What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Still infected, computer has slowed down... Need your help! [Solve

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1

Hey guys,

 

Really need your help.

 

Thought I got rid of the malware a few days ago but my compurer has slowed down now and irt seems I have some more maleware on my computer…

 

I ran the aswMBR scan as administrator but it froze a few times and now it keeps getting stuck on C:\Users\yosef\AppData\Local\Google\Update\GoogleUpdate.exe for some reason.

 

Also ran a scan with FRST64 as administrator and posted the logs below (aswMBR.txt, FRST.txt and Addition.txt)

 

Thank you in advance!

 

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2017-08-05 18:32:08
—————————–
18:32:08.081    OS Version: Windows x64 6.2.9200
18:32:08.081    Number of processors: 4 586 0x3D04
18:32:08.081    ComputerName: DESKTOP-FMTT2PH  UserName: yosef
18:32:10.277    Initialize success
18:32:10.324    VM: initialized successfully
18:32:10.324    VM: Intel CPU BiosDisabled
19:10:02.570    AVAST engine defs: 17030301
19:14:04.686    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000036
19:14:04.686    Disk 0 Vendor: HGST_HTS541075A9E680 JA2OA710 Size: 715404MB BusType: 11
19:14:04.842    Disk 0 MBR read successfully
19:14:04.858    Disk 0 MBR scan
19:14:04.858    Disk 0 unknown MBR code
19:14:04.936    Disk 0 Partition 1 00     EE          GPT           2097151 MB offset 1
19:14:05.264    Disk 0 scanning C:\WINDOWS\system32\drivers
19:14:24.424    Service scanning
19:15:24.256    Modules scanning
19:15:24.256    Disk 0 trace - called modules:
19:15:24.303    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll iaStorA.sys
19:15:24.803    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffc80b976d5610]
19:15:24.803    3 CLASSPNP.SYS[fffff805ba2c5efb] -> nt!IofCallDriver -> [0xffffc80b94cee7c0]
19:15:24.818    5 ACPI.sys[fffff805b8be4571] -> nt!IofCallDriver -> \Device\00000036[0xffffc80b9345f400]
19:15:26.019    AVAST engine scan C:\WINDOWS
19:15:28.587    AVAST engine scan C:\WINDOWS\system32
19:19:38.631    AVAST engine scan C:\WINDOWS\system32\drivers
19:20:00.138    AVAST engine scan C:\Users\yosef
19:23:16.908    Disk 0 MBR has been saved successfully to "C:\Users\yosef\Desktop\MBR.dat"
19:23:16.910    The log file has been saved successfully to "C:\Users\yosef\Desktop\aswMBR.txt"
 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 31-07-2017
Ran by [removed] (administrator) on DESKTOP-FMTT2PH (05-08-2017 18:18:10)
Running from C:\Users\[removed]\Desktop
[removed] Platform: Windows 10 Home Version 1607 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Intel Corporation) C:\Windows\SysWOW64\esif_uf.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\HP\HP System Event\HPWMISVC.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Intel Security, Inc.) C:\Program Files\Common Files\Intel Security\PEF\CORE\PEFService.exe
(McAfee, Inc.) C:\Program Files\mcafee\MfeAV\MfeAVSvc.exe
(Intel Security) C:\Program Files\Common Files\McAfee\ClientAnalytics\Legacy\McClientAnalytics.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\VSCore_15_6\mcapexe.exe
(Intel Corporation) C:\Windows\Temp\DPTF\esif_assist_64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler64.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam6\YouCamService6.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\CSP\2.5.312.0\McCSPServiceHost.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\platform\McUICnt.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIIBE.EXE
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\HP\HP System Event\HPMSGSVC.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(WildTangent) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe
(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Microsoft Corporation) C:\Windows\SysWOW64\backgroundTaskHost.exe
(Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam6\Youcam6_webcam_camera_video.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgentUserBroker.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\platform\Core\mchost.exe
(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.1439_none_7efe016621f50bd0\TiWorker.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8911872 2016-10-15] (Realtek Semiconductor)
HKLM\…\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-09-15] (Apple Inc.)
HKLM-x32\…\Run: [PowerDVD14Agent] => C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14Agent.exe [795336 2015-06-21] (CyberLink Corp.)
HKLM-x32\…\Run: [HPMessageService] => C:\Program Files (x86)\HP\HP System Event\HPMSGSVC.exe [653576 2015-06-29] (Hewlett-Packard Development Company, L.P.)
HKU\S-1-5-21-182178435-2925743980-1085802887-1001\…\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATIIBE.EXE [283232 2015-09-15] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-182178435-2925743980-1085802887-1001\…\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [23819304 2017-03-21] (Google)
HKU\S-1-5-21-182178435-2925743980-1085802887-1001\…\Run: [Google Update] => C:\Users\yosef\AppData\Local\Google\Update\1.3.33.5\GoogleUpdateCore.exe [601168 2017-04-28] (Google Inc.)
HKU\S-1-5-21-182178435-2925743980-1085802887-1001\…\Run: [EasyHideIPVPN] => C:\Program Files (x86)\Easy-Hide-IP VPN\easy.hide.ip.vpn.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 [removed] [removed]
Tcpip\..\Interfaces\{859a7fca-f00b-4090-a23b-664a3ab0e597}: [DhcpNameServer] 192.168.1.1 [removed] [removed]
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp15-comm.msn.com/?pc=HRTE
HKU\S-1-5-21-182178435-2925743980-1085802887-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-182178435-2925743980-1085802887-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp15-comm.msn.com/?pc=HRTE
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2017-07-11] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2017-07-11] (Microsoft Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-04-30] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2016-07-21] (HP Inc.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2016-04-19] (Microsoft Corporation)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll [2017-05-31] (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll [2017-05-31] (McAfee, Inc.)
FireFox:
========
FF DefaultProfile: 2eofar0g.default
FF ProfilePath: C:\Users\yosef\AppData\Roaming\Mozilla\Firefox\Profiles\2eofar0g.default [2017-08-05]
FF NewTab: Mozilla\Firefox\Profiles\2eofar0g.default -> about:newtab
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\2eofar0g.default -> Search Provided by Yahoo
FF DefaultSearchEngine.US: Mozilla\Firefox\Profiles\2eofar0g.default -> Search Provided by Yahoo
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\2eofar0g.default -> Search Provided by Yahoo
FF Homepage: Mozilla\Firefox\Profiles\2eofar0g.default -> about:home
FF Extension: (Dashlane) - C:\Users\yosef\AppData\Roaming\Mozilla\Firefox\Profiles\2eofar0g.default\Extensions\[removed] [2016-02-29]
FF HKLM-x32\…\Thunderbird\Extensions: [[removed]] - C:\Program Files\McAfee\MSK
FF Extension: (McAfee Anti-Spam Thunderbird Extension) - C:\Program Files\McAfee\MSK [2017-08-03] [not signed]
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2017-05-31] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1217157.dll [2015-02-05] (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.68 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2017-05-31] ()
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-09-15] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2015-06-25] ()
FF Plugin HKU\S-1-5-21-182178435-2925743980-1085802887-1001: @talk.google.com/GoogleTalkPlugin -> C:\Users\yosef\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
FF Plugin HKU\S-1-5-21-182178435-2925743980-1085802887-1001: @talk.google.com/O1DPlugin -> C:\Users\yosef\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-12-08] (Google)
FF Plugin HKU\S-1-5-21-182178435-2925743980-1085802887-1001: @tools.google.com/Google Update;version=3 -> C:\Users\yosef\AppData\Local\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin HKU\S-1-5-21-182178435-2925743980-1085802887-1001: @tools.google.com/Google Update;version=9 -> C:\Users\yosef\AppData\Local\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\yosef\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\yosef\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-12-08] (Google)
StartMenuInternet: FIREFOX.EXE - firefox.exe
Chrome:
=======
CHR DefaultSearchURL: Default -> hxxps://duckduckgo.com/?q={searchTerms}
CHR DefaultSearchKeyword: Default -> duckduckgo
CHR Profile: C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default [2017-08-01]
CHR Extension: (Google Slides) - C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-07-31]
CHR Extension: (Google Docs) - C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-07-31]
CHR Extension: (Google Drive) - C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-07-31]
CHR Extension: (YouTube) - C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-07-31]
CHR Extension: (Google Sheets) - C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-07-31]
CHR Extension: (Google Docs Offline) - C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-07-31]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2017-07-31]
CHR Extension: (Chrome Web Store Payments) - C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-07-31]
CHR Extension: (Gmail) - C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-07-31]
CHR Extension: (Chrome Media Router) - C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-07-31]
CHR HKU\S-1-5-21-182178435-2925743980-1085802887-1001\SOFTWARE\Google\Chrome\Extensions\…\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-09-02] (Apple Inc.)
R2 BcmBtRSupport; C:\WINDOWS\system32\BtwRSupportService.exe [2286848 2015-10-14] (Broadcom Corporation.)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [3042544 2017-03-14] (Microsoft Corporation)
R3 ClientAnalyticsService; C:\Program Files\Common Files\McAfee\ClientAnalytics\Legacy\McClientAnalytics.exe [1752992 2017-03-29] (Intel Security)
R2 esifsvc; C:\WINDOWS\SysWoW64\esif_uf.exe [1385640 2015-07-13] (Intel Corporation)
R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [349728 2015-06-25] (WildTangent)
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [641520 2017-02-22] (McAfee, Inc.)
R2 HPSupportSolutionsFrameworkService; c:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [321896 2017-07-06] (HP Inc.)
R2 HPWMISVC; C:\Program Files (x86)\HP\HP System Event\HPWMISVC.exe [602888 2015-06-29] (Hewlett-Packard Development Company, L.P.)
R2 igfxCUIService2.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [373720 2017-01-13] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [881152 2015-05-22] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [223008 2015-07-06] (Intel Corporation)
S2 Kingsoft_WPS_UpdateService; C:\Program Files (x86)\Kingsoft\WPS Office\9.1.0.5113\wtoolex\wpsupdatesvr.exe [133480 2015-07-21] (Zhuhai Kingsoft Office Software Co.,Ltd)
R2 McAPExe; C:\Program Files\Common Files\McAfee\VSCore_15_6\McApExe.exe [984480 2017-06-03] (McAfee, Inc.)
S3 McAWFwk; C:\Program Files\Common Files\McAfee\ActWiz\McAWFwk.exe [338208 2015-03-19] (McAfee, Inc.)
R2 mcbootdelaystartsvc; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [641520 2017-02-22] (McAfee, Inc.)
R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\2.5.312.0\\McCSPServiceHost.exe [2139832 2017-05-30] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [641520 2017-02-22] (McAfee, Inc.)
S4 McOobeSv2; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [641520 2017-02-22] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [641520 2017-02-22] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [641520 2017-02-22] (McAfee, Inc.)
R3 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [241656 2017-04-30] (McAfee, Inc.)
R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\\mfemms.exe [390656 2017-04-30] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [343544 2017-04-30] (McAfee, Inc.)
R2 ModuleCoreService; C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe [1543248 2017-05-31] (McAfee, Inc.)
S3 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [641520 2017-02-22] (McAfee, Inc.)
R2 PEFService; C:\Program Files\Common Files\Intel Security\PEF\CORE\PEFService.exe [1042288 2017-05-21] (Intel Security, Inc.)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [389896 2014-04-14] ()
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [326656 2016-10-15] (Realtek Semiconductor)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [266848 2016-12-27] (Synaptics Incorporated)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347320 2017-04-27] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103712 2017-04-27] (Microsoft Corporation)
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 bcbtums; C:\WINDOWS\system32\drivers\bcbtums.sys [208176 2015-10-14] (Broadcom Corporation.)
R3 BCM43XX; C:\WINDOWS\system32\DRIVERS\bcmwl63a.sys [7551240 2015-07-21] (Broadcom Corporation)
R3 cfwids; C:\WINDOWS\System32\drivers\cfwids.sys [76824 2017-05-02] (McAfee, Inc.)
R3 clwvd6; C:\WINDOWS\system32\DRIVERS\clwvd6.sys [41704 2013-10-29] (CyberLink Corporation)
R3 dptf_cpu; C:\WINDOWS\System32\drivers\dptf_cpu.sys [43512 2015-07-13] (Intel Corporation)
R3 dptf_pch; C:\WINDOWS\System32\drivers\dptf_pch.sys [41976 2015-07-13] (Intel Corporation)
R3 esif_lf; C:\WINDOWS\system32\DRIVERS\esif_lf.sys [251384 2015-07-13] (Intel Corporation)
S3 HipShieldK; C:\WINDOWS\System32\drivers\HipShieldK.sys [209608 2017-05-31] (McAfee, Inc.)
R3 mfeaack; C:\WINDOWS\System32\drivers\mfeaack.sys [476176 2017-05-02] (McAfee, Inc.)
R3 mfeavfk; C:\WINDOWS\System32\drivers\mfeavfk.sys [353808 2017-05-02] (McAfee, Inc.)
U3 mfeavfk01; no ImagePath
S0 mfeelamk; C:\WINDOWS\System32\drivers\mfeelamk.sys [84536 2017-05-02] (McAfee, Inc.)
R3 mfefirek; C:\WINDOWS\System32\drivers\mfefirek.sys [504336 2017-05-02] (McAfee, Inc.)
R0 mfehidk; C:\WINDOWS\System32\drivers\mfehidk.sys [918544 2017-05-02] (McAfee, Inc.)
R3 mfencbdc; C:\WINDOWS\System32\DRIVERS\mfencbdc.sys [495632 2017-04-07] (McAfee, Inc.)
S3 mfencrk; C:\WINDOWS\System32\DRIVERS\mfencrk.sys [107544 2017-04-07] (McAfee, Inc.)
R3 mfeplk; C:\WINDOWS\System32\drivers\mfeplk.sys [109072 2017-05-02] (McAfee, Inc.)
R0 mfewfpk; C:\WINDOWS\System32\drivers\mfewfpk.sys [252432 2017-05-02] (McAfee, Inc.)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [895256 2015-06-18] (Realtek                                            )
U5 RTSUER; C:\Windows\System32\Drivers\RTSUER.sys [411712 2015-05-20] (Realsil Semiconductor Corporation)
S3 SmbDrv; C:\WINDOWS\System32\drivers\Smb_driver_AMDASF.sys [33448 2015-07-13] (Synaptics Incorporated)
R3 SmbDrvI; C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys [72792 2016-12-27] (Synaptics Incorporated)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
R3 WirelessButtonDriver64; C:\WINDOWS\System32\drivers\WirelessButtonDriver64.sys [30384 2015-06-23] (HP Inc.)
R1 ZAM; C:\WINDOWS\System32\drivers\zam64.sys [203680 2017-07-29] (Zemana Ltd.)
R1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard64.sys [203680 2017-07-29] (Zemana Ltd.)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-08-05 18:18 - 2017-08-05 18:19 - 000021687 _____ C:\Users\yosef\Desktop\FRST.txt
2017-08-05 18:17 - 2017-08-05 18:18 - 000000000 ____D C:\FRST
2017-08-05 18:16 - 2017-08-05 18:16 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2017-08-05 14:35 - 2017-08-05 18:15 - 002381312 _____ (Farbar) C:\Users\yosef\Desktop\FRST64.exe
2017-08-05 14:33 - 2017-08-05 14:37 - 005198336 _____ (AVAST Software) C:\Users\yosef\Desktop\aswMBR.exe
2017-08-05 14:31 - 2017-08-05 14:33 - 016564750 _____ (Malwarebytes Corp.) C:\Users\yosef\Desktop\mbar-1.09.4.1001.exe
2017-08-05 14:27 - 2017-08-05 14:29 - 014554768 _____ (Copyright 2017.) C:\Users\yosef\Desktop\Zemana.AntiMalware.Portable-unsigned.exe
2017-08-04 16:53 - 2015-01-21 19:52 - 000046453 _____ C:\Users\yosef\Desktop\Rick Lopez.pdf
2017-08-04 15:47 - 2017-08-04 15:47 - 000191180 _____ C:\Users\yosef\Desktop\Letter of Reccomendation Checklist.pdf
2017-08-04 12:03 - 2017-08-05 18:01 - 000004034 _____ C:\WINDOWS\System32\Tasks\Intel Security DAT Reputation (AMCore) periodic endpoint safety pulse
2017-08-01 17:49 - 2017-08-01 17:49 - 000000000 ____D C:\WINDOWS\LastGood
2017-08-01 17:39 - 2017-08-01 17:40 - 000000000 ____D C:\WINDOWS\LastGood.Tmp
2017-08-01 17:31 - 2017-08-01 17:33 - 065033984 _____ (Malwarebytes ) C:\Users\yosef\Desktop\mb3-setup-consumer-3.1.2.1733-1.0.160-1.0.2251.exe
2017-08-01 17:14 - 2017-08-01 17:15 - 000000359 _____ C:\DelFix.txt
2017-08-01 00:42 - 2017-08-01 00:21 - 007576049 ____N C:\Users\yosef\Desktop\VID-20170801-WA0001.mp4
2017-07-31 17:01 - 2017-08-03 02:34 - 000002239 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-07-31 17:01 - 2017-08-03 02:34 - 000002227 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-07-30 19:25 - 2017-08-05 00:18 - 000001178 _____ C:\Users\yosef\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware Guard.lnk
2017-07-30 18:01 - 2017-07-30 18:24 - 000000000 ____D C:\EEK
2017-07-29 17:34 - 2017-08-05 14:21 - 000004222 _____ C:\WINDOWS\System32\Tasks\Intel Security DAT Reputation (AMCore) Post DAT update endpoint safety pulse
2017-07-29 15:03 - 2017-08-05 18:19 - 000062695 _____ C:\WINDOWS\ZAM.krnl.trace
2017-07-29 15:03 - 2017-08-05 18:19 - 000030926 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2017-07-29 15:03 - 2017-07-29 15:03 - 000203680 _____ (Zemana Ltd.) C:\WINDOWS\system32\Drivers\zamguard64.sys
2017-07-29 15:03 - 2017-07-29 15:03 - 000203680 _____ (Zemana Ltd.) C:\WINDOWS\system32\Drivers\zam64.sys
2017-07-29 15:03 - 2017-07-29 15:03 - 000000000 ____D C:\Users\yosef\AppData\Local\Zemana
2017-07-29 14:07 - 2017-08-05 17:19 - 000000000 ____D C:\ProgramData\Malwarebytes
2017-07-29 14:06 - 2017-07-30 16:32 - 000000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2017-07-29 13:08 - 2017-07-29 13:08 - 000000000 ____D C:\Users\yosef\AppData\Local\VS Revo Group
2017-07-29 13:08 - 2017-07-29 13:08 - 000000000 ____D C:\ProgramData\VS Revo Group
2017-07-29 13:08 - 2017-07-29 13:08 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
2017-07-29 13:08 - 2016-12-21 14:52 - 000040240 _____ (VS Revo Group) C:\WINDOWS\system32\Drivers\revoflt.sys
2017-07-29 13:05 - 2017-07-29 13:08 - 000000000 ____D C:\Program Files\VS Revo Group
2017-07-29 13:05 - 2017-07-29 13:05 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
2017-07-28 17:20 - 2017-07-28 16:57 - 000565416 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2017-07-27 19:12 - 2017-07-31 12:34 - 000000000 ____D C:\WINDOWS\Minidump
2017-07-26 18:14 - 2017-07-26 18:14 - 000051625 _____ C:\WINDOWS\uninstaller.dat
2017-07-21 00:34 - 2017-07-21 00:34 - 000001156 _____ C:\Users\Public\Desktop\Movavi Video Editor 12.lnk
2017-07-21 00:34 - 2017-07-21 00:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movavi Video Editor 12
2017-07-21 00:34 - 2017-07-21 00:34 - 000000000 ____D C:\Program Files (x86)\Movavi Video Editor 12
2017-07-17 10:30 - 2017-07-17 10:30 - 000863744 _____ (Farbar) C:\WINDOWS\mod_frst.exe
2017-07-14 12:57 - 2017-07-07 00:46 - 000781152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe
2017-07-14 12:57 - 2017-07-07 00:45 - 002263832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2017-07-14 12:57 - 2017-07-07 00:29 - 005686272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2017-07-14 12:57 - 2017-07-06 23:54 - 002997248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-07-14 12:57 - 2017-07-06 23:53 - 002483200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2017-07-14 12:57 - 2017-07-06 23:52 - 001599488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2017-07-14 12:57 - 2017-06-21 00:28 - 001504056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2017-07-14 12:57 - 2017-06-21 00:27 - 001431232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll
2017-07-14 12:57 - 2017-06-21 00:27 - 000116576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudExperienceHostCommon.dll
2017-07-14 12:57 - 2017-06-21 00:21 - 001277856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2017-07-14 12:57 - 2017-06-21 00:04 - 001631232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll
2017-07-14 12:57 - 2017-06-21 00:01 - 000141824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Radios.dll
2017-07-14 12:57 - 2017-06-21 00:00 - 000156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDeviceRegistration.dll
2017-07-14 12:57 - 2017-06-20 23:59 - 000285184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll
2017-07-14 12:57 - 2017-06-20 23:59 - 000123904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.HostName.dll
2017-07-14 12:57 - 2017-06-20 23:59 - 000097792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.System.SystemManagement.dll
2017-07-14 12:57 - 2017-06-20 23:58 - 000136192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinRtTracing.dll
2017-07-14 12:57 - 2017-06-20 23:58 - 000129024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.SerialCommunication.dll
2017-07-14 12:57 - 2017-06-20 23:58 - 000094208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryClient.dll
2017-07-14 12:57 - 2017-06-20 23:58 - 000087040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.ServiceDiscovery.Dnssd.dll
2017-07-14 12:57 - 2017-06-20 23:58 - 000059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.System.UserDeviceAssociation.dll
