# "CryptoWall" virus on desktop - please help!!!!



## Rain1290 (Apr 26, 2011)

Hi there,

We recently discovered that my aunt very likely has a CryptoWall virus, which, from what I understand, is one of the most vicious viruses out there. The virus was presumably contracted via an infected e-mail. Upon restarting the computer every time and arriving on the desktop, we see this instruction page stating something along the lines that corrupted files can never be restored unless paying some ransom of $500. Does this sound familiar? She said that she had been experiencing corrupted files for just over a month now (likely since late-April 2014).


The files typically affected are Word Perfect documents, as well as .jpg files. ALL of these are unreadable (encrypted) and are not supported by any alternative programs that we tried (Microsoft Word, or NotePad for .doc files, and Microsoft Paint, or Photo Viewer for image files). 

I am not certain if related to the virus, but her computer was not automatically doing updates, and the anti-virus was not active. There were difficulties in activating both, but we found solutions to get them working. Windows 8.1 was one of the updates, but this did not resolve the overall issue. We also used Malware Software and quarantined harmful found files, which were then quarantined (although this did not resolve the issue)

I feel really bad, as she has such a large album of photograph files (not backed up), as well as WordPerfect documents. Would it be possible to restore/repair the affected files?

Any information would be greatly appreciated!

Thanks,

~Trav.~


----------



## Mark1956 (May 7, 2011)

We can make a start by running these two programs.

*SCAN 1*
Click on this link to download : ADWCleaner Click on the Download Now button and save it to your desktop.

*NOTE:* If using Internet Explorer and you get an alert that stops the program downloading click on *Tools > Smartscreen Filter > Turn off Smartscreen Filter* then click on *OK* in the box that opens. Then click on the link again.

Close your browser and double click on this icon on your desktop: 

You will then see the screen below, click on the *Scan* button (as indicated), accept any prompts that appear and allow it to run, it may take several minutes to complete, when it is done click on the *Clean* button, accept any prompts that appear and allow the system to reboot. You will then be presented with the report, Copy & Paste it into your next post.

*NOTE:* If for any reason the report does not appear, open Windows Explorer and click on the C: drive in the left pane, in the right pane you should find a new folder called *Adwcleaner*, double click on it and you will see the saved logs. Find the log that has a number in brackets starting with an *S* NOT *R*, similar to this: *Adwcleaner[S1]*, double click on the one with the highest number and the log will open, Copy & Paste it into your reply.



*SCAN 2*
Please download Farbar Recovery Scan Tool (FRST) and save it to your desktop. Do not get tempted to download Regclean Pro.

*Note:* If you get a warning that the download could harm your system, please ignore it and allow the download to go ahead. FRST is perfectly safe and we would never ask you to download anything that isn't.

*Note*: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.


Double-click on FRST to run it. When the tool opens click *Yes* to the disclaimer.
Press the* Scan* button. *DO NOT* check any of the Optional Scan options unless requested.
It will make a log (*FRST.txt*) in the same directory the tool is run from. Please copy and paste it into your next reply.
The first time the tool is run, it makes another log (*Addition.txt*). Please also copy and paste that into your reply.


----------



## Rain1290 (Apr 26, 2011)

Hello Mark,


Thank you so much for these suggestions! The only problem is, my aunt lives far from where I do, so I cannot physically be there to try what you suggested above. I wish that I could remotely try somehow.


Do you know if it is actually possible to recover her currently corrupted picture and WordPerfect files? Has there been success in the past?


Thanks,


~Trav.~


----------



## Mark1956 (May 7, 2011)

It is extremely difficult for me to give any recommendations without seeing the logs from the system, as requested. With that infection it will need direct communication between me and the user, can you get your Aunt to sign in to your account here and follow the instructions given?

If you have correctly identified the infection as CryptoWall the chances of saving the files it may have encrypted are near to zero, but as I said, I can't make any real judgement without reviewing the logs.

If this is not going to be possible then your safest bet is to back up any personal files and do a clean install of Windows. You should only save personal files and none that are related to the system, as they may be infected.


----------



## Rain1290 (Apr 26, 2011)

Hi Mark,


I will try to run her through everything by phone.  For the second scan, only "Addition.txt" is checked off. Do I uncheck it, or leave it as it is?


Thanks,


~Trav.~


----------



## Rain1290 (Apr 26, 2011)

Hi Mark,

I successfully guided her through the steps and am now pasting the necessary/requested information from Adwcleaner:

*Previous log version of Adwcleaner: *

# AdwCleaner v3.214 - Report created 01/07/2014 at 13:05:51 
# Updated 29/06/2014 by Xplode
# Operating System : Windows 8.1 (64 bits)
# Username : EMoore - ELLEN
# Running from : C:\Users\EMoore\AppData\Local\Microsoft\Windows\INetCache\IE\CVRODMNW\AdwCleaner.exe
# Option : Clean
***** [ Services ] *****

***** [ Files / Folders ] *****
Folder Deleted : C:\Users\EMoore\AppData\LocalLow\iac
Folder Deleted : C:\Users\EMoore\Documents\Optimizer Pro
Folder Deleted : C:\Users\EMoore\Documents\PC Health Kit
Folder Deleted : C:\Users\EMoore\Documents\PCSpeedUp
***** [ Shortcuts ] *****

***** [ Registry ] *****
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.ToolbarProtector
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.ToolbarProtector.1
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [FromDocToPDF_65 Browser Plugin Loader 64]
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE84501A-2CB6-41D6-B3A7-9679BDBDFA0B}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4D8AEB1D-4ED4-44AC-A039-4775B2575DB0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BC7E25D7-4681-46A3-AF5A-9A1B865783ED}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{36B445BF-1B84-466A-A623-A360A8CFF8C3}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9A216821-0EC5-49A3-85AC-FB72AE79A1E8}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9A216821-0EC5-49A3-85AC-FB72AE79A1E8}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{36B445BF-1B84-466A-A623-A360A8CFF8C3}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{6CBF5C01-C876-481B-867E-111CB1D2A7D6}
***** [ Browsers ] *****
-\\ Internet Explorer v11.0.9600.17126

-\\ Google Chrome v
[ File : C:\Users\EMoore\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************
AdwCleaner[R0].txt - [2134 octets] - [01/07/2014 13:04:28]
AdwCleaner[S0].txt - [1964 octets] - [01/07/2014 13:05:51]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2024 octets] ##########

*New version:*

# AdwCleaner v3.214 - Report created 01/07/2014 at 16:27:56
# Updated 29/06/2014 by Xplode
# Operating System : Windows 8.1 (64 bits)
# Username : EMoore - ELLEN
# Running from : C:\Users\EMoore\Desktop\AdwCleaner.exe
# Option : Clean
***** [ Services ] *****
Service Deleted : 70e6ca8c
Service Deleted : CltMngSvc
***** [ Files / Folders ] *****
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\optimizer pro v3.2
Folder Deleted : C:\Program Files (x86)\Optimizer Pro
Folder Deleted : C:\Program Files (x86)\SearchProtect
Folder Deleted : C:\Users\EMoore\AppData\Local\SearchProtect
Folder Deleted : C:\Users\EMoore\AppData\Roaming\Optimizer Pro
Folder Deleted : C:\Users\EMoore\Documents\Optimizer Pro
***** [ Shortcuts ] *****

***** [ Registry ] *****
Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Optimizer Pro]
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Deleted : HKCU\Software\Optimizer Pro
Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Key Deleted : HKLM\Software\SearchProtect
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Data Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll
Data Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll
***** [ Browsers ] *****
-\\ Internet Explorer v11.0.9600.17126
Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
-\\ Google Chrome v
[ File : C:\Users\EMoore\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************
AdwCleaner[R0].txt - [2134 octets] - [01/07/2014 13:04:28]
AdwCleaner[R1].txt - [2713 octets] - [01/07/2014 16:27:11]
AdwCleaner[S0].txt - [2112 octets] - [01/07/2014 13:05:51]
AdwCleaner[S1].txt - [2331 octets] - [01/07/2014 16:27:56]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [2391 octets] ##########

I hope this helps. 

~Trav.~


----------



## Mark1956 (May 7, 2011)

> I will try to run her through everything by phone.
> 
> 
> 
> ...


 I see you figured it out, but all instructions are quite specific so if they don't tell you to do something, don't do it.

There is a problem though, both the programs appear to have been run from the download instead of being saved to the Desktop, as instructed, and then run.

I'll give you the instructions to set Internet Explorer so all future downloads go to the Desktop, after this only use Internet Explorer to download any of the tools I ask you to use.

Also, both of the logs are incomplete. Please follow this to make sure the entire log is copied correctly before posting.

*How to change the download location in IE9, 10 or 11.*


Open Internet Explorer.
Press the *CTRL + J* keys simultaneously to open the *View Downloads* window.
Click on Options.
Click on the *Browse* button.
Navigate to and select (highlight) *Desktop* in the left pane, then click on the *Select Folder* button, click on *OK* and shut the remaining window.
Close IE and re-open it for the changes to take effect.

*How to post a log*.
With the log open, hold down the *Control(Ctrl)* and* A* keys on your keyboard at the same time, the log text should turn blue, release the keys. If the text does not change color, left click on the log so the cursor appears on it and try again.
Right click on the blue area and select *Copy* from the pop up menu.
Come back here and right click on the Message box and select *Paste* from the pop up menu, the log should appear.
Type in any comments you wish to add and respond to any questions asked, then submit the post.

===============================

Please then download FRST and Adwcleaner again so they appear on the Desktop. Then run new scans with them, Adwcleaner needs to be run again anyway to be sure all the detections have gone. When you run FRST again you must put a check mark next to Addition.txt or it will only produce one log, we need them both.

You can go back to your last post and click on the Edit button, you can then completely remove the FRST logs, don't delete the Adwcleaner log. Then make a new post for the FRST logs.

================================

I can clearly see infected files, but the FRST log (the part that is missing) may show me more very important information about the infection.


----------



## Rain1290 (Apr 26, 2011)

Hi Mark,


Okay, I will do as you instructed. My apologies for overlooking those fine details. However, are the Awdcleaner results good the way they are? It is just those FRTS and Addition information that need to be re-submitted?


~Trav.~


----------



## Mark1956 (May 7, 2011)

That is correct, Adwcleaner scan is fine, just need you to download it again and save it in the correct location then run a fresh scan with it.


----------



## Mark1956 (May 7, 2011)

After further investigation of this specific infection I've got to tell you that any files that were encrypted by the infection will not be possible to recover. There is no known method of getting them back other than paying the criminals, but that does not guarantee you will get the encryption keys. This is one of the most damaging infections I've come across and I have read the criminals that originally launched it were closed down a couple of months ago, but it has come to the surface again with a slightly different name.

This is a very hard way to learn the importance of keeping regular back ups of all your important data, it is a must with PC's as you never know when something will go wrong. The only things you should not back up are the things you don't mind loosing.


----------



## Rain1290 (Apr 26, 2011)

Hi Mark,


Thanks for your recent replies! All right, I instructed my aunt to save both programs to her desktop, and then run them from there directly. I now have the information that you require. However, the reply box does not permit me to submit since the logs exceed the character limit (which is an indication that the logging information that I have is correct), even if I wanted to post each log in separate messages (not including that from Adwcleaner).


Is there any way around this?


Thanks,


~Trav.~


----------



## Mark1956 (May 7, 2011)

The Addition.txt log should fit into one post, if the FRST.txt won't fit then you just need to split it into two separate posts. If that causes too much confusion then attach the log as follows:


Below the *Message Box* click on *Go Advanced*. Then scroll down until you see a button, *Manage Attachments*. Click on that and a new window opens.
Click on the *Browse* button, find the file/folder you want to attach and click on it so it becomes highlighted and click on *Open.*
Now click on the *Upload* button. Wait for the Upload to complete, it will appear just below the *Browse* box.
When done, click on the *Close this window* button at the top of the page.
Enter your message-text in the message box, then click on *Submit Reply.*


----------



## Mark1956 (May 7, 2011)

One other thing, don't forget to remove the two incomplete FRST logs from earlier.


----------



## Rain1290 (Apr 26, 2011)

*FRST (first part):*

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-07-2014
Ran by EMoore (administrator) on ELLEN on 01-07-2014 16:38:07
Running from C:\Users\EMoore\Desktop
Platform: Windows 8.1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Creative Technology Ltd.) C:\Windows\System32\V0410Aps.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
() C:\Windows\jmesoft\Service.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Creative Technology Ltd.) C:\Program Files (x86)\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTSched.exe
(Creative Technology Ltd.) C:\Windows\V0410Mon.exe
(Lenovo) C:\Windows\jmesoft\hotkey.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(CyberLink) C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
() C:\Windows\jmesoft\JME_LOAD.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
() C:\Program Files (x86)\Speed Cleaner\Speed Cleaner.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\MSOSYNC.EXE
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe

