Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:24-06-2015 Ran by Philip (administrator) on PHILIPSCOMPUTER on 28-06-2015 08:01:02 Running from C:\Users\Philip\Desktop\Rescue.Scan Tools Loaded Profiles: Philip (Available Profiles: Philip & Administrator) Platform: Windows 8.1 (X64) OS Language: English (United States) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Intel Corporation) C:\Windows\System32\igfxCUIService.exe (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe (Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe (Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe (Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe (Panda Security) C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filteringb.exe (Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20905_x64__8wekyb3d8bbwe\livecomm.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Intel Corporation) C:\Windows\System32\igfxEM.exe (Intel Corporation) C:\Windows\System32\igfxHK.exe (Intel Corporation) C:\Windows\System32\igfxTray.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe (Qualcomm®Atheros®) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-07] (Apple Inc.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13876952 1999-12-31] (Realtek Semiconductor) HKLM-x32\...\Run: [BacKGround Agent] => C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe [66304 2015-05-06] (Acer Incorporated) HKLM-x32\...\Run: [abDocsDllLoader] => C:\Program Files (x86)\Acer\abDocs\abDocsDllLoader.exe [92928 2015-05-06] () HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation) HKLM-x32\...\Run: [PSUAMain] => C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe [40184 2015-02-17] (Panda Security, S.L.) HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [134784 2015-01-04] (Qualcomm®Atheros®) HKLM\...\Policies\Explorer: [NoFolderOptions] 0 HKLM\...\Policies\Explorer: [NoControlPanel] 0 HKU\S-1-5-21-733529448-3193121913-2867107617-1001\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7799576 2015-05-15] (SUPERAntiSpyware) HKU\S-1-5-21-733529448-3193121913-2867107617-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8358680 2015-06-01] (Piriform Ltd) Startup: C:\Users\Philip\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cleantemp.bat [2015-06-26] () ShellIconOverlayIdentifiers: [ ACloudSynced] -> {5CCE71FA-9F61-4F24-9CD1-98D819B40D68} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2015-05-06] (Acer Incorporated) ShellIconOverlayIdentifiers: [ ACloudSyncing] -> {C1E1456F-C2D8-4C96-870D-35F1E13941EE} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2015-05-06] (Acer Incorporated) ShellIconOverlayIdentifiers: [ ACloudToBeSynced] -> {307523FA-DDC0-4068-983F-2A6B34627744} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2015-05-06] (Acer Incorporated) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-733529448-3193121913-2867107617-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-733529448-3193121913-2867107617-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-06-25] (Oracle Corporation) BHO: Panda Security Toolbar -> {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} -> C:\Program Files (x86)\pandasecuritytb\pandasecurityDx64.dll [2015-02-10] () BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-25] (Oracle Corporation) Toolbar: HKLM - Panda Security Toolbar - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files (x86)\pandasecuritytb\pandasecurityDx64.dll [2015-02-10] () Tcpip\Parameters: [DhcpNameServer] 216.228.160.4 216.228.160.3 FireFox: ======== FF ProfilePath: C:\Users\Philip\AppData\Roaming\Mozilla\Firefox\Profiles\akinwl0q.default-1435276577375 FF Homepage: https://www.google.com/?gws_rd=ssl FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-25] (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-25] (Oracle Corporation) FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] () FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-05-13] () FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-05-13] () FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-06-25] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-06-25] (Google Inc.) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2013-08-05] () FF Extension: Panda Security Toolbar - C:\Users\Philip\AppData\Roaming\Mozilla\Firefox\Profiles\akinwl0q.default-1435276577375\Extensions\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} [2015-06-27] Chrome: ======= CHR Profile: C:\Users\Philip\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (WOT) - C:\Users\Philip\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp [2015-06-27] CHR Extension: (Widthie) - C:\Users\Philip\AppData\Local\Google\Chrome\User Data\Default\Extensions\gegdfeiahlfolhcfioipjlkombmgbakh [2015-06-27] CHR Extension: (AdBlock) - C:\Users\Philip\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-06-27] CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Philip\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-25] CHR Extension: (Google Wallet) - C:\Users\Philip\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-25] CHR Extension: (Search People) - C:\Users\Philip\AppData\Local\Google\Chrome\User Data\Default\Extensions\papbadoldddalgcjcicnikcfenodpghp [2015-06-27] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-07-22] (SUPERAntiSpyware.com) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.) R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [323200 2015-01-04] (Windows (R) Win 7 DDK provider) [File not signed] S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-28] (Microsoft Corporation) R2 CCDMonitorService; C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe [2839296 2015-05-05] (Acer Incorporated) S3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [2577640 2013-12-04] (Acer Incorporated) S2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-04-24] (WildTangent) R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [315352 2014-07-10] (Intel Corporation) R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation) R2 LMSvc; C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe [455912 2014-12-30] (Acer Incorporate) S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation) R2 NanoServiceMain; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe [142584 2015-02-17] (Panda Security, S.L.) R2 PandaAgent; C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe [66808 2014-10-09] (Panda Security, S.L.) R2 panda_url_filtering; C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filteringb.exe [296760 2014-09-19] (Panda Security) R2 PSUAService; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe [38136 2015-02-17] (Panda Security, S.L.) S3 QASvc; C:\Program Files\Acer\Acer Quick Access\QASvc.exe [458984 2014-06-26] (Acer Incorporate) R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [254512 2012-04-24] () S3 RMSvc; C:\Program Files\Acer\Acer Quick Access\RMSvc.exe [449768 2014-06-26] (Acer Incorporate) S3 SophosVirusRemovalTool; C:\Program Files (x86)\Sophos\Sophos Virus Removal Tool\SVRTservice.exe [153384 2014-11-26] (Sophos Limited) S3 UEIPSvc; C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe [234240 2014-07-14] (acer) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-03] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-03] (Microsoft Corporation) S2 LavasoftTcpService; C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.4.7\LavasoftTcpService.exe [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [4265984 