2017-07-14 12:57 - 2017-06-20 23:57 - 000142336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.WiFi.dll
2017-07-14 12:57 - 2017-06-20 23:56 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Gaming.Input.dll
2017-07-14 12:57 - 2017-06-20 23:56 - 000374784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.LowLevel.dll
2017-07-14 12:57 - 2017-06-20 23:56 - 000315904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Gaming.XboxLive.Storage.dll
2017-07-14 12:57 - 2017-06-20 23:56 - 000237056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SyncSettings.dll
2017-07-14 12:57 - 2017-06-20 23:56 - 000231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2017-07-14 12:57 - 2017-06-20 23:56 - 000184320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserMgrProxy.dll
2017-07-14 12:57 - 2017-06-20 23:56 - 000180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2017-07-14 12:57 - 2017-06-20 23:56 - 000113152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Lights.dll
2017-07-14 12:57 - 2017-06-20 23:55 - 000557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2017-07-14 12:57 - 2017-06-20 23:55 - 000117760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AuthBroker.dll
2017-07-14 12:57 - 2017-06-20 23:55 - 000115712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Core.dll
2017-07-14 12:57 - 2017-06-20 23:54 - 000609280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Import.dll
2017-07-14 12:57 - 2017-06-20 23:54 - 000298496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Management.dll
2017-07-14 12:57 - 2017-06-20 23:54 - 000223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe
2017-07-14 12:57 - 2017-06-20 23:53 - 000431616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\efswrt.dll
2017-07-14 12:57 - 2017-06-20 23:53 - 000386048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.WiFiDirect.dll
2017-07-14 12:57 - 2017-06-20 23:53 - 000332288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Bluetooth.dll
2017-07-14 12:57 - 2017-06-20 23:53 - 000325120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleacc.dll
2017-07-14 12:57 - 2017-06-20 23:53 - 000284672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apprepsync.dll
2017-07-14 12:57 - 2017-06-20 23:53 - 000271360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\deviceaccess.dll
2017-07-14 12:57 - 2017-06-20 23:53 - 000218624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WwaApi.dll
2017-07-14 12:57 - 2017-06-20 23:53 - 000202752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.HumanInterfaceDevice.dll
2017-07-14 12:57 - 2017-06-20 23:53 - 000185856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Identity.Provider.dll
2017-07-14 12:57 - 2017-06-20 23:53 - 000175616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Scanners.dll
2017-07-14 12:57 - 2017-06-20 23:53 - 000125952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apprepapi.dll
2017-07-14 12:57 - 2017-06-20 23:52 - 000262144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Picker.dll
2017-07-14 12:57 - 2017-06-20 23:51 - 000314368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Usb.dll
2017-07-14 12:57 - 2017-06-20 23:51 - 000284672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.dll
2017-07-14 12:57 - 2017-06-20 23:50 - 000857600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EmailApis.dll
2017-07-14 12:57 - 2017-06-20 23:49 - 000288256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CryptoWinRT.dll
2017-07-14 12:57 - 2017-06-20 23:48 - 002333184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmSvc.dll
2017-07-14 12:57 - 2017-06-20 23:46 - 001077760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Editing.dll
2017-07-14 12:57 - 2017-06-20 23:46 - 000355328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RTMediaFrame.dll
2017-07-14 12:57 - 2017-06-20 23:45 - 000313856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2017-07-14 12:57 - 2017-06-20 23:44 - 000795648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MiracastReceiver.dll
2017-07-14 12:57 - 2017-06-20 23:44 - 000343040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToDevice.dll
2017-07-14 12:57 - 2017-06-20 23:43 - 000653312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.AccountsControl.dll
2017-07-14 12:57 - 2017-06-20 23:43 - 000468992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.InkControls.dll
2017-07-14 12:57 - 2017-06-20 23:42 - 003307008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2017-07-14 12:57 - 2017-06-20 23:40 - 002641920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2017-07-14 12:57 - 2017-06-20 23:40 - 000895488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Streaming.dll
2017-07-14 12:57 - 2017-06-20 23:40 - 000675840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.dll
2017-07-14 12:57 - 2017-06-20 23:40 - 000220672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToReceiver.dll
2017-07-14 12:57 - 2017-06-20 23:39 - 000134144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ErrorDetails.dll
2017-07-14 12:57 - 2017-06-20 23:38 - 003733504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll
2017-07-14 12:57 - 2017-06-20 23:38 - 001221120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Audio.dll
2017-07-14 12:57 - 2017-06-20 23:37 - 006109696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2017-07-14 12:57 - 2017-06-20 23:37 - 000400384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToManager.dll
2017-07-14 12:57 - 2017-06-20 23:37 - 000357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Geolocation.dll
2017-07-14 12:57 - 2017-06-20 23:37 - 000103936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Devices.dll
2017-07-14 12:57 - 2017-06-20 23:36 - 001988096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
2017-07-14 12:57 - 2017-06-20 23:36 - 001247232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2017-07-14 12:57 - 2017-06-20 23:35 - 001656320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Perception.dll
2017-07-14 12:57 - 2017-06-20 23:35 - 001232384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Maps.dll
2017-07-14 12:57 - 2017-06-20 23:35 - 000598528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.dll
2017-07-14 12:57 - 2017-06-20 23:35 - 000589312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Sensors.dll
2017-07-14 12:57 - 2017-06-20 23:34 - 001886720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2017-07-14 12:57 - 2017-06-20 23:34 - 000654336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MbaeApiPublic.dll
2017-07-14 12:57 - 2017-06-20 23:34 - 000621056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2017-07-14 12:57 - 2017-06-20 23:34 - 000542208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.Connectivity.dll
2017-07-14 12:57 - 2017-06-20 23:33 - 001170944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Phone.dll
2017-07-14 12:57 - 2017-06-20 23:33 - 001013248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.Http.dll
2017-07-14 12:57 - 2017-06-20 23:33 - 000751104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.dll
2017-07-14 12:57 - 2017-06-20 23:10 - 000483840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2017-07-14 12:57 - 2017-03-03 23:56 - 000263472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll
2017-07-14 12:57 - 2017-03-03 23:21 - 001243136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.FaceAnalysis.dll
2017-07-14 12:57 - 2017-03-03 23:20 - 000426496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Wallet.dll
2017-07-14 12:57 - 2017-03-03 23:19 - 000498688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mbsmsapi.dll
2017-07-14 12:57 - 2016-10-05 02:15 - 000141312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dialclient.dll
2017-07-14 12:57 - 2016-09-15 09:58 - 000092672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Background.SystemEventsBroker.dll
2017-07-14 12:57 - 2016-09-15 09:47 - 000134656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Energy.dll
2017-07-14 12:56 - 2017-07-07 00:49 - 000340824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2017-07-14 12:56 - 2017-07-07 00:40 - 020967840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2017-07-14 12:56 - 2017-07-07 00:37 - 000118112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tdx.sys
2017-07-14 12:56 - 2017-07-07 00:29 - 000857440 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
2017-07-14 12:56 - 2017-07-07 00:24 - 022220856 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2017-07-14 12:56 - 2017-07-07 00:20 - 000059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\l2gpstore.dll
2017-07-14 12:56 - 2017-07-07 00:19 - 000025088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapprovp.dll
2017-07-14 12:56 - 2017-07-07 00:18 - 002532192 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2017-07-14 12:56 - 2017-07-07 00:18 - 000450560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll
2017-07-14 12:56 - 2017-07-07 00:18 - 000210432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\onex.dll
2017-07-14 12:56 - 2017-07-07 00:17 - 000118784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\raschap.dll
2017-07-14 12:56 - 2017-07-07 00:13 - 000364544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupShim.dll
2017-07-14 12:56 - 2017-07-07 00:13 - 000310272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Wldap32.dll
2017-07-14 12:56 - 2017-07-07 00:10 - 000755200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2017-07-14 12:56 - 2017-07-07 00:09 - 000637952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SmartcardCredentialProvider.dll
2017-07-14 12:56 - 2017-07-07 00:09 - 000506368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2017-07-14 12:56 - 2017-07-07 00:06 - 007626752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2017-07-14 12:56 - 2017-07-07 00:03 - 000337408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msinfo32.exe
2017-07-14 12:56 - 2017-07-07 00:02 - 001313280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wdc.dll
2017-07-14 12:56 - 2017-07-07 00:00 - 000476160 _____ (Microsoft® Windows® Operating System) C:\WINDOWS\SysWOW64\wvc.dll
2017-07-14 12:56 - 2017-07-06 23:55 - 004423680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
2017-07-14 12:56 - 2017-07-06 23:55 - 001571840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2017-07-14 12:56 - 2017-07-06 23:52 - 004561408 _____ (Microsoft) C:\WINDOWS\SysWOW64\dbgeng.dll
2017-07-14 12:56 - 2017-07-06 23:52 - 001413632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OpcServices.dll
2017-07-14 12:56 - 2017-07-06 23:47 - 000128512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthpan.sys
2017-07-14 12:56 - 2017-07-05 21:29 - 000690008 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcp120_clr0400.dll
2017-07-14 12:56 - 2017-06-21 23:17 - 000987840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr120_clr0400.dll
2017-07-14 12:56 - 2017-06-21 23:17 - 000485576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp120_clr0400.dll
2017-07-14 12:56 - 2017-06-21 00:53 - 000794928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Shell.Broker.dll
2017-07-14 12:56 - 2017-06-21 00:52 - 002213760 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2017-07-14 12:56 - 2017-06-21 00:52 - 000774224 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2017-07-14 12:56 - 2017-06-21 00:52 - 000088416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\scmbus.sys
2017-07-14 12:56 - 2017-06-21 00:52 - 000081760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\stornvme.sys
2017-07-14 12:56 - 2017-06-21 00:42 - 001573280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2017-07-14 12:56 - 2017-06-21 00:42 - 000601712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2017-07-14 12:56 - 2017-06-21 00:41 - 001706488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2017-07-14 12:56 - 2017-06-21 00:39 - 002048496 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2017-07-14 12:56 - 2017-06-21 00:38 - 007220192 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2017-07-14 12:56 - 2017-06-21 00:38 - 000790752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2017-07-14 12:56 - 2017-06-21 00:36 - 000557408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2017-07-14 12:56 - 2017-06-21 00:36 - 000129888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBSTOR.SYS
2017-07-14 12:56 - 2017-06-21 00:33 - 000408600 _____ (Microsoft Corporation) C:\WINDOWS\system32\tsmf.dll
2017-07-14 12:56 - 2017-06-21 00:33 - 000092512 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2017-07-14 12:56 - 2017-06-21 00:32 - 008169024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2017-07-14 12:56 - 2017-06-21 00:32 - 004260576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2017-07-14 12:56 - 2017-06-21 00:32 - 001983408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2017-07-14 12:56 - 2017-06-21 00:32 - 001702392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2017-07-14 12:56 - 2017-06-21 00:32 - 001072248 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll
2017-07-14 12:56 - 2017-06-21 00:30 - 000869848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2017-07-14 12:56 - 2017-06-21 00:30 - 000196960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ifsutil.dll
2017-07-14 12:56 - 2017-06-21 00:29 - 005722320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2017-07-14 12:56 - 2017-06-21 00:28 - 002277288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2017-07-14 12:56 - 2017-06-21 00:28 - 000524776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
2017-07-14 12:56 - 2017-06-21 00:28 - 000170960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2017-07-14 12:56 - 2017-06-21 00:27 - 001122344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dcomp.dll
2017-07-14 12:56 - 2017-06-21 00:27 - 000975744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2017-07-14 12:56 - 2017-06-21 00:27 - 000861024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2017-07-14 12:56 - 2017-06-21 00:27 - 000549088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll
2017-07-14 12:56 - 2017-06-21 00:25 - 002168288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2017-07-14 12:56 - 2017-06-21 00:25 - 001980776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2017-07-14 12:56 - 2017-06-21 00:24 - 000846560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll
2017-07-14 12:56 - 2017-06-21 00:24 - 000154432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntmarta.dll
2017-07-14 12:56 - 2017-06-21 00:22 - 000361104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tsmf.dll
2017-07-14 12:56 - 2017-06-21 00:21 - 006665440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2017-07-14 12:56 - 2017-06-21 00:21 - 004023552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2017-07-14 12:56 - 2017-06-21 00:21 - 001845512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2017-07-14 12:56 - 2017-06-21 00:21 - 001557808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
2017-07-14 12:56 - 2017-06-21 00:21 - 000952416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2017-07-14 12:56 - 2017-06-21 00:21 - 000374448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFPlay.dll
2017-07-14 12:56 - 2017-06-21 00:20 - 001360464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll
2017-07-14 12:56 - 2017-06-21 00:20 - 000981888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetcore.dll
2017-07-14 12:56 - 2017-06-21 00:20 - 000962768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2017-07-14 12:56 - 2017-06-21 00:20 - 000312472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mftranscode.dll
2017-07-14 12:56 - 2017-06-21 00:19 - 004312248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2017-07-14 12:56 - 2017-06-21 00:04 - 000026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\odbcconf.dll
2017-07-14 12:56 - 2017-06-21 00:03 - 000013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rootmdm.sys
2017-07-14 12:56 - 2017-06-21 00:02 - 000237568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.Diagnostics.dll
2017-07-14 12:56 - 2017-06-21 00:02 - 000124928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\scmdisk0101.sys
2017-07-14 12:56 - 2017-06-21 00:02 - 000124416 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2017-07-14 12:56 - 2017-06-21 00:01 - 000138752 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEDataLayerHelpers.dll
2017-07-14 12:56 - 2017-06-21 00:00 - 000519168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ngccredprov.dll
2017-07-14 12:56 - 2017-06-21 00:00 - 000295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\unimdm.tsp
2017-07-14 12:56 - 2017-06-21 00:00 - 000193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinRtTracing.dll
2017-07-14 12:56 - 2017-06-21 00:00 - 000143360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uudf.dll
2017-07-14 12:56 - 2017-06-21 00:00 - 000138240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DisplayManager.dll
2017-07-14 12:56 - 2017-06-21 00:00 - 000114688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Background.SystemEventsBroker.dll
2017-07-14 12:56 - 2017-06-20 23:59 - 000467968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Gaming.XboxLive.Storage.dll
2017-07-14 12:56 - 2017-06-20 23:59 - 000255488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\unimdm.tsp
2017-07-14 12:56 - 2017-06-20 23:59 - 000177664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.Diagnostics.dll
2017-07-14 12:56 - 2017-06-20 23:59 - 000149504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Core.dll
2017-07-14 12:56 - 2017-06-20 23:59 - 000137216 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdlrecover.exe
2017-07-14 12:56 - 2017-06-20 23:57 - 000360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll
2017-07-14 12:56 - 2017-06-20 23:57 - 000122880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sendmail.dll
2017-07-14 12:56 - 2017-06-20 23:57 - 000088576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDeviceRegistration.Ngc.dll
2017-07-14 12:56 - 2017-06-20 23:56 - 001507840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.FaceAnalysis.dll
2017-07-14 12:56 - 2017-06-20 23:56 - 000299520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll
2017-07-14 12:56 - 2017-06-20 23:56 - 000203776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\credprovhost.dll
2017-07-14 12:56 - 2017-06-20 23:55 - 000561664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Wallet.dll
2017-07-14 12:56 - 2017-06-20 23:55 - 000533504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FXSCOMEX.dll
2017-07-14 12:56 - 2017-06-20 23:55 - 000456192 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
2017-07-14 12:56 - 2017-06-20 23:55 - 000404992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dsreg.dll
2017-07-14 12:56 - 2017-06-20 23:55 - 000358912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.dll
2017-07-14 12:56 - 2017-06-20 23:55 - 000349184 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
2017-07-14 12:56 - 2017-06-20 23:55 - 000265728 _____ C:\WINDOWS\SysWOW64\Windows.Perception.Stub.dll
2017-07-14 12:56 - 2017-06-20 23:55 - 000020480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\regsvr32.exe
2017-07-14 12:56 - 2017-06-20 23:54 - 001159680 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblGameSave.dll
2017-07-14 12:56 - 2017-06-20 23:54 - 000574976 _____ (Microsoft Corporation) C:\WINDOWS\system32\tileobjserver.dll
2017-07-14 12:56 - 2017-06-20 23:54 - 000483840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.AllJoyn.dll
2017-07-14 12:56 - 2017-06-20 23:54 - 000245760 _____ (Microsoft Corporation) C:\WINDOWS\system32\WwaApi.dll
2017-07-14 12:56 - 2017-06-20 23:54 - 000141824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\easwrt.dll
2017-07-14 12:56 - 2017-06-20 23:53 - 000642048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.InkControls.dll
2017-07-14 12:56 - 2017-06-20 23:53 - 000390656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredProvDataModel.dll
2017-07-14 12:56 - 2017-06-20 23:53 - 000284160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AboveLockAppHost.dll
2017-07-14 12:56 - 2017-06-20 23:53 - 000201728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExecModelClient.dll
2017-07-14 12:56 - 2017-06-20 23:52 - 006288384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2017-07-14 12:56 - 2017-06-20 23:52 - 000963584 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebcamUi.dll
2017-07-14 12:56 - 2017-06-20 23:52 - 000331264 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnrSvc.dll
2017-07-14 12:56 - 2017-06-20 23:52 - 000182784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BioCredProv.dll
2017-07-14 12:56 - 2017-06-20 23:51 - 000846336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebcamUi.dll
2017-07-14 12:56 - 2017-06-20 23:51 - 000747520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Ocr.dll
2017-07-14 12:56 - 2017-06-20 23:51 - 000258048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsDocumentTargetPrint.dll
2017-07-14 12:56 - 2017-06-20 23:50 - 001167360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certutil.exe
2017-07-14 12:56 - 2017-06-20 23:50 - 000529920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StructuredQuery.dll
2017-07-14 12:56 - 2017-06-20 23:50 - 000297472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe
2017-07-14 12:56 - 2017-06-20 23:50 - 000238080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AboveLockAppHost.dll
