multiple dllhost.exe *32 instances, dreadfully slow PC #?

jpoor
New Helpee

Posts: 19

multiple dllhost.exe *32 instances, dreadfully slow PC #? Nov 10, 2014 19:40:12 GMT -8

Post by jpoor on Nov 10, 2014 19:40:12 GMT -8

Hello,

I have a Dell Optiplex 390 desktop running on Windows 7. Lately, the PC has been slowing to a standstill, and the task manager shows high CPU and memory usage, even when no applications are running. Multiple instances of dllhost.exe can be seen in the task manager. Ending these processes give temporary relief, but they come right back within minutes.

My antivirus has been Windows Security Essentials. WSE did catch a bunch of trojans and such, but the behavior persists.

For the last 24 hours, WSE scans have given a "Preliminary" warning that the computer might be infected, but at the end of the scan, no problems are found. After googleing this condition, I followed advice to try "Malwarebytes Anti-Malware" This program found 21 additional problems missed by WSE.

But the dllhost.exes keep coming.... I then found a link to this board. I will hold off an any further actions.

I would be grateful if you could help me!

Thanks,

Jonathan

Last Edit: Nov 24, 2014 20:26:12 GMT -8 by Quads

Krusty
Logging Assistant

In Oz

Posts: 2,330

multiple dllhost.exe *32 instances, dreadfully slow PC #? Nov 10, 2014 19:49:05 GMT -8

Post by Krusty on Nov 10, 2014 19:49:05 GMT -8

Do Not use any tools or any programs for cleaning used until being asked / instructed to do so!!!!!

Malware removal can be difficult over a forum as it is, without a user doing their own actions, the tools used are more advanced and thus have added danger that comes with that. This board is protected so that only Malware removers, Admin and Mods can reply to a users thread but all members can create a thread asking for removal of Infection(s)

Make changes to your computer only when the Malware Expert specifically states it. The Malware Experts request specific steps to be followed, as some malware removal requires multiple steps and evaluations along the way. When you take other advice or make other changes, this often negates the work done by the expert, and can sometimes result in an inoperable system.

This also includes any tools or steps other than those the from the Malware Expert. We need to be certain about the state of your system to see what actually is going on, and what is required to fix the system while not harming the rest of the system. Most often, well-intentioned independent efforts can make things much worse. The malware remediation tools are more advanced than othe tools, and can often create bigger problems when used without expert guidance.

Follow all the directions in order, and to the end. Please perform all steps in the order they are listed in each set of instructions. As you might imagine, some steps are a bit complicated. If things are not clear, be sure to stop and let the Malware Expert know the problem. We don't mind clarifying a situation, as others might have the same question. If a tool does not run as expected, don't force it. Stop the steps, and update the forum topic with the current situation. It is better stop and let us know, than to force a tool to run and cause bigger problems.

Also, when your computer is clean and we are finished, the Expert will tell you we are finished. Malware removal is a process that requires verification, and we want to be sure your system is completely clean before we're done.

When describing your problem, provide as much information as possible, as soon as possible. Explain as best you can what happens with your computer, e.g. it beeps three times, black screen with cursor then goes no further, system gets stuck at the Windows startup logo, etc. This helps the expert to understand what is happening to the system and what may be wrong. If your computer cannot start up successfully please provide details about your installed Windows Operating System, including the Version, Edition and if it is a 32bit or a 64bit system. (e.g. Windows Vista Home Premium 32-bit)

When the user follow instructions and things still go a little haywire, and it does happen, it is up to us to sort the extra problem out.

Take longer to read if your language is not English, so that hopefully it is understood.

Reply stating you have read the post fully.

I also if it is busy (have a lot of systems at once to deal with) like being in a supermarket checkout line, waiting their turn, I use the forum like a checkout line.

And the Forum is VERY BUSY at the moment for just 2 Removers, so Please be patient as no one would want us to do a script wrong and hurt someones Computer / System.