2014-12-11] (Qualcomm Atheros Communications, Inc.) R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2015-01-04] (Qualcomm Atheros) R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation) R3 ETDI2C; C:\Windows\system32\DRIVERS\ETDI2C.sys [173384 2014-04-07] (ELAN Microelectronic Corp.) S3 GeneStor; C:\Windows\System32\drivers\GeneStor.sys [111336 2014-04-28] (GenesysLogic) S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [41032 2013-05-23] (ThreatTrack Security) S3 gfiutil; C:\Windows\System32\drivers\gfiutil.sys [31264 2013-09-04] (ThreatTrack Security) S3 GPIO; C:\Windows\System32\drivers\iaiogpioe.sys [31232 2013-11-10] (Intel Corporation) S3 iaioi2c; C:\Windows\System32\drivers\iaioi2ce.sys [67584 2013-11-10] (Intel Corporation) R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-07-17] (Acer Incorporated) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation) S0 MBI; C:\Windows\System32\drivers\MBI.sys [29464 2013-12-10] (Intel Corporation) R1 NNSALPC; C:\Windows\System32\DRIVERS\NNSAlpc.sys [93968 2015-02-09] (Panda Security, S.L.) R1 NNSHTTP; C:\Windows\System32\DRIVERS\NNSHttp.sys [202000 2015-02-09] (Panda Security, S.L.) R1 NNSHTTPS; C:\Windows\System32\DRIVERS\NNSHttps.sys [110864 2015-02-09] (Panda Security, S.L.) R1 NNSIDS; C:\Windows\System32\DRIVERS\NNSIds.sys [116496 2015-02-09] (Panda Security, S.L.) R1 NNSNAHSL; C:\Windows\system32\DRIVERS\NNSNAHSL.sys [49936 2014-12-31] (Panda Security, S.L.) R1 NNSPICC; C:\Windows\System32\DRIVERS\NNSPicc.sys [99600 2015-02-09] (Panda Security, S.L.) R1 NNSPIHSW; C:\Windows\System32\DRIVERS\NNSPihsw.sys [69904 2015-02-09] (Panda Security, S.L.) R1 NNSPOP3; C:\Windows\System32\DRIVERS\NNSPop3.sys [124176 2015-02-09] (Panda Security, S.L.) R1 NNSPROT; C:\Windows\System32\DRIVERS\NNSProt.sys [299792 2015-02-09] (Panda Security, S.L.) R1 NNSPRV; C:\Windows\System32\DRIVERS\NNSPrv.sys [166160 2015-02-09] (Panda Security, S.L.) R1 NNSSMTP; C:\Windows\System32\DRIVERS\NNSSmtp.sys [113424 2015-02-09] (Panda Security, S.L.) R1 NNSSTRM; C:\Windows\System32\DRIVERS\NNSStrm.sys [257296 2015-02-09] (Panda Security, S.L.) R1 NNSTLSC; C:\Windows\System32\DRIVERS\NNSTlsc.sys [106256 2015-02-09] (Panda Security, S.L.) R2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [163088 2015-02-11] (Panda Security, S.L.) R2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [121616 2015-02-11] (Panda Security, S.L.) R1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [197392 2015-02-09] (Panda Security, S.L.) R2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [124176 2015-02-11] (Panda Security, S.L.) R2 PSINProt; C:\Windows\System32\DRIVERS\PSINProt.sys [133904 2015-02-11] (Panda Security, S.L.) R2 PSINReg; C:\Windows\System32\DRIVERS\PSINReg.sys [107792 2015-02-11] (Panda Security, S.L.) R3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [61712 2015-01-29] (Panda Security, S.L.) R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [14680 2013-07-17] (Acer Incorporated) R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com) R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com) U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [35064 2015-06-27] () R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [88592 2014-01-15] (Intel Corporation) S1 UimBus; C:\Windows\System32\drivers\uimx64.sys [90960 2012-11-22] (Windows (R) 2000 DDK provider) S1 Uim_IM; C:\Windows\System32\Drivers\Uim_IMx64.sys [633680 2012-11-22] (Paragon) S1 Uim_VIM; C:\Windows\System32\Drivers\uim_vimx64.sys [390352 2012-11-22] (Paragon) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-03] (Microsoft Corporation) S3 BioNTDrv; \??\C:\Program Files (x86)\Paragon Software\Hard Disk Manager 12 Professional Demo\program\BioNTDrv.SYS [X] S3 WinRing0_1_2_0; \??