2017-07-14 12:56 - 2017-06-20 23:49 - 003778048 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2017-07-14 12:56 - 2017-06-20 23:49 - 000500224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Graphics.Printing.dll
2017-07-14 12:56 - 2017-06-20 23:49 - 000458752 _____ (Microsoft Corporation) C:\WINDOWS\system32\RTMediaFrame.dll
2017-07-14 12:56 - 2017-06-20 23:49 - 000295936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Graphics.dll
2017-07-14 12:56 - 2017-06-20 23:49 - 000175616 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.DeviceEncryptionHandlers.dll
2017-07-14 12:56 - 2017-06-20 23:48 - 000395264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmenrollengine.dll
2017-07-14 12:56 - 2017-06-20 23:48 - 000336384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\azroleui.dll
2017-07-14 12:56 - 2017-06-20 23:47 - 013873664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2017-07-14 12:56 - 2017-06-20 23:47 - 007655424 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2017-07-14 12:56 - 2017-06-20 23:46 - 004615168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2017-07-14 12:56 - 2017-06-20 23:46 - 001908224 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll
2017-07-14 12:56 - 2017-06-20 23:46 - 001323008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_fs.dll
2017-07-14 12:56 - 2017-06-20 23:46 - 001137152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll
2017-07-14 12:56 - 2017-06-20 23:46 - 000627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\SpaceControl.dll
2017-07-14 12:56 - 2017-06-20 23:45 - 000891904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\autochk.exe
2017-07-14 12:56 - 2017-06-20 23:45 - 000471552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.BackgroundMediaPlayback.dll
2017-07-14 12:56 - 2017-06-20 23:45 - 000102400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uexfat.dll
2017-07-14 12:56 - 2017-06-20 23:44 - 000535040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\untfs.dll
2017-07-14 12:56 - 2017-06-20 23:44 - 000136704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ufat.dll
2017-07-14 12:56 - 2017-06-20 23:44 - 000027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fdProxy.dll
2017-07-14 12:56 - 2017-06-20 23:43 - 001534464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Graphics.Printing.3D.dll
2017-07-14 12:56 - 2017-06-20 23:43 - 001217024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Audio.dll
2017-07-14 12:56 - 2017-06-20 23:43 - 000713216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpnapps.dll
2017-07-14 12:56 - 2017-06-20 23:43 - 000035328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cnvfat.dll
2017-07-14 12:56 - 2017-06-20 23:42 - 002749440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mispace.dll
2017-07-14 12:56 - 2017-06-20 23:42 - 000853504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\autofmt.exe
2017-07-14 12:56 - 2017-06-20 23:42 - 000525312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll
2017-07-14 12:56 - 2017-06-20 23:42 - 000470016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.BackgroundMediaPlayer.dll
2017-07-14 12:56 - 2017-06-20 23:42 - 000380416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uReFSv1.dll
2017-07-14 12:56 - 2017-06-20 23:41 - 003400704 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2017-07-14 12:56 - 2017-06-20 23:41 - 001255936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll
2017-07-14 12:56 - 2017-06-20 23:41 - 001080320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Ocr.dll
2017-07-14 12:56 - 2017-06-20 23:41 - 000983040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcsvc.dll
2017-07-14 12:56 - 2017-06-20 23:41 - 000459776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.MediaPlayer.dll
2017-07-14 12:56 - 2017-06-20 23:40 - 002154496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\storagewmi.dll
2017-07-14 12:56 - 2017-06-20 23:40 - 000901120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Bluetooth.dll
2017-07-14 12:56 - 2017-06-20 23:40 - 000611328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Graphics.Printing.dll
2017-07-14 12:56 - 2017-06-20 23:40 - 000090624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2017-07-14 12:56 - 2017-06-20 23:39 - 008076288 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2017-07-14 12:56 - 2017-06-20 23:39 - 002538496 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
2017-07-14 12:56 - 2017-06-20 23:39 - 000816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2017-07-14 12:56 - 2017-06-20 23:39 - 000546304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uReFS.dll
2017-07-14 12:56 - 2017-06-20 23:38 - 003520512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsrchvw.exe
2017-07-14 12:56 - 2017-06-20 23:38 - 002424320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Perception.dll
2017-07-14 12:56 - 2017-06-20 23:38 - 001984000 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2017-07-14 12:56 - 2017-06-20 23:38 - 000886272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll
2017-07-14 12:56 - 2017-06-20 23:38 - 000877056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\autoconv.exe
2017-07-14 12:56 - 2017-06-20 23:38 - 000846336 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApiPublic.dll
2017-07-14 12:56 - 2017-06-20 23:38 - 000765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Sensors.dll
2017-07-14 12:56 - 2017-06-20 23:38 - 000753152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imapi2fs.dll
2017-07-14 12:56 - 2017-06-20 23:38 - 000709120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CPFilters.dll
2017-07-14 12:56 - 2017-06-20 23:37 - 007468544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2017-07-14 12:56 - 2017-06-20 23:36 - 002648576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnroll.dll
2017-07-14 12:56 - 2017-06-20 23:36 - 001424896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Maps.dll
2017-07-14 12:56 - 2017-06-20 23:36 - 000903680 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
2017-07-14 12:56 - 2017-06-20 23:35 - 004149248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2017-07-14 12:56 - 2017-06-20 23:35 - 002740224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2017-07-14 12:56 - 2017-06-20 23:35 - 002682880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netshell.dll
2017-07-14 12:56 - 2017-06-20 23:35 - 001369088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Phone.dll
2017-07-14 12:56 - 2017-06-20 23:35 - 001170944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll
2017-07-14 12:56 - 2017-06-20 23:35 - 000827904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll
2017-07-14 12:56 - 2017-06-20 23:35 - 000732160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll
2017-07-14 12:56 - 2017-06-20 23:35 - 000348160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Midi.dll
2017-07-14 12:56 - 2017-06-20 23:34 - 003299840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstsc.exe
2017-07-14 12:56 - 2017-06-20 23:34 - 000773120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
2017-07-14 12:56 - 2017-06-20 23:34 - 000711168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2017-07-14 12:56 - 2017-06-20 23:34 - 000566784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ShareHost.dll
2017-07-14 12:56 - 2017-06-20 23:33 - 000691200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2017-07-14 12:56 - 2017-06-20 23:33 - 000439296 _____ (Microsoft Corporation) C:\WINDOWS\system32\wksprt.exe
2017-07-14 12:56 - 2017-06-20 23:32 - 001556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
2017-07-14 12:56 - 2017-06-20 23:32 - 000353280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TextInputFramework.dll
2017-07-14 12:56 - 2017-06-20 23:31 - 003106304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe
2017-07-14 12:56 - 2017-06-20 23:30 - 000038912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tlscsp.dll
2017-07-14 12:56 - 2017-06-19 19:42 - 000993632 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcr120_clr0400.dll
2017-07-14 12:56 - 2017-05-22 21:58 - 000448576 _____ C:\WINDOWS\system32\ApnDatabase.xml
2017-07-14 12:56 - 2017-03-04 00:10 - 000360040 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2017-07-14 12:56 - 2017-03-03 23:26 - 000307200 _____ (Microsoft Corporation) C:\WINDOWS\system32\PrintDialogs3D.dll
2017-07-14 12:56 - 2017-03-03 23:23 - 000583680 _____ (Microsoft Corporation) C:\WINDOWS\system32\PrintDialogs.dll
2017-07-14 12:56 - 2017-03-03 23:21 - 000670208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.PointOfService.dll
2017-07-14 12:56 - 2017-03-03 23:20 - 000562176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.SmartCards.dll
2017-07-14 12:56 - 2017-03-03 23:20 - 000206336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vaultcli.dll
2017-07-14 12:56 - 2017-03-03 23:18 - 000525824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintDialogs.dll
2017-07-14 12:56 - 2017-03-03 23:17 - 000864256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnapps.dll
2017-07-14 12:56 - 2017-03-03 23:16 - 000584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2017-07-14 12:56 - 2017-03-03 23:15 - 001078784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Streaming.dll
2017-07-14 12:56 - 2017-03-03 23:12 - 004596224 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsrchvw.exe
2017-07-14 12:56 - 2017-03-03 23:02 - 002138112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
2017-07-14 12:55 - 2017-07-07 00:44 - 000108896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2017-07-14 12:55 - 2017-07-07 00:42 - 007781720 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-07-14 12:55 - 2017-07-07 00:40 - 000376672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2017-07-14 12:55 - 2017-07-07 00:37 - 000468320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys
2017-07-14 12:55 - 2017-07-07 00:32 - 000404824 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2017-07-14 12:55 - 2017-07-07 00:29 - 002759712 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2017-07-14 12:55 - 2017-07-07 00:28 - 000223584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2017-07-14 12:55 - 2017-07-07 00:23 - 000241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHost.dll
2017-07-14 12:55 - 2017-07-07 00:19 - 000081408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2017-07-14 12:55 - 2017-07-07 00:18 - 001100120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys
2017-07-14 12:55 - 2017-07-07 00:18 - 000057400 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsass.exe
2017-07-14 12:55 - 2017-07-07 00:14 - 000270336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2017-07-14 12:55 - 2017-07-07 00:14 - 000126464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2017-07-14 12:55 - 2017-07-07 00:11 - 000340480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2017-07-14 12:55 - 2017-07-07 00:06 - 018364928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-07-14 12:55 - 2017-07-07 00:05 - 019414528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-07-14 12:55 - 2017-07-07 00:00 - 012187136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2017-07-14 12:55 - 2017-07-06 23:57 - 000691712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2017-07-14 12:55 - 2017-07-06 23:56 - 006035456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-07-14 12:55 - 2017-07-06 23:55 - 003664896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2017-07-14 12:55 - 2017-07-06 23:54 - 002027008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2017-07-14 12:55 - 2017-07-06 23:51 - 022569984 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-07-14 12:55 - 2017-07-06 23:49 - 000115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bridge.sys
2017-07-14 12:55 - 2017-07-06 23:48 - 000071680 _____ (Microsoft Corporation) C:\WINDOWS\system32\l2gpstore.dll
2017-07-14 12:55 - 2017-07-06 23:48 - 000030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapprovp.dll
2017-07-14 12:55 - 2017-07-06 23:46 - 000231424 _____ (Microsoft Corporation) C:\WINDOWS\system32\shutdownux.dll
2017-07-14 12:55 - 2017-07-06 23:46 - 000052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpipreg.sys
2017-07-14 12:55 - 2017-07-06 23:45 - 000276992 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2017-07-14 12:55 - 2017-07-06 23:45 - 000223744 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2017-07-14 12:55 - 2017-07-06 23:44 - 000502784 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll
2017-07-14 12:55 - 2017-07-06 23:44 - 000238592 _____ (Microsoft Corporation) C:\WINDOWS\system32\onex.dll
2017-07-14 12:55 - 2017-07-06 23:44 - 000139264 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2017-07-14 12:55 - 2017-07-06 23:44 - 000137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\raschap.dll
2017-07-14 12:55 - 2017-07-06 23:43 - 001081856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2017-07-14 12:55 - 2017-07-06 23:43 - 000431616 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpAXHolder.dll
2017-07-14 12:55 - 2017-07-06 23:43 - 000387584 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2017-07-14 12:55 - 2017-07-06 23:43 - 000088576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2017-07-14 12:55 - 2017-07-06 23:42 - 000805888 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2017-07-14 12:55 - 2017-07-06 23:39 - 000282624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2017-07-14 12:55 - 2017-07-06 23:36 - 000369664 _____ (Microsoft Corporation) C:\WINDOWS\system32\msinfo32.exe
2017-07-14 12:55 - 2017-07-06 23:35 - 001397760 _____ (Microsoft Corporation) C:\WINDOWS\system32\wdc.dll
2017-07-14 12:55 - 2017-07-06 23:33 - 000576000 _____ (Microsoft® Windows® Operating System) C:\WINDOWS\system32\wvc.dll
2017-07-14 12:55 - 2017-07-06 23:31 - 023676416 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-07-14 12:55 - 2017-07-06 23:30 - 013090816 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2017-07-14 12:55 - 2017-07-06 23:29 - 000932864 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2017-07-14 12:55 - 2017-07-06 23:28 - 002096640 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2017-07-14 12:55 - 2017-07-06 23:28 - 000759296 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2017-07-14 12:55 - 2017-07-06 23:28 - 000589312 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2017-07-14 12:55 - 2017-07-06 23:27 - 008120832 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-07-14 12:55 - 2017-07-06 23:24 - 004744704 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2017-07-14 12:55 - 2017-07-06 23:24 - 002895872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2017-07-14 12:55 - 2017-07-06 23:24 - 001783296 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2017-07-14 12:55 - 2017-07-06 23:24 - 001513472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2017-07-14 12:55 - 2017-07-06 23:22 - 001826816 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2017-07-14 12:55 - 2017-06-21 00:54 - 000603488 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContentDeliveryManager.Utilities.dll
2017-07-14 12:55 - 2017-06-21 00:52 - 001886344 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2017-07-14 12:55 - 2017-06-21 00:51 - 002255712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2017-07-14 12:55 - 2017-06-21 00:51 - 000434528 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2017-07-14 12:55 - 2017-06-21 00:50 - 000126304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mup.sys
2017-07-14 12:55 - 2017-06-21 00:48 - 002681200 _____ C:\WINDOWS\system32\CoreUIComponents.dll
2017-07-14 12:55 - 2017-06-21 00:40 - 001069720 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2017-07-14 12:55 - 2017-06-21 00:40 - 000328008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2017-07-14 12:55 - 2017-06-21 00:38 - 001860288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2017-07-14 12:55 - 2017-06-21 00:38 - 001738560 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2017-07-14 12:55 - 2017-06-21 00:37 - 001369240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcomp.dll
2017-07-14 12:55 - 2017-06-21 00:37 - 001157008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2017-07-14 12:55 - 2017-06-21 00:31 - 001277824 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2017-07-14 12:55 - 2017-06-21 00:31 - 000160096 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHostBroker.dll
2017-07-14 12:55 - 2017-06-21 00:26 - 000387864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpps.dll
2017-07-14 12:55 - 2017-06-21 00:06 - 000372736 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXTaskFactory.dll
2017-07-14 12:55 - 2017-06-21 00:04 - 001631232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll
2017-07-14 12:55 - 2017-06-21 00:02 - 000030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\odbcconf.dll
2017-07-14 12:55 - 2017-06-21 00:01 - 000185344 _____ (Microsoft Corporation) C:\WINDOWS\system32\DisplayManager.dll
2017-07-14 12:55 - 2017-06-21 00:01 - 000015872 _____ (Microsoft Corporation) C:\WINDOWS\system32\snmptrap.exe
2017-07-14 12:55 - 2017-06-21 00:00 - 000233984 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvisioningHandlers.dll
2017-07-14 12:55 - 2017-06-21 00:00 - 000113664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.ServiceDiscovery.Dnssd.dll
2017-07-14 12:55 - 2017-06-20 23:59 - 000182272 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceDirectoryClient.dll
2017-07-14 12:55 - 2017-06-20 23:58 - 000418304 _____ C:\WINDOWS\system32\Windows.Perception.Stub.dll
2017-07-14 12:55 - 2017-06-20 23:58 - 000211968 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2017-07-14 12:55 - 2017-06-20 23:58 - 000144896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dfsc.sys
2017-07-14 12:55 - 2017-06-20 23:57 - 000505856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.WiFiDirect.dll
2017-07-14 12:55 - 2017-06-20 23:57 - 000418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll
2017-07-14 12:55 - 2017-06-20 23:57 - 000243712 _____ (Microsoft Corporation) C:\WINDOWS\system32\credprovhost.dll
2017-07-14 12:55 - 2017-06-20 23:57 - 000171520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.SerialCommunication.dll
2017-07-14 12:55 - 2017-06-20 23:57 - 000144896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Lights.dll
2017-07-14 12:55 - 2017-06-20 23:56 - 000912384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.SmartCards.dll
2017-07-14 12:55 - 2017-06-20 23:56 - 000748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2017-07-14 12:55 - 2017-06-20 23:56 - 000719872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdiWiFi.sys
2017-07-14 12:55 - 2017-06-20 23:56 - 000590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\efswrt.dll
2017-07-14 12:55 - 2017-06-20 23:56 - 000568320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.LowLevel.dll
2017-07-14 12:55 - 2017-06-20 23:56 - 000260608 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe
2017-07-14 12:55 - 2017-06-20 23:56 - 000216576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Scanners.dll
2017-07-14 12:55 - 2017-06-20 23:55 - 000310784 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncSettings.dll
2017-07-14 12:55 - 2017-06-20 23:55 - 000252416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Identity.Provider.dll
2017-07-14 12:55 - 2017-06-20 23:54 - 000949248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.PointOfService.dll
2017-07-14 12:55 - 2017-06-20 23:54 - 000671744 _____ (Microsoft Corporation) C:\WINDOWS\system32\mbsmsapi.dll
2017-07-14 12:55 - 2017-06-20 23:54 - 000472064 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Bluetooth.dll
2017-07-14 12:55 - 2017-06-20 23:54 - 000337408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Picker.dll
2017-07-14 12:55 - 2017-06-20 23:53 - 000437248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Usb.dll
2017-07-14 12:55 - 2017-06-20 23:53 - 000425984 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll
2017-07-14 12:55 - 2017-06-20 23:53 - 000339968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Graphics.dll
2017-07-14 12:55 - 2017-06-20 23:52 - 017198592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2017-07-14 12:55 - 2017-06-20 23:52 - 000410112 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevicesFlowBroker.dll
2017-07-14 12:55 - 2017-06-20 23:52 - 000352256 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsDocumentTargetPrint.dll
2017-07-14 12:55 - 2017-06-20 23:51 - 000634368 _____ (Microsoft Corporation) C:\WINDOWS\system32\StructuredQuery.dll
2017-07-14 12:55 - 2017-06-20 23:50 - 000661504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
2017-07-14 12:55 - 2017-06-20 23:49 - 002104320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
2017-07-14 12:55 - 2017-06-20 23:49 - 001403392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Editing.dll
2017-07-14 12:55 - 2017-06-20 23:49 - 000169984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Energy.dll
2017-07-14 12:55 - 2017-06-20 23:47 - 001105408 _____ (Microsoft Corporation) C:\WINDOWS\system32\MiracastReceiver.dll
2017-07-14 12:55 - 2017-06-20 23:47 - 000442368 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToDevice.dll
2017-07-14 12:55 - 2017-06-20 23:46 - 000187904 _____ (Microsoft Corporation) C:\WINDOWS\system32\dialclient.dll
2017-07-14 12:55 - 2017-06-20 23:44 - 000588288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidprov.dll