I do NOT do support by PM.

Thank you.

jpoor New Helpee Posts: 19	multiple dllhost.exe *32 instances, dreadfully slow PC #? Nov 10, 2014 19:49:46 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by jpoor on Nov 10, 2014 19:49:46 GMT -8 I have read and understood.

Krusty Logging Assistant In Oz Posts: 2,330	multiple dllhost.exe *32 instances, dreadfully slow PC #? Nov 10, 2014 19:51:55 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by Krusty on Nov 10, 2014 19:51:55 GMT -8 What is your Operating System including whether it is 32 bit or 64 bit? Thanks.
	I do NOT do support by PM. Thank you.

jpoor New Helpee Posts: 19	multiple dllhost.exe *32 instances, dreadfully slow PC #? Nov 10, 2014 20:13:01 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by jpoor on Nov 10, 2014 20:13:01 GMT -8 Windows 7 Professional, Service Pack 1, 64 bit.

Krusty
Logging Assistant

In Oz

Posts: 2,330

multiple dllhost.exe *32 instances, dreadfully slow PC #? Nov 10, 2014 20:18:06 GMT -8

Post by Krusty on Nov 10, 2014 20:18:06 GMT -8

You may need to disable your AV until after you have created the logs.

Read Slowly and all of it.

Please download www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ You need to download the 64 bit version.

Place FRST64.exe onto your desktop from where ever it downloaded to.

Start FRST64 that is on your Desktop

The tool will start to run.
When the tool opens click Yes to disclaimer. (if it does)

Press Scan button.

It will make a logs (FRST.txt and addition.txt) on your Desktop Please attach the log in your reply back. Or open the logs in notepad and copy the logs and paste back in a message as a reply.

IF ADDITION.txt does not want to upload

go to Wikisend wikisend.com/ OR go to pastebin.com

and upload the addition.txt there, then post the download link back in a message.

I do NOT do support by PM.

Thank you.

jpoor
New Helpee

Posts: 19

multiple dllhost.exe *32 instances, dreadfully slow PC #? Nov 10, 2014 20:52:01 GMT -8

Post by jpoor on Nov 10, 2014 20:52:01 GMT -8

FRST.txt

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-11-2014
Ran by ConradPoor (administrator) on XP-PC on 10-11-2014 23:28:05
Running from C:\Users\ConradPoor\Desktop
Loaded Profile: ConradPoor (Available profiles: Jonathan Poor & ConradPoor)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Broadcom Corporation) C:\Program Files\Broadcom\MgmtAgent\BrcmMgmtAgent.exe
(Citrix Online, a division of Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\GoToMyPC\g2svc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Citrix Online, a division of Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\GoToMyPC\g2comm.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Online Games Manager\ogmservice.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Citrix Online, a division of Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\GoToMyPC\g2pre.exe
(Citrix Online, a division of Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\GoToMyPC\g2tray.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2782096 2010-07-25] (CANON INC.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM-x32\...\Run: [RemoteControl9] => C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe [87336 2009-07-06] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD9LanguageShortcut] => C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe [50472 2010-04-29] (CyberLink Corp.)
HKLM-x32\...\Run: [Desktop Disc Tool] => C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [514544 2010-11-17] ()
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1213848 2010-09-14] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452016 2010-09-09] (CANON INC.)
HKLM-x32\...\Run: [LifeCam] => C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation)
HKLM-x32\...\Run: [AMD AVT] => C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [20992 2012-03-19] ()
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-623171776-3952065402-665669785-1014\...\Policies\Explorer: [NoSaveSettings] 0
HKU\S-1-5-21-623171776-3952065402-665669785-1014\...\MountPoints2: {99dc5c5d-e8a8-11e0-8df7-806e6f6e6963} - D:\autorun.exe
HKU\S-1-5-21-623171776-3952065402-665669785-1014\...\MountPoints2: {b886e223-5f1a-11e2-941b-806e6f6e6963} - "F:\WD SmartWare.exe" autoplay=true
HKU\S-1-5-21-623171776-3952065402-665669785-1014\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 239 more characters). <==== Poweliks!