==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12497552 2012-05-27] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1180304 2012-05-30] (Realtek Semiconductor)
HKLM-x32\...\Run: [V0410Mon.exe] => C:\WINDOWS\V0410Mon.exe [32768 2007-06-06] (Creative Technology Ltd.)
HKLM-x32\...\Run: [jmekey] => C:\windows\jmesoft\hotkey.exe [118784 2011-06-08] (Lenovo)
HKLM-x32\...\Run: [jmesoft] => C:\Windows\jmesoft\ServiceLoader.exe [28672 2011-03-15] ()
HKLM-x32\...\Run: [mcui_exe] => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [103720 2009-12-04] (CyberLink)
HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-04-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-12] (Intel Corporation)
HKLM-x32\...\Run: [QuickFinder Scheduler] => c:\Program Files (x86)\Corel\WordPerfect Office X5\Programs\QFSCHD150.EXE [136600 2010-03-11] (Corel Corporation)
HKLM-x32\...\Run: [Feolsyodcotaivc] => C:\Users\EMoore\AppData\Roaming\Umingyy\oszio.exe
HKLM-x32\...\Run: [Ucrocumytibygi] => C:\Users\EMoore\AppData\Roaming\Opdaur\veximi.exe
HKLM-x32\...\Run: [Olasgay] => C:\Users\EMoore\AppData\Roaming\Ohybboum\ygysvey.exe
HKLM-x32\...\Run: [Uzylzaroamvozii] => C:\Users\EMoore\AppData\Roaming\Ywymfouc\zudekau.exe
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766688 2014-04-23] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Speed Cleaner] => C:\Program Files (x86)\Speed Cleaner\Speed Cleaner.exe [1465760 2014-06-24] ()
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0
HKLM\...\Policies\Explorer: [HideSCAHealth] 0
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKU\S-1-5-21-3554997651-2643067823-2061939718-1002\...\Run: [Creative Live! Cam Manager] => C:\Program Files (x86)\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe [155648 2007-06-07] (Creative Technology Ltd.)
HKU\S-1-5-21-3554997651-2643067823-2061939718-1002\...\Run: [CreativeTaskScheduler] => C:\Program Files (x86)\Creative\Shared Files\CTSched.exe [53341 2006-11-17] (Creative Technology Ltd)
HKU\S-1-5-21-3554997651-2643067823-2061939718-1002\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-21-3554997651-2643067823-2061939718-1002\...\Policies\Explorer: [HideSCAHealth] 0
Startup: C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.HTML ()
Startup: C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.TXT ()
InternetURL: C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.URL -> https://kpai7ycr7jxqkilp.torexplorer.com/5ag2
ShellIconOverlayIdentifiers: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: SugarSyncBackedUp -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File
ShellIconOverlayIdentifiers: SugarSyncPending -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File
ShellIconOverlayIdentifiers: SugarSyncRoot -> {A759AFF6-5851-457D-A540-F4ECED148351} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File
ShellIconOverlayIdentifiers: SugarSyncShared -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File
ShellIconOverlayIdentifiers-x32: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers-x32: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers-x32: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo13.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.lenovo.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - DefaultScope {5B9FD57B-9D6A-4C7A-916F-7E39C0616FCF} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS
SearchScopes: HKLM - {5B9FD57B-9D6A-4C7A-916F-7E39C0616FCF} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {5B9FD57B-9D6A-4C7A-916F-7E39C0616FCF} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS
SearchScopes: HKCU - DefaultScope {5B9FD57B-9D6A-4C7A-916F-7E39C0616FCF} URL = 
SearchScopes: HKCU - {034BB28E-1C44-4EAF-BA50-08A1D4A4721B} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {5B9FD57B-9D6A-4C7A-916F-7E39C0616FCF} URL = 
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
DPF: HKLM-x32 {4FF78044-96B4-4312-A5B7-FDA3CB328095} 
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
FireFox:
========
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
Chrome: 
=======
CHR HomePage: 
CHR Extension: (Google Docs) - C:\Users\EMoore\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-21]
CHR Extension: (Google Drive) - C:\Users\EMoore\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-21]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\EMoore\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-21]
CHR Extension: (YouTube) - C:\Users\EMoore\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-21]
CHR Extension: (Google Search) - C:\Users\EMoore\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-21]
CHR Extension: (Google Wallet) - C:\Users\EMoore\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-21]
CHR Extension: (Gmail) - C:\Users\EMoore\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-21]
==================== Services (Whitelisted) =================
R2 AEV0410; C:\Windows\system32\V0410Aps.exe [85504 2007-06-06] (Creative Technology Ltd.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-04-23] (Advanced Micro Devices, Inc.) [File not signed]
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2279608 2014-05-21] (Microsoft Corporation)
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [2457232 2012-07-24] (Realsil Microelectronics Inc.)
R2 JME Keyboard; C:\Windows\jmesoft\Service.exe [32768 2011-03-15] () [File not signed]
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-06-30] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-06-30] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-20] (Advanced Micro Devices)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [98472 2012-07-16] (Advanced Micro Devices)
R3 RLDesignVirtualAudioCableWdm; C:\Windows\system32\DRIVERS\livecamv.sys [49664 2007-02-05] ()
R3 V0410Dev; C:\Windows\system32\DRIVERS\V0410Dev.sys [277344 2007-07-03] (Creative Technology Ltd.)
R3 V0410Vfx; C:\Windows\system32\DRIVERS\V0410Vfx.sys [11776 2006-12-05] (EyePower Games Pte. Ltd.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [71680 2013-08-22] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-06-30] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
S3 MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [X]
==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========
2014-07-01 16:38 - 2014-07-01 16:38 - 00013480 _____ () C:\Users\EMoore\Desktop\FRST.txt
2014-07-01 16:36 - 2014-07-01 16:36 - 02083840 _____ (Farbar) C:\Users\EMoore\Desktop\FRST64.exe
2014-07-01 16:26 - 2014-07-01 16:25 - 01346519 _____ () C:\Users\EMoore\Desktop\AdwCleaner.exe
2014-07-01 15:19 - 2014-07-01 15:19 - 00000000 ____D () C:\Users\EMoore\AppData\Local\IsolatedStorage
2014-07-01 15:18 - 2014-07-01 15:18 - 00002499 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Speed Cleaner.lnk
2014-07-01 15:18 - 2014-07-01 15:18 - 00000000 ____D () C:\Program Files (x86)\Speed Cleaner
2014-07-01 15:17 - 2014-07-01 15:17 - 00001991 _____ () C:\Users\Public\Desktop\InstallConverter.lnk
2014-07-01 15:17 - 2014-07-01 15:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InstallConverter
2014-07-01 15:17 - 2014-07-01 15:17 - 00000000 ____D () C:\Program Files (x86)\InstallConverter
2014-07-01 13:17 - 2014-07-01 16:38 - 00000000 ____D () C:\FRST
2014-07-01 13:04 - 2014-07-01 16:28 - 00000000 ____D () C:\AdwCleaner
2014-07-01 13:04 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\WINDOWS\SysWOW64\sqlite3.dll
2014-06-30 11:36 - 2014-06-30 11:36 - 00000000 ____D () C:\ProgramData\ATI
2014-06-30 11:18 - 2014-06-30 11:18 - 00060601 _____ () C:\WINDOWS\SysWOW64\CCCInstall_201406301118550025.log
2014-06-30 11:18 - 2014-06-30 11:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-06-30 11:18 - 2014-06-30 11:18 - 00000000 ____D () C:\Program Files\ATI Technologies
2014-06-30 11:18 - 2014-06-30 11:18 - 00000000 ____D () C:\Program Files (x86)\Advanced Micro Devices, Inc
2014-06-30 11:17 - 2014-06-30 11:18 - 00000000 ____D () C:\Program Files (x86)\ATI Technologies
2014-06-30 11:16 - 2014-06-30 11:16 - 00000000 ____D () C:\Users\Default\AppData\Roaming\ATI
2014-06-30 11:16 - 2014-06-30 11:16 - 00000000 ____D () C:\Users\Default\AppData\Local\ATI
2014-06-30 11:16 - 2014-06-30 11:16 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\ATI
2014-06-30 11:16 - 2014-06-30 11:16 - 00000000 ____D () C:\Users\Default User\AppData\Local\ATI
2014-06-30 11:15 - 2014-07-01 15:18 - 00000000 ____D () C:\ProgramData\Package Cache
2014-06-30 11:14 - 2014-06-30 11:14 - 00000000 ____D () C:\Program Files\AMD
2014-06-30 11:05 - 2014-05-18 23:31 - 00057856 _____ (Microsoft Corporation) C:\WINDOWS\system32\drvcfg.exe
2014-06-30 11:05 - 2014-05-18 23:21 - 00110592 _____ (Microsoft Corporation) C:\WINDOWS\system32\drvinst.exe
2014-06-30 11:05 - 2014-05-18 22:23 - 00098816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\drvinst.exe
2014-06-30 11:02 - 2014-07-01 16:30 - 00000000 __RDO () C:\Users\EMoore\OneDrive
2014-06-30 11:01 - 2014-07-01 11:31 - 00003918 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{49A5250D-4CE8-4240-AD5F-D59DCD60ADB9}
2014-06-30 11:01 - 2014-06-30 11:01 - 00000000 __SHD () C:\Users\EMoore\AppData\Local\EmieUserList
2014-06-30 11:01 - 2014-06-30 11:01 - 00000000 __SHD () C:\Users\EMoore\AppData\Local\EmieSiteList
2014-06-30 10:59 - 2014-06-30 10:59 - 00001457 _____ () C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-06-30 10:59 - 2014-06-30 10:59 - 00000020 ___SH () C:\Users\EMoore\ntuser.ini
2014-06-30 01:45 - 2014-06-30 11:50 - 00000000 ___DC () C:\WINDOWS\Panther
2014-06-30 01:44 - 2014-06-30 01:44 - 23414784 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 17271296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 13522944 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 11725312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 05782528 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 04244992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 02768384 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 02266112 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 02179072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 02040832 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-06-30 01:44 - 2014-06-30 01:44 - 01964544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-06-30 01:44 - 2014-06-30 01:44 - 01790976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 01398272 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 01143296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00846336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00752640 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00704512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00631808 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00608768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-06-30 01:44 - 2014-06-30 01:44 - 00592896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00526336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00452096 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00368128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00308224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wusa.exe
2014-06-30 01:44 - 2014-06-30 01:44 - 00305152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wusa.exe
2014-06-30 01:44 - 2014-06-30 01:44 - 00295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00242688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\system32\msrating.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00164864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrating.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00139264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieUnatt.exe
2014-06-30 01:44 - 2014-06-30 01:44 - 00112128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieUnatt.exe
2014-06-30 01:44 - 2014-06-30 01:44 - 00111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwcollector.exe
2014-06-30 01:44 - 2014-06-30 01:44 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00051200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieetwproxystub.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00051200 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwproxystub.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00033792 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00004096 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwcollectorres.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00000000 ____D () C:\Windows.old
2014-06-30 01:43 - 2014-06-30 01:43 - 03118080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wpc.dll
2014-06-30 01:43 - 2014-06-30 01:43 - 03048904 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcMon.exe
2014-06-30 01:43 - 2014-06-30 01:43 - 02861056 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebSync.dll
2014-06-30 01:43 - 2014-06-30 01:43 - 02834944 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpccpl.dll
2014-06-30 01:43 - 2014-06-30 01:43 - 02518872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2014-06-30 01:43 - 2014-06-30 01:43 - 02344448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Wpc.dll
2014-06-30 01:43 - 2014-06-30 01:43 - 00428888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS
2014-06-30 01:43 - 2014-06-30 01:43 - 00295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ks.sys
2014-06-30 01:43 - 2014-06-30 01:43 - 00055328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wpcfltr.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 02900992 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 02641920 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 02479616 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmSvc.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 02373784 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2014-06-30 01:42 - 2014-06-30 01:42 - 02331000 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 02317824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 02270208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 02141912 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 02133504 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 02088160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2014-06-30 01:42 - 2014-06-30 01:42 - 02030080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmSvc.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 02013016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 01843712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Display.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01816576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Display.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01779800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01764864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01679128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01656832 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01557848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 01542768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01351168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01336648 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01306624 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01291200 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01112536 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01095488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01064448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01063424 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2014-06-30 01:42 - 2014-06-30 01:42 - 01036288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01015808 _____ (Microsoft Corporation) C:\WINDOWS\system32\aclui.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00950784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00939520 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00924160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00887296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aclui.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00836096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00834560 _____ (Microsoft Corporation) C:\WINDOWS\system32\netlogon.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00827392 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL
2014-06-30 01:42 - 2014-06-30 01:42 - 00800256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00755712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00717312 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netlogon.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00669696 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasapi32.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00655360 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00621568 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAgent.exe
2014-06-30 01:42 - 2014-06-30 01:42 - 00605184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasapi32.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00567296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00542208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Graphics.Printing.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00518552 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00512000 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidprov.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00494592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00488280 _____ (Microsoft Corporation) C:\WINDOWS\system32\netcfgx.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00467800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2014-06-30 01:42 - 2014-06-30 01:42 - 00462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlangpui.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00412672 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL
2014-06-30 01:42 - 2014-06-30 01:42 - 00406912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Graphics.Printing.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00390488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netcfgx.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00387210 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2014-06-30 01:42 - 2014-06-30 01:42 - 00386560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlangpui.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00379224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 00376152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 00360512 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfreadwrite.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00356864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlidprov.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00356848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcomp.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00355832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfreadwrite.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00325632 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationApi.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\SessEnv.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00299008 _____ (Microsoft Corporation) C:\WINDOWS\system32\pdh.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00298496 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSDMon.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00291840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Sensors.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00283648 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 00280576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SessEnv.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmWmiPl.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\spp.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00264192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL
2014-06-30 01:42 - 2014-06-30 01:42 - 00262656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LocationApi.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00254976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pdh.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00254464 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsrslvr.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00252928 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00247296 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsApi.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00226304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Sensors.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00222720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\spp.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00222720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dcomp.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00220160 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00212992 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdd.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00201216 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReInfo.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00197632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Scanners.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00186368 _____ (Microsoft Corporation) C:\WINDOWS\system32\dafWfdProvider.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00172544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReInfo.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00171008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SensorsApi.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00160768 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00157016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wof.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 00151040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Scanners.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 00139776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00136024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wfplwfs.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 00134144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dfsc.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 00115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\umpnpmgr.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevPropMgr.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00113648 _____ (Microsoft Corporation) C:\WINDOWS\system32\userenv.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidclass.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\davclnt.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00094016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\userenv.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\RMapi.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\davclnt.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\sxproxy.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00079360 _____ (Microsoft Corporation) C:\WINDOWS\system32\w32tm.exe
2014-06-30 01:42 - 2014-06-30 01:42 - 00079360 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\IPMIDrv.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\w32tm.exe
2014-06-30 01:42 - 2014-06-30 01:42 - 00069120 _____ (Microsoft Corporation) C:\WINDOWS\system32\l2gpstore.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\l2gpstore.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpipreg.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\SetNetworkLocation.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00033792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sxproxy.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidusb.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredentialMigrationHandler.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredentialMigrationHandler.dll
2014-06-30 01:41 - 2014-06-30 01:41 - 00086688 _____ (Microsoft Corporation) C:\WINDOWS\system32\mrt_map.dll
2014-06-30 01:41 - 2014-06-30 01:41 - 00080032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mrt_map.dll
2014-06-30 01:41 - 2014-06-30 01:41 - 00028320 _____ (Microsoft Corporation) C:\WINDOWS\system32\mrt100.dll
2014-06-30 01:41 - 2014-06-30 01:41 - 00026784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mrt100.dll
2014-06-30 01:40 - 2014-06-30 01:40 - 03360256 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2014-06-30 01:40 - 2014-06-30 01:40 - 02151424 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2014-06-30 01:40 - 2014-06-30 01:40 - 01975296 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2014-06-30 01:40 - 2014-06-30 01:40 - 01509888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2014-06-30 01:40 - 2014-06-30 01:40 - 01345536 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2014-06-30 01:40 - 2014-06-30 01:40 - 01312256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2014-06-30 01:40 - 2014-06-30 01:40 - 00921088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2014-06-30 01:40 - 2014-06-30 01:40 - 00754688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2014-06-30 01:40 - 2014-06-30 01:40 - 00249344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-06-30 01:40 - 2014-06-30 01:40 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-06-30 01:40 - 2014-06-30 01:40 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe
2014-06-30 01:39 - 2014-06-30 01:39 - 03464192 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2014-06-30 01:39 - 2014-06-30 01:39 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2014-06-30 01:39 - 2014-06-30 01:39 - 01705472 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 01054208 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00828928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00827392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00666624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00555736 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00419928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00381440 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00257880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys
2014-06-30 01:39 - 2014-06-30 01:39 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00190976 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00123904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00123224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys
2014-06-30 01:39 - 2014-06-30 01:39 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00054776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2014-06-30 01:39 - 2014-06-30 01:39 - 00035856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys
2014-06-30 01:39 - 2014-06-30 01:39 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2014-06-30 01:39 - 2014-06-30 01:39 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2014-06-30 01:39 - 2014-06-30 01:39 - 00025088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 21268952 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 18755672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 16872448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 13287936 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 12711424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 11792384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 08652800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 07425368 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2014-06-30 01:38 - 2014-06-30 01:38 - 07173120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 06645248 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 05833216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 05774848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 05104640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 04269056 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncEngine.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 04190720 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 02688000 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 02144984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 02140888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 02124840 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d9.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 02100736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlowUI.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01797896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d9.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01584128 _____ (Microsoft Corporation) C:\WINDOWS\system32\workfolderssvc.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01527296 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01466856 _____ (Microsoft Corporation) C:\WINDOWS\system32\propsys.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01436160 _____ (Microsoft Corporation) C:\WINDOWS\system32\VSSVC.exe
2014-06-30 01:38 - 2014-06-30 01:38 - 01411584 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01403856 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01379064 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpmde.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01308160 _____ (Microsoft Corporation) C:\WINDOWS\system32\gpsvc.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01287168 _____ (Microsoft Corporation) C:\WINDOWS\system32\mispace.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01230336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01222656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Streaming.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01209616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01200288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\propsys.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01126912 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchFolder.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01057280 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvidcrl.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01029120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mispace.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01025024 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00982016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Streaming.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00955904 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00918528 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00888320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00881616 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00872448 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDrive.exe
2014-06-30 01:38 - 2014-06-30 01:38 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdvidcrl.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00836608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchFolder.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00834048 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00805376 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00765408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00761856 _____ (Microsoft Corporation) C:\WINDOWS\system32\WorkfoldersControl.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00731648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\adtschema.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00731648 _____ (Microsoft Corporation) C:\WINDOWS\system32\adtschema.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00721408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveTelemetry.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00718336 _____ (Microsoft Corporation) C:\WINDOWS\system32\swprv.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00707048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00677376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00669856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00629760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00609448 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00589656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fvevol.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00565536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00563200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00518544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00491744 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00491520 _____ (Microsoft Corporation) C:\WINDOWS\system32\GeofenceMonitorService.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00486912 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
2014-06-30 01:38 - 2014-06-30 01:38 - 00467968 _____ (Microsoft Corporation) C:\WINDOWS\system32\srcore.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00467496 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00463256 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsGdiConverter.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00449536 _____ (Microsoft Corporation) C:\WINDOWS\system32\defragsvc.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00443904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00443904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nwifi.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00426496 _____ (Microsoft Corporation) C:\WINDOWS\system32\clusapi.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00407016 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe
2014-06-30 01:38 - 2014-06-30 01:38 - 00406504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00387896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00384856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00372568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00370176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv
2014-06-30 01:38 - 2014-06-30 01:38 - 00370176 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanmsm.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00364640 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00360792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fltMgr.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GeofenceMonitorService.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00337408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsGdiConverter.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00337240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Classpnp.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00335872 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDEServer.exe
2014-06-30 01:38 - 2014-06-30 01:38 - 00326024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00324888 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFCaptureEngine.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\srvsvc.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00313344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clusapi.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00310616 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00307304 _____ (Microsoft Corporation) C:\WINDOWS\system32\wintrust.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00305768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00300544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanmsm.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00296960 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanapi.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00285144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFCaptureEngine.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00281600 _____ (Microsoft Corporation) C:\WINDOWS\system32\resutils.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00275800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msiscsi.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\rstrui.exe
2014-06-30 01:38 - 2014-06-30 01:38 - 00263424 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2014-06-30 01:38 - 2014-06-30 01:38 - 00250368 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srvnet.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00244880 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2014-06-30 01:38 - 2014-06-30 01:38 - 00233912 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00230808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wintrust.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanapi.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00219136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\resutils.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00209920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00201920 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00201216 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00191488 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpchttp.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00186880 _____ (Microsoft Corporation) C:\WINDOWS\system32\WorkFoldersShell.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00180056 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00178184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVideoDSP.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00144384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpchttp.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00143872 _____ (Microsoft Corporation) C:\WINDOWS\system32\BootMenuUX.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00135168 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscsvc.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00130144 _____ (Microsoft Corporation) C:\WINDOWS\system32\gpapi.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00125496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmapi.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00111528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gpapi.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00098584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmapi.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00077312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hdaudbus.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\system32\srclient.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\tsgqec.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\srclient.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00055296 _____ (Microsoft Corporation) C:\WINDOWS\system32\energyprov.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tsgqec.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00047616 _____ (Microsoft Corporation) C:\WINDOWS\system32\tlscsp.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00046592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tlscsp.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00040960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Shell.Search.UriHandler.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Shell.Search.UriHandler.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00032600 _____ (Microsoft Corporation) C:\WINDOWS\system32\ploptin.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00028408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfpmp.exe
2014-06-30 01:38 - 2014-06-30 01:38 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d8thk.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00011264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanhlp.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00011264 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanhlp.dll
2014-06-30 01:36 - 2014-06-30 01:36 - 00262144 _____ () C:\WINDOWS\system32\config\userdiff
2014-06-30 01:35 - 2014-06-30 01:35 - 00000000 ____D () C:\Program Files\Reference Assemblies
2014-06-30 01:35 - 2014-06-30 01:35 - 00000000 ____D () C:\Program Files\MSBuild
2014-06-30 01:35 - 2014-06-30 01:35 - 00000000 ____D () C:\Program Files (x86)\Reference Assemblies
2014-06-30 01:35 - 2014-06-30 01:35 - 00000000 ____D () C:\Program Files (x86)\MSBuild
2014-06-30 01:35 - 2013-08-02 21:48 - 01166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2014-06-30 01:35 - 2013-08-02 21:48 - 00124112 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2014-06-30 01:35 - 2013-08-02 21:48 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2014-06-30 01:35 - 2013-08-02 21:41 - 00778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2014-06-30 01:35 - 2013-08-02 21:41 - 00102608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2014-06-30 01:35 - 2013-08-02 21:41 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2014-06-30 01:22 - 2014-07-01 16:31 - 02034049 _____ () C:\WINDOWS\WindowsUpdate.log
2014-06-30 01:21 - 2014-06-30 01:21 - 00022744 _____ () C:\WINDOWS\system32\emptyregdb.dat
2014-06-30 01:06 - 2014-06-30 01:06 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-06-30 01:03 - 2014-06-30 01:03 - 00000000 ____D () C:\WINDOWS\system32\config\bbimigrate
2014-06-30 00:53 - 2014-06-30 11:02 - 00000000 ____D () C:\Users\EMoore
2014-06-30 00:53 - 2014-06-30 01:21 - 00032388 _____ () C:\WINDOWS\diagwrn.xml
2014-06-30 00:53 - 2014-06-30 01:21 - 00032388 _____ () C:\WINDOWS\diagerr.xml
2014-06-30 00:53 - 2014-06-30 01:21 - 00000000 ____D () C:\Users\Administrator
2014-06-30 00:53 - 2014-06-30 01:03 - 00000000 ___RD () C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-06-30 00:53 - 2014-06-30 01:03 - 00000000 ___RD () C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-06-30 00:53 - 2014-06-30 00:54 - 00000000 ___RD () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-06-30 00:53 - 2014-06-30 00:54 - 00000000 ___RD () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-06-30 00:53 - 2014-03-18 03:13 - 00000369 _____ () C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2014-06-30 00:53 - 2014-03-18 03:13 - 00000369 _____ () C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2014-06-30 00:53 - 2014-03-18 03:13 - 00000369 _____ () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2014-06-30 00:53 - 2014-03-18 03:13 - 00000369 _____ () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2014-06-30 00:53 - 2013-08-22 08:36 - 00000000 ___RD () C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-06-30 00:53 - 2013-08-22 08:36 - 00000000 ___RD () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-06-30 00:53 - 2013-08-22 08:36 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-06-30 00:53 - 2013-08-22 08:36 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-06-30 00:48 - 2014-06-30 01:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Creative
2014-06-30 00:48 - 2014-06-30 00:48 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2014-06-30 00:48 - 2014-06-30 00:48 - 00000000 ____D () C:\WINDOWS\SysWOW64\RTCOM
2014-06-30 00:48 - 2014-06-30 00:48 - 00000000 ____D () C:\ProgramData\Brother
2014-06-30 00:48 - 2014-06-30 00:48 - 00000000 ____D () C:\Program Files\Realtek
2014-06-30 00:48 - 2014-06-30 00:48 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies
2014-06-30 00:48 - 2014-06-30 00:48 - 00000000 _____ () C:\WINDOWS\BRPARAM.INI
2014-06-30 00:48 - 2014-06-30 00:48 - 00000000 _____ () C:\WINDOWS\ativpsrm.bin
2014-06-29 22:07 - 2014-06-29 22:07 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-29 17:28 - 2014-07-01 16:31 - 00004966 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for Ellen-EMoore Ellen
2014-06-29 17:25 - 2014-01-19 00:38 - 00270496 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2014-06-29 17:09 - 2014-06-30 11:02 - 00000000 ___RD () C:\Users\EMoore\OneDrive.old
2014-06-29 17:09 - 2014-06-29 17:09 - 00002216 _____ () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2014-06-29 17:09 - 2014-06-29 17:09 - 00002216 _____ () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2014-06-29 17:09 - 2014-06-29 17:09 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive
2014-06-29 17:09 - 2014-06-29 17:09 - 00000000 ____D () C:\Program Files (x86)\Microsoft OneDrive
2014-06-29 16:23 - 2014-06-30 01:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2014-06-29 16:17 - 2014-06-29 16:18 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-06-11 06:41 - 2014-06-17 04:12 - 00002387 _____ () C:\Users\EMoore\Documents\Bills.wpd
2014-06-10 00:52 - 2014-06-10 00:52 - 29382144 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\amdocl64.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 26352128 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atio6axx.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 24860160 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\amdocl.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 22157824 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atioglxx.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 15716352 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticaldd64.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 14302208 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticaldd.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 13209088 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\atikmdag.sys
2014-06-10 00:52 - 2014-06-10 00:52 - 08287008 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiumdva.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 06630232 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiumdag.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 03461040 _____ () C:\WINDOWS\SysWOW64\atiumdva.cap
2014-06-10 00:52 - 2014-06-10 00:52 - 03426688 _____ () C:\WINDOWS\system32\atiumd6a.cap
2014-06-10 00:52 - 2014-06-10 00:52 - 01187342 _____ () C:\WINDOWS\system32\amdocl_as64.exe
2014-06-10 00:52 - 2014-06-10 00:52 - 01061902 _____ () C:\WINDOWS\system32\amdocl_ld64.exe
2014-06-10 00:52 - 2014-06-10 00:52 - 00995342 _____ () C:\WINDOWS\SysWOW64\amdocl_as32.exe
2014-06-10 00:52 - 2014-06-10 00:52 - 00825344 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atiadlxy.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00798734 _____ () C:\WINDOWS\SysWOW64\amdocl_ld32.exe
2014-06-10 00:52 - 2014-06-10 00:52 - 00721296 _____ () C:\WINDOWS\system32\atiicdxx.dat
2014-06-10 00:52 - 2014-06-10 00:52 - 00626688 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\atikmpag.sys
2014-06-10 00:52 - 2014-06-10 00:52 - 00550464 _____ () C:\WINDOWS\SysWOW64\atiapfxx.blb
2014-06-10 00:52 - 2014-06-10 00:52 - 00550464 _____ () C:\WINDOWS\system32\atiapfxx.blb
2014-06-10 00:52 - 2014-06-10 00:52 - 00412672 _____ () C:\WINDOWS\system32\amdmiracast.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00368640 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atiapfxx.exe
2014-06-10 00:52 - 2014-06-10 00:52 - 00234036 _____ () C:\WINDOWS\system32\ativvaxy_cik.dat
2014-06-10 00:52 - 2014-06-10 00:52 - 00233776 _____ () C:\WINDOWS\system32\ativvaxy_cik_nd.dat
2014-06-10 00:52 - 2014-06-10 00:52 - 00230912 _____ () C:\WINDOWS\system32\clinfo.exe
2014-06-10 00:52 - 2014-06-10 00:52 - 00190976 _____ (AMD) C:\WINDOWS\system32\atitmm64.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00134656 _____ () C:\WINDOWS\system32\amdhdl64.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00129536 _____ (AMD) C:\WINDOWS\system32\coinst_13.251.9001.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00123392 _____ () C:\WINDOWS\SysWOW64\amdhdl32.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00100352 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atig6txx.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00099840 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\OpenVideo64.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00098496 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiu9pag.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00096768 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atigktxx.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00086528 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\OVDecode64.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00083968 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\OpenVideo.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00083552 _____ () C:\WINDOWS\system32\ativce02.dat
2014-06-10 00:52 - 2014-06-10 00:52 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atimpc64.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdpcom64.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00074752 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atig6pxx.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00073728 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\OVDecode.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atimpc32.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdpcom32.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiglpxx.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiglpxx.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00063488 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00062464 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticalrt64.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00057344 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00055808 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticalcl64.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00052224 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticalrt.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00049152 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticalcl.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00047887 _____ () C:\WINDOWS\atiogl.xml
2014-06-10 00:52 - 2014-06-10 00:52 - 00043520 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\ati2erec.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00031232 _____ (AMD) C:\WINDOWS\system32\atimuixx.dll
2014-06-07 17:44 - 2014-06-30 01:06 - 00000000 ____D () C:\WINDOWS\system32\MpEngineStore


