2014-04-12 18:36 - 2013-09-30 00:04 - 00865408 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-04-10 16:22 - 2014-04-10 16:22 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2014-04-10 16:22 - 2014-04-10 16:22 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2014-04-03 16:21 - 2013-07-07 17:31 - 00000000 ____D () C:\ProgramData\DVD Shrink
2014-04-03 09:51 - 2014-04-15 17:50 - 00063192 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-15 17:50 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-03-31 17:23 - 2013-08-22 11:38 - 00693240 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-03-31 17:23 - 2013-08-22 11:38 - 00105464 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-31 03:51 - 2013-07-08 17:10 - 90655440 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-03-30 21:16 - 2014-04-10 16:25 - 23134208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-03-30 19:57 - 2014-04-10 16:25 - 17073152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-03-27 16:59 - 2013-08-22 10:46 - 00290341 _____ () C:\WINDOWS\setupact.log
2014-03-27 04:38 - 2013-07-08 17:26 - 00000000 ____D () C:\Users\Chris\AppData\Local\Nero
2014-03-21 15:32 - 2013-08-22 09:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2014-03-21 15:32 - 2013-08-16 04:14 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-03-19 20:12 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-03-19 18:07 - 2013-07-07 17:04 - 00000000 ___RD () C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-03-19 18:05 - 2013-08-22 11:36 - 00000000 ___RD () C:\WINDOWS\ToastData
Some content of TEMP:
====================
C:\Users\Chris\AppData\Local\Temp\ntdll_dump.dll
C:\Users\Chris\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-16 16:43
==================== End Of Log ============================