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = g.msn.com/USREL/1
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope {6EA01293-93B9-40ED-99DB-08172504E430} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {79489AFD-C3B4-4FD0-AE85-77D80161EC35} URL =
SearchScopes: HKCU - {6EA01293-93B9-40ED-99DB-08172504E430} URL =
SearchScopes: HKCU - {79489AFD-C3B4-4FD0-AE85-77D80161EC35} URL =
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Microsoft Web Test Recorder 10.0 Helper -> {DDA57003-0068-4ed2-9D32-4D1EC707D94D} -> C:\Program Files (x86)\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
DPF: HKLM-x32 {362C56AA-6E4F-40C7-A0B5-85501DBDAD77} i.dell.com/images/global/js/scanner/SysProExe.cab
DPF: HKLM-x32 {4871A87A-BFDD-4106-8153-FFDE2BAC2967} dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.6.2.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-623171776-3952065402-665669785-1014: @citrixonline.com/appdetectorplugin -> C:\Users\ConradPoor\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Users\ConradPoor\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\ConradPoor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-11-04]
CHR Extension: (Google Docs) - C:\Users\ConradPoor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-01-14]
CHR Extension: (Google Drive) - C:\Users\ConradPoor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-01-14]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\ConradPoor\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-21]
CHR Extension: (YouTube) - C:\Users\ConradPoor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-01-14]
CHR Extension: (Google Search) - C:\Users\ConradPoor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-01-14]
CHR Extension: (Google Sheets) - C:\Users\ConradPoor\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-04]
CHR Extension: (Google Wallet) - C:\Users\ConradPoor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Gmail) - C:\Users\ConradPoor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-14]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 BrcmMgmtAgent; C:\Program Files\Broadcom\MgmtAgent\BrcmMgmtAgent.exe [158720 2010-06-29] (Broadcom Corporation) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Roxio\Roxio MyDVD DE\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 ogmservice; C:\Program Files (x86)\Online Games Manager\ogmservice.exe [581568 2014-03-27] (RealNetworks, Inc.)
R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1025920 2014-11-07] (Enigma Software Group USA, LLC.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [15920 2014-11-07] (Enigma Software Group USA, LLC.)
R2 monblanking; C:\Windows\System32\DRIVERS\monblanking.sys [34960 2014-09-04] (Citrix Systems, Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
S1 hoyxdjga; \??\C:\Windows\system32\drivers\hoyxdjga.sys [X]
S1 iksywjxm; \??\C:\Windows\system32\drivers\iksywjxm.sys [X]
S1 MpKsle3212b89; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E33431D5-54E9-4158-92F5-26D72CF43135}\MpKsle3212b89.sys [X]
S1 plfvjuto; \??\C:\Windows\system32\drivers\plfvjuto.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-10 23:28 - 2014-11-10 23:35 - 00015006 _____ () C:\Users\ConradPoor\Desktop\FRST.txt
2014-11-10 23:27 - 2014-11-10 23:28 - 00000000 ____D () C:\FRST
2014-11-10 23:25 - 2014-11-10 23:26 - 02116096 _____ (Farbar) C:\Users\ConradPoor\Desktop\FRST64.exe
2014-11-10 20:31 - 2014-11-10 21:37 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-10 20:30 - 2014-11-10 20:30 - 00001104 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-11-10 20:30 - 2014-11-10 20:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-11-10 20:30 - 2014-11-10 20:30 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-11-10 20:30 - 2014-11-10 20:30 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-11-10 20:30 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-11-10 20:30 - 2014-10-01 11:11 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-11-10 20:30 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-11-10 18:35 - 2014-11-10 18:36 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\ConradPoor\Downloads\mbam-setup-2.0.3.1025.exe
2014-11-09 10:30 - 2014-11-09 10:30 - 00002119 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-11-09 10:29 - 2014-11-09 10:30 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-11-09 10:29 - 2014-11-09 10:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-11-09 10:02 - 2014-11-09 10:12 - 14087848 _____ (Microsoft Corporation) C:\Users\ConradPoor\Downloads\mseinstall.exe
2014-11-07 19:26 - 2014-11-07 19:26 - 00000000 ____D () C:\Users\ConradPoor\AppData\Roaming\Enigma Software Group
2014-11-07 19:26 - 2014-11-07 19:26 - 00000000 ____D () C:\sh4ldr
2014-11-06 20:13 - 2014-11-06 20:19 - 105136128 _____ () C:\Windows\system32\config\software.esg.tmp
2014-11-06 10:23 - 2014-09-28 19:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-06 10:23 - 2014-09-04 21:11 - 06584320 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-11-06 10:23 - 2014-09-04 20:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-11-06 10:23 - 2014-09-04 00:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-11-06 10:23 - 2014-09-04 00:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-11-06 10:23 - 2014-07-16 21:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-11-06 10:23 - 2014-07-16 21:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-11-06 10:23 - 2014-07-16 21:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-11-06 10:23 - 2014-07-16 21:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-11-06 10:23 - 2014-07-16 21:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-11-06 10:23 - 2014-07-16 21:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-11-06 10:23 - 2014-07-16 20:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-11-06 10:23 - 2014-07-16 20:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-11-06 10:23 - 2014-07-16 20:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-11-06 