----------



## Rain1290 (Apr 26, 2011)

*FRST (final part):*

==================== One Month Modified Files and Folders =======
2014-07-01 16:38 - 2014-07-01 16:38 - 00013480 _____ () C:\Users\EMoore\Desktop\FRST.txt
2014-07-01 16:38 - 2014-07-01 13:17 - 00000000 ____D () C:\FRST
2014-07-01 16:36 - 2014-07-01 16:36 - 02083840 _____ (Farbar) C:\Users\EMoore\Desktop\FRST64.exe
2014-07-01 16:35 - 2014-02-25 14:41 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3554997651-2643067823-2061939718-1002
2014-07-01 16:33 - 2014-03-18 03:03 - 00863592 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-07-01 16:31 - 2014-06-30 01:22 - 02034049 _____ () C:\WINDOWS\WindowsUpdate.log
2014-07-01 16:31 - 2014-06-29 17:28 - 00004966 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for Ellen-EMoore Ellen
2014-07-01 16:30 - 2014-06-30 11:02 - 00000000 __RDO () C:\Users\EMoore\OneDrive
2014-07-01 16:28 - 2014-07-01 13:04 - 00000000 ____D () C:\AdwCleaner
2014-07-01 16:28 - 2014-03-18 02:54 - 00001414 _____ () C:\WINDOWS\PFRO.log
2014-07-01 16:28 - 2013-08-22 07:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-07-01 16:28 - 2013-08-22 06:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-07-01 16:25 - 2014-07-01 16:26 - 01346519 _____ () C:\Users\EMoore\Desktop\AdwCleaner.exe
2014-07-01 16:20 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-07-01 15:19 - 2014-07-01 15:19 - 00000000 ____D () C:\Users\EMoore\AppData\Local\IsolatedStorage
2014-07-01 15:18 - 2014-07-01 15:18 - 00002499 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Speed Cleaner.lnk
2014-07-01 15:18 - 2014-07-01 15:18 - 00000000 ____D () C:\Program Files (x86)\Speed Cleaner
2014-07-01 15:18 - 2014-06-30 11:15 - 00000000 ____D () C:\ProgramData\Package Cache
2014-07-01 15:17 - 2014-07-01 15:17 - 00001991 _____ () C:\Users\Public\Desktop\InstallConverter.lnk
2014-07-01 15:17 - 2014-07-01 15:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InstallConverter
2014-07-01 15:17 - 2014-07-01 15:17 - 00000000 ____D () C:\Program Files (x86)\InstallConverter
2014-07-01 15:10 - 2014-02-28 16:39 - 00001682 ___SH () C:\ProgramData\KGyGaAvL.sys
2014-07-01 15:10 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\system32\FxsTmp
2014-07-01 11:31 - 2014-06-30 11:01 - 00003918 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{49A5250D-4CE8-4240-AD5F-D59DCD60ADB9}
2014-07-01 11:30 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-07-01 08:14 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2014-07-01 06:43 - 2013-08-22 07:44 - 00492608 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-06-30 12:02 - 2014-02-28 16:22 - 00000000 ____D () C:\Program Files (x86)\Corel
2014-06-30 12:01 - 2014-02-28 16:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WordPerfect Office X5
2014-06-30 11:59 - 2012-09-22 12:02 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-06-30 11:50 - 2014-06-30 01:45 - 00000000 ___DC () C:\WINDOWS\Panther
2014-06-30 11:36 - 2014-06-30 11:36 - 00000000 ____D () C:\ProgramData\ATI
2014-06-30 11:33 - 2012-07-26 00:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-06-30 11:18 - 2014-06-30 11:18 - 00060601 _____ () C:\WINDOWS\SysWOW64\CCCInstall_201406301118550025.log
2014-06-30 11:18 - 2014-06-30 11:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-06-30 11:18 - 2014-06-30 11:18 - 00000000 ____D () C:\Program Files\ATI Technologies
2014-06-30 11:18 - 2014-06-30 11:18 - 00000000 ____D () C:\Program Files (x86)\Advanced Micro Devices, Inc
2014-06-30 11:18 - 2014-06-30 11:17 - 00000000 ____D () C:\Program Files (x86)\ATI Technologies
2014-06-30 11:16 - 2014-06-30 11:16 - 00000000 ____D () C:\Users\Default\AppData\Roaming\ATI
2014-06-30 11:16 - 2014-06-30 11:16 - 00000000 ____D () C:\Users\Default\AppData\Local\ATI
2014-06-30 11:16 - 2014-06-30 11:16 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\ATI
2014-06-30 11:16 - 2014-06-30 11:16 - 00000000 ____D () C:\Users\Default User\AppData\Local\ATI
2014-06-30 11:15 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\system32\restore
2014-06-30 11:14 - 2014-06-30 11:14 - 00000000 ____D () C:\Program Files\AMD
2014-06-30 11:05 - 2014-02-28 10:58 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Nitro PDF
2014-06-30 11:04 - 2014-02-25 14:33 - 00000000 ____D () C:\Users\EMoore\AppData\Local\Packages
2014-06-30 11:02 - 2014-06-30 00:53 - 00000000 ____D () C:\Users\EMoore
2014-06-30 11:02 - 2014-06-29 17:09 - 00000000 ___RD () C:\Users\EMoore\OneDrive.old
2014-06-30 11:02 - 2014-03-18 04:47 - 00000000 ___HD () C:\$Windows.~BT
2014-06-30 11:02 - 2013-08-22 07:46 - 00333428 _____ () C:\WINDOWS\setupact.log
2014-06-30 11:01 - 2014-06-30 11:01 - 00000000 __SHD () C:\Users\EMoore\AppData\Local\EmieUserList
2014-06-30 11:01 - 2014-06-30 11:01 - 00000000 __SHD () C:\Users\EMoore\AppData\Local\EmieSiteList
2014-06-30 10:59 - 2014-06-30 10:59 - 00001457 _____ () C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-06-30 10:59 - 2014-06-30 10:59 - 00000020 ___SH () C:\Users\EMoore\ntuser.ini
2014-06-30 01:45 - 2013-11-28 13:54 - 00000000 __SHD () C:\Recovery
2014-06-30 01:44 - 2014-06-30 01:44 - 23414784 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 17271296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 13522944 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 11725312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 05782528 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 04244992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 02768384 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 02266112 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 02179072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 02040832 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-06-30 01:44 - 2014-06-30 01:44 - 01964544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-06-30 01:44 - 2014-06-30 01:44 - 01790976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 01398272 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 01143296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00846336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00752640 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00704512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00631808 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00608768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-06-30 01:44 - 2014-06-30 01:44 - 00592896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00526336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00452096 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00368128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00308224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wusa.exe
2014-06-30 01:44 - 2014-06-30 01:44 - 00305152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wusa.exe
2014-06-30 01:44 - 2014-06-30 01:44 - 00295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00242688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\system32\msrating.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00164864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrating.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00139264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieUnatt.exe
2014-06-30 01:44 - 2014-06-30 01:44 - 00112128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieUnatt.exe
2014-06-30 01:44 - 2014-06-30 01:44 - 00111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwcollector.exe
2014-06-30 01:44 - 2014-06-30 01:44 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00051200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieetwproxystub.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00051200 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwproxystub.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00033792 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00004096 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwcollectorres.dll
2014-06-30 01:44 - 2014-06-30 01:44 - 00000000 ____D () C:\Windows.old
2014-06-30 01:44 - 2013-08-22 08:36 - 00262144 _____ () C:\WINDOWS\system32\config\BCD-Template
2014-06-30 01:43 - 2014-06-30 01:43 - 03118080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wpc.dll
2014-06-30 01:43 - 2014-06-30 01:43 - 03048904 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcMon.exe
2014-06-30 01:43 - 2014-06-30 01:43 - 02861056 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebSync.dll
2014-06-30 01:43 - 2014-06-30 01:43 - 02834944 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpccpl.dll
2014-06-30 01:43 - 2014-06-30 01:43 - 02518872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2014-06-30 01:43 - 2014-06-30 01:43 - 02344448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Wpc.dll
2014-06-30 01:43 - 2014-06-30 01:43 - 00428888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS
2014-06-30 01:43 - 2014-06-30 01:43 - 00295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ks.sys
2014-06-30 01:43 - 2014-06-30 01:43 - 00055328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wpcfltr.sys
2014-06-30 01:43 - 2013-08-22 08:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-06-30 01:42 - 2014-06-30 01:42 - 02900992 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 02641920 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 02479616 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmSvc.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 02373784 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2014-06-30 01:42 - 2014-06-30 01:42 - 02331000 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 02317824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 02270208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 02141912 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 02133504 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 02088160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2014-06-30 01:42 - 2014-06-30 01:42 - 02030080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmSvc.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 02013016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 01843712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Display.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01816576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Display.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01779800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01764864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01679128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01656832 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01557848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 01542768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01351168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01336648 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01306624 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01291200 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01112536 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01095488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01064448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01063424 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2014-06-30 01:42 - 2014-06-30 01:42 - 01036288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 01015808 _____ (Microsoft Corporation) C:\WINDOWS\system32\aclui.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00950784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00939520 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00924160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00887296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aclui.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00836096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00834560 _____ (Microsoft Corporation) C:\WINDOWS\system32\netlogon.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00827392 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL
2014-06-30 01:42 - 2014-06-30 01:42 - 00800256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00755712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00717312 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netlogon.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00669696 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasapi32.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00655360 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00621568 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAgent.exe
2014-06-30 01:42 - 2014-06-30 01:42 - 00605184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasapi32.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00567296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00542208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Graphics.Printing.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00518552 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00512000 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidprov.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00494592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00488280 _____ (Microsoft Corporation) C:\WINDOWS\system32\netcfgx.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00467800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2014-06-30 01:42 - 2014-06-30 01:42 - 00462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlangpui.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00412672 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL
2014-06-30 01:42 - 2014-06-30 01:42 - 00406912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Graphics.Printing.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00390488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netcfgx.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00387210 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2014-06-30 01:42 - 2014-06-30 01:42 - 00386560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlangpui.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00379224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 00376152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 00360512 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfreadwrite.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00356864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlidprov.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00356848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcomp.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00355832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfreadwrite.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00325632 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationApi.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\SessEnv.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00299008 _____ (Microsoft Corporation) C:\WINDOWS\system32\pdh.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00298496 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSDMon.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00291840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Sensors.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00283648 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 00280576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SessEnv.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmWmiPl.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\spp.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00264192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL
2014-06-30 01:42 - 2014-06-30 01:42 - 00262656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LocationApi.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00254976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pdh.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00254464 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsrslvr.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00252928 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00247296 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsApi.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00226304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Sensors.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00222720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\spp.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00222720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dcomp.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00220160 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00212992 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdd.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00201216 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReInfo.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00197632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Scanners.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00186368 _____ (Microsoft Corporation) C:\WINDOWS\system32\dafWfdProvider.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00172544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReInfo.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00171008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SensorsApi.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00160768 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00157016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wof.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 00151040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Scanners.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 00139776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00136024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wfplwfs.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 00134144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dfsc.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 00115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\umpnpmgr.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevPropMgr.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00113648 _____ (Microsoft Corporation) C:\WINDOWS\system32\userenv.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidclass.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\davclnt.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00094016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\userenv.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\RMapi.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\davclnt.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\sxproxy.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00079360 _____ (Microsoft Corporation) C:\WINDOWS\system32\w32tm.exe
2014-06-30 01:42 - 2014-06-30 01:42 - 00079360 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\IPMIDrv.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\w32tm.exe
2014-06-30 01:42 - 2014-06-30 01:42 - 00069120 _____ (Microsoft Corporation) C:\WINDOWS\system32\l2gpstore.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\l2gpstore.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpipreg.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\SetNetworkLocation.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00033792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sxproxy.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidusb.sys
2014-06-30 01:42 - 2014-06-30 01:42 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredentialMigrationHandler.dll
2014-06-30 01:42 - 2014-06-30 01:42 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredentialMigrationHandler.dll
2014-06-30 01:42 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\system32\setup
2014-06-30 01:41 - 2014-06-30 01:41 - 00086688 _____ (Microsoft Corporation) C:\WINDOWS\system32\mrt_map.dll
2014-06-30 01:41 - 2014-06-30 01:41 - 00080032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mrt_map.dll
2014-06-30 01:41 - 2014-06-30 01:41 - 00028320 _____ (Microsoft Corporation) C:\WINDOWS\system32\mrt100.dll
2014-06-30 01:41 - 2014-06-30 01:41 - 00026784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mrt100.dll
2014-06-30 01:40 - 2014-06-30 01:40 - 03360256 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2014-06-30 01:40 - 2014-06-30 01:40 - 02151424 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2014-06-30 01:40 - 2014-06-30 01:40 - 01975296 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2014-06-30 01:40 - 2014-06-30 01:40 - 01509888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2014-06-30 01:40 - 2014-06-30 01:40 - 01345536 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2014-06-30 01:40 - 2014-06-30 01:40 - 01312256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2014-06-30 01:40 - 2014-06-30 01:40 - 00921088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2014-06-30 01:40 - 2014-06-30 01:40 - 00754688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2014-06-30 01:40 - 2014-06-30 01:40 - 00249344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-06-30 01:40 - 2014-06-30 01:40 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-06-30 01:40 - 2014-06-30 01:40 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe
2014-06-30 01:40 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\WinStore
2014-06-30 01:40 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\system32\SecureBootUpdates
2014-06-30 01:39 - 2014-06-30 01:39 - 03464192 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2014-06-30 01:39 - 2014-06-30 01:39 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2014-06-30 01:39 - 2014-06-30 01:39 - 01705472 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 01054208 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00828928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00827392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00666624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00555736 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00419928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00381440 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00257880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys
2014-06-30 01:39 - 2014-06-30 01:39 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00190976 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00123904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00123224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys
2014-06-30 01:39 - 2014-06-30 01:39 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2014-06-30 01:39 - 2014-06-30 01:39 - 00054776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2014-06-30 01:39 - 2014-06-30 01:39 - 00035856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys
2014-06-30 01:39 - 2014-06-30 01:39 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2014-06-30 01:39 - 2014-06-30 01:39 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2014-06-30 01:39 - 2014-06-30 01:39 - 00025088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll
2014-06-30 01:39 - 2013-08-22 08:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-06-30 01:39 - 2013-08-22 08:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-06-30 01:39 - 2013-08-22 08:36 - 00000000 ____D () C:\Program Files\Windows Defender
2014-06-30 01:39 - 2013-08-22 08:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-06-30 01:38 - 2014-06-30 01:38 - 21268952 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 18755672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 16872448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 13287936 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 12711424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 11792384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 08652800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 07425368 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2014-06-30 01:38 - 2014-06-30 01:38 - 07173120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 06645248 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 05833216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 05774848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 05104640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 04269056 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncEngine.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 04190720 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 02688000 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 02144984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 02140888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 02124840 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d9.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 02100736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlowUI.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01797896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d9.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01584128 _____ (Microsoft Corporation) C:\WINDOWS\system32\workfolderssvc.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01527296 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01466856 _____ (Microsoft Corporation) C:\WINDOWS\system32\propsys.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01436160 _____ (Microsoft Corporation) C:\WINDOWS\system32\VSSVC.exe
2014-06-30 01:38 - 2014-06-30 01:38 - 01411584 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01403856 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01379064 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpmde.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01308160 _____ (Microsoft Corporation) C:\WINDOWS\system32\gpsvc.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01287168 _____ (Microsoft Corporation) C:\WINDOWS\system32\mispace.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01230336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01222656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Streaming.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01209616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01200288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\propsys.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01126912 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchFolder.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01057280 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvidcrl.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01029120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mispace.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 01025024 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00982016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Streaming.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00955904 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00918528 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00888320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00881616 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00872448 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDrive.exe
2014-06-30 01:38 - 2014-06-30 01:38 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdvidcrl.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00836608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchFolder.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00834048 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00805376 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00765408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00761856 _____ (Microsoft Corporation) C:\WINDOWS\system32\WorkfoldersControl.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00731648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\adtschema.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00731648 _____ (Microsoft Corporation) C:\WINDOWS\system32\adtschema.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00721408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveTelemetry.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00718336 _____ (Microsoft Corporation) C:\WINDOWS\system32\swprv.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00707048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00677376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00669856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00629760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00609448 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00589656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fvevol.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00565536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00563200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00518544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00491744 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00491520 _____ (Microsoft Corporation) C:\WINDOWS\system32\GeofenceMonitorService.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00486912 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
2014-06-30 01:38 - 2014-06-30 01:38 - 00467968 _____ (Microsoft Corporation) C:\WINDOWS\system32\srcore.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00467496 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00463256 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsGdiConverter.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00449536 _____ (Microsoft Corporation) C:\WINDOWS\system32\defragsvc.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00443904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00443904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nwifi.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00426496 _____ (Microsoft Corporation) C:\WINDOWS\system32\clusapi.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00407016 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe
2014-06-30 01:38 - 2014-06-30 01:38 - 00406504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00387896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00384856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00372568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00370176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv
2014-06-30 01:38 - 2014-06-30 01:38 - 00370176 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanmsm.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00364640 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00360792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fltMgr.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GeofenceMonitorService.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00337408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsGdiConverter.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00337240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Classpnp.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00335872 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDEServer.exe
2014-06-30 01:38 - 2014-06-30 01:38 - 00326024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00324888 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFCaptureEngine.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\srvsvc.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00313344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clusapi.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00310616 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00307304 _____ (Microsoft Corporation) C:\WINDOWS\system32\wintrust.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00305768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00300544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanmsm.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00296960 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanapi.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00285144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFCaptureEngine.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00281600 _____ (Microsoft Corporation) C:\WINDOWS\system32\resutils.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00275800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msiscsi.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\rstrui.exe
2014-06-30 01:38 - 2014-06-30 01:38 - 00263424 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2014-06-30 01:38 - 2014-06-30 01:38 - 00250368 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srvnet.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00244880 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2014-06-30 01:38 - 2014-06-30 01:38 - 00233912 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00230808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wintrust.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanapi.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00219136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\resutils.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00209920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00201920 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00201216 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00191488 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpchttp.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00186880 _____ (Microsoft Corporation) C:\WINDOWS\system32\WorkFoldersShell.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00180056 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00178184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVideoDSP.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00144384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpchttp.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00143872 _____ (Microsoft Corporation) C:\WINDOWS\system32\BootMenuUX.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00135168 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscsvc.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00130144 _____ (Microsoft Corporation) C:\WINDOWS\system32\gpapi.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00125496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmapi.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00111528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gpapi.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00098584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmapi.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00077312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hdaudbus.sys
2014-06-30 01:38 - 2014-06-30 01:38 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\system32\srclient.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\tsgqec.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\srclient.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00055296 _____ (Microsoft Corporation) C:\WINDOWS\system32\energyprov.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tsgqec.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00047616 _____ (Microsoft Corporation) C:\WINDOWS\system32\tlscsp.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00046592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tlscsp.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00040960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Shell.Search.UriHandler.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Shell.Search.UriHandler.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00032600 _____ (Microsoft Corporation) C:\WINDOWS\system32\ploptin.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00028408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfpmp.exe
2014-06-30 01:38 - 2014-06-30 01:38 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d8thk.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00011264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanhlp.dll
2014-06-30 01:38 - 2014-06-30 01:38 - 00011264 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanhlp.dll
2014-06-30 01:38 - 2013-08-22 08:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel
2014-06-30 01:36 - 2014-06-30 01:36 - 00262144 _____ () C:\WINDOWS\system32\config\userdiff
2014-06-30 01:35 - 2014-06-30 01:35 - 00000000 ____D () C:\Program Files\Reference Assemblies
2014-06-30 01:35 - 2014-06-30 01:35 - 00000000 ____D () C:\Program Files\MSBuild
2014-06-30 01:35 - 2014-06-30 01:35 - 00000000 ____D () C:\Program Files (x86)\Reference Assemblies
2014-06-30 01:35 - 2014-06-30 01:35 - 00000000 ____D () C:\Program Files (x86)\MSBuild
2014-06-30 01:23 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-06-30 01:21 - 2014-06-30 01:21 - 00022744 _____ () C:\WINDOWS\system32\emptyregdb.dat
2014-06-30 01:21 - 2014-06-30 00:53 - 00032388 _____ () C:\WINDOWS\diagwrn.xml
2014-06-30 01:21 - 2014-06-30 00:53 - 00032388 _____ () C:\WINDOWS\diagerr.xml
2014-06-30 01:21 - 2014-06-30 00:53 - 00000000 ____D () C:\Users\Administrator
2014-06-30 01:21 - 2014-02-26 18:27 - 00013182 _____ () C:\WINDOWS\comsetup.log
2014-06-30 01:21 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\Registration
2014-06-30 01:21 - 2013-08-22 06:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2014-06-30 01:19 - 2013-08-22 08:36 - 00000000 __RSD () C:\WINDOWS\Media
2014-06-30 01:19 - 2013-08-22 08:36 - 00000000 __RHD () C:\Users\Public\Libraries
2014-06-30 01:07 - 2014-06-30 00:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Creative
2014-06-30 01:07 - 2014-06-29 16:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2014-06-30 01:07 - 2014-02-25 15:06 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FirstClass
2014-06-30 01:07 - 2013-08-22 06:36 - 00000000 ____D () C:\WINDOWS\system32\Sysprep
2014-06-30 01:07 - 2012-09-22 12:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel AppUp(SM) center
2014-06-30 01:07 - 2012-09-22 12:13 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo Rescue System
2014-06-30 01:07 - 2012-09-22 12:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo
2014-06-30 01:07 - 2012-09-22 12:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-06-30 01:06 - 2014-06-30 01:06 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-06-30 01:06 - 2014-06-07 17:44 - 00000000 ____D () C:\WINDOWS\system32\MpEngineStore
2014-06-30 01:06 - 2014-03-18 02:32 - 00000000 ____D () C:\WINDOWS\SysWOW64\WCN
2014-06-30 01:06 - 2014-03-18 02:32 - 00000000 ____D () C:\WINDOWS\SysWOW64\sysprep
2014-06-30 01:06 - 2014-03-18 02:32 - 00000000 ____D () C:\WINDOWS\system32\WCN
2014-06-30 01:06 - 2013-08-22 08:37 - 00004893 _____ () C:\WINDOWS\DtcInstall.log
2014-06-30 01:06 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\MUI
2014-06-30 01:06 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\migwiz
2014-06-30 01:06 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\IME
2014-06-30 01:06 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\system32\WinBioPlugIns
2014-06-30 01:06 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\system32\spool
2014-06-30 01:06 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\system32\MUI
2014-06-30 01:06 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\system32\IME
2014-06-30 01:06 - 2013-08-22 06:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\SMI
2014-06-30 01:06 - 2013-08-22 06:36 - 00000000 ____D () C:\WINDOWS\system32\oobe
2014-06-30 01:06 - 2012-09-22 12:03 - 00000000 ____D () C:\WINDOWS\SysWOW64\sda
2014-06-30 01:06 - 2012-07-25 22:37 - 00000000 ____D () C:\Users\Default.migrated
2014-06-30 01:05 - 2014-03-18 02:45 - 00000000 ____D () C:\WINDOWS\ShellNew
2014-06-30 01:05 - 2014-02-28 12:29 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.0.1
2014-06-30 01:05 - 2013-08-22 08:43 - 00000000 ____D () C:\WINDOWS\DigitalLocker
2014-06-30 01:05 - 2013-08-22 08:36 - 00000000 __SHD () C:\Program Files\Windows Sidebar
2014-06-30 01:05 - 2013-08-22 08:36 - 00000000 __SHD () C:\Program Files (x86)\Windows Sidebar
2014-06-30 01:05 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions
2014-06-30 01:05 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\IME
2014-06-30 01:05 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\Help
2014-06-30 01:05 - 2013-08-22 08:36 - 00000000 ____D () C:\Program Files\Common Files\System
2014-06-30 01:05 - 2013-08-22 08:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-06-30 01:05 - 2012-08-01 08:53 - 00000000 ____D () C:\ProgramData\PRICache
2014-06-30 01:03 - 2014-06-30 01:03 - 00000000 ____D () C:\WINDOWS\system32\config\bbimigrate
2014-06-30 01:03 - 2014-06-30 00:53 - 00000000 ___RD () C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-06-30 01:03 - 2014-06-30 00:53 - 00000000 ___RD () C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-06-30 01:03 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\system32\Recovery
2014-06-30 00:54 - 2014-06-30 00:53 - 00000000 ___RD () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-06-30 00:54 - 2014-06-30 00:53 - 00000000 ___RD () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-06-30 00:54 - 2012-08-01 08:52 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Packages
2014-06-30 00:48 - 2014-06-30 00:48 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2014-06-30 00:48 - 2014-06-30 00:48 - 00000000 ____D () C:\WINDOWS\SysWOW64\RTCOM
2014-06-30 00:48 - 2014-06-30 00:48 - 00000000 ____D () C:\ProgramData\Brother
2014-06-30 00:48 - 2014-06-30 00:48 - 00000000 ____D () C:\Program Files\Realtek
2014-06-30 00:48 - 2014-06-30 00:48 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies
2014-06-30 00:48 - 2014-06-30 00:48 - 00000000 _____ () C:\WINDOWS\BRPARAM.INI
2014-06-30 00:48 - 2014-06-30 00:48 - 00000000 _____ () C:\WINDOWS\ativpsrm.bin
2014-06-30 00:47 - 2013-08-22 06:36 - 00000000 __RHD () C:\Users\Default
2014-06-30 00:30 - 2012-09-22 12:16 - 01928043 _____ () C:\WINDOWS\WindowsUpdate (1).log
2014-06-29 23:17 - 2012-07-26 01:12 - 00000000 ____D () C:\WINDOWS\AUInstallAgent
2014-06-29 22:07 - 2014-06-29 22:07 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-29 17:37 - 2012-09-22 12:08 - 00000000 ____D () C:\ProgramData\McAfee
2014-06-29 17:27 - 2014-02-25 20:59 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-06-29 17:09 - 2014-06-29 17:09 - 00002216 _____ () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2014-06-29 17:09 - 2014-06-29 17:09 - 00002216 _____ () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2014-06-29 17:09 - 2014-06-29 17:09 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive
2014-06-29 17:09 - 2014-06-29 17:09 - 00000000 ____D () C:\Program Files (x86)\Microsoft OneDrive
2014-06-29 17:09 - 2012-09-22 12:07 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-06-29 16:50 - 2012-07-26 01:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
2014-06-29 16:18 - 2014-06-29 16:17 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-06-22 11:45 - 2013-12-15 14:36 - 00000324 _____ () C:\Users\EMoore\Desktop\Sign In.url
2014-06-17 04:12 - 2014-06-11 06:41 - 00002387 _____ () C:\Users\EMoore\Documents\Bills.wpd
2014-06-10 00:52 - 2014-06-10 00:52 - 29382144 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\amdocl64.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 26352128 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atio6axx.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 24860160 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\amdocl.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 22157824 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atioglxx.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 15716352 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticaldd64.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 14302208 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticaldd.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 13209088 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\atikmdag.sys
2014-06-10 00:52 - 2014-06-10 00:52 - 08287008 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiumdva.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 06630232 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiumdag.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 03461040 _____ () C:\WINDOWS\SysWOW64\atiumdva.cap
2014-06-10 00:52 - 2014-06-10 00:52 - 03426688 _____ () C:\WINDOWS\system32\atiumd6a.cap
2014-06-10 00:52 - 2014-06-10 00:52 - 01187342 _____ () C:\WINDOWS\system32\amdocl_as64.exe
2014-06-10 00:52 - 2014-06-10 00:52 - 01061902 _____ () C:\WINDOWS\system32\amdocl_ld64.exe
2014-06-10 00:52 - 2014-06-10 00:52 - 00995342 _____ () C:\WINDOWS\SysWOW64\amdocl_as32.exe
2014-06-10 00:52 - 2014-06-10 00:52 - 00825344 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atiadlxy.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00798734 _____ () C:\WINDOWS\SysWOW64\amdocl_ld32.exe
2014-06-10 00:52 - 2014-06-10 00:52 - 00721296 _____ () C:\WINDOWS\system32\atiicdxx.dat
2014-06-10 00:52 - 2014-06-10 00:52 - 00626688 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\atikmpag.sys
2014-06-10 00:52 - 2014-06-10 00:52 - 00550464 _____ () C:\WINDOWS\SysWOW64\atiapfxx.blb
2014-06-10 00:52 - 2014-06-10 00:52 - 00550464 _____ () C:\WINDOWS\system32\atiapfxx.blb
2014-06-10 00:52 - 2014-06-10 00:52 - 00412672 _____ () C:\WINDOWS\system32\amdmiracast.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00368640 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atiapfxx.exe
2014-06-10 00:52 - 2014-06-10 00:52 - 00234036 _____ () C:\WINDOWS\system32\ativvaxy_cik.dat
2014-06-10 00:52 - 2014-06-10 00:52 - 00233776 _____ () C:\WINDOWS\system32\ativvaxy_cik_nd.dat
2014-06-10 00:52 - 2014-06-10 00:52 - 00230912 _____ () C:\WINDOWS\system32\clinfo.exe
2014-06-10 00:52 - 2014-06-10 00:52 - 00190976 _____ (AMD) C:\WINDOWS\system32\atitmm64.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00134656 _____ () C:\WINDOWS\system32\amdhdl64.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00129536 _____ (AMD) C:\WINDOWS\system32\coinst_13.251.9001.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00123392 _____ () C:\WINDOWS\SysWOW64\amdhdl32.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00100352 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atig6txx.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00099840 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\OpenVideo64.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00098496 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiu9pag.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00096768 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atigktxx.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00086528 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\OVDecode64.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00083968 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\OpenVideo.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00083552 _____ () C:\WINDOWS\system32\ativce02.dat
2014-06-10 00:52 - 2014-06-10 00:52 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atimpc64.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdpcom64.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00074752 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atig6pxx.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00073728 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\OVDecode.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atimpc32.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdpcom32.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiglpxx.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiglpxx.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00063488 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00062464 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticalrt64.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00057344 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00055808 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticalcl64.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00052224 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticalrt.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00049152 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticalcl.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00047887 _____ () C:\WINDOWS\atiogl.xml
2014-06-10 00:52 - 2014-06-10 00:52 - 00043520 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\ati2erec.dll
2014-06-10 00:52 - 2014-06-10 00:52 - 00031232 _____ (AMD) C:\WINDOWS\system32\atimuixx.dll
2014-06-10 00:52 - 2012-09-14 04:22 - 09753752 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atidxx64.dll
2014-06-10 00:52 - 2012-09-14 04:22 - 08927704 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiumd6a.dll
2014-06-10 00:52 - 2012-09-14 04:22 - 08406024 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atidxx32.dll
2014-06-10 00:52 - 2012-09-14 04:22 - 07751920 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiumd64.dll
2014-06-10 00:52 - 2012-09-14 04:22 - 01318552 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\aticfx64.dll
2014-06-10 00:52 - 2012-09-14 04:22 - 01144320 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atiadlxx.dll
2014-06-10 00:52 - 2012-09-14 04:22 - 01100216 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\aticfx32.dll
2014-06-10 00:52 - 2012-09-14 04:22 - 00588288 _____ (AMD) C:\WINDOWS\system32\atieclxx.exe
2014-06-10 00:52 - 2012-09-14 04:22 - 00442368 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atidemgy.dll
2014-06-10 00:52 - 2012-09-14 04:22 - 00239616 _____ (AMD) C:\WINDOWS\system32\atiesrxx.exe
2014-06-10 00:52 - 2012-09-14 04:22 - 00143304 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiuxp64.dll
2014-06-10 00:52 - 2012-09-14 04:22 - 00126336 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiuxpag.dll
2014-06-10 00:52 - 2012-09-14 04:22 - 00115512 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiu9p64.dll
2014-06-07 17:46 - 2014-05-29 12:17 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Ywymfouc
2014-06-07 17:46 - 2014-05-28 10:37 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Foymonwu
2014-06-07 17:46 - 2014-05-27 17:27 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Rigiar
2014-06-07 17:46 - 2014-05-27 15:56 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Ohybboum
2014-06-07 17:46 - 2014-05-27 04:17 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Umingyy
2014-06-07 17:46 - 2014-05-26 15:41 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Hiimixan
2014-06-07 17:46 - 2014-05-26 15:41 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Enitysy
2014-06-07 17:46 - 2014-05-18 12:12 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Feciuhly
2014-06-07 17:46 - 2014-05-18 12:11 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Xyogykzy
2014-06-07 17:46 - 2014-05-18 12:11 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Opdaur
2014-06-05 19:38 - 2014-05-24 08:45 - 543824255 _____ () C:\WINDOWS\MEMORY.DMP
2014-06-01 17:17 - 2014-02-25 20:59 - 95414520 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
Some content of TEMP:
====================
C:\Users\EMoore\AppData\Local\Temp\nskE70.exe
C:\Users\EMoore\AppData\Local\Temp\nsmD202.exe
C:\Users\EMoore\AppData\Local\Temp\optprosetup.exe
C:\Users\EMoore\AppData\Local\Temp\Quarantine.exe
C:\Users\EMoore\AppData\Local\Temp\_isFCB9.exe