\C:\Windows_Repair_Toolbox\Windows_Repair_Toolbox.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== Three Months Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-06-28 07:14 - 2015-06-28 07:14 - 00000000 ____D C:\Users\Philip\AppData\Local\Apple Computer 2015-06-28 06:54 - 2015-06-28 06:54 - 00000000 ____D C:\Users\Philip\AppData\Local\Apple 2015-06-27 16:35 - 2015-06-27 16:38 - 297943040 _____ C:\Users\Philip\Downloads\kav_rescue_10.iso 2015-06-27 13:54 - 2015-06-27 13:54 - 00000000 _____ C:\WINDOWS\SysWOW64\SBRC.dat 2015-06-27 13:54 - 2013-09-04 14:57 - 00031264 _____ (ThreatTrack Security) C:\WINDOWS\system32\Drivers\gfiutil.sys 2015-06-27 13:54 - 2013-05-23 08:39 - 00041032 _____ (ThreatTrack Security) C:\WINDOWS\system32\Drivers\gfiark.sys 2015-06-27 13:45 - 2015-06-27 13:45 - 00003066 _____ C:\WINDOWS\System32\Tasks\{A2B47E4F-CB4C-4699-A75E-3ADA3D113FB8} 2015-06-27 13:31 - 2015-06-27 13:31 - 00001096 _____ C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk 2015-06-27 13:31 - 2015-06-27 13:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox 2015-06-27 13:31 - 2015-05-13 17:11 - 00922704 _____ (Oracle Corporation) C:\WINDOWS\system32\Drivers\VBoxDrv.sys 2015-06-27 13:31 - 2015-05-13 17:10 - 00128592 _____ (Oracle Corporation) C:\WINDOWS\system32\Drivers\VBoxUSBMon.sys 2015-06-27 13:30 - 2015-06-27 13:30 - 00000000 ____D C:\Program Files\Oracle 2015-06-27 13:24 - 2015-06-27 13:25 - 111273672 _____ (Oracle Corporation) C:\Users\Philip\Downloads\VirtualBox-4.3.28-100309-Win (1).exe 2015-06-27 13:18 - 2015-06-27 13:18 - 00002806 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC 2015-06-27 13:07 - 2015-06-27 13:07 - 00000000 ____D C:\Users\Philip\VirtualBox VMs 2015-06-27 13:06 - 2015-06-27 13:48 - 00000000 ____D C:\Users\Philip\.VirtualBox 2015-06-27 13:02 - 2015-06-27 13:03 - 111273672 _____ (Oracle Corporation) C:\Users\Philip\Downloads\VirtualBox-4.3.28-100309-Win.exe 2015-06-27 12:13 - 2015-06-27 12:13 - 00012872 _____ (SurfRight B.V.) C:\WINDOWS\system32\bootdelete.exe 2015-06-27 10:47 - 2015-06-27 10:47 - 00052320 _____ (Kaspersky Lab ZAO) C:\WINDOWS\system32\Drivers\21036925.sys 2015-06-27 09:34 - 2015-06-27 09:35 - 00000000 ____D C:\ProgramData\Sophos 2015-06-27 09:29 - 2015-06-27 09:29 - 00002775 _____ C:\Users\Public\Desktop\Sophos Virus Removal Tool.lnk 2015-06-27 09:29 - 2015-06-27 09:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos 2015-06-27 09:28 - 2015-06-27 09:28 - 00000000 ____D C:\Program Files (x86)\Sophos 2015-06-27 09:08 - 2015-06-27 09:18 - 125236608 _____ (Sophos Limited) C:\Users\Philip\Downloads\Sophos Virus Removal Tool.exe 2015-06-27 09:03 - 2015-06-27 09:03 - 00852662 _____ C:\Users\Philip\Downloads\SecurityCheck(1).exe 2015-06-27 08:57 - 2015-06-27 08:57 - 00321848 _____ (Malwarebytes Corporation) C:\Users\Philip\Downloads\mbam-clean-2.1.1.1001.exe 2015-06-27 08:14 - 2015-06-27 08:15 - 00000000 ____D C:\Users\Philip\AppData\Local\Acer Aspire R7 Tutorial 2015-06-27 08:08 - 2015-06-27 08:08 - 00457824 _____ (Kaspersky Lab ZAO) C:\WINDOWS\system32\Drivers\AE40345E.sys 2015-06-27 08:00 - 2015-06-27 08:00 - 00852662 _____ C:\Users\Philip\Downloads\SecurityCheck.exe 2015-06-27 06:21 - 2015-06-27 15:36 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-733529448-3193121913-2867107617-1001 2015-06-27 06:16 - 2015-01-29 10:21 - 00061712 _____ (Panda Security, S.L.) C:\WINDOWS\system32\Drivers\PSKMAD.sys 2015-06-27 06:13 - 2015-06-27 06:13 - 00000000 ____D C:\ProgramData\panda_url_filtering 2015-06-27 06:13 - 2015-06-27 06:13 - 00000000 ____D C:\ProgramData\Panda Security URL Filtering 2015-06-27 06:12 - 2015-06-27 10:48 - 00000000 ____D C:\Program Files (x86)\pandasecuritytb 