2017-07-14 12:55 - 2017-06-20 23:43 - 000130560 _____ (Microsoft Corporation) C:\WINDOWS\system32\SpaceAgent.exe
2017-07-14 12:55 - 2017-06-20 23:42 - 000981504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll
2017-07-14 12:55 - 2017-06-20 23:42 - 000539136 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToManager.dll
2017-07-14 12:55 - 2017-06-20 23:42 - 000467968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Geolocation.dll
2017-07-14 12:55 - 2017-06-20 23:42 - 000079360 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationFrameworkInternalPS.dll
2017-07-14 12:55 - 2017-06-20 23:41 - 000945664 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
2017-07-14 12:55 - 2017-06-20 23:41 - 000913920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.dll
2017-07-14 12:55 - 2017-06-20 23:40 - 004474368 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll
2017-07-14 12:55 - 2017-06-20 23:40 - 001891328 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnidui.dll
2017-07-14 12:55 - 2017-06-20 23:39 - 002208768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Graphics.Printing.3D.dll
2017-07-14 12:55 - 2017-06-20 23:39 - 000971264 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll
2017-07-14 12:55 - 2017-06-20 23:38 - 005611008 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll
2017-07-14 12:55 - 2017-06-20 23:38 - 002695680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2017-07-14 12:55 - 2017-06-20 23:38 - 001275392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Bluetooth.dll
2017-07-14 12:55 - 2017-06-20 23:38 - 000908800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2017-07-14 12:55 - 2017-06-20 23:37 - 000875520 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2017-07-14 12:55 - 2017-06-20 23:37 - 000774656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.dll
2017-07-14 12:55 - 2017-06-20 23:37 - 000735744 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2017-07-14 12:55 - 2017-06-20 23:36 - 000701952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.Connectivity.dll
2017-07-14 12:55 - 2017-06-20 23:35 - 001328640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.Http.dll
2017-07-14 12:55 - 2017-06-20 23:35 - 000924672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.dll
2017-07-14 12:55 - 2017-06-20 23:34 - 001121280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll
2017-07-14 12:55 - 2017-06-20 23:34 - 000035328 _____ (Microsoft Corporation) C:\WINDOWS\system32\spaceman.exe
2017-07-14 12:55 - 2017-06-20 23:33 - 000048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\tlscsp.dll
2017-07-14 12:55 - 2017-03-03 23:28 - 000279552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.HumanInterfaceDevice.dll
2017-07-14 12:55 - 2017-03-03 23:23 - 001145856 _____ (Microsoft Corporation) C:\WINDOWS\system32\EmailApis.dll
2017-07-14 12:55 - 2017-03-03 23:20 - 000800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2017-07-14 12:55 - 2017-03-03 23:19 - 001589760 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtctm.dll
2017-07-14 12:55 - 2017-03-03 23:14 - 000279552 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToReceiver.dll
2017-07-14 12:55 - 2016-10-14 20:45 - 001790464 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationFramework.dll
2017-07-14 12:55 - 2016-08-26 22:12 - 000244816 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2017-07-14 12:54 - 2017-07-07 00:23 - 001600624 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2017-07-14 12:54 - 2017-07-06 23:58 - 007217152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2017-07-14 12:54 - 2017-07-06 23:47 - 000201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\ScDeviceEnum.dll
2017-07-14 12:54 - 2017-07-06 23:45 - 000488960 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupShim.dll
2017-07-14 12:54 - 2017-07-06 23:45 - 000289792 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeveloperOptionsSettingsHandlers.dll
2017-07-14 12:54 - 2017-07-06 23:44 - 000193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\certprop.dll
2017-07-14 12:54 - 2017-07-06 23:44 - 000147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll
2017-07-14 12:54 - 2017-07-06 23:42 - 000352256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wldap32.dll
2017-07-14 12:54 - 2017-07-06 23:34 - 009131008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2017-07-14 12:54 - 2017-07-06 23:29 - 004749824 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2017-07-14 12:54 - 2017-07-06 23:28 - 000927744 _____ (Microsoft Corporation) C:\WINDOWS\system32\SmartcardCredentialProvider.dll
2017-07-14 12:54 - 2017-07-06 23:25 - 004708864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
2017-07-14 12:54 - 2017-07-06 23:24 - 005388800 _____ (Microsoft) C:\WINDOWS\system32\dbgeng.dll
2017-07-14 12:54 - 2017-07-06 23:24 - 003615744 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-07-14 12:54 - 2017-07-06 23:24 - 002217472 _____ (Microsoft Corporation) C:\WINDOWS\system32\OpcServices.dll
2017-07-14 12:54 - 2017-06-21 00:47 - 000764392 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2017-07-14 12:54 - 2017-06-21 00:40 - 000224096 _____ (Microsoft Corporation) C:\WINDOWS\system32\ifsutil.dll
2017-07-14 12:54 - 2017-06-21 00:37 - 002446704 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2017-07-14 12:54 - 2017-06-21 00:37 - 000146784 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHostCommon.dll
2017-07-14 12:54 - 2017-06-21 00:36 - 000624048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2017-07-14 12:54 - 2017-06-21 00:35 - 002915704 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2017-07-14 12:54 - 2017-06-21 00:35 - 001267512 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll
2017-07-14 12:54 - 2017-06-21 00:31 - 004674360 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2017-07-14 12:54 - 2017-06-21 00:03 - 000167936 _____ (Microsoft Corporation) C:\WINDOWS\system32\uudf.dll
2017-07-14 12:54 - 2017-06-21 00:02 - 000124416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.System.SystemManagement.dll
2017-07-14 12:54 - 2017-06-21 00:01 - 000156160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Family.Client.dll
2017-07-14 12:54 - 2017-06-21 00:01 - 000108032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Family.Authentication.dll
2017-07-14 12:54 - 2017-06-21 00:00 - 000259072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Family.SyncEngine.dll
2017-07-14 12:54 - 2017-06-21 00:00 - 000224256 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_SignInOptions.dll
2017-07-14 12:54 - 2017-06-21 00:00 - 000193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.WiFi.dll
2017-07-14 12:54 - 2017-06-21 00:00 - 000148480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.System.Profile.RetailInfo.dll
2017-07-14 12:54 - 2017-06-21 00:00 - 000082432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.System.UserDeviceAssociation.dll
2017-07-14 12:54 - 2017-06-21 00:00 - 000073216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryBroker.dll
2017-07-14 12:54 - 2017-06-20 23:59 - 000196096 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDeviceRegistration.dll
2017-07-14 12:54 - 2017-06-20 23:59 - 000136192 _____ (Microsoft Corporation) C:\WINDOWS\system32\sendmail.dll
2017-07-14 12:54 - 2017-06-20 23:59 - 000122880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryClient.dll
2017-07-14 12:54 - 2017-06-20 23:59 - 000101888 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDeviceRegistration.Ngc.dll
2017-07-14 12:54 - 2017-06-20 23:59 - 000082944 _____ (Microsoft Corporation) C:\WINDOWS\system32\KdsCli.dll
2017-07-14 12:54 - 2017-06-20 23:58 - 000547840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Gaming.Input.dll
2017-07-14 12:54 - 2017-06-20 23:58 - 000257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudDomainJoinDataModelServer.dll
2017-07-14 12:54 - 2017-06-20 23:58 - 000224768 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpd_ci.dll
2017-07-14 12:54 - 2017-06-20 23:58 - 000186368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Radios.dll
2017-07-14 12:54 - 2017-06-20 23:57 - 000651264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.AllJoyn.dll
2017-07-14 12:54 - 2017-06-20 23:57 - 000157696 _____ (Microsoft Corporation) C:\WINDOWS\system32\XamlTileRender.dll
2017-07-14 12:54 - 2017-06-20 23:57 - 000087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdbusenum.dll
2017-07-14 12:54 - 2017-06-20 23:56 - 000852480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Import.dll
2017-07-14 12:54 - 2017-06-20 23:56 - 000379904 _____ (Microsoft Corporation) C:\WINDOWS\system32\apprepsync.dll
2017-07-14 12:54 - 2017-06-20 23:56 - 000324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2017-07-14 12:54 - 2017-06-20 23:56 - 000268800 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserMgrProxy.dll
2017-07-14 12:54 - 2017-06-20 23:56 - 000267264 _____ (Microsoft Corporation) C:\WINDOWS\system32\vaultcli.dll
2017-07-14 12:54 - 2017-06-20 23:55 - 000407552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Management.dll
2017-07-14 12:54 - 2017-06-20 23:55 - 000176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\apprepapi.dll
2017-07-14 12:54 - 2017-06-20 23:54 - 000247808 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExecModelClient.dll
2017-07-14 12:54 - 2017-06-20 23:54 - 000168960 _____ (Microsoft Corporation) C:\WINDOWS\system32\easwrt.dll
2017-07-14 12:54 - 2017-06-20 23:53 - 001010176 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2017-07-14 12:54 - 2017-06-20 23:53 - 000329728 _____ (Microsoft Corporation) C:\WINDOWS\system32\deviceaccess.dll
2017-07-14 12:54 - 2017-06-20 23:52 - 000956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2017-07-14 12:54 - 2017-06-20 23:52 - 000896512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.AccountsControl.dll
2017-07-14 12:54 - 2017-06-20 23:52 - 000775168 _____ (Microsoft Corporation) C:\WINDOWS\system32\GamePanel.exe
2017-07-14 12:54 - 2017-06-20 23:52 - 000560128 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppReadiness.dll
2017-07-14 12:54 - 2017-06-20 23:51 - 000410112 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2017-07-14 12:54 - 2017-06-20 23:50 - 001054208 _____ (Microsoft Corporation) C:\WINDOWS\system32\qmgr.dll
2017-07-14 12:54 - 2017-06-20 23:49 - 001913856 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_fs.dll
2017-07-14 12:54 - 2017-06-20 23:49 - 001584128 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_health.dll
2017-07-14 12:54 - 2017-06-20 23:48 - 000968192 _____ (Microsoft Corporation) C:\WINDOWS\system32\autochk.exe
2017-07-14 12:54 - 2017-06-20 23:48 - 000112640 _____ (Microsoft Corporation) C:\WINDOWS\system32\uexfat.dll
2017-07-14 12:54 - 2017-06-20 23:47 - 000574976 _____ (Microsoft Corporation) C:\WINDOWS\system32\untfs.dll
2017-07-14 12:54 - 2017-06-20 23:47 - 000152064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ufat.dll
2017-07-14 12:54 - 2017-06-20 23:47 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\fdProxy.dll
2017-07-14 12:54 - 2017-06-20 23:46 - 003290112 _____ (Microsoft Corporation) C:\WINDOWS\system32\mispace.dll
2017-07-14 12:54 - 2017-06-20 23:46 - 000925184 _____ (Microsoft Corporation) C:\WINDOWS\system32\autofmt.exe
2017-07-14 12:54 - 2017-06-20 23:46 - 000516608 _____ (Microsoft Corporation) C:\WINDOWS\system32\uReFSv1.dll
2017-07-14 12:54 - 2017-06-20 23:46 - 000039424 _____ (Microsoft Corporation) C:\WINDOWS\system32\cnvfat.dll
2017-07-14 12:54 - 2017-06-20 23:45 - 002861056 _____ (Microsoft Corporation) C:\WINDOWS\system32\storagewmi.dll
2017-07-14 12:54 - 2017-06-20 23:44 - 000167936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ErrorDetails.dll
2017-07-14 12:54 - 2017-06-20 23:43 - 000961536 _____ (Microsoft Corporation) C:\WINDOWS\system32\imapi2fs.dll
2017-07-14 12:54 - 2017-06-20 23:43 - 000953344 _____ (Microsoft Corporation) C:\WINDOWS\system32\autoconv.exe
2017-07-14 12:54 - 2017-06-20 23:43 - 000628736 _____ (Microsoft Corporation) C:\WINDOWS\system32\uReFS.dll
2017-07-14 12:54 - 2017-06-20 23:42 - 000139776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Devices.dll
2017-07-14 12:54 - 2017-06-20 23:41 - 002279424 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2017-07-14 12:54 - 2017-06-20 23:41 - 001692160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2017-07-14 12:54 - 2017-06-20 23:41 - 001359872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModel.dll
2017-07-14 12:54 - 2017-06-20 23:41 - 001021440 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll
2017-07-14 12:54 - 2017-06-20 23:41 - 000460800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Midi.dll
2017-07-14 12:54 - 2017-06-20 23:40 - 001586176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2017-07-14 12:54 - 2017-06-20 23:40 - 001421824 _____ (Microsoft Corporation) C:\WINDOWS\system32\certutil.exe
2017-07-14 12:54 - 2017-06-20 23:40 - 000886784 _____ (Microsoft Corporation) C:\WINDOWS\system32\CPFilters.dll
2017-07-14 12:54 - 2017-06-20 23:40 - 000376832 _____ (Microsoft Corporation) C:\WINDOWS\system32\CryptoWinRT.dll
2017-07-14 12:54 - 2017-06-20 23:39 - 002916864 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertEnroll.dll
2017-07-14 12:54 - 2017-06-20 23:39 - 001643008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll
2017-07-14 12:54 - 2017-06-20 23:39 - 001490432 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2017-07-14 12:54 - 2017-06-20 23:39 - 000673792 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2017-07-14 12:54 - 2017-06-20 23:37 - 000716800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ShareHost.dll
2017-07-14 12:54 - 2017-06-20 23:36 - 002318848 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2017-07-14 12:54 - 2017-06-20 23:36 - 000881152 _____ (Microsoft Corporation) C:\WINDOWS\system32\MsSpellCheckingFacility.dll
2017-07-14 12:54 - 2017-06-20 23:36 - 000180224 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
2017-07-14 12:54 - 2017-06-20 23:35 - 001726976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
2017-07-14 12:54 - 2017-03-03 23:27 - 000391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleacc.dll
2017-07-14 12:54 - 2016-10-05 02:32 - 000146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\AuthBroker.dll
2017-07-13 22:57 - 2017-07-26 01:53 - 000000000 ____D C:\Users\yosef\Desktop\Renewal of O1
2017-07-12 22:41 - 2017-07-12 22:41 - 000000000 ____D C:\Program Files\WinRAR
2017-07-12 22:40 - 2017-07-12 22:40 - 000000000 ____D C:\Program Files\Mozilla Firefox
2017-07-08 11:49 - 2016-09-04 18:48 - 000344153 _____ C:\Users\yosef\Desktop\Yuri - RecommendLetter.pdf
2017-07-07 16:11 - 2017-07-07 16:11 - 000000000 ____D C:\Users\yosef\AppData\Local\UNP
2017-07-06 23:02 - 2017-07-06 23:03 - 000000000 ____D C:\Program Files\UNP
2017-07-06 23:02 - 2017-07-06 23:02 - 000000000 ____D C:\WINDOWS\system32\UNP
2017-07-06 12:32 - 2017-07-06 13:32 - 000003446 _____ C:\WINDOWS\System32\Tasks\McAfee Remediation (Prepare)
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-08-05 18:17 - 2015-09-14 17:29 - 000000000 ____D C:\Users\yosef\Documents\YouCam
2017-08-05 18:15 - 2016-09-20 12:33 - 000000000 ___RD C:\Users\yosef\Google Drive
2017-08-05 18:13 - 2016-09-26 02:42 - 000000000 ____D C:\Users\yosef
2017-08-05 18:13 - 2016-09-26 02:37 - 000000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2017-08-05 18:13 - 2015-09-14 17:28 - 000000000 __SHD C:\Users\yosef\IntelGraphicsProfiles
2017-08-05 18:12 - 2016-09-26 03:07 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-08-05 18:12 - 2016-09-26 02:34 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2017-08-05 17:34 - 2016-07-15 23:04 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2017-08-05 13:52 - 2016-07-16 04:47 - 000000000 ____D C:\WINDOWS\AppReadiness
2017-08-05 12:24 - 2016-07-16 04:47 - 000000000 ____D C:\WINDOWS\system32\FxsTmp
2017-08-04 20:53 - 2017-03-13 19:26 - 000000364 _____ C:\WINDOWS\Tasks\HPCeeScheduleForyosef.job
2017-08-04 19:50 - 2015-09-20 12:08 - 000000000 ____D C:\Users\yosef\Desktop\Quotes
2017-08-04 19:28 - 2017-03-13 19:26 - 000003256 _____ C:\WINDOWS\System32\Tasks\HPCeeScheduleForyosef
2017-08-04 12:06 - 2016-07-16 04:47 - 000000000 ___HD C:\Program Files\WindowsApps
2017-08-03 15:42 - 2015-07-21 17:31 - 000000000 ____D C:\Program Files\mcafee
2017-08-03 13:17 - 2016-07-16 04:47 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-08-03 13:15 - 2015-09-15 10:43 - 000000000 ____D C:\Program Files\Microsoft Office 15
2017-08-03 13:13 - 2015-07-21 17:31 - 000000000 ____D C:\ProgramData\mcafee
2017-08-03 13:13 - 2015-07-21 17:31 - 000000000 ____D C:\Program Files\Common Files\McAfee
2017-08-03 13:11 - 2016-07-16 04:47 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2017-08-03 13:09 - 2016-09-26 03:07 - 000003126 _____ C:\WINDOWS\System32\Tasks\McAfeeLogon
2017-08-03 13:07 - 2016-09-26 03:07 - 000000000 ____D C:\WINDOWS\System32\Tasks\McAfee
2017-08-02 10:30 - 2016-07-16 04:47 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2017-08-01 17:48 - 2016-07-16 04:45 - 000000000 ____D C:\WINDOWS\INF
2017-07-31 23:55 - 2016-07-15 23:04 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2017-07-31 18:48 - 2017-06-23 01:12 - 000000000 ____D C:\Users\yosef\Desktop\Rosacia
2017-07-31 17:01 - 2016-09-20 12:31 - 000000000 ____D C:\Users\yosef\AppData\Local\Google
2017-07-31 17:01 - 2016-09-20 12:31 - 000000000 ____D C:\Program Files (x86)\Google
2017-07-31 17:00 - 2016-09-26 03:07 - 000003416 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2017-07-31 17:00 - 2016-09-26 03:07 - 000003292 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2017-07-30 15:20 - 2015-10-30 00:24 - 000000000 ____D C:\WINDOWS\system32\Tasks_Migrated
2017-07-30 00:55 - 2015-09-14 17:33 - 000000000 ___RD C:\Users\yosef\OneDrive
2017-07-29 13:56 - 2016-05-12 15:24 - 000000008 __RSH C:\ProgramData\ntuser.pol
2017-07-29 13:19 - 2015-07-21 17:36 - 000002170 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Priceline.com.lnk
2017-07-29 13:15 - 2016-07-16 04:47 - 000000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy
2017-07-29 13:15 - 2015-07-10 04:04 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy
2017-07-29 12:48 - 2015-11-30 14:06 - 000000000 ____D C:\Users\yosef\AppData\Roaming\Dashlane
2017-07-29 12:47 - 2015-09-14 17:28 - 000000000 ____D C:\Users\yosef\AppData\Local\Packages
2017-07-22 00:16 - 2016-11-19 21:39 - 000000000 ____D C:\Users\yosef\Desktop\Agents & Managers
2017-07-20 13:58 - 2017-04-04 19:48 - 000000000 ____D C:\Users\yosef\Desktop\Direct TV POWER Commercial
2017-07-19 10:15 - 2016-12-15 23:48 - 000000000 ____D C:\Users\yosef\Desktop\Headshots
2017-07-17 14:11 - 2016-07-16 04:47 - 000000000 ____D C:\WINDOWS\rescache
2017-07-15 11:57 - 2016-09-26 02:41 - 001557236 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-07-15 11:56 - 2015-07-15 23:05 - 000000000 __RHD C:\Users\Public\AccountPictures
2017-07-15 11:49 - 2016-09-26 02:34 - 000356848 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-07-14 22:52 - 2016-07-16 04:47 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-07-14 22:52 - 2016-07-16 04:47 - 000000000 ____D C:\WINDOWS\system32\oobe
2017-07-14 22:52 - 2016-07-16 04:47 - 000000000 ____D C:\WINDOWS\system32\appraiser
2017-07-14 22:52 - 2016-07-16 04:47 - 000000000 ____D C:\WINDOWS\ShellExperiences
2017-07-14 22:52 - 2016-07-16 04:47 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2017-07-14 22:52 - 2016-07-16 04:47 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2017-07-14 13:10 - 2016-07-16 04:36 - 000000000 ____D C:\WINDOWS\CbsTemp
2017-07-14 13:02 - 2015-09-14 20:52 - 000000000 ____D C:\WINDOWS\system32\MRT
2017-07-14 12:59 - 2015-09-14 20:52 - 135225752 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-07-14 12:21 - 2016-07-16 04:43 - 000157696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\enrollmentapi.dll
2017-07-14 12:00 - 2016-03-18 18:03 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-07-13 20:31 - 2015-09-19 15:00 - 000000000 ____D C:\Users\yosef\Desktop\O1 -Supporting Documents
2017-07-12 22:41 - 2016-05-12 15:26 - 000000000 ____D C:\Users\yosef\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-07-12 22:41 - 2016-05-12 15:26 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-07-12 22:41 - 2016-03-18 18:03 - 000001012 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-07-12 22:41 - 2016-03-18 18:03 - 000001000 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2017-07-12 22:39 - 2017-04-17 22:33 - 000001106 _____ C:\Users\Public\Desktop\VLC media player.lnk
2017-07-12 13:11 - 2015-09-15 18:36 - 000000000 ____D C:\Users\yosef\AppData\Roaming\Skype
2017-07-11 14:49 - 2017-04-18 12:51 - 000170298 _____ C:\Users\yosef\Desktop\Yosef Podolski - Resume.pdf
2017-07-08 11:09 - 2017-05-20 18:47 - 000000000 ____D C:\Users\yosef\Desktop\Acting Reel - May 2017
2017-07-08 10:04 - 2015-11-06 16:04 - 000000000 ____D C:\Users\yosef\AppData\Roaming\CyberLink
2017-07-08 10:03 - 2015-07-21 17:38 - 000000000 ____D C:\ProgramData\CyberLink
==================== Files in the root of some directories =======
2016-05-12 16:25 - 2016-09-14 00:30 - 000000180 _____ () C:\Users\yosef\AppData\Roaming\WB.CFG
2017-05-17 11:32 - 2017-05-17 11:32 - 000125952 _____ () C:\Users\yosef\AppData\Local\report
2015-09-19 11:44 - 2015-09-19 11:44 - 000004105 _____ () C:\ProgramData\wmzddnmb.cix
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2017-07-28 21:47
==================== End of FRST.txt ============================