==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-06-30 00:47
==================== End Of Log ============================


----------



## Rain1290 (Apr 26, 2011)

*Addition.txt:*

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-07-2014
Ran by EMoore at 2014-07-01 16:39:06
Running from C:\Users\EMoore\Desktop
Boot Mode: Normal
==========================================================

==================== Security Center ========================
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Adobe Reader X (10.1.3) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.3 - Adobe Systems Incorporated)
Advanced Audio FX Engine (HKLM-x32\...\Advanced Audio FX Engine) (Version: - )
Advanced Video FX Engine (HKLM-x32\...\Advanced Video FX Engine) (Version: - )
AMD Accelerated Video Transcoding (Version: 2.00.0002 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.938.2 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2014.0423.449.6734 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{546799EE-EDAE-E14D-CC1D-C6A1BF33AA25}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
AMD Fuel (Version: 2014.0423.449.6734 - Advanced Micro Devices, Inc.) Hidden
AMD VISION Engine Control Center (HKLM-x32\...\{8B1A559A-FB9D-42F5-A8A7-2F132CF28414}) (Version: 1.00.0000 - )
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.0806.1156.19437 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2014.0423.449.6734 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2014.0423.449.6734 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2014.0423.0448.6734 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2014.0423.0448.6734 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2014.0423.0448.6734 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2014.0423.0448.6734 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2014.0423.0448.6734 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2014.0423.0448.6734 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2014.0423.0448.6734 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2014.0423.0448.6734 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2014.0423.0448.6734 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2014.0423.0448.6734 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2014.0423.0448.6734 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2014.0423.0448.6734 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2014.0423.0448.6734 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2014.0423.0448.6734 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2014.0423.0448.6734 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2014.0423.0448.6734 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2014.0423.0448.6734 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2014.0423.0448.6734 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2014.0423.0448.6734 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2014.0423.0448.6734 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2014.0423.0448.6734 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2014.0423.0448.6734 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2014.0423.449.6734 - Advanced Micro Devices, Inc.) Hidden
Corel WordPerfect Office - iFilter 64 Bit (HKLM\...\{1B45B85C-99E8-4523-8FB3-0248B3DECFC8}) (Version: 1.01.000 - Corel Corporation)
Creative Live! Cam Center (HKLM-x32\...\Creative Live! Cam Center) (Version: - )
Creative Live! Cam Doodling (HKLM-x32\...\Creative Live! Cam Doodling) (Version: - )
Creative Live! Cam FX Creator (HKLM-x32\...\Creative Live! Cam FX Creator) (Version: - )
Creative Live! Cam Manager (HKLM-x32\...\Creative Live! Cam Manager) (Version: - )
Creative Live! Cam User's Guide (HKLM-x32\...\Creative Live! Cam User's Guide) (Version: - )
Creative Live! Cam Video IM Pro (VF0410) (1.00.06.00) (HKLM\...\Creative VF0410) (Version: - )
Creative Photo Calendar (HKLM-x32\...\Creative Photo Calendar) (Version: - )
Creative Photo Manager (HKLM-x32\...\Creative Photo Manager) (Version: - )
Creative Software AutoUpdate (HKLM-x32\...\Creative Software AutoUpdate) (Version: - )
Creative System Information (HKLM-x32\...\SysInfo) (Version: - )
Driver & Application Installation (HKLM-x32\...\{BFECCF2A-F094-4066-8BFA-29CCBB7F6602}) (Version: 6.12.0815 - Lenovo)
FirstClass Client (HKLM-x32\...\{3367D1F6-D572-4DAE-AF01-7F19B3965950}) (Version: 12.007 - OpenText)
InstallConverter (HKLM-x32\...\InstallConverter) (Version: 1.0 - InstallConverter)
Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33057) (Version: 3.6.1.33057.10 - Intel)
Lenovo Blacksilk USB Keyboard Driver (HKLM-x32\...\{B266E062-D6C5-485B-B426-51B152B041A6}) (Version: V1.4.11.0608 - Lenovo)
Lenovo Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.6418 - CyberLink Corp.)
Lenovo Power2Go (x32 Version: 6.0.6418 - CyberLink Corp.) Hidden
Lenovo PowerDVD10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4126.52 - CyberLink Corp.)
Lenovo PowerDVD10 (x32 Version: 10.0.4126.52 - CyberLink Corp.) Hidden
Lenovo Rescue System (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 4.0.0.0822 - CyberLink Corp.)
Lenovo Rescue System (Version: 4.0.0.0822 - CyberLink Corp.) Hidden
Live! Cam Avatar v1.0 (HKLM-x32\...\{1D5E29AD-39A9-4D0A-A8B6-46A6FCD8C995}) (Version: 1.0 - Creative)
Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 15.0.4623.1003 - Microsoft Corporation)
Microsoft OneDrive (HKCU\...\OneDriveSetup.exe) (Version: 17.0.4023.1211 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.50401.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4623.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4623.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4623.1003 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.2.612.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6649 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.2.8400.30137 - Realtek Semiconductor Corp.)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Speed Cleaner (HKLM-x32\...\{5d2ec59e-2389-4032-8a48-d7c68bae0e94}) (Version: 1.0.0.0 - OneBit IT)
Speed Cleaner (x32 Version: 1.0.0.0 - OneBit IT) Hidden
update (x32 Version: 2.00.0000 - Your Company Name) Hidden
Windows Driver Package - Advanced Micro Devices Inc. AMD USB Filter Driver (06/19/2012 2.0.10.262) (HKLM\...\94887C1A249E60EBD575144108084AE2D38822FA) (Version: 06/19/2012 2.0.10.262 - Advanced Micro Devices Inc.)
WordPerfect Lightning - IPM (x32 Version: 1.0 - Corel Corporation) Hidden
WordPerfect Lightning - Messages (x32 Version: 1.0 - Corel Corporation) Hidden
WordPerfect Lightning - MSOM (x32 Version: 1.1 - Corel Corporation) Hidden
WordPerfect Lightning (x32 Version: 2.0 - Corel Corporation) Hidden
WordPerfect Office X5 - Common (x32 Version: 15.0 - Corel Corporation) Hidden
Wordperfect Office X5 - EN (x32 Version: 15.0 - Corel Corporation) Hidden
WordPerfect Office X5 - Filters (x32 Version: 15.0 - Corel Corporation) Hidden
WordPerfect Office X5 - Graphics (x32 Version: 15.0 - Corel Corporation) Hidden
WordPerfect Office X5 - IPM (x32 Version: 15.0 - Corel Corporation) Hidden
WordPerfect Office X5 - LegalTools (x32 Version: 15.0 - Corel Corporation) Hidden
WordPerfect Office X5 - Migration Manager (x32 Version: 15.0 - Corel Corporation) Hidden
WordPerfect Office X5 - Oxford (x32 Version: 15.0 - Corel Corporation) Hidden
WordPerfect Office X5 - PerfectExperts EN (x32 Version: 15.0 - Corel Corporation) Hidden
WordPerfect Office X5 - PR (x32 Version: 15.0 - Corel Corporation) Hidden
WordPerfect Office X5 - QP (x32 Version: 15.0 - Corel Corporation) Hidden
WordPerfect Office X5 - Setup Files (x32 Version: 15.0 - Corel Corporation) Hidden
WordPerfect Office X5 - Sharepoint (x32 Version: 15.0 - Corel Corporation) Hidden
WordPerfect Office X5 - Skins (x32 Version: 15.0 - Corel Corporation) Hidden
WordPerfect Office X5 - System EN (x32 Version: 15.0 - Corel Corporation) Hidden
WordPerfect Office X5 - Templates (x32 Version: 15.0 - Corel Corporation) Hidden
WordPerfect Office X5 - WP (x32 Version: 15.0 - Corel Corporation) Hidden
WordPerfect Office X5 - WT (x32 Version: 15.0 - Corel Corporation) Hidden
WordPerfect Office X5 (HKLM-x32\...\_{DE6DE4A1-0343-4DBE-9DC2-E667AA03F579}) (Version: 15.0.0.357 - Corel Corporation)
WordPerfect Office X5 (x32 Version: 15.0 - Corel Corporation) Hidden
==================== Restore Points =========================
30-06-2014 18:15:31 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727
30-06-2014 18:16:04 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727
01-07-2014 22:18:29 Speed Cleaner
==================== Hosts content: ==========================
2013-08-22 06:25 - 2013-08-22 06:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {035792A1-D4EF-4A78-BF9A-AA9628C281A3} - System32\Tasks\Microsoft\Windows\Setup\SetupCleanupTask
Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {08893240-5F66-4601-A3CB-1B9F26DBBB56} - \Security Center Update - 3194036556 No Task File <==== ATTENTION
Task: {08A8D180-8C28-4ABB-B7E8-504E4BF63A70} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv
Task: {09EB0598-5D7F-4E11-97B0-E7DA88638953} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {25A2334B-92A8-40A8-A9CE-4D39AD52A1A1} - \Security Center Update - 3617965272 No Task File <==== ATTENTION
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-21] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {3E58BC6F-7DD0-4639-BA77-394C3D9E95F9} - \Security Center Update - 2115062466 No Task File <==== ATTENTION
Task: {3E9B3CA8-7247-4DF4-89EA-309CDD308803} - \Security Center Update - 4123664380 No Task File <==== ATTENTION
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {504912E0-D078-469A-AA95-0714F63614F1} - System32\Tasks\Microsoft Office 15 Sync Maintenance for Ellen-EMoore Ellen => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2014-06-29] (Microsoft Corporation)
Task: {555D42A5-0871-4E4F-A387-591C6E8E52FA} - System32\Tasks\Microsoft\Windows\SysResetLogSuccess => Rundll32.exe ResetEng.dll,RjvLogSuccessEntryPoint
Task: {64AB149E-A8BF-469E-AE92-FE7293162062} - \Security Center Update - 259400069 No Task File <==== ATTENTION
Task: {696384C4-4BF8-4E19-A9BC-2E4BC078262E} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-06-01] (Microsoft Corporation)
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6D7B54B6-992F-49F1-8B2D-FFE83D2F9F34} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-05-13] (Microsoft Corporation)
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {9283C280-03F4-4B9A-AEB4-C0DB4BA2648D} - \Security Center Update - 1307576807 No Task File <==== ATTENTION
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {A4B902BD-10A1-4276-B6B1-2F74ABE5B0A0} - \Security Center Update - 31898372 No Task File <==== ATTENTION
Task: {A6C5369E-5ADD-46C5-9788-08C3A30BB237} - \Security Center Update - 554690895 No Task File <==== ATTENTION
Task: {BF58E14B-1069-43E0-80DD-BB525A2FD9CD} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D08F1AB1-8F5E-4779-937E-7A750E734C77} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-03-18] (Microsoft Corporation)
Task: {D2006F81-20A2-4F02-987F-782238C48914} - \Security Center Update - 709532655 No Task File <==== ATTENTION
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {E2ACF668-4308-4463-9ECA-B3DD4467FB01} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation
Task: {E3BDCA69-0278-4D27-AE94-D673C4802877} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: {E98D2463-D326-4299-A8B2-08BD68732F09} - \Security Center Update - 909090735 No Task File <==== ATTENTION
Task: {F9240436-40A4-4754-BFD8-4CA7C7A66DBD} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-06-29] (Microsoft Corporation)
==================== Loaded Modules (whitelisted) =============
2014-04-23 04:52 - 2014-04-23 04:52 - 00214528 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2013-07-26 06:59 - 2013-07-26 06:59 - 00814592 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
2013-07-26 06:59 - 2013-07-26 06:59 - 03650560 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Platform.dll
2014-06-29 16:17 - 2013-10-31 18:13 - 00102568 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2012-09-22 12:04 - 2011-03-15 20:47 - 00032768 _____ () C:\Windows\jmesoft\Service.exe
2014-06-29 16:39 - 2014-06-29 16:39 - 08890536 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2012-09-22 12:04 - 2011-05-17 13:54 - 00024576 _____ () C:\Windows\jmesoft\JME_LOAD.exe
2014-06-24 22:44 - 2014-06-24 22:44 - 01465760 _____ () C:\Program Files (x86)\Speed Cleaner\Speed Cleaner.exe
2014-05-19 00:10 - 2014-05-19 00:10 - 00020480 _____ () C:\Program Files (x86)\Speed Cleaner\UrlHistoryLibrary.dll
2014-04-23 04:52 - 2014-04-23 04:52 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2009-12-04 16:59 - 2009-12-04 16:59 - 00619816 _____ () C:\Program Files (x86)\Lenovo\Power2Go\CLMediaLibrary.dll
2009-12-04 17:04 - 2009-12-04 17:04 - 00013096 _____ () C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvcPS.dll
2012-09-22 12:04 - 2011-05-17 13:27 - 00028672 _____ () C:\Windows\jmesoft\hidhook.dll
2014-06-29 16:17 - 2014-06-29 16:17 - 00316584 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\AppVIsvStream32.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\Windows:nlsPreferences
AlternateDataStreams: C:\Users\EMoore\OneDrive:ms-properties
==================== Safe Mode (whitelisted) ===================