2015-06-27 06:12 - 2015-06-27 06:14 - 00002216 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Free Antivirus.lnk 2015-06-27 06:12 - 2015-06-27 06:12 - 00000000 ____D C:\Users\Philip\AppData\Roaming\Panda Security 2015-06-27 06:12 - 2015-06-27 06:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Free Antivirus 2015-06-27 06:12 - 2015-06-27 06:12 - 00000000 ____D C:\Program Files (x86)\Panda Security 2015-06-27 06:11 - 2015-06-27 06:12 - 00000000 ____D C:\ProgramData\Panda Security 2015-06-27 05:58 - 2015-03-03 06:17 - 00295552 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe 2015-06-26 17:53 - 2015-06-27 16:40 - 00000258 __RSH C:\ProgramData\ntuser.pol 2015-06-26 14:20 - 2015-06-26 14:20 - 00000000 ____D C:\Users\Philip\AppData\Local\AOP SDK 2015-06-26 14:02 - 2015-06-26 14:02 - 00022460 _____ C:\WINDOWS\system32\.crusader 2015-06-26 13:48 - 2015-06-26 13:48 - 00000000 ____D C:\SUPERDelete 2015-06-26 13:27 - 2015-06-26 12:39 - 02949565 _____ (Malwarebytes Corporation) C:\Users\Philip\Desktop\JRT.exe 2015-06-26 13:25 - 2015-06-26 13:25 - 00000000 ____D C:\Users\Philip\AppData\Local\GWX 2015-06-26 11:08 - 2015-06-26 11:08 - 00000000 ____D C:\archive_db 2015-06-26 11:07 - 2015-06-26 11:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinFix Pro 2015-06-26 11:04 - 2015-06-26 12:02 - 00000000 ____D C:\Users\Philip\AppData\Roaming\Opera Software 2015-06-26 11:04 - 2015-06-26 12:02 - 00000000 ____D C:\Users\Philip\AppData\Local\Opera Software 2015-06-26 11:04 - 2015-06-26 11:04 - 00000051 _____ C:\WINDOWS\winfix.ini 2015-06-26 10:59 - 2015-06-26 10:59 - 00000000 ____D C:\ProgramData\launcher 2015-06-26 10:56 - 2015-06-26 10:56 - 00631808 _____ C:\WINDOWS\rtn.dat 2015-06-26 10:56 - 2013-08-22 06:25 - 00000824 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak 2015-06-26 09:43 - 2015-06-26 09:43 - 00000000 ____D C:\Users\Philip\Documents\nirsoft_package_1.19.39 2015-06-26 01:35 - 2015-05-25 06:23 - 00036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\UtcResources.dll 2015-06-26 01:35 - 2015-05-25 06:07 - 01430528 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll 2015-06-25 17:37 - 2015-06-27 05:57 - 00000000 ____D C:\WINDOWS\System32\Tasks\McAfee 2015-06-25 16:53 - 2015-06-25 16:53 - 00001245 _____ C:\Users\Philip\Desktop\windows id key numbers.txt - Shortcut.lnk 2015-06-25 16:53 - 2015-06-25 16:53 - 00000025 _____ C:\Users\Philip\Documents\windows id key numbers.txt 2015-06-25 16:51 - 2015-06-25 16:51 - 00000000 ____D C:\Users\Philip\AppData\Local\Lavasoft 2015-06-25 16:50 - 2015-06-26 13:29 - 00000000 ____D C:\Program Files (x86)\Lavasoft 2015-06-25 16:50 - 2015-06-26 12:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft 2015-06-25 16:50 - 2015-06-26 10:10 - 00003024 _____ C:\WINDOWS\system32\LavasoftTcpServiceOff.ini 2015-06-25 16:50 - 2015-06-08 14:13 - 00428880 _____ (Lavasoft Limited) C:\WINDOWS\system32\LavasoftTcpService64.dll 2015-06-25 16:47 - 2015-06-26 13:30 - 00000000 ____D C:\Users\Philip\AppData\Roaming\Lavasoft 2015-06-25 16:47 - 2015-06-26 13:29 - 00000000 ____D C:\ProgramData\Lavasoft 2015-06-25 16:47 - 2015-06-25 16:47 - 00001098 _____ C:\Users\Public\Desktop\KeyFinder.lnk 2015-06-25 16:47 - 2015-06-25 16:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeyFinder 2015-06-25 16:47 - 2015-06-25 16:47 - 00000000 ____D C:\Program Files (x86)\Magical Jelly Bean 2015-06-25 16:46 - 2015-06-25 16:46 - 01178272 _____ (Magical Jelly Bean ) C:\Users\Philip\Downloads\KeyFinderInstaller.exe 2015-06-25 16:43 - 2015-06-25 16:43 - 00001136 _____ C:\Users\Philip\Desktop\BroniFixlistExamples - Shortcut.lnk 2015-06-25 16:42 - 2015-06-27 10:27 - 00000000 ____D C:\Users\Philip\Documents\BroniFixlistExamples 2015-06-25 15:35 - 2015-06-28 07:59 - 