 

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-07-2017
Ran by [removed] (05-08-2017 18:20:28)
Running from C:\Users\[removed]\Desktop
Windows 10 Home Version 1607 (X64) (2016-09-26 10:27:16)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================
Administrator (S-1-5-21-182178435-2925743980-1085802887-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-182178435-2925743980-1085802887-503 - Limited - Disabled)
Guest (S-1-5-21-182178435-2925743980-1085802887-501 - Limited - Disabled)
yosef (S-1-5-21-182178435-2925743980-1085802887-1001 - Administrator - Enabled) => C:\Users\yosef
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: McAfee VirusScan (Disabled - Up to date) {8BCDACFA-D264-3528-5EF8-E94FD0BC1FBC}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: McAfee VirusScan (Disabled - Up to date) {30AC4D1E-F45E-3AA6-6448-D23DAB3B5501}
FW: McAfee Firewall (Enabled) {B3F62DDF-980B-3470-75A7-407A2E6F58C7}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
12 Labours of Hercules III: Girl Power (HKLM-x32\…\WTA-76751182-3748-4898-9b2c-2e90377d4935) (Version: 3.0.2.118 - WildTangent) Hidden
Adobe Shockwave Player 12.1 (HKLM-x32\…\Adobe Shockwave Player) (Version: 12.1.7.157 - Adobe Systems, Inc.)
Apple Application Support (32-bit) (HKLM-x32\…\{3540ADD5-822B-47FB-B1C2-CD7B2C8E9FEC}) (Version: 4.0.2 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\…\{C9C0FE2C-602E-49D7-8C42-5B9E8FF04798}) (Version: 4.0.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\…\{FD244E19-6EFE-4A2D-948A-0D45D4C168BE}) (Version: 9.0.0.26 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
Azkend 2: The World Beneath (HKLM-x32\…\WTA-9f75a07d-20f1-433e-b85e-073e239218c3) (Version: 2.2.0.98 - WildTangent) Hidden
Barn Yarn Collector's Edition (HKLM-x32\…\WTA-57ed38a0-dbd9-49c8-9ec7-f7061d1d8b6a) (Version: 3.0.2.48 - WildTangent) Hidden
Bonjour (HKLM\…\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Broadcom 802.11 Network Adapter (HKLM\…\Broadcom 802.11 Network Adapter) (Version:  - Broadcom Corporation)
Broadcom Bluetooth Drivers (HKLM\…\{0A1B4690-E176-4533-8058-939480AEE1D0}) (Version: 12.0.1.660 - Broadcom Corporation)
Coyote The Outlander (HKLM-x32\…\WTA-cf511337-9247-43e2-af11-399a371345fe) (Version: 3.0.2.59 - WildTangent) Hidden
CyberLink PhotoDirector (HKLM\…\{5A454EC5-217A-42a5-8CE1-2DDEC4E70E01}) (Version: 5.0.5.6713 - CyberLink Corp.) Hidden
CyberLink PhotoDirector (HKLM-x32\…\InstallShield_{5A454EC5-217A-42a5-8CE1-2DDEC4E70E01}) (Version: 5.0.5.6713 - CyberLink Corp.)
CyberLink Power Media Player 14 (HKLM-x32\…\{32C8E300-BDB4-4398-92C2-E9B7D8A233DB}) (Version: 14.0.1.5418 - CyberLink Corp.)
CyberLink PowerDirector 12 (HKLM\…\{E1646825-D391-42A0-93AA-27FA810DA093}) (Version: 12.0.4.4301 - CyberLink Corp.) Hidden
CyberLink PowerDirector 12 (HKLM-x32\…\InstallShield_{E1646825-D391-42A0-93AA-27FA810DA093}) (Version: 12.0.4.4301 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\…\{A9CEDD6E-4792-493e-BB35-D86D2E188A5A}) (Version: 6.0.1.4301 - CyberLink Corp.)
Delicious: Emily's Wonder Wedding Premium Edition (HKLM-x32\…\WTA-793d5787-4a3c-4f98-b5fb-673d9b3abf12) (Version: 3.0.2.59 - WildTangent) Hidden
DisableMSDefender (HKLM\…\{74FE39A0-FB76-47CD-84BA-91E2BBB17EF2}) (Version: 1.0.0 - Hewlett-Packard Company) Hidden
Dropbox 25 GB (HKLM-x32\…\{597A58EC-42D6-4940-8739-FB94491B013C}) (Version: 1.0.8.2 - Dropbox, Inc.)
Energy Star (HKLM\…\{465CA2B6-98AF-4E77-BE22-A908C34BB9EC}) (Version: 1.0.9 - Hewlett-Packard Company)
Entwined: The Perfect Murder (HKLM-x32\…\WTA-0e9bc4f8-6d2a-4190-ada3-b1251028a3b0) (Version: 3.0.2.59 - WildTangent) Hidden
EPSON XP-400 Series Printer Uninstall (HKLM\…\EPSON XP-400 Series) (Version:  - SEIKO EPSON Corporation)
Evernote v. 5.8.6 (HKLM-x32\…\{FEDC7C10-EF67-11E4-9B07-00505695D7B0}) (Version: 5.8.6.7519 - Evernote Corp.)
Family Vacation 2: Road Trip (HKLM-x32\…\WTA-1e934273-d7f5-4b7a-a48d-7d6b88282e1b) (Version: 3.0.2.59 - WildTangent) Hidden
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 60.0.3112.90 - Google Inc.)
Google Drive (HKLM-x32\…\{A1238426-ECDF-4639-BE2F-8D12A97AE23C}) (Version: 2.34.5075.1619 - Google, Inc.)
Google Talk Plugin (HKLM-x32\…\{F9B579C2-D854-300A-BE62-A09EB9D722E4}) (Version: 5.41.3.0 - Google)
Google Update Helper (HKLM-x32\…\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
Home Makeover (HKLM-x32\…\WTA-e752cb9b-7a63-420a-8731-f734d5eb96bc) (Version: 3.0.2.59 - WildTangent) Hidden
HP Documentation (HKLM\…\HP_Documentation) (Version:  - HP)
HP Registration Service (HKLM\…\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.8293.5264 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\…\{61EB474B-67A6-47F4-B1B7-386851BAB3D0}) (Version: 8.4.19.3 - Hewlett-Packard Company)
HP Support Solutions Framework (HKLM-x32\…\{D7D5F438-26EF-45AB-AB89-C476FBCF8584}) (Version: 12.7.27.15 - Hewlett-Packard Company)
HP System Event Utility (HKLM-x32\…\{8B4EE87E-6D40-4C91-B5E8-0DC77DC412F1}) (Version: 1.4.1 - Hewlett-Packard Company)
HP Welcome (HKLM\…\HPWelcome) (Version: 1.0 - Hewlett-Packard Company)
HP Wireless Button Driver (HKLM-x32\…\{EFA01423-3857-468C-B7B6-F30AA08E50BC}) (Version: 1.1.5.1 - Hewlett-Packard)
IGT Slots: Paradise Garden (HKLM-x32\…\WTA-2c63d50e-94ea-451b-934e-eb8deb930f60) (Version: 3.0.2.59 - WildTangent) Hidden
Imperial Island: Birth of an Empire (HKLM-x32\…\WTA-cff803f1-2ce3-4772-bcf3-5f12ef24633d) (Version: 3.0.2.59 - WildTangent) Hidden
Intel(R) Chipset Device Software (HKLM-x32\…\{a47edec4-fa11-4d02-b329-4424d0197af8}) (Version: 10.1.1.7 - Intel(R) Corporation) Hidden
Intel(R) Dynamic Platform and Thermal Framework (HKLM-x32\…\{654EE65D-FAA4-4EA6-8C07-DC94E6A304D4}) (Version: 8.1.10600.150 - Intel Corporation)
Intel(R) Management Engine Components (HKLM\…\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.0.0.1156 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4549 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\…\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 14.5.0.1081 - Intel Corporation)
iTunes (HKLM\…\{88509E20-3936-4D88-A1C0-B274C7BB5151}) (Version: 12.3.0.44 - Apple Inc.)
Jewel Match Snowscapes (HKLM-x32\…\WTA-7a8e062b-3597-40c2-8579-84ca06953def) (Version: 3.0.2.118 - WildTangent) Hidden
Living Legends: Frozen Beauty Collector's Edition (HKLM-x32\…\WTA-fc0d8f3c-b6ff-4736-ba7a-91da30926247) (Version: 3.0.2.59 - WildTangent) Hidden
Lost Lands: Dark Overlord Collector's Edition (HKLM-x32\…\WTA-7288a8d7-d139-41e8-98b6-a9339f31b5ed) (Version: 3.0.2.59 - WildTangent) Hidden
Lost Souls: Timeless Fables Collector's Edition (HKLM-x32\…\WTA-6d5ca6d9-18c2-4dbc-adeb-a3a864014469) (Version: 3.0.2.59 - WildTangent) Hidden
Magic Heroes: Save Our Park (HKLM-x32\…\WTA-b228589f-9c01-448b-8783-b4a680393483) (Version: 3.0.2.59 - WildTangent) Hidden
Manor Memoirs Collector's Edition (HKLM-x32\…\WTA-fc29eb53-639f-4dba-8a10-091ebf6b71e9) (Version: 3.0.2.59 - WildTangent) Hidden
McAfee LiveSafe (HKLM-x32\…\MSC) (Version: 16.0.1 - McAfee, Inc.)
Microsoft Office 365 - en-us (HKLM\…\O365HomePremRetail - en-us) (Version: 15.0.4953.1001 - Microsoft Corporation)
Microsoft Office Word 2007 (HKLM-x32\…\WORD) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\…\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\…\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Preview Redistributable (x64) - 12.0.20617 (HKLM-x32\…\{448652c1-f5f3-4230-98c6-68c10c88b1fb}) (Version: 12.0.20617.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\…\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Movavi Video Editor 10 (HKLM-x32\…\Movavi Video Editor 10) (Version: 10.3.0 - Movavi)
Movavi Video Editor 12 (HKLM-x32\…\Movavi Video Editor 12) (Version: 12.5.1 - Movavi)
Mozilla Firefox 45.0 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 45.0 (x86 en-US)) (Version: 45.0 - Mozilla)
Mozilla Firefox 54.0 (x64 en-US) (HKLM\…\Mozilla Firefox 54.0 (x64 en-US)) (Version: 54.0 - Mozilla)
Mozilla Maintenance Service (HKLM\…\MozillaMaintenanceService) (Version: 54.0 - Mozilla)
Mystery Expedition: Prisoners of Ice (HKLM-x32\…\WTA-3fe90593-1a24-44c2-9f8b-86c44393f858) (Version: 3.0.2.59 - WildTangent) Hidden
Office 15 Click-to-Run Extensibility Component (HKLM-x32\…\{90150000-008C-0000-0000-0000000FF1CE}) (Version: 15.0.4953.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (HKLM\…\{90150000-008F-0000-1000-0000000FF1CE}) (Version: 15.0.4953.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (HKLM-x32\…\{90150000-008C-0409-0000-0000000FF1CE}) (Version: 15.0.4953.1001 - Microsoft Corporation) Hidden
Plagiarii (HKLM-x32\…\WTA-60a65df8-48a2-4111-9fe0-551199cf889e) (Version: 3.0.2.59 - WildTangent) Hidden
Polar Bowler 1st Frame (HKLM-x32\…\WTA-cac33129-b6f6-4681-9ec3-15be5fb54d4d) (Version: 3.0.2.59 - WildTangent) Hidden
Realtek Card Reader (HKLM-x32\…\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.31213 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.1.505.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7944 - Realtek Semiconductor Corp.)
Revo Uninstaller 2.0.3 (HKLM\…\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.3 - VS Revo Group, Ltd.)
Revo Uninstaller Pro 3.1.9 (HKLM\…\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.1.9 - VS Revo Group, Ltd.)
Runefall (HKLM-x32\…\WTA-29505306-8974-4f8d-adda-167c316ca56d) (Version: 3.0.2.126 - WildTangent) Hidden
Rush Hour! Gas Station (HKLM-x32\…\WTA-57bb1ec7-8c64-4249-bc66-243dd49246c3) (Version: 3.0.2.59 - WildTangent) Hidden
Sky High Farm (HKLM-x32\…\WTA-f25c1209-e55c-470d-91fe-69545a39bc29) (Version: 3.0.2.59 - WildTangent) Hidden
Skype™ 7.37 (HKLM-x32\…\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.37.103 - Skype Technologies S.A.)
swMSM (HKLM-x32\…\{612C34C7-5E90-47D8-9B5C-0F717DD82726}) (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\…\SynTPDeinstKey) (Version: 19.3.11.45 - Synaptics Incorporated)
Update Installer for WildTangent Games App (HKLM-x32\…\{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App) (Version:  - WildTangent) Hidden
VLC media player (HKLM-x32\…\VLC media player) (Version: 2.2.6 - VideoLAN)
WildTangent Games (HKLM-x32\…\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App for HP (HKLM-x32\…\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-hp) (Version: 4.0.11.16 - WildTangent) Hidden
Windows 10 Update and Privacy Settings (HKLM\…\{4DFCD818-036A-4229-A67D-CF17DC461D92}) (Version: 1.0.14.0 - Microsoft Corporation)
WinRAR 5.30 beta 6 (32-bit) (HKLM-x32\…\WinRAR archiver) (Version: 5.30.6 - win.rar GmbH)
WinRAR 5.40 (64-bit) (HKLM\…\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
WPS Office (9.1.0.5113) (HKLM-x32\…\Kingsoft Office) (Version: 9.1.0.5113 - Kingsoft Corp.)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-182178435-2925743980-1085802887-1001_Classes\CLSID\{144DF3B2-2402-47AE-9583-5A045929A8D4}\InprocServer32 -> C:\Users\yosef\AppData\Local\Google\Update\1.3.33.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-182178435-2925743980-1085802887-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\yosef\AppData\Local\Google\Update\1.3.33.5\psuser_64.dll (Google Inc.)
ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ContextMenuHandlers1: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files (x86)\Google\Drive\contextmenu64.dll [2017-03-21] (Google)
ContextMenuHandlers1: [McCtxMenuFrmWrk] -> {CCA9EFD3-29ED-430A-BA6D-E6BBFF0A60C2} => c:\Program Files\mcafee\msc\McCtxMenuFrmWrk.dll [2017-05-31] (McAfee, Inc.)
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-15] (Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2016-08-15] (Alexander Roshal)
ContextMenuHandlers4: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files (x86)\Google\Drive\contextmenu64.dll [2017-03-21] (Google)
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2017-01-13] (Intel Corporation)
ContextMenuHandlers6: [McCtxMenuFrmWrk] -> {CCA9EFD3-29ED-430A-BA6D-E6BBFF0A60C2} => c:\Program Files\mcafee\msc\McCtxMenuFrmWrk.dll [2017-05-31] (McAfee, Inc.)
ContextMenuHandlers6: [RUShellExt] -> {2C5515DC-2A7E-4BFD-B813-CACC2B685EB7} => C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll [2016-12-15] (VS Revo Group)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-15] (Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2016-08-15] (Alexander Roshal)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {13848A87-6E5A-44F4-85DB-061203CA7869} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2017-04-07] (HP Inc.)
Task: {18959483-CD8B-4F24-9272-6899B6844F87} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-182178435-2925743980-1085802887-1001UA => C:\Users\yosef\AppData\Local\Google\Update\GoogleUpdate.exe [2017-02-16] (Google Inc.)
Task: {193EB9DC-B30D-428C-AFBB-E56B96CC72C6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-12-07] (HP Inc.)
Task: {1B61F209-091F-4072-8079-4F2C74A33927} - System32\Tasks\WpsUpdateTask_Administrator => C:\Program Files (x86)\Kingsoft\WPS Office\9.1.0.5113\wtoolex\wpsupdate.exe [2015-07-21] (Zhuhai Kingsoft Office Software Co.,Ltd)
Task: {2B158669-4D40-4614-8691-3A0E746A075F} - System32\Tasks\{427419DB-1E0C-4CEA-A0DF-37EFAB4545E7} => "c:\windows\system32\launchwinapp.exe" hxxp://www.skype.com/go/downloading?source=lightinstaller&ver;=7.10.0.101&LastError;=12002
Task: {3630116B-EB93-4A1A-9CB6-BFC21343BE0C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2017-04-06] (HP Inc.)
Task: {3E7D7899-3D27-4D88-B784-7AF0F041229D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-09-20] (Google Inc.)
Task: {40808E68-62A9-447B-BA4D-C7D2902F2AD5} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-182178435-2925743980-1085802887-1001Core => C:\Users\yosef\AppData\Local\Google\Update\GoogleUpdate.exe [2017-02-16] (Google Inc.)
Task: {47F7BDF2-ADED-45DF-B3E4-C04A597A4846} - System32\Tasks\OneDrive Standalone Update Task => C:\Users\yosef\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\OneDriveStandaloneUpdater.exe
Task: {4A734EB2-05E2-4A9E-9645-E2C7D40112CC} - System32\Tasks\YCMServiceAgent => C:\Program Files (x86)\CyberLink\YouCam6\YouCamService6.exe [2015-07-01] (CyberLink Corp.)
Task: {4CCCC3FF-5B75-4BD6-A660-564308728570} - System32\Tasks\DropboxOEM => C:\Program Files (x86)\Dropbox\DropboxOEM\DropboxOEM.exe [2015-06-19] ()
Task: {5366A388-ACD5-4FEB-887E-6C5F9653EBAE} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2017-04-11] (Microsoft Corporation)
Task: {59676E11-6B8A-4CD7-9DC0-60977A2029CF} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2017-07-11] (Microsoft Corporation)
Task: {5F87496D-8277-4734-91F0-1CBE7CCAA0DF} - System32\Tasks\McAfee\McAfee Idle Detection Task
Task: {5FE2102D-E4A2-4A85-BEF3-8D9F66CFB43A} - System32\Tasks\WpsNotifyTask_Administrator => C:\Program Files (x86)\Kingsoft\WPS Office\9.1.0.5113\wtoolex\wpsnotify.exe [2015-07-21] (Zhuhai Kingsoft Office Software Co.,Ltd)
Task: {665BA96F-204A-402A-A11D-A0160673612F} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2016-11-07] (HP Inc.)
Task: {66AC8D60-CF78-4FD6-908F-94C8D7B67EE3} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2017-04-11] (Microsoft Corporation)
Task: {6A2230EB-F3B7-488F-BF5C-8E0176A084ED} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2017-04-07] (HP Inc.)
Task: {712586A3-BAC9-4C37-865E-60169D059E4E} - System32\Tasks\Intel Security DAT Reputation (AMCore) Post DAT update endpoint safety pulse => C:\Program Files\Common Files\McAfee\AMContent\scanners\x86_64\datrep\1.50.1291.1\mcdatrep.exe [2017-02-10] (McAfee, Inc.)
Task: {7CC1ED86-971A-444A-9C3F-1C1F7EC92F5B} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Product Configurator => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\ProductConfig.exe [2017-03-02] (HP Inc.)
Task: {8879F2F9-EFC6-46C1-9F1B-855375008F16} - System32\Tasks\Intel Security DAT Reputation (AMCore) periodic endpoint safety pulse => C:\Program Files\Common Files\McAfee\AMContent\scanners\x86_64\datrep\1.50.1291.1\mcdatrep.exe [2017-02-10] (McAfee, Inc.)
Task: {8F89FF4B-20F0-4E1A-8738-2EA7B809D499} - System32\Tasks\McAfee Remediation (Prepare) => C:\Program Files\Common Files\AV\McAfee VirusScan\upgrade.exe [2017-04-12] (McAfee, Inc.)
Task: {A23E2DB7-EAB7-4377-80C6-657910C0099C} - System32\Tasks\McAfee\McAfee Auto Maintenance Task Agent
Task: {A4A39533-2A95-4669-80D2-435B704FF8D9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-09-20] (Google Inc.)
Task: {A77CEEA6-BBDA-4C74-94AD-47678C6CC54B} - System32\Tasks\{7A7E1064-99F9-4EA8-BD03-2A432A7E0968} => "c:\windows\system32\launchwinapp.exe" hxxp://www.skype.com/go/downloading?source=lightinstaller&ver;=7.10.0.101&LastError;=12002
Task: {AD660034-68FC-471D-B982-91443C09AAA7} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2017-07-14] (Microsoft Corporation)
Task: {C3F000B3-A1B8-42A6-9256-4956B5603F58} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2017-04-06] (HP Inc.)
Task: {D83B1FDA-DB2E-451C-91B5-AC30C6A5210B} - System32\Tasks\HPCeeScheduleForyosef => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-16] (Hewlett-Packard)
Task: {EFC51866-5754-4F96-86E4-8B9C40C7624A} - System32\Tasks\McAfeeLogon => C:\Program Files\Common Files\McAfee\platform\McUICnt.exe [2017-05-31] (McAfee, Inc.)
Task: {F570CC82-535F-4606-8616-CFD7E79FB91E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2017-06-22] (HP Inc.)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\HPCeeScheduleForyosef.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\WINDOWS\Tasks\WpsNotifyTask_Administrator.job => C:\Program Files (x86)\Kingsoft\WPS Office\9.1.0.5113\wtoolex\wpsnotify.exe
Task: C:\WINDOWS\Tasks\WpsUpdateTask_Administrator.job => C:\Program Files (x86)\Kingsoft\WPS Office\9.1.0.5113\wtoolex\wpsupdate.exe
==================== Shortcuts & WMI ========================
(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============
2016-07-16 04:42 - 2016-07-16 04:42 - 000231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2017-07-14 12:55 - 2017-06-21 00:48 - 002681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2015-09-15 10:43 - 2017-01-17 04:25 - 000117440 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-07-21 17:52 - 2014-04-14 18:59 - 000389896 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2017-08-03 13:13 - 2017-06-11 13:00 - 000583160 _____ () C:\Program Files\McAfee\MfeAV\RealProtectAMScanIf.dll
2017-08-03 13:13 - 2017-06-11 12:59 - 000574352 _____ () C:\Program Files\McAfee\MfeAV\AMEngineScan.dll
2017-08-03 13:13 - 2017-06-11 13:00 - 000571240 _____ () C:\Program Files\McAfee\MfeAV\RepairModule.dll
2017-03-21 18:56 - 2017-01-31 05:34 - 008909512 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2016-09-26 03:25 - 2016-09-26 03:25 - 000134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-03-14 17:22 - 2017-03-03 23:31 - 000474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-03-14 17:22 - 2017-03-03 23:12 - 009760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-03-14 17:22 - 2017-03-03 23:05 - 001401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-03-14 17:22 - 2017-03-03 23:05 - 000757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-07-14 12:55 - 2017-06-20 23:35 - 002424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-07-14 12:55 - 2017-06-20 23:37 - 004853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-09-15 14:25 - 2015-09-15 14:25 - 000085800 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-09-15 14:25 - 2015-09-15 14:25 - 001328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2017-07-26 01:49 - 2017-07-26 01:49 - 000054272 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11706.1001.26.0_x64__8wekyb3d8bbwe\WinStoreTasksWrapper.dll
2015-07-21 17:41 - 2011-08-23 19:39 - 000081920 _____ () C:\Program Files (x86)\CyberLink\YouCam6\koan\_ctypes.pyd
2015-07-21 17:41 - 2011-08-23 19:39 - 000053248 _____ () C:\Program Files (x86)\CyberLink\YouCam6\koan\_socket.pyd
2015-07-21 17:41 - 2011-08-23 19:39 - 000655360 _____ () C:\Program Files (x86)\CyberLink\YouCam6\koan\_ssl.pyd
2015-07-21 17:41 - 2015-04-21 19:23 - 000057344 _____ () C:\Program Files (x86)\CyberLink\YouCam6\subsys\YouCam\XUControl.dll
2015-07-21 17:41 - 2015-07-01 00:42 - 000310712 _____ () C:\Program Files (x86)\CyberLink\YouCam6\subsys\YouCam\BlackCat.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Users\yosef\Desktop\STARZ-Direct TV Commersial Rates.jpg:3or4kl4x13tuuug3Byamue2s4b [91]
AlternateDataStreams: C:\Users\yosef\Desktop\Stella Adler Diploma.jpg:3or4kl4x13tuuug3Byamue2s4b [91]
AlternateDataStreams: C:\Users\yosef\Desktop\Zara branches info.bmp:3or4kl4x13tuuug3Byamue2s4b [91]
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ModuleCoreService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcapexe => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfemms => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeplk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeplk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ModuleCoreService => ""="Service"
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2015-07-10 04:04 - 2017-07-29 13:19 - 000000027 _____ C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1       localhost
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-182178435-2925743980-1085802887-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Hewlett-Packard Backgrounds\backgroundDefault.jpg
DNS Servers: 192.168.1.1 - [removed]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==