==================== EXE Association (whitelisted) =============

==================== MSCONFIG/TASK MANAGER disabled items =========

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================
Application errors:
==================
Error: (06/30/2014 11:17:37 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: NT AUTHORITY)
Description: Application or service 'AMD FUEL Service' could not be restarted.
Error: (06/30/2014 11:17:29 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Fuel.Service.exe, version: 1.0.0.0, time stamp: 0x501fec0e
Faulting module name: Device.dll, version: 4.1.0.0, time stamp: 0x4f55e10b
Exception code: 0xc0000005
Fault offset: 0x00000000000033c1
Faulting process id: 0x594
Faulting application start time: 0xFuel.Service.exe0
Faulting application path: Fuel.Service.exe1
Faulting module path: Fuel.Service.exe2
Report Id: Fuel.Service.exe3
Faulting package full name: Fuel.Service.exe4
Faulting package-relative application ID: Fuel.Service.exe5
Error: (06/30/2014 11:16:46 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: MsiExec.exe, version: 5.0.9600.16384, time stamp: 0x52158c02
Faulting module name: MSI8A60.tmp, version: 2.0.0.9, time stamp: 0x4d4b089c
Exception code: 0xc000000d
Fault offset: 0x00019d88
Faulting process id: 0xc28
Faulting application start time: 0xMsiExec.exe0
Faulting application path: MsiExec.exe1
Faulting module path: MsiExec.exe2
Report Id: MsiExec.exe3
Faulting package full name: MsiExec.exe4
Faulting package-relative application ID: MsiExec.exe5
Error: (06/30/2014 11:16:42 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: MsiExec.exe, version: 5.0.9600.16384, time stamp: 0x52158c02
Faulting module name: MSI7359.tmp, version: 2.0.0.9, time stamp: 0x4d4b089c
Exception code: 0xc000000d
Fault offset: 0x00019d88
Faulting process id: 0x1224
Faulting application start time: 0xMsiExec.exe0
Faulting application path: MsiExec.exe1
Faulting module path: MsiExec.exe2
Report Id: MsiExec.exe3
Faulting package full name: MsiExec.exe4
Faulting package-relative application ID: MsiExec.exe5
Error: (06/30/2014 00:30:15 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Fuel.Service.exe, version: 1.0.0.0, time stamp: 0x501fec0e
Faulting module name: Device.dll, version: 4.1.0.0, time stamp: 0x4f55e10b
Exception code: 0xc0000005
Fault offset: 0x00000000000033c1
Faulting process id: 0x654
Faulting application start time: 0xFuel.Service.exe0
Faulting application path: Fuel.Service.exe1
Faulting module path: Fuel.Service.exe2
Report Id: Fuel.Service.exe3
Faulting package full name: Fuel.Service.exe4
Faulting package-relative application ID: Fuel.Service.exe5
Error: (06/29/2014 10:14:28 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: ELLEN)
Description: Package winstore_1.0.0.0_neutral_neutral_cw5n1h2txyewy was terminated because it took too long to suspend.
Error: (06/29/2014 06:52:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: wpwin15.exe, version: 15.0.0.357, time stamp: 0x4b99a5af
Faulting module name: wpwin15.dll, version: 15.0.0.357, time stamp: 0x4b99a451
Exception code: 0xc0000005
Fault offset: 0x0026fa3e
Faulting process id: 0x1224
Faulting application start time: 0xwpwin15.exe0
Faulting application path: wpwin15.exe1
Faulting module path: wpwin15.exe2
Report Id: wpwin15.exe3
Faulting package full name: wpwin15.exe4
Faulting package-relative application ID: wpwin15.exe5
Error: (06/29/2014 05:45:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Fuel.Service.exe, version: 1.0.0.0, time stamp: 0x501fec0e
Faulting module name: Device.dll, version: 4.1.0.0, time stamp: 0x4f55e10b
Exception code: 0xc0000005
Fault offset: 0x00000000000033c1
Faulting process id: 0x658
Faulting application start time: 0xFuel.Service.exe0
Faulting application path: Fuel.Service.exe1
Faulting module path: Fuel.Service.exe2
Report Id: Fuel.Service.exe3
Faulting package full name: Fuel.Service.exe4
Faulting package-relative application ID: Fuel.Service.exe5
Error: (06/29/2014 05:35:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Fuel.Service.exe, version: 1.0.0.0, time stamp: 0x501fec0e
Faulting module name: Device.dll, version: 4.1.0.0, time stamp: 0x4f55e10b
Exception code: 0xc0000005
Fault offset: 0x00000000000033c1
Faulting process id: 0x6f8
Faulting application start time: 0xFuel.Service.exe0
Faulting application path: Fuel.Service.exe1
Faulting module path: Fuel.Service.exe2
Report Id: Fuel.Service.exe3
Faulting package full name: Fuel.Service.exe4
Faulting package-relative application ID: Fuel.Service.exe5
Error: (06/21/2014 06:02:22 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: ELLEN)
Description: App microsoft.windowsphotos_8wekyb3d8bbwe!Microsoft.WindowsLive.ModernPhotos did not launch within its allotted time.

System errors:
=============
Error: (07/01/2014 04:28:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The UAC File Virtualization service failed to start due to the following error: 
%%1275
Error: (07/01/2014 01:07:24 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The UAC File Virtualization service failed to start due to the following error: 
%%1275
Error: (07/01/2014 06:43:24 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The UAC File Virtualization service failed to start due to the following error: 
%%1275
Error: (06/30/2014 11:35:00 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The UAC File Virtualization service failed to start due to the following error: 
%%1275
Error: (06/30/2014 11:33:19 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
Error: (06/30/2014 11:18:23 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The AODDriver4.2.0 service failed to start due to the following error: 
%%2
Error: (06/30/2014 11:17:30 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The AMD FUEL Service service terminated unexpectedly. It has done this 1 time(s).
Error: (06/30/2014 11:16:47 AM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 10. The Windows SChannel error state is 10.
Error: (06/30/2014 11:16:47 AM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 10. The Windows SChannel error state is 10.
Error: (06/30/2014 11:16:47 AM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 10. The Windows SChannel error state is 10.

Microsoft Office Sessions:
=========================
Error: (06/30/2014 11:17:37 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: NT AUTHORITY)
Description: 0C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exeAMD FUEL Service03026217814280
Error: (06/30/2014 11:17:29 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fuel.Service.exe1.0.0.0501fec0eDevice.dll4.1.0.04f55e10bc000000500000000000033c159401cf943a848d6eceC:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exeC:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dllcb694725-0082-11e4-8251-d43d7e1a2cb2
Error: (06/30/2014 11:16:46 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: MsiExec.exe5.0.9600.1638452158c02MSI8A60.tmp2.0.0.94d4b089cc000000d00019d88c2801cf948f720aa150C:\Windows\syswow64\MsiExec.exeC:\WINDOWS\Installer\MSI8A60.tmpb1751eea-0082-11e4-8251-d43d7e1a2cb2
Error: (06/30/2014 11:16:42 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: MsiExec.exe5.0.9600.1638452158c02MSI7359.tmp2.0.0.94d4b089cc000000d00019d88122401cf948f6f357da4C:\Windows\syswow64\MsiExec.exeC:\WINDOWS\Installer\MSI7359.tmpaf42cd74-0082-11e4-8251-d43d7e1a2cb2
Error: (06/30/2014 00:30:15 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fuel.Service.exe1.0.0.0501fec0eDevice.dll4.1.0.04f55e10bc000000500000000000033c165401cf93fcd0282ff9C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exeC:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll60a7b2c3-0028-11e4-be92-d43d7e1a2cb2
Error: (06/29/2014 10:14:28 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: ELLEN)
Description: winstore_1.0.0.0_neutral_neutral_cw5n1h2txyewy
Error: (06/29/2014 06:52:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: wpwin15.exe15.0.0.3574b99a5afwpwin15.dll15.0.0.3574b99a451c00000050026fa3e122401cf9404bfc05c6cc:\Program Files (x86)\Corel\WordPerfect Office X5\Programs\wpwin15.exec:\Program Files (x86)\Corel\WordPerfect Office X5\Programs\wpwin15.dll33f2018d-fff9-11e3-be92-d43d7e1a2cb2
Error: (06/29/2014 05:45:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fuel.Service.exe1.0.0.0501fec0eDevice.dll4.1.0.04f55e10bc000000500000000000033c165801cf93fb66a7b8eaC:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exeC:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dlldb428dd0-ffef-11e3-be91-d43d7e1a2cb2
Error: (06/29/2014 05:35:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fuel.Service.exe1.0.0.0501fec0eDevice.dll4.1.0.04f55e10bc000000500000000000033c16f801cf92d5cedc6d3cC:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exeC:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll67846d24-ffee-11e3-be90-d43d7e1a2cb2
Error: (06/21/2014 06:02:22 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: ELLEN)
Description: microsoft.windowsphotos_8wekyb3d8bbwe!Microsoft.WindowsLive.ModernPhotos

==================== Memory info =========================== 
Percentage of memory in use: 22%
Total physical RAM: 5598.84 MB
Available physical RAM: 4312.77 MB
Total Pagefile: 11230.84 MB
Available Pagefile: 9755.54 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB
==================== Drives ================================
Drive c: (Windows8_OS) (Fixed) (Total:904.47 GB) (Free:839.64 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (CREATIVE) (CDROM) (Total:0.54 GB) (Free:0 GB) CDFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 932 GB) (Disk ID: 06E3C44D)
Partition: GPT Partition Type.
==================== End Of Log ============================


----------



## Rain1290 (Apr 26, 2011)

Previous post was edited for Adwcleaner logging information, and those pertaining to FRST were deleted. 


~Trav.~


----------



## Mark1956 (May 7, 2011)

Still need the new scan results from Adwcleaner and the deletion of the FRST logs in post 6.

I'm going to have to turn in now as it is 23.45 here, I shall post back in the morning with the fix to clean out all the infected files, there will be just a few more checks to do after that and the system should be back to normal.

Please tell your Aunt to stay away from PC optimizer programs that promise to speed up and fix everything, they are not worth a cent, she has Speed Cleaner installed, you can read about it here: http://www.2-spyware.com/remove-speed-cleaner.html and the general opinion with all the other optimizer programs is pretty much the same, they can cause more harm than good. I could see three more of these types of programs detected by Adwcleaner. I would recommend Speed Cleaner is uninstalled.


----------



## Mark1956 (May 7, 2011)

Rain1290 said:


> Previous post was edited for Adwcleaner logging information, and those pertaining to FRST were deleted.
> 
> ~Trav.~


I can still see the FRST logs in post 6 and no new log from Adwcleaner has been posted.


----------



## Mark1956 (May 7, 2011)

Ok, we skipped posts, sorry for the confusion. I can now see you have removed the first FRST logs, but you have also replaced the Adwcleaner log so that I can no longer see the original, the idea was to leave the first Adwcleaner where it was and post the new log produced from a second scan. Not to worry as Adwcleaner has found further bad files so it needs to be run again. 

Please do another scan with Adwcleaner and post the new log in your next reply. I must turn in now as having trouble keeping awake. I'll be back in the morning, I am on GMT +1.


----------



## Mark1956 (May 7, 2011)

Just had one final look at the new Adwcleaner log and it found another Optimizer program which I don't think was in the first scan. Please tell your Aunt not to install any other programs and just follow what I have requested as this can cause great confusion in the log results. As I said above Optimizer programs are not worth a cent and they certainly won't fix any of the problems with her PC, they might even make it worse.


----------



## Rain1290 (Apr 26, 2011)

Hi Mark,


Okay, I will have her do another scan with Adwcleaner and leave the corresponding information here. Also, I'm sorry for not leaving the previous logging information in post#6, but since I still have it, I will now include it in that post for you (it will be on top of the current version there).


As for the other Optimizer program that you discovered, I do not think she intentionally meant to install it (whatever it is) - I'm not sure how that happened (she does not have a great deal of knowledge of computers). Should I have her remove it, or just leave things the way they are and simply run another scan with Adwcleaner?


Cheers,


~Trav.~


----------



## Rain1290 (Apr 26, 2011)

Hi Mark,

The newest log information from Adwcleaner:

# AdwCleaner v3.214 - Report created 01/07/2014 at 19:38:32
# Updated 29/06/2014 by Xplode
# Operating System : Windows 8.1 (64 bits)
# Username : EMoore - ELLEN
# Running from : C:\Users\EMoore\Desktop\AdwCleaner.exe
# Option : Clean
***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

***** [ Browsers ] *****
-\\ Internet Explorer v11.0.9600.17126

-\\ Google Chrome v
[ File : C:\Users\EMoore\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************
AdwCleaner[R0].txt - [2134 octets] - [01/07/2014 13:04:28]
AdwCleaner[R1].txt - [2713 octets] - [01/07/2014 16:27:11]
AdwCleaner[R2].txt - [963 octets] - [01/07/2014 19:37:09]
AdwCleaner[S0].txt - [2112 octets] - [01/07/2014 13:05:51]
AdwCleaner[S1].txt - [2475 octets] - [01/07/2014 16:27:56]
AdwCleaner[S2].txt - [885 octets] - [01/07/2014 19:38:32]
########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [944 octets] ##########

* EDIT:* Also, just out of curiosity, is it possible that Adwcleaner somehow removed/uninstalled the drivers for my aunt's printer? I am just asking, as she recently told me that she receives error messages when attempting to print (driver-support related). I told her to uninstall anything related to the printer, and re-install everything from scratch using her software disc. I also tried it on my laptop, as well, and it removed my Pokki program, so that's why I made the connection and wanted to bring it to your attention.

Thanks,

~Trav.~


----------



## Mark1956 (May 7, 2011)

Adwcleaner will not have touched a printer driver, it only removes bad programs (Optimizers) and Adware from browsers. It is however possible that the infection might have damaged the printer driver files.

Now that I can see the first Adwcleaner log I was wrong to suggest another Optimizer had been installed, sorry about that, Adwcleaner often needs more than one go at deleting some items, it took out the program in the second run and now the third log is completely clean.

Not sure why Adwcleaner would have removed your Pokki program unless it included some Adware. When you do the initial scan you can go through all the tabs to see what it found and uncheck any that you don't want it to remove before you click on the Clean button. It works from a database of known bad programs so there is probably a good reason why Pokki was detected.

We can now perform the clean up of the infected files, this also includes the removal of several orphan entries.

We are now going to run FRST in a different way.


*IMPORTANT---> *First download the attachment at the bottom of this post by clicking on it and save it in the same location as FRST.
Launch *FRST* by double clicking on it. *DO NOT* click on the *Scan* button or check any of the boxes.
You may see a message that an update is installing, if so the program will close when the update completes, you will then need to double click on *FRST* to open it again.
When the *FRST* window opens click on the *Fix* button *just once* and wait.
You will see a message confirming the fix has been run and the log saved, click on *OK* and the Fixlog will open. *Copy & Paste* the full log it into your next reply.

*NOTE:* This fix has been written specifically for the PC being dealt with in this thread, if you run it on another system it may have undesirable consequences. If you have a similar problem, ask for help by opening a new thread in the appropriate forum.


I'd also like you to run this to clean out all the temp files as they can be hiding infections.

NOTE: This will empty your recycle bin, if you have anything you need in there please save it before you run this scan.
Download Temporary file cleaner and save it to the desktop. Make sure you do not use the Download button in the advert at the top of the page, use the button right next to the name *TFC - Temp File Cleaner by Old Timer*.
Double click on the icon to run it (it appears as a dark grey dustbin). For Windows 7 and Vista right click the icon and select *Run as Administrator*.
When the window opens click on* Start*. It will close all running programs and clear the desktop icons.
When complete you may be asked to reboot, if so accept the request and your PC will reboot automatically.

NOTE: There is no need to post the log, just confirm in your next post that it ran without a problem. At times it may appear to freeze, which is perfectly normal, it may take a while to complete the clean up depending on the amount of temporary files there are on the system.


----------



## Rain1290 (Apr 26, 2011)

Thank you for your response, and no worries about the confusion concerning the Optimizer programs. Many thanks also for the explanation concerning the printer drivers and my Pokki program! It is always nice to gain insight! Could it also be possible that Windows 8.1 caused some fault with the printer drivers?

Okay, I will work with her with your latest suggestion.  Do you know if this procedure will delete her infected files, or could it help to restore her affected files?

*EDIT:* Also, with respect to Temporary File Cleaner, it does not specify that it is compatible with Windows 8/8.1. Is that okay? Furthermore, just to be clear, we press the download button entitled "Download Now @ Author's site"? You additionally mentioned above that the desktop icons will be cleared. Will those icons return once the computer reboots?

With respect to FRST, you mentioned above not to check any of the boxes. However, there are some already checked, so do we need to uncheck those? Upon opening FRST (using the icon already downloaded to the desktop), the checkboxes under "Whitelist" are all checked. Do we uncheck them, or leave them the way they are? There is nothing under "Optional Scan" that is checked off, so that's okay.

Finally, for the "fixlist.txt" file attachment, would it be okay if I downloaded it and sent it by email to her, and then she can download it to her desktop from the email?

Thanks,

~Trav.~


----------



## Mark1956 (May 7, 2011)

Windows 8.1 might have caused a problem with the drivers if they are not fully compatible with the OS, difficult for me to comment any further on that issue.

The procedure will remove the infection and all its related files, it won't however change anything with the files that were encrypted by the infection.

As far as I am aware TFC is compatible with Windows 8, it is likely it simply will not run if it isn't. When it clears the desktop, that is only temporary, they will all return to normal after the scan has completed.

With respect to FRST, as mentioned before, if the instruction don't tell you to change anything then leave it as it is.

Emailing the fixlist.txt file should be ok, but wouldn't it be easier for her to log into this site and download it herself and then post the fixlog?


----------



## Rain1290 (Apr 26, 2011)

Hi Mark,


Thank you for all of your answers! 


Based on what we have done thus far, do you think there is even the slightest possibility to save the already affected files? Also, are you further convinced that this is, indeed, CryptoWall?


Also, my aunt recently disclosed to me that she sees a screen called "Speed Cleaner" that keeps on popping up and asked her to register because she has many unresolved issues which are harmful to her computer. Should she register or ignore it?

~Trav.~


----------



## Mark1956 (May 7, 2011)

As I have already pointed out, once any files get encrypted by the infection there is no way to decrypt them. And yes, it is CryptoWall that has infected the system.

Please tell your Aunt to completely ignore the pop ups from Speed Cleaner, it is a bad program that is a boderline scam. I posted a link to give you the information about it and recommended it was uninstalled in post 18.


----------



## Rain1290 (Apr 26, 2011)

Okay, I will pass on this information to her and have her uninstall Speed Cleaner. We will also begin working on your suggestion, as per your post #24.


Given the situation, I suppose that it would not make sense to have a technician attempt to physically look at the infected files on her computer to see if they can be recovered. Under the circumstances, that would be a total waste of time and money, correct?