10:23 - 2014-07-16 20:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-11-06 10:23 - 2014-07-16 20:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-11-06 10:23 - 2014-06-18 17:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-11-06 10:23 - 2014-06-18 17:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-11-06 10:23 - 2014-06-18 17:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-11-06 10:23 - 2014-06-18 17:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-11-06 10:23 - 2014-06-18 17:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-11-06 10:23 - 2014-06-18 17:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-11-06 10:22 - 2014-10-09 21:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-11-06 10:22 - 2014-10-09 21:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-11-06 10:22 - 2014-10-09 21:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-11-06 10:22 - 2014-10-06 21:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-11-06 10:22 - 2014-10-06 21:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-11-06 10:22 - 2014-09-25 17:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-11-06 10:22 - 2014-09-25 17:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-11-06 10:22 - 2014-09-25 17:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-11-06 10:22 - 2014-09-25 17:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-11-06 10:22 - 2014-09-25 17:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-11-06 10:22 - 2014-09-25 17:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-11-06 10:22 - 2014-09-25 17:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-11-06 10:22 - 2014-09-18 21:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-11-06 10:22 - 2014-09-18 20:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-11-06 10:22 - 2014-09-18 20:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-11-06 10:22 - 2014-09-18 20:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-11-06 10:22 - 2014-09-18 20:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-11-06 10:22 - 2014-09-18 20:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-11-06 10:22 - 2014-09-18 20:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-11-06 10:22 - 2014-09-18 20:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-11-06 10:22 - 2014-09-18 20:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-11-06 10:22 - 2014-09-18 20:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-11-06 10:22 - 2014-09-18 20:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-11-06 10:22 - 2014-09-18 20:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-11-06 10:22 - 2014-09-18 20:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-11-06 10:22 - 2014-09-18 20:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-11-06 10:22 - 2014-09-18 20:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-11-06 10:22 - 2014-09-18 20:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-11-06 10:22 - 2014-09-18 20:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-11-06 10:22 - 2014-09-18 20:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-11-06 10:22 - 2014-09-18 20:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-11-06 10:22 - 2014-09-18 20:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-11-06 10:22 - 2014-09-18 20:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-11-06 10:22 - 2014-09-18 20:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-11-06 10:22 - 2014-09-18 20:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-11-06 10:22 - 2014-09-18 20:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-11-06 10:22 - 2014-09-18 20:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-11-06 10:22 - 2014-09-18 20:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-11-06 10:22 - 2014-09-18 19:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-11-06 10:22 - 2014-09-18 19:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-11-06 10:22 - 2014-09-18 19:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-11-06 10:22 - 2014-09-18 19:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-11-06 10:22 - 2014-09-18 19:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-11-06 10:22 - 2014-09-18 19:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-11-06 10:22 - 2014-09-18 19:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-11-06 10:22 - 2014-09-18 19:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-11-06 10:22 - 2014-09-18 19:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-11-06 10:22 - 2014-09-18 19:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-11-06 10:22 - 2014-09-18 19:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-11-06 10:22 - 2014-09-18 19:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-11-06 10:22 - 2014-09-18 19:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-11-06 10:22 - 2014-09-18 19:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-11-06 10:22 - 2014-09-18 19:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-11-06 10:22 - 2014-09-18 19:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-11-06 10:22 - 2014-09-18 19:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-11-06 10:22 - 2014-09-18 18:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-11-06 10:22 - 2014-09-18 18:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-11-06 10:22 - 2014-09-18 18:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-11-06 10:22 - 2014-09-18 18:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-11-06 10:22 - 2014-09-17 21:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-11-06 10:22 - 2014-09-17 20:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-11-06 10:22 - 2014-09-12 20:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-11-06 10:22 - 2014-09-12 20:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-11-06 10:22 - 2014-08-28 21:07 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-11-06 10:21 - 2014-07-08 21:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-11-06 10:21 - 2014-07-08 21:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-11-06 10:21 - 2014-07-08 21:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-11-06 10:21 - 2014-07-08 21:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-11-06 10:21 - 2014-07-08 21:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-11-06 10:21 - 2014-07-08 20:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-11-06 10:21 - 2014-07-08 20:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-11-06 10:21 - 2014-07-08 20:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-11-06 10:21 - 2014-07-08 20:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-11-06 10:21 - 2014-07-08 20:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-11-06 10:21 - 2014-07-08 17:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-11-06 10:21 - 2014-07-08 17:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-11-04 21:55 - 2014-11-04 21:56 - 00000000 ____D () C:\Users\ConradPoor\AppData\Local\{B03F3C17-B2C8-4BF9-97A5-699A8E5BD7CD}
2014-11-04 21:52 - 2014-11-04 22:45 - 00000000 ____D () C:\Users\ConradPoor\AppData\Roaming\Yhipnom
2014-11-04 21:52 - 2014-11-04 22:45 - 00000000 ____D () C:\Users\ConradPoor\AppData\Roaming\Ciitecnu
2014-11-04 21:47 - 2014-11-10 21:04 - 00000000 ____D () C:\ProgramData\ZuhiJiqo
2014-11-04 21:47 - 2014-11-06 20:13 - 00000000 ____D () C:\ProgramData\Windows Genuine Advantage
2014-11-04 21:03 - 2014-11-04 21:03 - 00001200 _____ () C:\Users\ConradPoor\Desktop\Format Factory.lnk
2014-11-04 21:03 - 2014-11-04 21:03 - 00000000 ____D () C:\Users\ConradPoor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FormatFactory
2014-11-04 20:55 - 2014-11-04 20:55 - 00000000 ____D () C:\Program Files (x86)\FreeTime
2014-11-04 09:55 - 2014-11-04 09:55 - 00000000 ____D () C:\Users\ConradPoor\AppData\Local\{E217CBDD-3D28-4368-AA15-348CAC146DE2}
2014-11-03 21:54 - 2014-11-03 21:54 - 00000000 ____D () C:\Users\ConradPoor\AppData\Local\{AB75DB6F-F2CC-4B77-A19A-C418FB742B71}
2014-10-29 20:43 - 2014-10-29 20:43 - 00000000 ____D () C:\ProgramData\EA Core
2014-10-29 20:31 - 2014-10-29 20:58 - 00000000 ____D () C:\Users\ConradPoor\AppData\Roaming\NewSPORE
2014-10-27 19:14 - 2014-10-27 19:14 - 00186548 _____ () C:\Users\ConradPoor\Downloads\Orb-3_Viewing.kmz
2014-10-25 16:07 - 2014-10-25 16:07 - 00001891 _____ () C:\Users\ConradPoor\Desktop\GA -- SporeApp.exe - Shortcut.lnk
2014-10-25 07:38 - 2009-05-06 14:51 - 00212240 _____ (Electronic Arts Inc.) C:\Users\ConradPoor\Desktop\Autorun.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-10 23:19 - 2009-07-13 23:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-10 23:19 - 2009-07-13 23:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-10 21:35 - 2011-09-26 20:35 - 01240764 _____ () C:\Windows\WindowsUpdate.log
2014-11-10 21:09 - 2011-09-26 19:01 - 00000000 ____D () C:\ProgramData\Sonic
2014-11-10 21:09 - 2009-07-14 00:13 - 00831128 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-10 21:04 - 2010-11-20 22:47 - 00276214 _____ () C:\Windows\PFRO.log
2014-11-10 21:04 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-10 21:04 - 2009-07-13 23:51 - 00052760 _____ () C:\Windows\setupact.log
2014-11-10 21:04 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\SchCache
2014-11-09 10:30 - 2014-02-24 07:03 - 00001945 _____ () C:\Windows\epplauncher.mif
2014-11-07 19:31 - 2013-01-14 21:43 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-07 19:31 - 2013-01-14 21:43 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-07 19:31 - 2012-11-09 14:11 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-07 19:26 - 2013-09-09 21:54 - 00001089 _____ () C:\Users\ConradPoor\Desktop\SpyHunter.lnk
2014-11-07 19:26 - 2013-09-09 21:54 - 00000000 ____D () C:\Users\ConradPoor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2014-11-07 19:25 - 2014-06-05 08:05 - 00003442 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask
2014-11-07 19:25 - 2013-09-09 21:54 - 00000000 ____D () C:\Windows\86CA3695A4124BAE92B649A60C2AC663.TMP
2014-11-07 19:25 - 2013-01-14 21:43 - 00003906 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-11-07 19:25 - 2013-01-14 21:43 - 00003654 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-11-07 19:25 - 2012-11-09 14:11 - 00003770 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-11-07 19:03 - 2012-07-27 22:05 - 00000000 ___RD () C:\Users\Jonathan Poor\Virtual Machines
2014-11-07 19:02 - 2011-10-03 16:03 - 00001415 _____ () C:\Users\Jonathan Poor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-11-06 20:20 - 2009-07-13 21:34 - 18350080 _____ () C:\Windows\system32\config\system.esg.bak
2014-11-06 20:20 - 2009-07-13 21:34 - 118226944 _____ () C:\Windows\system32\config\software.esg.bak
2014-11-06 20:20 - 2009-07-13 21:34 - 05242880 _____ () C:\Windows\system32\config\default.esg.bak
2014-11-06 20:20 - 2009-07-13 21:34 - 00262144 _____ () C:\Windows\system32\config\sam.esg.bak
2014-11-06 12:15 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\rescache
2014-11-06 11:10 - 2009-07-13 23:45 - 00462488 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-06 11:06 - 2014-08-04 09:39 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-11-06 10:48 - 2012-08-30 23:46 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-11-06 10:39 - 2013-08-15 02:02 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-06 10:25 - 2012-08-27 08:04 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-11-02 22:31 - 2013-01-14 08:39 - 00000000 ____D () C:\Users\ConradPoor\AppData\Roaming\Adobe
2014-10-30 06:25 - 2010-11-20 22:27 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-29 20:55 - 2009-07-14 00:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-10-28 12:57 - 2013-01-14 21:45 - 00002185 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-10-24 21:19 - 2013-01-15 09:08 - 00000000 ____D () C:\Users\ConradPoor\AppData\Roaming\SPORE
2014-10-24 20:21 - 2013-01-01 13:59 - 00000000 ____D () C:\Program Files (x86)\Electronic Arts
2014-10-24 20:17 - 2011-09-26 18:52 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