==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{94A1FC2B-CAAE-45C8-BEF4-C1F1324F6054}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPSOCKSVC.exe
FirewallRules: [{A48DC7D6-4F7C-4D83-8AFE-1A98B26A1F69}] => (Allow) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
FirewallRules: [{B42334A0-2767-4022-BE9E-569E99A087AE}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD.exe
FirewallRules: [{FE962337-939B-4177-BF12-DB6ABFB1C815}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\Kernel\DMS\CLMSServerPDVD14.exe
FirewallRules: [{42DA7682-94C7-49F3-801B-084876B05B84}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14Agent.exe
FirewallRules: [{A4993C1B-0FA0-4B8E-970E-25A2DA416548}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\Movie\PowerDVDMovie.exe
FirewallRules: [{24E5ED63-2589-46AE-9165-7ABC924480B4}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\Movie\PowerDVD Cinema\PowerDVDCinema.exe
FirewallRules: [{657BC0F0-7F71-4363-AF5D-0A673FFCB418}] => (Allow) c:\Program Files\CyberLink\PowerDirector12\PDR10.EXE
FirewallRules: [{14E516DA-83A0-4458-85F8-429E6E29361C}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{05EE5315-BB21-4A58-AB6C-7B1A3702FCED}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{E0505C3F-C60C-4E09-B3C6-E3AF41247087}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{2860C6D6-F1BC-4A65-B1E6-0CB17EAB2B22}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{D1146C6D-897E-4868-8A8F-9B91FE0E952A}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{5B9D4B53-A35A-404B-8869-0840D6C7A721}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{1FCE313E-378F-4CDE-9A77-140B9C0F35E6}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{25923F13-0C3A-4633-8AC1-8C04D1C80874}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{E7371350-D21C-4AAE-8388-5FBFF45EE3E7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{8B0FD386-6EBB-4065-ADFA-9B0779E64E53}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{61D06E48-A321-43A4-830F-EDC4FD9EFB85}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{A0DF1237-BA95-4845-AC64-F16F6FF023B2}] => (Allow) C:\WINDOWS\system32\rundll32.exe
FirewallRules: [{39480C80-71DB-4FFA-95DF-1EF1A66139E2}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Restore Points =========================
30-07-2017 15:36:57 JRT Pre-Junkware Removal
30-07-2017 15:43:38 JRT Pre-Junkware Removal
==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================
Application errors:
==================
Error: (08/05/2017 05:44:02 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "c:\Program Files\CyberLink\PhotoDirector\Kernel\CES\CES_AudioCacheAgent.exe.Manifest".
Dependent Assembly PDR.X,type="win32",version="1.0.0.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.
Error: (08/05/2017 05:43:56 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "c:\Program Files\CyberLink\PhotoDirector\Kernel\CES\CES_CacheAgent.exe.Manifest".
Dependent Assembly PDR.X,type="win32",version="1.0.0.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.
Error: (08/05/2017 05:17:06 PM) (Source: COM) (EventID: 10031) (User: )
Description: An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {2CD39202-3A2F-4935-9A86-65B919919A7F} was rejected
Error: (08/05/2017 05:13:07 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: DESKTOP-FMTT2PH)
Description: Package windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy+microsoft.windows.immersivecontrolpanel was terminated because it took too long to suspend.
Error: (08/05/2017 04:06:21 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "c:\Program Files\CyberLink\PhotoDirector\Kernel\CES\CES_AudioCacheAgent.exe.Manifest".
Dependent Assembly PDR.X,type="win32",version="1.0.0.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.
Error: (08/05/2017 04:06:16 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "c:\Program Files\CyberLink\PhotoDirector\Kernel\CES\CES_CacheAgent.exe.Manifest".
Dependent Assembly PDR.X,type="win32",version="1.0.0.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.
Error: (08/05/2017 03:58:00 PM) (Source: COM) (EventID: 10031) (User: )
Description: An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {2CD39202-3A2F-4935-9A86-65B919919A7F} was rejected
Error: (08/05/2017 03:19:02 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine QueryFullProcessImageNameW.  hr = 0x8007001f, A device attached to the system is not functioning.
.