Also, would you recommend her to keep the infected files, just in case a solution does surface down the line? Or would keeping infected files cause potential further corruptions or damage in the future? Could they also corrupt a flash drive (assuming infected files can cause damage)?


Thanks,


~Trav.~


----------



## Mark1956 (May 7, 2011)

Completing the instructions in post 24 should be done as soon as you can, to get the PC clean.

Just to try and explain the situation further with what this infection has done. When it gets on your system it finds a bunch of personal files, it does not infect them with anything it encrypts them, which makes them impossible to read without the encryption key. It is a bit like putting all the files in a safe and keeping the combination to the safe a secret. The infection then requests payment to give you the ability to decrypt the files, but as this infection is under the control of criminals you are not guaranteed in any way shape or form to actually get your files back.

Asking anyone to decrypt the files is like asking someone to guess the combination of the safe, the odds on that being achieved are less likely than you guessing the next set of winning lottery numbers for the next few weeks in a row. You have to have the encryption key to unlock the files and the only people that have that key are those that created the infection.

File encryption is used on PC's to protect sensitive files, it isn't just something used by criminals, when you encrypt files yourself you get an encryption key which will be unique, without the key those files are lost for ever, encryption is an extremely secure way of keeping sensitive data safe. Saving the encrypted files will be a waste of time, but it is up to you if you want to hang on to them.


----------



## Rain1290 (Apr 26, 2011)

Thanks for your explanation and analogies, Mark. 


My aunt had such a wonderful large album of photographs taken from various trips that she made around the world over the last several years. As you said previously, it is a hard lesson to learn to back up files regularly. It is a pity that there are such cruel, cruel people out there....


So, as long as the infection is in her computer, any new photos that she uploads or WordPerfect documents that she creates on her computer will automatically become encrypted by it?


~Trav.~


----------



## Mark1956 (May 7, 2011)

> My aunt had such a wonderful large album of photographs taken from various trips that she made around the world over the last several years. As you said previously, it is a hard lesson to learn to back up files regularly. It is a pity that there are such cruel, cruel people out there....


 My heart goes out to her, and I quite agree about these dreadful people who can't find a way to make an 'honest' living. The importance of backing up valuable data is unfortunately not thought about by many PC users until it is too late, even an all too common problem like a hard drive failure can loose all your data. I'll bet all those photo's could have been put on just one DVD, a ten minute job to save all the heartache, such a shame. 


> So, as long as the infection is in her computer, any new photos that she uploads or WordPerfect documents that she creates on her computer will automatically become encrypted by it?


 That is quite likely, but I cannot be sure, so it is important to follow my instructions as soon as possible to remove the threat of the infection doing any more damage. Thankfully this infection is fairly easy to get rid of.


----------



## Mark1956 (May 7, 2011)

I just found something which is a long shot, but it might get those files back. I believe the infection wipes out Shadow Copies to stop anyone from bypassing the ransom, but it may be worth a shot, if this fails then all hope is lost. The earlier version of this infection had a flaw in it that left the encryption key on the computer, but this new version keeps the key on the criminals own server, not a lot of help to you, but just a bit more information for anyone reading this thread.

Go here: Shadow Explorer Download the latest version installer. Install it on the system. When you run the program you need to use the Help button and select Manual, this will show you how to use it. If the Shadow Copies have not been removed by the infection you might just stand a chance of retrieving the lost files.

I've never used this software so can't offer much help with it, you will have to follow the instructions in the on-line manual.

It is crucial that before using this the infection is removed following my instructions in post 24.


----------



## Rain1290 (Apr 26, 2011)

Hi Mark,


Thank you for the glimmer of hope! Yes, we will try this as soon as we have a chance to remove the virus (as per your instructions in post# 24). We will begin working on this later today, when my aunt has the chance to do so. 


Also, in the meantime, would it be okay to try Shadow Explorer on my own computer, just to see how it works before I guide her through it (after successful removal of the virus)? 


Finally, what about trying a system restore? Would that do any good?


Thanks,


~Trav.~


----------



## Mark1956 (May 7, 2011)

You're welcome, but it is only a 'very faint' glimmer of hope.

You can certainly try out Shadow Explorer on your own system.

System Restore will not do any good as it does not have any bearing on personal files. Your only real chance to recover the files is from the Shadow copies using Shadow Explorer, best of luck.


----------



## Rain1290 (Apr 26, 2011)

Hi Mark,

Many thanks, once again, for your response.

I just installed Shadow Explorer and am just trying to familiarize myself with its functionalities using the manual. I see that I am able to select and view files pertaining to my C: Drive (D: Drive selection is also possible, but that is not important) based on the Shadow Copy that I select. From what I understand, "Shadow Copies" operate similarly to restore points, and upon installing the program, I see Shadow Copies in the available drop down menu, with selections dating as far back as June 12th, 2014. So, if I understand this correctly, let's say I chose a Shadow Copy from the drop down menu (such as June 12th), the files that I am navigating through on my C: Drive are all those that were there on that particular day, and, if I wanted to, I could export them to a given location on my computer right now. In my aunt's case, if there are Shadow Copies available, she can use one of them to retrieve her pictures on a particular past date and, providing they are not encrypted, can be transferred to a desired location on her computer (after the removal of the virus, of course). However, if that is the way this works, given how long she may have had this virus (possibly as far back as late-April), if there are no Shadow Copies that do not date back far enough in the past (assuming she will have Shadow Copies available), could the files in relatively recent Shadow Copies also be encrypted, since the virus already likely encrypted the files at those times?

Also, at least in my case, when I export photos and video from June 12th (or any other date available) to my desktop, for some reason, the photos do not open correctly (sometimes not even supported by Windows Photo Viewer), and videos do not play (on VLC), and when they do play, the footage is distorted, and there is no audio. The same types of problems/errors occur with exported PDF and Microsoft Word files.

*EDIT:* Also, with respect to Temporary File Cleaner, just to be clear, we press the download button entitled "Download Now @ Author's site"?

~Trav.~


----------



## Mark1956 (May 7, 2011)

As I said, I have never used the software, but by the sound of it you have already found out a lot more about it than I know. You are correct though, if Shadow copies don't date back beyond the infection date it will do no good.

Another thing you could try (I have only just figured this out), which might actually be easier for your Aunt. When the infection has been removed get her to locate the folder that all the pictures were saved in (this is assuming they were all in the same place). Right click on the folder and select Properties, then when the box opens click on the 'Previous Versions' tab, if it shows a copy with a date prior to the infection click on it and then select the Copy button, you can then choose a location to save the copies to. Putting the good copies in another location will save getting them mixed up with all the encrypted ones. I sooooo hope this works for you.


----------



## Mark1956 (May 7, 2011)

We just crossed posts as you made your edit.


> *EDIT:* Also, with respect to Temporary File Cleaner, just to be clear, we press the download button entitled "Download Now @ Author's site"?


It is hard sometimes to keep up with the constant changes they make on some of the download sites, it used to show exactly as described in my instructions so yet another edit is needed, thanks for bringing that to my attention. And yes, that is the correct button.


----------



## Rain1290 (Apr 26, 2011)

Hi Mark,


Thank you for the responses, and I am glad that caught my edit!


The only concern that I have about the Shadow Explorer, though, is that even if suitable Shadow copies are available to her, it would seem that exporting files directly from there cause errors when trying to open them upon transferring them to the desired location (as per my post #36). 


I recall trying your latest suggestion previously, but the problem was that there was no "Previous Versions" tab available under "Properties". Is it possible to make it available?


~Trav.~


----------



## Mark1956 (May 7, 2011)

Not having any experience with Shadow Explorer I'm sorry I can't help much with this. I have just tried using my second method of opening a folders properties and used the Copy button to save the old version of the folder to my desktop and the few pictures that were in it opened up as good as the originals. 

When you don't see the Previous Versions tab it is most likely because there aren't any, that is to say the Shadow Copy service has not saved a previous version, most probably because the file or folder is quite new.


----------



## Rain1290 (Apr 26, 2011)

Hi Mark,

A few things to report. First, my aunt confirmed that she successfully uninstalled "Speed Cleaner" previously. Second, as per your post #24, we performed the FRST scan using the "Fix" button after saving the "fixlist" document to the desktop (which is where FRST is also located). The corresponding logging information is as follows:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-07-2014
Ran by EMoore at 2014-07-03 20:32:26 Run:1
Running from C:\Users\EMoore\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\Program Files (x86)\Speed Cleaner
HKLM-x32\...\Run: [mcui_exe] => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
HKLM-x32\...\Run: [Feolsyodcotaivc] => C:\Users\EMoore\AppData\Roaming\Umingyy\oszio.exe
HKLM-x32\...\Run: [Ucrocumytibygi] => C:\Users\EMoore\AppData\Roaming\Opdaur\veximi.exe
HKLM-x32\...\Run: [Olasgay] => C:\Users\EMoore\AppData\Roaming\Ohybboum\ygysvey.exe
HKLM-x32\...\Run: [Uzylzaroamvozii] => C:\Users\EMoore\AppData\Roaming\Ywymfouc\zudekau.exe
HKLM-x32\...\Run: [Speed Cleaner] => C:\Program Files (x86)\Speed Cleaner\Speed Cleaner.exe [1465760 2014-06-24] ()
Startup: C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.HTML ()
Startup: C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.TXT ()
InternetURL: C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.URL -> https://kpai7ycr7jxqkilp.torexplorer.com/5ag2
ShellIconOverlayIdentifiers: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: SugarSyncBackedUp -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File
ShellIconOverlayIdentifiers: SugarSyncPending -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File
ShellIconOverlayIdentifiers: SugarSyncRoot -> {A759AFF6-5851-457D-A540-F4ECED148351} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File
ShellIconOverlayIdentifiers: SugarSyncShared -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File
ShellIconOverlayIdentifiers-x32: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers-x32: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers-x32: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {5B9FD57B-9D6A-4C7A-916F-7E39C0616FCF} URL = 
SearchScopes: HKCU - {5B9FD57B-9D6A-4C7A-916F-7E39C0616FCF} URL = 
2014-06-07 17:46 - 2014-05-29 12:17 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Ywymfouc
2014-06-07 17:46 - 2014-05-28 10:37 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Foymonwu
2014-06-07 17:46 - 2014-05-27 17:27 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Rigiar
2014-06-07 17:46 - 2014-05-27 15:56 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Ohybboum
2014-06-07 17:46 - 2014-05-27 04:17 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Umingyy
2014-06-07 17:46 - 2014-05-26 15:41 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Hiimixan
2014-06-07 17:46 - 2014-05-26 15:41 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Enitysy
2014-06-07 17:46 - 2014-05-18 12:12 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Feciuhly
2014-06-07 17:46 - 2014-05-18 12:11 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Xyogykzy
2014-06-07 17:46 - 2014-05-18 12:11 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Opdaur
Task: {08893240-5F66-4601-A3CB-1B9F26DBBB56} - \Security Center Update - 3194036556 No Task File <==== ATTENTION
Task: {25A2334B-92A8-40A8-A9CE-4D39AD52A1A1} - \Security Center Update - 3617965272 No Task File <==== ATTENTION
Task: {3E58BC6F-7DD0-4639-BA77-394C3D9E95F9} - \Security Center Update - 2115062466 No Task File <==== ATTENTION
Task: {3E9B3CA8-7247-4DF4-89EA-309CDD308803} - \Security Center Update - 4123664380 No Task File <==== ATTENTION
Task: {64AB149E-A8BF-469E-AE92-FE7293162062} - \Security Center Update - 259400069 No Task File <==== ATTENTION
Task: {9283C280-03F4-4B9A-AEB4-C0DB4BA2648D} - \Security Center Update - 1307576807 No Task File <==== ATTENTION
Task: {A4B902BD-10A1-4276-B6B1-2F74ABE5B0A0} - \Security Center Update - 31898372 No Task File <==== ATTENTION
Task: {A6C5369E-5ADD-46C5-9788-08C3A30BB237} - \Security Center Update - 554690895 No Task File <==== ATTENTION
Task: {D2006F81-20A2-4F02-987F-782238C48914} - \Security Center Update - 709532655 No Task File <==== ATTENTION
Task: {E98D2463-D326-4299-A8B2-08BD68732F09} - \Security Center Update - 909090735 No Task File <==== ATTENTION
2014-06-24 22:44 - 2014-06-24 22:44 - 01465760 _____ () C:\Program Files (x86)\Speed Cleaner\Speed Cleaner.exe
2014-05-19 00:10 - 2014-05-19 00:10 - 00020480 _____ () C:\Program Files (x86)\Speed Cleaner\UrlHistoryLibrary.dll
*****************
"C:\Program Files (x86)\Speed Cleaner" => File/Directory not found.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\mcui_exe => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Feolsyodcotaivc => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Ucrocumytibygi => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Olasgay => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Uzylzaroamvozii => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Speed Cleaner => Value not found.
C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.HTML => Moved successfully.
C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.TXT => Moved successfully.
C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.URL => Moved successfully.
'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SkyDrive1'=> Key not found.
'HKLM\Software\Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}'=> Key not found.
'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SkyDrive2'=> Key not found.
'HKLM\Software\Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}'=> Key not found.
'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SkyDrive3'=> Key not found.
'HKLM\Software\Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}'=> Key not found.
'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SugarSyncBackedUp' => Key deleted successfully.
'HKLM\Software\Classes\CLSID\{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472}' => Key deleted successfully.
'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SugarSyncPending' => Key deleted successfully.
'HKLM\Software\Classes\CLSID\{62CCD8E3-9C21-41E1-B55E-1E26DFC68511}' => Key deleted successfully.
'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SugarSyncRoot' => Key deleted successfully.
'HKLM\Software\Classes\CLSID\{A759AFF6-5851-457D-A540-F4ECED148351}' => Key deleted successfully.
'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SugarSyncShared' => Key deleted successfully.
'HKLM\Software\Classes\CLSID\{1574C9EF-7D58-488F-B358-8B78C1538F51}' => Key deleted successfully.
'HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SkyDrive1'=> Key not found.
'HKLM\Software\Wow6432Node\Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}'=> Key not found.
'HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SkyDrive2'=> Key not found.
'HKLM\Software\Wow6432Node\Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}'=> Key not found.
'HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SkyDrive3'=> Key not found.
'HKLM\Software\Wow6432Node\Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}'=> Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
'HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{5B9FD57B-9D6A-4C7A-916F-7E39C0616FCF}' => Key deleted successfully.
'HKCR\CLSID\{5B9FD57B-9D6A-4C7A-916F-7E39C0616FCF}'=> Key not found.
C:\Users\EMoore\AppData\Roaming\Ywymfouc => Moved successfully.
C:\Users\EMoore\AppData\Roaming\Foymonwu => Moved successfully.
C:\Users\EMoore\AppData\Roaming\Rigiar => Moved successfully.
C:\Users\EMoore\AppData\Roaming\Ohybboum => Moved successfully.
C:\Users\EMoore\AppData\Roaming\Umingyy => Moved successfully.
C:\Users\EMoore\AppData\Roaming\Hiimixan => Moved successfully.
C:\Users\EMoore\AppData\Roaming\Enitysy => Moved successfully.
C:\Users\EMoore\AppData\Roaming\Feciuhly => Moved successfully.
C:\Users\EMoore\AppData\Roaming\Xyogykzy => Moved successfully.
C:\Users\EMoore\AppData\Roaming\Opdaur => Moved successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{08893240-5F66-4601-A3CB-1B9F26DBBB56}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{08893240-5F66-4601-A3CB-1B9F26DBBB56}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Security Center Update - 3194036556' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{25A2334B-92A8-40A8-A9CE-4D39AD52A1A1}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{25A2334B-92A8-40A8-A9CE-4D39AD52A1A1}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Security Center Update - 3617965272' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3E58BC6F-7DD0-4639-BA77-394C3D9E95F9}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3E58BC6F-7DD0-4639-BA77-394C3D9E95F9}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Security Center Update - 2115062466' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3E9B3CA8-7247-4DF4-89EA-309CDD308803}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3E9B3CA8-7247-4DF4-89EA-309CDD308803}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Security Center Update - 4123664380' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{64AB149E-A8BF-469E-AE92-FE7293162062}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{64AB149E-A8BF-469E-AE92-FE7293162062}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Security Center Update - 259400069' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9283C280-03F4-4B9A-AEB4-C0DB4BA2648D}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9283C280-03F4-4B9A-AEB4-C0DB4BA2648D}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Security Center Update - 1307576807' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A4B902BD-10A1-4276-B6B1-2F74ABE5B0A0}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A4B902BD-10A1-4276-B6B1-2F74ABE5B0A0}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Security Center Update - 31898372' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A6C5369E-5ADD-46C5-9788-08C3A30BB237}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A6C5369E-5ADD-46C5-9788-08C3A30BB237}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Security Center Update - 554690895' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D2006F81-20A2-4F02-987F-782238C48914}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D2006F81-20A2-4F02-987F-782238C48914}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Security Center Update - 709532655' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E98D2463-D326-4299-A8B2-08BD68732F09}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E98D2463-D326-4299-A8B2-08BD68732F09}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Security Center Update - 909090735' => Key deleted successfully.
"C:\Program Files (x86)\Speed Cleaner\Speed Cleaner.exe" => File/Directory not found.
"C:\Program Files (x86)\Speed Cleaner\UrlHistoryLibrary.dll" => File/Directory not found.
==== End of Fixlog ====