Files to move or delete:
====================
C:\Users\ConradPoor\gosetup.exe
C:\Users\ConradPoor\gotomypc_626.exe

Some content of TEMP:
====================
C:\Users\ConradPoor\AppData\Local\Temp\77zip.exe
C:\Users\ConradPoor\AppData\Local\Temp\acufutls.dll
C:\Users\ConradPoor\AppData\Local\Temp\D2M-Precheck.exe
C:\Users\ConradPoor\AppData\Local\Temp\drm_dyndata_7370014.dll
C:\Users\ConradPoor\AppData\Local\Temp\MouseKeyboardCenterx64_1033.exe
C:\Users\ConradPoor\AppData\Local\Temp\MSETUP4.EXE
C:\Users\ConradPoor\AppData\Local\Temp\ochelper.exe
C:\Users\ConradPoor\AppData\Local\Temp\RHSetup.exe
C:\Users\ConradPoor\AppData\Local\Temp\SHSetup.exe
C:\Users\ConradPoor\AppData\Local\Temp\tbappb.dll
C:\Users\Jonathan Poor\AppData\Local\Temp\drm_dyndata_7370014.dll
C:\Users\Jonathan Poor\AppData\Local\Temp\EAD1758.exe
C:\Users\Jonathan Poor\AppData\Local\Temp\EADF2CB.exe
C:\Users\Jonathan Poor\AppData\Local\Temp\UninstallEADM.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-11-05 19:40