Operation:
   Executing Asynchronous Operation
Context:
   Current State: DoSnapshotSet
Error: (08/05/2017 03:18:34 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
System Error:
Access is denied.
.
Error: (08/05/2017 03:18:17 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
   Gathering Writer Data
Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {c04c9091-6234-476e-9dd7-ac6eb5889c73}

System errors:
=============
Error: (08/05/2017 06:13:27 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (08/05/2017 06:13:05 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Apple Mobile Device Service service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.
Error: (08/05/2017 06:13:05 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Apple Mobile Device Service service to connect.
Error: (08/05/2017 06:12:35 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Kingsoft_WPS_UpdateService service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.
Error: (08/05/2017 06:12:35 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Kingsoft_WPS_UpdateService service to connect.
Error: (08/05/2017 06:12:00 PM) (Source: Microsoft-Windows-HAL) (EventID: 13) (User: NT AUTHORITY)
Description: The system watchdog timer was triggered.
Error: (08/05/2017 06:12:29 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 6:05:10 PM on ‎8/‎5/‎2017 was unexpected.
Error: (08/05/2017 05:35:36 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (08/05/2017 05:35:13 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Kingsoft_WPS_UpdateService service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.
Error: (08/05/2017 05:35:13 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Kingsoft_WPS_UpdateService service to connect.