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-07-2014
Ran by EMoore at 2014-07-03 20:32:26 Run:1
Running from C:\Users\EMoore\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\Program Files (x86)\Speed Cleaner
HKLM-x32\...\Run: [mcui_exe] => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
HKLM-x32\...\Run: [Feolsyodcotaivc] => C:\Users\EMoore\AppData\Roaming\Umingyy\oszio.exe
HKLM-x32\...\Run: [Ucrocumytibygi] => C:\Users\EMoore\AppData\Roaming\Opdaur\veximi.exe
HKLM-x32\...\Run: [Olasgay] => C:\Users\EMoore\AppData\Roaming\Ohybboum\ygysvey.exe
HKLM-x32\...\Run: [Uzylzaroamvozii] => C:\Users\EMoore\AppData\Roaming\Ywymfouc\zudekau.exe
HKLM-x32\...\Run: [Speed Cleaner] => C:\Program Files (x86)\Speed Cleaner\Speed Cleaner.exe [1465760 2014-06-24] ()
Startup: C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.HTML ()
Startup: C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.TXT ()
InternetURL: C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.URL -> https://kpai7ycr7jxqkilp.torexplorer.com/5ag2
ShellIconOverlayIdentifiers: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: SugarSyncBackedUp -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File
ShellIconOverlayIdentifiers: SugarSyncPending -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File
ShellIconOverlayIdentifiers: SugarSyncRoot -> {A759AFF6-5851-457D-A540-F4ECED148351} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File
ShellIconOverlayIdentifiers: SugarSyncShared -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File
ShellIconOverlayIdentifiers-x32: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers-x32: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers-x32: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {5B9FD57B-9D6A-4C7A-916F-7E39C0616FCF} URL = 
SearchScopes: HKCU - {5B9FD57B-9D6A-4C7A-916F-7E39C0616FCF} URL = 
2014-06-07 17:46 - 2014-05-29 12:17 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Ywymfouc
2014-06-07 17:46 - 2014-05-28 10:37 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Foymonwu
2014-06-07 17:46 - 2014-05-27 17:27 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Rigiar
2014-06-07 17:46 - 2014-05-27 15:56 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Ohybboum
2014-06-07 17:46 - 2014-05-27 04:17 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Umingyy
2014-06-07 17:46 - 2014-05-26 15:41 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Hiimixan
2014-06-07 17:46 - 2014-05-26 15:41 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Enitysy
2014-06-07 17:46 - 2014-05-18 12:12 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Feciuhly
2014-06-07 17:46 - 2014-05-18 12:11 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Xyogykzy
2014-06-07 17:46 - 2014-05-18 12:11 - 00000000 ____D () C:\Users\EMoore\AppData\Roaming\Opdaur
Task: {08893240-5F66-4601-A3CB-1B9F26DBBB56} - \Security Center Update - 3194036556 No Task File <==== ATTENTION
Task: {25A2334B-92A8-40A8-A9CE-4D39AD52A1A1} - \Security Center Update - 3617965272 No Task File <==== ATTENTION
Task: {3E58BC6F-7DD0-4639-BA77-394C3D9E95F9} - \Security Center Update - 2115062466 No Task File <==== ATTENTION
Task: {3E9B3CA8-7247-4DF4-89EA-309CDD308803} - \Security Center Update - 4123664380 No Task File <==== ATTENTION
Task: {64AB149E-A8BF-469E-AE92-FE7293162062} - \Security Center Update - 259400069 No Task File <==== ATTENTION
Task: {9283C280-03F4-4B9A-AEB4-C0DB4BA2648D} - \Security Center Update - 1307576807 No Task File <==== ATTENTION
Task: {A4B902BD-10A1-4276-B6B1-2F74ABE5B0A0} - \Security Center Update - 31898372 No Task File <==== ATTENTION
Task: {A6C5369E-5ADD-46C5-9788-08C3A30BB237} - \Security Center Update - 554690895 No Task File <==== ATTENTION
Task: {D2006F81-20A2-4F02-987F-782238C48914} - \Security Center Update - 709532655 No Task File <==== ATTENTION
Task: {E98D2463-D326-4299-A8B2-08BD68732F09} - \Security Center Update - 909090735 No Task File <==== ATTENTION
2014-06-24 22:44 - 2014-06-24 22:44 - 01465760 _____ () C:\Program Files (x86)\Speed Cleaner\Speed Cleaner.exe
2014-05-19 00:10 - 2014-05-19 00:10 - 00020480 _____ () C:\Program Files (x86)\Speed Cleaner\UrlHistoryLibrary.dll
*****************
"C:\Program Files (x86)\Speed Cleaner" => File/Directory not found.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\mcui_exe => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Feolsyodcotaivc => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Ucrocumytibygi => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Olasgay => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Uzylzaroamvozii => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Speed Cleaner => Value not found.
C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.HTML => Moved successfully.
C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.TXT => Moved successfully.
C:\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.URL => Moved successfully.
'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SkyDrive1'=> Key not found.
'HKLM\Software\Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}'=> Key not found.
'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SkyDrive2'=> Key not found.
'HKLM\Software\Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}'=> Key not found.
'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SkyDrive3'=> Key not found.
'HKLM\Software\Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}'=> Key not found.
'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SugarSyncBackedUp' => Key deleted successfully.
'HKLM\Software\Classes\CLSID\{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472}' => Key deleted successfully.
'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SugarSyncPending' => Key deleted successfully.
'HKLM\Software\Classes\CLSID\{62CCD8E3-9C21-41E1-B55E-1E26DFC68511}' => Key deleted successfully.
'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SugarSyncRoot' => Key deleted successfully.
'HKLM\Software\Classes\CLSID\{A759AFF6-5851-457D-A540-F4ECED148351}' => Key deleted successfully.
'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SugarSyncShared' => Key deleted successfully.
'HKLM\Software\Classes\CLSID\{1574C9EF-7D58-488F-B358-8B78C1538F51}' => Key deleted successfully.
'HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SkyDrive1'=> Key not found.
'HKLM\Software\Wow6432Node\Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}'=> Key not found.
'HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SkyDrive2'=> Key not found.
'HKLM\Software\Wow6432Node\Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}'=> Key not found.
'HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SkyDrive3'=> Key not found.
'HKLM\Software\Wow6432Node\Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}'=> Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
'HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{5B9FD57B-9D6A-4C7A-916F-7E39C0616FCF}' => Key deleted successfully.
'HKCR\CLSID\{5B9FD57B-9D6A-4C7A-916F-7E39C0616FCF}'=> Key not found.
C:\Users\EMoore\AppData\Roaming\Ywymfouc => Moved successfully.
C:\Users\EMoore\AppData\Roaming\Foymonwu => Moved successfully.
C:\Users\EMoore\AppData\Roaming\Rigiar => Moved successfully.
C:\Users\EMoore\AppData\Roaming\Ohybboum => Moved successfully.
C:\Users\EMoore\AppData\Roaming\Umingyy => Moved successfully.
C:\Users\EMoore\AppData\Roaming\Hiimixan => Moved successfully.
C:\Users\EMoore\AppData\Roaming\Enitysy => Moved successfully.
C:\Users\EMoore\AppData\Roaming\Feciuhly => Moved successfully.
C:\Users\EMoore\AppData\Roaming\Xyogykzy => Moved successfully.
C:\Users\EMoore\AppData\Roaming\Opdaur => Moved successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{08893240-5F66-4601-A3CB-1B9F26DBBB56}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{08893240-5F66-4601-A3CB-1B9F26DBBB56}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Security Center Update - 3194036556' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{25A2334B-92A8-40A8-A9CE-4D39AD52A1A1}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{25A2334B-92A8-40A8-A9CE-4D39AD52A1A1}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Security Center Update - 3617965272' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3E58BC6F-7DD0-4639-BA77-394C3D9E95F9}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3E58BC6F-7DD0-4639-BA77-394C3D9E95F9}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Security Center Update - 2115062466' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3E9B3CA8-7247-4DF4-89EA-309CDD308803}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3E9B3CA8-7247-4DF4-89EA-309CDD308803}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Security Center Update - 4123664380' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{64AB149E-A8BF-469E-AE92-FE7293162062}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{64AB149E-A8BF-469E-AE92-FE7293162062}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Security Center Update - 259400069' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9283C280-03F4-4B9A-AEB4-C0DB4BA2648D}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9283C280-03F4-4B9A-AEB4-C0DB4BA2648D}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Security Center Update - 1307576807' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A4B902BD-10A1-4276-B6B1-2F74ABE5B0A0}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A4B902BD-10A1-4276-B6B1-2F74ABE5B0A0}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Security Center Update - 31898372' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A6C5369E-5ADD-46C5-9788-08C3A30BB237}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A6C5369E-5ADD-46C5-9788-08C3A30BB237}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Security Center Update - 554690895' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D2006F81-20A2-4F02-987F-782238C48914}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D2006F81-20A2-4F02-987F-782238C48914}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Security Center Update - 709532655' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E98D2463-D326-4299-A8B2-08BD68732F09}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E98D2463-D326-4299-A8B2-08BD68732F09}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Security Center Update - 909090735' => Key deleted successfully.
"C:\Program Files (x86)\Speed Cleaner\Speed Cleaner.exe" => File/Directory not found.
"C:\Program Files (x86)\Speed Cleaner\UrlHistoryLibrary.dll" => File/Directory not found.
==== End of Fixlog ====

Next, we tried the "Temporary File Cleaner" scan, and it was successful (no error messages following its completion), although it did not cause the desktop icons to disappear during the scan, nor did it ask to reboot the computer after it finished. A report showed up once done, much like what you see for the second screenshot on the download page.

Based on this information, can you confirm that the virus has successfully vanished from the computer?

Next, I had her install Shadow Explorer for the sole purpose of seeing how far back in time Shadow copies were available. She had four selections, but, unfortunately, the earliest one was June 30th, 2014, which is just recently.

Finally, we tried looking into her principal picture folder, and subsequent picture folders contained inside, to see if the "Previous Versions" tab was available under "Properties", but, much like my situation, there was no such tab. The only tabs available in all cases were "General", "Sharing", "Security", "Location", and "Customize".

Does this officially mean that all hope is lost, at least until some more full-proof method is available down the line?

Ultimately, I advised my aunt to keep the encrypted files, since a more clear-cut method may emerge at some point, and considering that withholding the files poses no danger to her computer (or external drives). If so, we can use that method (whatever it may be) to decrypt the affected files. Wise decision?

Thanks,

~Trav.~


----------



## Mark1956 (May 7, 2011)

Unfortunately from what you have posted this would confirm that the Shadow copies don't go back far enough, as I had feared, the infection most probably deleted them all to make it impossible to find a work around.

Keeping all the encrypted files won't pose any risk to the system and although the chances are extremely slim, someone may figure out a way to decrypt the files that are damaged by this infection.

There are just two more scans I would recommend, one to check that no damage has been done to the Windows Services and another, deep on-line scan, to make sure there are no other infections.

Please download *Farbar Service Scanner* and save it to your desktop. Double click on the icon to run the program.


Put a check mark in all the boxes.
Press "*Scan*".
The results will be displayed when the scan completes, please Copy & Paste the entire log into your next reply. It will also save a log on the desktop in a text file.
Please copy and paste the log into your reply.

*Eset online scan instructions.*
*IMPORTANT --->* Please make sure you follow the instruction to *uncheck* the box next to *Remove found threats*. Eset will detect anything that looks even remotely suspicious, this can include legitimate program files. If you do not uncheck the box, as instructed, Eset will automatically remove all suspect files which could leave some of your software inoperative. If you make a mistake these files can be restored from quarantine, but it would be preferable not to add any extra work to the clean up of your system.


Disable your existing Anti Virus following these instructions.
Please go here to use the Eset Online Scanner.
When the web page opens click on this button








If you are not using *Internet Explorer* you will see a message box open asking you to to download the *ESET Smart Installer*, click on the link and allow it to download and then run it. Accept the *Terms of use* and click on *Start*. The required components will download.
If using Internet Explorer the *Terms of use* box will open immediately, accept it and click on *Start*.
After the download is complete the *Computer scan settings* window will open, *IMPORTANT ---->* *uncheck* the box next to *Remove found threats* and click on *Start*. The virus signature database will then download which may take some time depending on the speed of your internet connection. The scan will automatically start when the download is complete.
This is a very thorough scan and may take several hours to complete depending on how much data you have on your hard drive. *Do not* interrupt it, be patient and let it finish.
A Scan Results window will appear at the end of the scan. If it lists any number of Infected Files click on List of found threats. Click on Copy to clipboard, come back to this thread and right click on the message box. Select *Paste* and the report will appear, add any comments you have and post the reply.
Back on the *Eset* window, click the *Back* button and then click on *Finish*.


----------



## Rain1290 (Apr 26, 2011)

Hi Mark,

Okay, I will soon prepare to have her perform these two scans that you recommended. For ESET, though, do we select "Enable detection of potentially unwanted applications", or "Disable detection of potentially unwanted applications"? I am just asking as it does not permit us to move on without selecting one of these options. Also, the "Remove found threats" box seems to be located under "Advanced settings". Is that correct?

Also, in terms of Shadow copies, even though you have only little experience with Shadow Explorer, what do you think is the reason that my own earliest Shadow copy is only June 12th, 2014?

*Edit:* Finally, one way of knowing, too, that the virus has been fully removed is if the ransom/instruction message no longer appears on the desktop screen following every reboot, correct?

~Trav.~


----------



## Mark1956 (May 7, 2011)

I've just checked out the Eset scan and they have changed a few things since I created those instructions, sorry for the confusion.

You should Enable detection of potentially unwanted applications.

Click on Advanced settings and check all the boxes apart from Remove found threats and Use custom proxy settings. We don't need to use a Proxy and no found threats should be removed until I review the scan result.



> *Edit:* Finally, one way of knowing, too, that the virus has been fully removed is if the ransom/instruction message no longer appears on the desktop screen following every reboot, correct?


 Correct.


----------



## Rain1290 (Apr 26, 2011)

Hi Mark,

My apologies for the delayed response. Again, I have a few things that I would like to report based on your recommendations in post #42, as well as a couple of other updates. First, the results from the Farbar Service Scanner:

Farbar Service Scanner Version: 10-06-2014
Ran by EMoore (administrator) on 04-07-2014 at 18:39:27
Running from "C:\Users\EMoore\Desktop"
Microsoft Windows 8.1 (X64)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============
Firewall Disabled Policy: 
==================

System Restore:
============
System Restore Disabled Policy: 
========================

Action Center:
============

Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is set to Demand. The default start type is Auto.
The ImagePath of wuauserv service is OK.
The ServiceDll of wuauserv service is OK.

Windows Autoupdate Disabled Policy: 
============================

Windows Defender:
==============
Other Services:
==============

File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MsMpEng.exe => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed

**** End of log ****

* For the ESET scan*, my aunt disclosed that there were 682 infected files, but a lot of these seemed to be related to her photos, given the target folder names:

.AOLWebSuite .AOLPicturesFullSizeLink { height: 1px; width: 1px; overflow: hidden; } .AOLWebSuite a {color:blue; text-decoration: underline; cursor: pointer} .AOLWebSuite a.hsSig {cursor: default} .AOLWebSuiteM1 {margin: 10px 20px;} .AOLWebSuiteM2 {margin: 5px;} .AOLWebSuiteM3 {margin: 10px;} .dmItemSelected {padding: 2px !important;text-decoration: none !important;color:#fff !important;background-color: #656565 !important;border-radius: 2px;}

C:\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptimizerPro.exe.vir Win32/SpeedingUpMyPC.O application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptProCrash.dll.vir a variant of Win32/SProtector.D potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptProLauncher.exe.vir a variant of Win32/AdWare.SpeedingUpMyPC.D application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptProSmartScan.exe.vir a variant of Win32/Adware.SpeedingUpMyPC.C application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe.vir a variant of Win32/Conduit.SearchProtect.H potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPTool.dll.vir probably a variant of Win32/Conduit.SearchProtect.H potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe.vir probably a variant of Win32/Conduit.SearchProtect.H potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe.vir a variant of Win32/Conduit.SearchProtect.I potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32.dll.vir a variant of Win32/Conduit.SearchProtect.H potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\EMoore\Documents\Optimizer Pro\DECRYPT_INSTRUCTION.HTML.vir Win32/Filecoder.CR trojan
C:\AdwCleaner\Quarantine\C\Users\EMoore\Documents\Optimizer Pro\DECRYPT_INSTRUCTION.TXT.vir Win32/Filecoder.CR trojan
C:\AdwCleaner\Quarantine\C\Users\EMoore\Documents\Optimizer Pro\DECRYPT_INSTRUCTION.URL.vir Win32/Filecoder.CR.Gen trojan
C:\AdwCleaner\Quarantine\C\Users\EMoore\Documents\PC Health Kit\DECRYPT_INSTRUCTION.HTML.vir Win32/Filecoder.CR trojan
C:\AdwCleaner\Quarantine\C\Users\EMoore\Documents\PC Health Kit\DECRYPT_INSTRUCTION.TXT.vir Win32/Filecoder.CR trojan
C:\AdwCleaner\Quarantine\C\Users\EMoore\Documents\PC Health Kit\DECRYPT_INSTRUCTION.URL.vir Win32/Filecoder.CR.Gen trojan
C:\FRST\Quarantine\C\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.HTML.xBAD Win32/Filecoder.CR trojan
C:\FRST\Quarantine\C\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.TXT.xBAD Win32/Filecoder.CR trojan
C:\FRST\Quarantine\C\Users\EMoore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.URL.xBAD Win32/Filecoder.CR.Gen trojan
C:\ProgramData\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Casedata\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Casedata\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Casedata\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540229901_907002\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205358652437\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205358652437\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205358652437\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205358652478\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205358652478\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205358652478\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636147\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636147\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636147\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636161\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636161\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636161\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636921\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636921\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636921\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1210192725504\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1210192725504\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1210192725504\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\Button\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\Button\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\Button\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\frame\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\frame\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\frame\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540236243_917001\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205358652437\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205358652437\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205358652437\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205358652478\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205358652478\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205358652478\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205857636147\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205857636147\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205857636147\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205857636161\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205857636161\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205857636161\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205857636921\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205857636921\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205857636921\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1210192725504\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1210192725504\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1210192725504\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\Images\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\Images\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\Images\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\Images\Button\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\Images\Button\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\Images\Button\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\Images\frame\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\Images\frame\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\Images\frame\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Creative\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Creative\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Creative\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Creative\Product Registration\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Creative\Product Registration\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Creative\Product Registration\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Intel\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Intel\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Intel\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Intel\IntelAppStore\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Intel\IntelAppStore\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Intel\IntelAppStore\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Intel\IntelAppStore\assets\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Intel\IntelAppStore\assets\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Intel\IntelAppStore\assets\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Intel\IntelAppStore\html_docs\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Intel\IntelAppStore\html_docs\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Intel\IntelAppStore\html_docs\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Intel\IntelAppStore\html_docs\pc-ux\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Intel\IntelAppStore\html_docs\pc-ux\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Intel\IntelAppStore\html_docs\pc-ux\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Intel\IntelAppStore\html_docs\pc-ux\branding\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Intel\IntelAppStore\html_docs\pc-ux\branding\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Intel\IntelAppStore\html_docs\pc-ux\branding\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Intel\IntelAppStore\html_docs\pc-ux\branding\img\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Intel\IntelAppStore\html_docs\pc-ux\branding\img\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Intel\IntelAppStore\html_docs\pc-ux\branding\img\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Intel\IntelAppStore\html_docs\pc-ux\resources\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Intel\IntelAppStore\html_docs\pc-ux\resources\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Intel\IntelAppStore\html_docs\pc-ux\resources\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Intel\IntelAppStore\html_docs\pc-ux\resources\img\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Intel\IntelAppStore\html_docs\pc-ux\resources\img\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Intel\IntelAppStore\html_docs\pc-ux\resources\img\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Microsoft\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Microsoft\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Microsoft\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Nitro PDF\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Nitro PDF\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Nitro PDF\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Nitro PDF\Professional\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Nitro PDF\Professional\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Nitro PDF\Professional\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Nitro PDF\Professional\7.0\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Nitro PDF\Professional\7.0\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Nitro PDF\Professional\7.0\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\Nitro PDF\Professional\7.0\Stamps\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\Nitro PDF\Professional\7.0\Stamps\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\Nitro PDF\Professional\7.0\Stamps\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\ProgramData\OneKey Recovery\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\ProgramData\OneKey Recovery\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\ProgramData\OneKey Recovery\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\Administrator\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\Administrator\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\Administrator\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\Administrator\AppData\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\Administrator\AppData\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\Administrator\AppData\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\Administrator\AppData\Local\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\Administrator\AppData\Local\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\Administrator\AppData\Local\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\Administrator\AppData\Local\Microsoft\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\Administrator\AppData\Local\Microsoft\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\Administrator\AppData\Local\Microsoft\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Casedata\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Casedata\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Casedata\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540229901_907002\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205358652437\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205358652437\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205358652437\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205358652478\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205358652478\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205358652478\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636147\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636147\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636147\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636161\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636161\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636161\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636921\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636921\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636921\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1210192725504\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1210192725504\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1210192725504\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\Button\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\Button\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\Button\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\frame\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\frame\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\frame\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540236243_917001\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205358652437\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205358652437\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205358652437\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205358652478\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205358652478\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205358652478\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205857636147\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205857636147\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205857636147\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205857636161\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205857636161\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205857636161\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205857636921\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205857636921\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1205857636921\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1210192725504\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1210192725504\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\1210192725504\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\Images\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\Images\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\Images\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\Images\Button\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\Images\Button\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\Images\Button\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\Images\frame\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\Images\frame\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Corel\Messages\540236243_917001\EN\MessageCache1\Workflow\shared\Images\frame\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Creative\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Creative\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Creative\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Creative\Product Registration\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Creative\Product Registration\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Creative\Product Registration\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Intel\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Intel\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Intel\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Intel\IntelAppStore\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Intel\IntelAppStore\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Intel\IntelAppStore\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Intel\IntelAppStore\assets\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Intel\IntelAppStore\assets\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Intel\IntelAppStore\assets\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Intel\IntelAppStore\html_docs\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Intel\IntelAppStore\html_docs\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Intel\IntelAppStore\html_docs\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Intel\IntelAppStore\html_docs\pc-ux\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Intel\IntelAppStore\html_docs\pc-ux\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Intel\IntelAppStore\html_docs\pc-ux\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Intel\IntelAppStore\html_docs\pc-ux\branding\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Intel\IntelAppStore\html_docs\pc-ux\branding\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Intel\IntelAppStore\html_docs\pc-ux\branding\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Intel\IntelAppStore\html_docs\pc-ux\branding\img\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Intel\IntelAppStore\html_docs\pc-ux\branding\img\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Intel\IntelAppStore\html_docs\pc-ux\branding\img\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Intel\IntelAppStore\html_docs\pc-ux\resources\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Intel\IntelAppStore\html_docs\pc-ux\resources\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Intel\IntelAppStore\html_docs\pc-ux\resources\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Intel\IntelAppStore\html_docs\pc-ux\resources\img\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Intel\IntelAppStore\html_docs\pc-ux\resources\img\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Intel\IntelAppStore\html_docs\pc-ux\resources\img\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Microsoft\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Microsoft\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Microsoft\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Nitro PDF\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Nitro PDF\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Nitro PDF\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Nitro PDF\Professional\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Nitro PDF\Professional\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Nitro PDF\Professional\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Nitro PDF\Professional\7.0\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Nitro PDF\Professional\7.0\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Nitro PDF\Professional\7.0\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\Nitro PDF\Professional\7.0\Stamps\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\Nitro PDF\Professional\7.0\Stamps\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\Nitro PDF\Professional\7.0\Stamps\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\All Users\OneKey Recovery\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\All Users\OneKey Recovery\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\All Users\OneKey Recovery\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\2006_08_03\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\2006_08_03\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\2006_08_03\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Local\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Local\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Local\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Local\AMD\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Local\AMD\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Local\AMD\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Local\AMD\Fuel\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Local\AMD\Fuel\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Local\AMD\Fuel\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Local\Microsoft\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Local\Microsoft\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Local\Microsoft\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Local\Microsoft\Internet Explorer\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Local\Microsoft\Internet Explorer\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Local\Microsoft\Internet Explorer\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\LocalLow\FromDocToPDF_65EI\Installr\Cache\05868699.exe a variant of Win32/Toolbar.MyWebSearch.V potentially unwanted application
C:\Users\EMoore\AppData\Roaming\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Adobe\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Adobe\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Adobe\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Adobe\Flash Player\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Adobe\Flash Player\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Adobe\Flash Player\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Adobe\Flash Player\AssetCache\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Adobe\Flash Player\AssetCache\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Adobe\Flash Player\AssetCache\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Adobe\Flash Player\AssetCache\KUDSRMBX\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Adobe\Flash Player\AssetCache\KUDSRMBX\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Adobe\Flash Player\AssetCache\KUDSRMBX\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Messages\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Messages\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Messages\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Messages\1381935231546\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Messages\1381935231546\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Messages\1381935231546\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Messages\1381935231613\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Messages\1381935231613\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Messages\1381935231613\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205358652437\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205358652437\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205358652437\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205358652478\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205358652478\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205358652478\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636147\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636147\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636147\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636161\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636161\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636161\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636921\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636921\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1205857636921\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1210192725504\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1210192725504\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\1210192725504\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\Button\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\Button\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\Button\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\frame\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\frame\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache1\Workflow\shared\Images\frame\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Messages\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Messages\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Messages\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Messages\1381935231546\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Messages\1381935231546\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Messages\1381935231546\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Messages\1381935231613\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Messages\1381935231613\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Messages\1381935231613\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\1205358652437\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\1205358652437\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\1205358652437\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\1205358652478\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\1205358652478\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\1205358652478\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\1205857636147\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\1205857636147\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\1205857636147\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\1205857636161\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\1205857636161\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\1205857636161\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\1205857636921\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\1205857636921\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\1205857636921\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\1210192725504\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\1210192725504\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\1210192725504\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\shared\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\shared\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\shared\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\shared\Images\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\shared\Images\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\shared\Images\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\shared\Images\Button\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\shared\Images\Button\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\shared\Images\Button\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\shared\Images\frame\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\shared\Images\frame\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Corel\Messages\540229901_907002\EN\MessageCache2\Workflow\shared\Images\frame\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\FirstClass\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\FirstClass\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\FirstClass\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\FirstClass\Images\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\FirstClass\Images\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\FirstClass\Images\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Nitro PDF\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Nitro PDF\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Nitro PDF\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Nitro PDF\Professional\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Nitro PDF\Professional\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Nitro PDF\Professional\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Nitro PDF\Professional\7.0\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Nitro PDF\Professional\7.0\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Nitro PDF\Professional\7.0\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\AppData\Roaming\Nitro PDF\Professional\7.0\Stamps\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Nitro PDF\Professional\7.0\Stamps\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\AppData\Roaming\Nitro PDF\Professional\7.0\Stamps\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Documents\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Documents\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Documents\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Documents\FirstClass\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Documents\FirstClass\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Documents\FirstClass\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Documents\FirstClass\download\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Documents\FirstClass\download\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Documents\FirstClass\download\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Documents\HTML\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Documents\HTML\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Documents\HTML\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Documents\HTML\document1\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Documents\HTML\document1\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Documents\HTML\document1\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Documents\Scanned Documents\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Documents\Scanned Documents\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Documents\Scanned Documents\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Downloads\Red lentil soup with lemon & herbs Recipe Toronto Star_files\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Downloads\Red lentil soup with lemon & herbs Recipe Toronto Star_files\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Downloads\Red lentil soup with lemon & herbs Recipe Toronto Star_files\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2006-12 (Dec)\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006-12 (Dec)\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006-12 (Dec)\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2006_07_24\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_07_24\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_07_24\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2006_07_26\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_07_26\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_07_26\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2006_07_27\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_07_27\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_07_27\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2006_07_28\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_07_28\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_07_28\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2006_07_30\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_07_30\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_07_30\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2006_07_31\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_07_31\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_07_31\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2006_08_01\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_01\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_01\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2006_08_02\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_02\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_02\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2006_08_03\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_03\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_03\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2006_08_04\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_04\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_04\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2006_08_05\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_05\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_05\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2006_08_06\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_06\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_06\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2006_08_07\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_07\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_07\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2006_08_08\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_08\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_08\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2006_08_09\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_09\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_09\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2006_08_10\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_10\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_10\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2006_08_11\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_11\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_11\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2006_08_12\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_12\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_12\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2006_08_13\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_13\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_13\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2006_08_14\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_14\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_14\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2006_08_15\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_15\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_15\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2006_08_16\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_16\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2006_08_16\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2007-01 (Jan)\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2007-01 (Jan)\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2007-01 (Jan)\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2007-05 (May)\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2007-05 (May)\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2007-05 (May)\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2007-06 (Jun)\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2007-06 (Jun)\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2007-06 (Jun)\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2007-07 (Jul)\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2007-07 (Jul)\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2007-07 (Jul)\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2007-08 (Aug)\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2007-08 (Aug)\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2007-08 (Aug)\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2007-09 (Sep)\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2007-09 (Sep)\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2007-09 (Sep)\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2007-10 (Oct)\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2007-10 (Oct)\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2007-10 (Oct)\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2008-03 (Mar)\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2008-03 (Mar)\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2008-03 (Mar)\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2008-04 (Apr)\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2008-04 (Apr)\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2008-04 (Apr)\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2008-12 (Dec)\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2008-12 (Dec)\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2008-12 (Dec)\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2009-01 (Jan)\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2009-01 (Jan)\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2009-01 (Jan)\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2009-03 (Mar)-27\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2009-03 (Mar)-27\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2009-03 (Mar)-27\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2009-04 (Apr)-15\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2009-04 (Apr)-15\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2009-04 (Apr)-15\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2012-12-01\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2012-12-01\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2012-12-01\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2013-03-06\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2013-03-06\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2013-03-06\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2013-04-23\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2013-04-23\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2013-04-23\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2013-07-25\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2013-07-25\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2013-07-25\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2013-09-02\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2013-09-02\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2013-09-02\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2014-02-17\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2014-02-17\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2014-02-17\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\2014-02-17 (2)\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2014-02-17 (2)\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\2014-02-17 (2)\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\Arizona\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\Arizona\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\Arizona\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\download\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\download\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\download\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\Kodak Pictures\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\Kodak Pictures\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\Kodak Pictures\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\Kodak Pictures\2005-08-02\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\Kodak Pictures\2005-08-02\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\Kodak Pictures\2005-08-02\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\Kodak Pictures\2005-08-15\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\Kodak Pictures\2005-08-15\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\Kodak Pictures\2005-08-15\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\Pictures\maeve\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\maeve\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\Pictures\maeve\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\EMoore\SyncFolder\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\EMoore\SyncFolder\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\EMoore\SyncFolder\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\Public\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\Public\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\Public\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\Public\Documents\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\Public\Documents\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\Public\Documents\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\Public\Documents\WordPerfect Office\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\Public\Documents\WordPerfect Office\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\Public\Documents\WordPerfect Office\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\Public\Documents\WordPerfect Office\X5\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\Public\Documents\WordPerfect Office\X5\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\Public\Documents\WordPerfect Office\X5\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen trojan
C:\Users\Public\Documents\WordPerfect Office\X5\Tutorial Samples\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
C:\Users\Public\Documents\WordPerfect Office\X5\Tutorial Samples\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
C:\Users\Public\Documents\WordPerfect Office\X5\Tutorial Samples\DECRYPT_INSTRUCTION.URL Win32/Filecoder.CR.Gen Trojan