00004292 _____ C:\WINDOWS\setupact.log 2015-06-25 15:35 - 2015-06-27 10:49 - 00091990 _____ C:\WINDOWS\PFRO.log 2015-06-25 15:35 - 2015-06-25 15:35 - 00000000 _____ C:\WINDOWS\setuperr.log 2015-06-25 15:23 - 2015-06-25 15:23 - 00002279 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2015-06-25 15:23 - 2015-06-25 15:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2015-06-25 15:22 - 2015-06-27 11:47 - 00000930 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2015-06-25 15:22 - 2015-06-27 11:47 - 00000926 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2015-06-25 15:22 - 2015-06-25 15:23 - 00000000 ____D C:\Users\Philip\AppData\Local\Google 2015-06-25 15:22 - 2015-06-25 15:22 - 00000000 ____D C:\Program Files (x86)\Google 2015-06-25 14:52 - 2015-06-25 14:52 - 00001175 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2015-06-25 14:52 - 2015-06-25 14:52 - 00001163 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2015-06-25 14:52 - 2015-06-25 14:52 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2015-06-25 14:44 - 2015-06-25 14:44 - 00092276 _____ C:\Users\Philip\Documents\cc_20150625_144446.reg 2015-06-25 14:44 - 2015-06-25 14:44 - 00000082 _____ C:\Users\Philip\Documents\cc_20150625_144434.reg 2015-06-25 14:44 - 2015-06-25 14:44 - 00000082 _____ C:\Users\Philip\Documents\cc_20150625_144416.reg 2015-06-25 14:41 - 2015-06-25 14:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2015-06-25 14:41 - 2015-06-25 14:41 - 00000000 ____D C:\Program Files\CCleaner 2015-06-25 14:32 - 2015-06-25 14:32 - 00000000 ____D C:\Users\Philip\AppData\Roaming\SUPERAntiSpyware.com 2015-06-25 14:32 - 2015-06-25 14:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware 2015-06-25 14:31 - 2015-06-25 14:32 - 00000000 ____D C:\Program Files\SUPERAntiSpyware 2015-06-25 14:31 - 2015-06-25 14:31 - 00000000 ____D C:\ProgramData\SUPERAntiSpyware.com 2015-06-25 14:25 - 2015-06-25 14:25 - 00000000 ____D C:\Users\Philip\AppData\Local\VS Revo Group 2015-06-25 14:25 - 2015-06-25 14:25 - 00000000 ____D C:\ProgramData\VS Revo Group 2015-06-25 14:25 - 2015-06-25 14:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro 2015-06-25 14:25 - 2015-06-25 14:25 - 00000000 ____D C:\Program Files\VS Revo Group 2015-06-25 14:25 - 2009-12-30 10:21 - 00031800 _____ (VS Revo Group) C:\WINDOWS\system32\Drivers\revoflt.sys 2015-06-25 14:23 - 2015-06-25 14:23 - 00001276 _____ C:\Users\Philip\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HD Audio Manager.lnk 2015-06-25 14:16 - 2015-06-25 14:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Mouse and Keyboard Center 2015-06-25 14:16 - 2015-06-25 14:16 - 00000000 ____D C:\Program Files\Microsoft Mouse and Keyboard Center 2015-06-25 14:13 - 2015-06-25 14:13 - 00000000 ____D C:\WINDOWS\SysWOW64\RTCOM 2015-06-25 14:13 - 2015-06-25 14:13 - 00000000 ____D C:\Program Files\Realtek 2015-06-25 14:12 - 1999-12-31 17:00 - 72113152 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RCoRes64.dat 2015-06-25 14:12 - 1999-12-31 17:00 - 07164176 _____ (Dolby Laboratories) C:\WINDOWS\system32\R4EEP64A.dll 2015-06-25 14:12 - 1999-12-31 17:00 - 05804772 _____ C:\WINDOWS\system32\Drivers\rtvienna.dat 2015-06-25 14:12 - 1999-12-31 17:00 - 04467928 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\Drivers\RTKVHD64.sys 2015-06-25 14:12 - 1999-12-31 17:00 - 03262184 _____ (Yamaha Corporation) C:\WINDOWS\system32\YamahaAE2.dll 2015-06-25 14:12 - 1999-12-31 17:00 - 03218800 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtkApi64.dll 2015-06-25 14:12 - 1999-12-31 17:00 - 02907864 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtPgEx64.dll 2015-06-25 14:12 - 1999-12-31 17:00 - 02846424 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RltkAPO64.dll