==================== End Of Log ============================

jpoor New Helpee Posts: 19	multiple dllhost.exe *32 instances, dreadfully slow PC #? Nov 10, 2014 20:55:26 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by jpoor on Nov 10, 2014 20:55:26 GMT -8 Addition.txt [addition.txt was blocked. I will try the alternative methods mentioned.]

jpoor New Helpee Posts: 19	multiple dllhost.exe *32 instances, dreadfully slow PC #? Nov 10, 2014 20:57:48 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by jpoor on Nov 10, 2014 20:57:48 GMT -8 Link for jPoor's Addition.txt: wikisend.com/download/431842/Addition.txt

Krusty
Logging Assistant

In Oz

Posts: 2,330

multiple dllhost.exe *32 instances, dreadfully slow PC #? Nov 10, 2014 21:02:35 GMT -8

Post by Krusty on Nov 10, 2014 21:02:35 GMT -8

Good job!

Please wait patiently for a Malware Removalist to get to you. As you can see they are very busy at the moment so you could be in for a lengthy wait. There are over 300 machines being worked on at this time.

Thanks.

I do NOT do support by PM.

Thank you.

multiple dllhost.exe *32 instances, dreadfully slow PC #?

Post by jpoor on Nov 10, 2014 19:40:12 GMT -8

Post by Krusty on Nov 10, 2014 19:49:05 GMT -8

Post by jpoor on Nov 10, 2014 19:49:46 GMT -8

Post by Krusty on Nov 10, 2014 19:51:55 GMT -8

Post by jpoor on Nov 10, 2014 20:13:01 GMT -8

Post by Krusty on Nov 10, 2014 20:18:06 GMT -8

Post by jpoor on Nov 10, 2014 20:52:01 GMT -8

Post by jpoor on Nov 10, 2014 20:55:26 GMT -8

Post by jpoor on Nov 10, 2014 20:57:48 GMT -8

Post by Krusty on Nov 10, 2014 21:02:35 GMT -8