I can additionally confirm that she no longer sees the ransom instruction message that used to come up on her desktop after every time the computer restarts/powers on.  Thank you!

Also, in terms of Shadow copies, even though you have only little experience with Shadow Explorer, what do you think is the reason that my own earliest Shadow copy is only June 12th, 2014?

~Trav.~


----------



## Mark1956 (May 7, 2011)

Everything in the Eset scan relates directly to the infection apart from a few items already in Quarantine, the quickest way to take all those bad files out is to run Eset again to remove them.

Go through the same routine you did before with Eset, check all the boxes exactly as before, but this time also check the box to Remove Found Threats. Post the log results when done.

As for your questions about Shadow Copies, I will need to investigate that to give an answer, I'll see what I can find out about it.


----------



## Rain1290 (Apr 26, 2011)

Hi Mark,


Okay, we will work on that as soon as possible. Does a log window open up automatically when threats are removed in ESET?


Also, by removing found threats, would ESET delete her encrypted photos and WordPerfect documents?


Thanks,


~Trav.~


----------



## Mark1956 (May 7, 2011)

A log should open when threats are removed.

Eset will only delete the files shown in the report above.


----------



## Rain1290 (Apr 26, 2011)

Thanks, Mark.


Based on the report, does it appear that her pictures will be deleted by ESET?


Thanks again,


~Trav.~


----------



## Mark1956 (May 7, 2011)

You're welcome.

As I said in my previous post:

Eset will only delete the files shown in the report above.

None of those files are pictures or any other personal files, they were all produced by the infection.


----------



## Rain1290 (Apr 26, 2011)

Hi Mark,


I apologize for this delayed response! I hope that you are still subscribed to this thread!


In any case, I just wanted to inform you that my aunt has been very pre-occupied lately, so she has not been finding the time to perform the scan again in order to delete the infected files. Once she does, I will post the logging information here.


Thanks for your patience, and, once again, my sincere apologies for the delayed response.


~Trav.~


----------



## Mark1956 (May 7, 2011)

No problem, I never unsubscribe from a thread even after it has been solved just in case the person I was helping makes another post.

Whenever your Aunt is ready will be fine.


----------



## Rain1290 (Apr 26, 2011)

Hi Mark,


I am so sorry that this took so long - my aunt has been (and continues to be) incredibly busy. That said, she recently contacted me and mentioned that someone told her something about "SanDisk" being a potential solution in file recoveries. I do not know much about its functionalities in relation to this problem, but someone claimed that it might help. Have you heard about this "SanDisk"? If so, could it be of assistance?


Thanks, and we will try to run the (ESET) anti-virus again as soon as possible (in accordance with post #46).


~Trav.~


----------



## Mark1956 (May 7, 2011)

'SanDisk' is a company that produces memory cards, they do make a data recovery program, but that will not decrypt encrypted files, it is used to recover files that have been accidentally deleted.

I can assure you (with the deepest regret) that there is no known way at present to recover the encrypted files. You could make a full back up of them to a DVD or external hard drive in the hope someone may find a way to decrypt them in the future, but I seriously doubt if anyone will ever achieve this, it needs the encryption key which only the Malware author is in possession of. Imagine trying to guess the numbers drawn in the next four lottery draws, you have more chance of getting that right than you have trying to guess the decryption key to get those files back, file decryption is extremely secure and the criminals that created this nasty infection have taken full advantage of it.

Having just helped another victim of this nasty infection I have found another method of removing all the files put on the system by the infection. If Eset takes more than five hours to complete, stop the scan and let me know and I will post the instructions.


----------



## Rain1290 (Apr 26, 2011)

Hi Mark,

Still patiently waiting on my aunt! I thank you for your continued patience with us, and I thank you for the valuable information that you kindly provided in your previous posting!

Also, I believe that I recently contracted some viruses of my own when attempting to download a trial DVD burning program online. Suddenly, all of these unwanted programs installed themselves (which I managed to successfully remove in add/remove programs). I then noticed pop-ups appearing on the top and bottom right with most webpages that I visited beyond my homepage. The pop-up ads and new unwanted windows are still continuing, even though I removed all of the new programs that were introduced, so I suspect that there are viruses/infections present. Some of these adds are typically in the form of "computer protection" offers, especially with the new windows that come up when I go to any website (either on Internet Explorer or Google Chrome). By fully removing one of the programs (I believe "istart") and its components, I was able to restore my homepage (Yahoo!).

Out of precaution, I used Windows Defender to do a full scan, and it found nothing. I then performed the same ESET scan that you recommended, and, unlike Windows Defender, it found 42 threats in my system, and I am not sure if these are potent viruses/infections in any way (I haven't removed them just yet). As such, I will post the logging information for you here, just for you to take a look before I do anything:

C:\Config.Msi\393744f5.rbf a variant of MSIL/Adware.Proxomoto.A application
C:\Program Files\005\vulsrsebjh64.exe a variant of Win64/Adware.Adpeak.C application
C:\Program Files (x86)\395821AD-3E17-4F17-BAB2-932B7EA6E81B\etmajyzoqm64.exe a variant of Win64/Adware.Adpeak.F application
C:\Program Files (x86)\FLVM Player\FLVPlayerUninstaller.exe a variant of MSIL/Solimba.AC potentially unwanted application
C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64.dll a variant of Win32/ClientConnect.A potentially unwanted application
C:\Program Files (x86)\SupTab\HpUI.exe Win32/Thinknice.E potentially unwanted application
C:\Program Files (x86)\SupTab\Loader32.exe Win32/Thinknice.E potentially unwanted application
C:\Program Files (x86)\SupTab\Loader64.exe Win64/Thinknice.E potentially unwanted application
C:\Program Files (x86)\SupTab\SupTab.dll Win32/Thinknice.B potentially unwanted application
C:\Program Files (x86)\SupTab\uninstall.exe Win32/Thinknice.E potentially unwanted application
C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll Win32/Thinknice.E potentially unwanted application
C:\Program Files (x86)\SupTab\WindowsSupportDll64.dll Win64/Thinknice.D potentially unwanted application
C:\ProgramData\IePluginServices\PluginService.exe Win32/ELEX.AV potentially unwanted application
C:\Users\All Users\IePluginServices\PluginService.exe Win32/ELEX.AV potentially unwanted application
C:\Users\Travis\AppData\Local\Microsoft\Windows\INetCache\IE\GDPFD73O\v-bates[1].exe a variant of Win32/Toolbar.BitCocktail.B potentially unwanted application
C:\Users\Travis\AppData\Local\Temp\MsiToExe.SetupExtension.msi multiple threats
C:\Users\Travis\AppData\Local\Temp\nsgDEC6.exe Win32/Conduit.SearchProtect.R potentially unwanted application
C:\Users\Travis\AppData\Local\Temp\nsk4AD.exe Win32/Conduit.SearchProtect.R potentially unwanted application
C:\Users\Travis\AppData\Local\Temp\nskEAAB.tmp a variant of Win32/ClientConnect.A potentially unwanted application
C:\Users\Travis\AppData\Local\Temp\nss2401.exe Win32/Conduit.SearchProtect.R potentially unwanted application
C:\Users\Travis\AppData\Local\Temp\nst279.exe Win32/Conduit.SearchProtect.R potentially unwanted application
C:\Users\Travis\AppData\Local\Temp\nsw2160.exe Win32/Conduit.SearchProtect.R potentially unwanted application
C:\Users\Travis\AppData\Local\Temp\v-bates.exe a variant of Win32/Toolbar.BitCocktail.B potentially unwanted application
C:\Users\Travis\AppData\Local\Temp\8BF5C37C-EDD1-4ada-A4EB-B36299196186_\1.zipDir\tmp\wpm_ns_v20.0.0.502.exe a variant of Win32/ELEX.AM potentially unwanted application
C:\Users\Travis\AppData\Local\Temp\n5373\FLVMPlayerSetup-c45490cb.exe a variant of MSIL/Solimba.AC potentially unwanted application
C:\Users\Travis\AppData\Local\Temp\n5373\meteorids_1607_CA-b0afc253.exe multiple threats
C:\Users\Travis\AppData\Local\Temp\n5373\s5373.exe a variant of MSIL/Solimba.AC potentially unwanted application
C:\Users\Travis\AppData\Local\Temp\nsdBDA6.tmp\Helper.dll a variant of MSIL/Adware.PullUpdate.A application
C:\Users\Travis\AppData\Local\Temp\nso7B48.tmp\istart123_0608-31d7add9.exe a variant of Win32/ELEX.AT potentially unwanted application
C:\Users\Travis\AppData\Local\Temp\nso7B48.tmp\setup.exe a variant of Win32/Packed.ScrambleWrapper.K potentially unwanted application
C:\Users\Travis\AppData\Local\Temp\nso7B48.tmp\ss54.exe a variant of Win32/Packed.ScrambleWrapper.K potentially unwanted application
C:\Users\Travis\AppData\Local\Temp\nst5DFE.tmp\Helper.dll a variant of MSIL/Adware.PullUpdate.A application
C:\Users\Travis\AppData\Local\Temp\nst5DFE.tmp\MeteoroidsInstall.exe a variant of MSIL/Adware.PullUpdate.E application
C:\Users\Travis\Downloads\imgburn-setup.exe Win32/DownloadAdmin.G potentially unwanted application
C:\Users\Travis\Downloads\ImgBurn.exe a variant of MSIL/Solimba.AH potentially unwanted application
C:\Users\Travis\Downloads\Nero_BurningROM2014_setup-15.1c_trial (1).exe a variant of Win32/InstallCore.PZ potentially unwanted application
C:\Users\Travis\Downloads\Nero_BurningROM2014_setup-15.1c_trial.exe a variant of Win32/InstallCore.PZ potentially unwanted application
C:\Users\Travis\Downloads\Unconfirmed 615916.crdownload a variant of Win32/CNETInstaller.B potentially unwanted application
C:\Windows\apppatch\apppatch64\SPVCLdr64.dll_1408057325206 a variant of Win32/ClientConnect.A potentially unwanted application
C:\Windows\Microsoft\sogr\Installer.dll a variant of MSIL/Adware.Proxomoto.A application
C:\Windows\Microsoft\sogr\InstallerLibrary.dll a variant of MSIL/Adware.Proxomoto.A application
C:\Windows\Microsoft\sogr\WindowsUpdater.exe a variant of MSIL/Adware.Proxomoto.G application
Operating memory Win32/Thinknice.E potentially unwanted application

Are any of these very harmful? Am I free to remove these threats with ESET? Once removed, will the those aforementioned pop-ups disappear? If not, should I attempt a system restore?

Thanks,

~Trav.~_


----------



## Mark1956 (May 7, 2011)

All of those threats are Adware, you should run the scan again and tick the box to remove found threats. I would then recommend you run Adwcleaner and keep running it until it comes up with a clean log. If any items persist in returning it will need further attention.

System Restore should never be used when trying to clean a system.


----------



## Rain1290 (Apr 26, 2011)

Hi Mark, 


Thank you for your posting. Do you have a (safe) download link to Adwcleaner? Also, how would I know when a "clean log" comes up?



Thanks again,


~Trav.~


----------



## Mark1956 (May 7, 2011)

The instructions with the link for the download are in post 2 which you have already followed.

The log is clean when it shows nothing listed as Deleted, if in doubt post the log for me to check.


----------



## Rain1290 (Apr 26, 2011)

Hi Mark,

Okay, I think everything is mostly working, thank you! Just to inform you, I did another scan with ESET, and it found three more infections and removed them successfully. I then did yet another scan with ESET, but it found nothing. 

Following this, I used Adwcleaner, and it found two items, which I cleaned using the "Clean" button. I then used it a second and third time, and it found nothing on both attempts. I then noticed that on Internet Explorer, the pop-up adds and new windows have ceased, but I see them continuing in Google Chrome (my secondary browser). Is there a reason for that? Would re-installing Google Chrome fix that issue?

*Edit:* Also, should I have deleted the quarantined files in ESET?

Thanks,

~Trav.~


----------



## Mark1956 (May 7, 2011)

Sounds like your nearly there. Google can be a problem with some Adware as they can get reinstalled with the sync system it uses. The best way to deal with that is to reinstall it, but you must remove all the sync data, follow this guide:

First save all your bookmarks/favourites.
Open Chrome, click on the 3 bars in the top right hand corner, select *Bookmarks* and then *Bookmarks Manager.*
Click on *Organise* and then select *Export Bookmarks to HTML file* and choose the *Desktop* to save it.
When you have re-installed Chrome repeat the process and select *Import Bookmarks* to put them back.

Open Chrome, click on the three bars in the top right hand corner and select *Settings*.
At the top in the text of the next window click on *Google Dashboard*, at the *Chrome sync* screen click on *Stop and Clear* at the bottom. Wait to see the confirmation message:"Finished clearing synced Chrome data".
Shut Google Chrome, click on *Start* > *Control Panel* > *Programs and Features* (or *Add/Remove Programs* in XP) and uninstall *Google Chrome*. Select Everything for removal when asked.

When done, use IE to Download Temporary file cleaner and save it to the desktop.
Double click on the icon to run it (it appears as a dark grey dustbin). For Windows 7 and Vista right click the icon and select *Run as Administrator*.
When the window opens click on* Start*. It will close all running programs and clear the desktop icons.
When complete you may be asked to reboot, if so accept the request and your PC will reboot automatically.

If there is no request to reboot please reboot anyway and run the scan again.

Reboot the system again and then reinstall Google Chrome from Here


----------



## Rain1290 (Apr 26, 2011)

Hi Mark,


Fortunately for me, I only have just four favorites in Google Chrome, which are also duplicated in Internet Explorer. 


When I open Google Chrome and click on the top right button (the three-bar button), and then "Settings", I do not see "Google Dashboard" in the next window. Could it be located somewhere else?


Also, was it okay to delete the quarantined files in ESET?


Thanks,


~Trav.~


----------



## Mark1956 (May 7, 2011)

You need to be signed in to Google for Google Dashboard to appear.

Files held in the Eset quarantine are quite safe, but deleting them will not cause any issues.


----------



## Rain1290 (Apr 26, 2011)

A big thanks to you, Mark! Indeed, everything worked out perfectly, and Google Chrome has been successfully re-installed following the two reboots associated with TFC.  I also have not noticed any adds emerging on the same sites where I observed them previously, so it looks like everything is running normally. 


Thank you so, so much! And now we will continue to patiently wait for my aunt! 


Cheers,


~Trav.~


----------



## Mark1956 (May 7, 2011)

You're most welcome and ready to proceed with the other PC.


----------



## Rain1290 (Apr 26, 2011)

Possible solution?

http://www.bbc.com/news/technology-28661463

https://www.decryptcryptolocker.com/

My cousin recently brought this to my attention, and I wanted to know if this might help? It is quite the coincidence when this news came out, too!

~Trav.~


----------



## Mark1956 (May 7, 2011)

That sounds very encouraging, give it a go.


----------



## Rain1290 (Apr 26, 2011)

Hi Mark,


My apologies for the delayed response.


Well, we gave it a try, but unfortunately, it appears that the keys are unique to Crypto Wall. The decryption feature provided in the above link is specifically for keys pertaining to Crypto Locker. Ah well, it was worth a shot, especially since there was the possibility of the feature being applicable to any kind of encryption. 


When she tried with several files, a message came up each time stating something along the lines to upload a file related to Crypto Locker, suggesting that this was only meant for encryptions associated with Crypto Locker. 


In any case, this may be encouraging news since there may be a possibility that those authors associated with Crypto Wall may be caught at some point, as well. 


~Trav.~


----------



## Mark1956 (May 7, 2011)

No problem with the delay. Hopefully the Crypto Wall encryption keys will be made available once the authorities catch the criminals, I wish you the best of luck.

This thread will remain open for a while, if you have any news or you hear from your Aunt again and the thread is closed, please send a PM to a Moderator and ask for the thread to be re-opened.


----------