CodeIntegrity:
===================================
  Date: 2017-08-05 17:27:46.337
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
  Date: 2017-08-05 17:19:49.248
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
  Date: 2017-08-05 17:09:51.739
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
  Date: 2017-08-05 17:04:05.128
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
  Date: 2017-08-05 16:49:54.192
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
  Date: 2017-08-05 16:32:23.997
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
  Date: 2017-08-05 16:24:06.462
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
  Date: 2017-08-05 15:57:56.850
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
  Date: 2017-08-05 15:55:58.719
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
  Date: 2017-08-05 15:41:32.046
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.

==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3-5005U CPU @ 2.00GHz
Percentage of memory in use: 31%
Total physical RAM: 6059.39 MB
Available physical RAM: 4121.18 MB
Total Virtual: 6443.39 MB
Available Virtual: 4231.75 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:677.89 GB) (Free:554.46 GB) NTFS
Drive d: (RECOVERY) (Fixed) (Total:19.52 GB) (Free:2.28 GB) NTFS ==>[system with boot components (obtained from drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: 54E8AF3C)
Partition: GPT.
==================== End of Addition.txt ============================

 

Post #2
Not seeing anything obvious.

Can you open task manager, click on processes, look for an .exe thats using the most CPU?
~~~~~

🖼Click to load external image (a6csRll.png)Malwarebytes Anti-Rootkit Beta
  • Download Malwarebytes Anti-Rootkit Beta and extract it to your desktop (MBAR will be launched shortly after the extraction);
    🖼Click to load external image (HTCF1SV.png)
  • Click on Next, and then on the Update button to let it update its database. Once the database has been successfully updated, click on Next;
    🖼Click to load external image (UJCQPAS.png)
  • Make sure all the checkboxes are checked, then click on the Scan button, and let it completes its scan (this can take a while);
    🖼Click to load external image (v4lJKL5.png)
  • Once the scan is done, make sure that every item is checked, and click on the Cleanup button (a reboot might be required);
  • After that (and the reboot, if one was required), go back in the mbar folder and look for a text file called mbar-log-TODAY'S-DATE.txt;
  • Copy/paste the content of that log in your next reply;
~~~~~~~~~~~~~~~~~~~`

Download AdwCleaner from this page: https://toolslib.net/downloads/viewdownload/1-adwcleaner/
Execute it, then read the EULA and click on "I agree" if you agree it.

Click on [Scan] and wait until it ends.

Click on [Clean], read the informative message. If you have any questions about it, please ask.
All unrequired programs will be closed during the cleaning process, so be sure to save your work before.
When the clean is over, the computer may reboot and shows the logfile
Copy/Paste it in your answer.
Post #3

Hi Julie! Thank you for your reply.

 

Noticed that my computer startes to lag (when opening and closing programs, youtube videos resolution became low and started to lag as well) so I ran my McAfee a few times but it kept freezing so I ran Malwarebytes twice but didn't find anything and them when I ran Emisoft it found malware and I had them removed. Then tried to run aswMBR to post the scan reslults here but it stopped twice on certain corrupt or infected files that it highlighted in red and I've removed them manually, after that it kept freeing on C:\Users\yosef\AppData\Local\Google\Update\GoogleUpdate.exe

 

Not sure what's going on… the .exe that take most of the CPU on my computer are: CompatTelRunner.exe (up to 26% at times), SynTPEnh.exe (up to %6.8 at times), Taskmgr.exe (up to %4.9).

 

Reinstalled and ran another scan with Malwarebytes Anti-Rootkit Beta, it hasn't found anything, nothing to clean, no reboot required.

 

Ran a scan with AdwCleaner and although it said no PUPs were found, it did give me the option to delete a few things when the scan was finished.

 

Please find logs below, thank you:

 

 

Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org
Database version:
  main:    v2017.08.06.04
  rootkit: v2017.08.02.01
Windows 10 x64 NTFS
Internet Explorer 11.1480.14393.0
yosef :: DESKTOP-FMTT2PH [administrator]
8/6/2017 1:47:21 PM
mbar-log-2017-08-06 (13-47-21).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 290907
Time elapsed: 43 minute(s), 17 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)

 

—————————————
Malwarebytes Anti-Rootkit BETA 1.09.3.1001
© Malwarebytes Corporation 2011-2012
OS version: 10.0.9200 Windows 10 x64
Account is Administrative
Internet Explorer version: 11.1480.14393.0
File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 1.995000 GHz
Memory total: 6353727488, free: 3797262336
Downloaded database version: v2017.08.06.04
Downloaded database version: v2017.08.02.01
Downloaded database version: v2017.07.17.01
=======================================
Initializing…
Driver version: 0.3.0.4
———— Kernel report ————
     08/06/2017 13:47:12
———— Loaded modules ———–
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kd.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\System32\drivers\werkernel.sys
\SystemRoot\System32\drivers\CLFS.SYS
\SystemRoot\System32\drivers\tm.sys
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\System32\drivers\FLTMGR.SYS
\SystemRoot\System32\drivers\msrpc.sys
\SystemRoot\System32\drivers\ksecdd.sys
\SystemRoot\System32\drivers\clipsp.sys
\SystemRoot\System32\drivers\cmimcext.sys
\SystemRoot\System32\drivers\ntosext.sys
\SystemRoot\system32\CI.dll
\SystemRoot\System32\drivers\cng.sys
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\System32\Drivers\acpiex.sys
\SystemRoot\System32\Drivers\WppRecorder.sys
\SystemRoot\System32\drivers\ACPI.sys
\SystemRoot\System32\drivers\WMILIB.SYS
\SystemRoot\System32\drivers\msisadrv.sys
\SystemRoot\System32\drivers\pci.sys
\SystemRoot\System32\drivers\tpm.sys
\SystemRoot\System32\drivers\intelpep.sys
\SystemRoot\system32\drivers\WindowsTrustedRT.sys
\SystemRoot\System32\drivers\WindowsTrustedRTProxy.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\drivers\vdrvroot.sys
\SystemRoot\system32\drivers\pdc.sys
\SystemRoot\system32\drivers\CEA.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\System32\drivers\spaceport.sys
\SystemRoot\System32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\System32\drivers\iaStorA.sys
\SystemRoot\System32\drivers\storport.sys
\SystemRoot\System32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Wof.sys
\SystemRoot\system32\drivers\mfehidk.sys
\SystemRoot\System32\Drivers\NTFS.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\System32\drivers\wfplwfs.sys
\SystemRoot\system32\drivers\mfewfpk.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\System32\drivers\volume.sys
\SystemRoot\System32\drivers\volsnap.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\system32\drivers\iorate.sys
\SystemRoot\System32\drivers\disk.sys
\SystemRoot\System32\drivers\CLASSPNP.SYS
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\drivers\cdrom.sys
\SystemRoot\system32\drivers\filecrypt.sys
\SystemRoot\system32\drivers\tbs.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\BasicDisplay.sys
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\BasicRender.sys
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\drivers\vwififlt.sys
\SystemRoot\System32\drivers\pacer.sys
\SystemRoot\system32\drivers\netbios.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\??\C:\WINDOWS\System32\drivers\zamguard64.sys
\??\C:\WINDOWS\System32\drivers\zam64.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\System32\drivers\npsvctrig.sys
\SystemRoot\System32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\gpuenergydrv.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\ahcache.sys
\SystemRoot\System32\DriverStore\FileRepository\compositebus.inf_amd64_a140581a8f8b58b7\CompositeBus.sys
\SystemRoot\System32\drivers\kdnic.sys
\SystemRoot\System32\drivers\umbus.sys
\SystemRoot\system32\DRIVERS\igdkmd64.sys
\SystemRoot\System32\drivers\HDAudBus.sys
\SystemRoot\System32\drivers\portcls.sys
\SystemRoot\System32\drivers\drmk.sys
\SystemRoot\System32\drivers\ks.sys
\SystemRoot\System32\drivers\dptf_cpu.sys
\SystemRoot\System32\drivers\USBXHCI.SYS
\SystemRoot\system32\drivers\ucx01000.sys
\SystemRoot\System32\drivers\TeeDriverW8x64.sys
\SystemRoot\System32\drivers\rt640x64.sys
\SystemRoot\system32\DRIVERS\bcmwl63a.sys
\SystemRoot\System32\drivers\vwifibus.sys
\SystemRoot\System32\drivers\i8042prt.sys
\SystemRoot\system32\DRIVERS\SynTP.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\System32\drivers\kbdclass.sys
\SystemRoot\System32\drivers\mouclass.sys
\SystemRoot\System32\drivers\CmBatt.sys
\SystemRoot\System32\drivers\BATTC.SYS
\SystemRoot\system32\DRIVERS\Smb_driver_Intel.sys
\SystemRoot\System32\drivers\dptf_pch.sys
\SystemRoot\System32\drivers\intelppm.sys
\SystemRoot\System32\drivers\acpipagr.sys
\SystemRoot\System32\drivers\WirelessButtonDriver64.sys
\SystemRoot\System32\drivers\HIDCLASS.SYS
\SystemRoot\System32\drivers\HIDPARSE.SYS
\SystemRoot\System32\drivers\wmiacpi.sys
\SystemRoot\System32\drivers\UEFI.sys
\SystemRoot\System32\drivers\NdisVirtualBus.sys
\SystemRoot\System32\drivers\swenum.sys
\SystemRoot\System32\drivers\rdpbus.sys
\SystemRoot\system32\DRIVERS\clwvd6.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\System32\drivers\UsbHub3.sys
\SystemRoot\system32\drivers\RTKVHD64.sys
\SystemRoot\System32\Drivers\fastfat.SYS
\SystemRoot\system32\drivers\bcbtums.sys
\SystemRoot\System32\drivers\BTHUSB.sys
\SystemRoot\System32\drivers\bthport.sys
\SystemRoot\System32\drivers\usbccgp.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\DRIVERS\mfencbdc.sys
\SystemRoot\system32\drivers\mfeavfk.sys
\SystemRoot\system32\drivers\mfeaack.sys
\SystemRoot\system32\drivers\mfefirek.sys
\SystemRoot\system32\drivers\mfeplk.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\win32kfull.sys
\SystemRoot\System32\win32kbase.sys
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\Drivers\dump_iaStorA.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\drivers\dxgmms2.sys
\SystemRoot\System32\drivers\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\esif_lf.sys
\SystemRoot\system32\DRIVERS\WUDFRd.sys
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\drivers\wcifs.sys
\SystemRoot\system32\drivers\storqosflt.sys
\SystemRoot\system32\drivers\wcnfs.sys
\SystemRoot\System32\drivers\registry.sys
\SystemRoot\system32\drivers\mmcss.sys
\SystemRoot\system32\drivers\lltdio.sys
\SystemRoot\system32\drivers\mslldp.sys
\SystemRoot\system32\drivers\rspndr.sys
\SystemRoot\System32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\ndisuio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\drivers\Ndu.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\drivers\condrv.sys
\SystemRoot\System32\drivers\vwifimp.sys
\SystemRoot\system32\drivers\cfwids.sys
\??\C:\Users\yosef\AppData\Local\Temp\aswMBR.sys
\??\C:\Users\yosef\AppData\Local\Temp\aswVmm.sys
\SystemRoot\System32\drivers\rdpvideominiport.sys
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\drivers\tunnel.sys
\??\C:\WINDOWS\system32\drivers\mbamchameleon.sys
\??\C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys
———– End ———–
Done!
Scan started
Database versions:
  main:    v2017.08.06.04
  rootkit: v2017.08.02.01
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffc80b976d5610, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
——— Disk Stack ——
DevicePointer: 0xffffc80b97666ae0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffc80b976d5610, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
DevicePointer: 0xffffc80b94cee7c0, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffc80b9345f400, DeviceName: \Device\00000036\, DriverName: \Driver\iaStorA\
———— End ———-
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers…
Done!
Drive 0
This is a System drive
Scanning MBR on drive 0…
Inspecting partition table:
This drive is a GPT Drive.
MBR Signature: 55AA
Disk Signature: 54E8AF3C
GPT Protective MBR Partition information:
    Partition 0 type is EFI-GPT (0xee)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 1  Numsec = 4294967295
    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
GPT Partition information:
    GPT Header Signature 4546492050415254
    GPT Header Revision 65536 Size 92 CRC 367095435
    GPT Header CurrentLba = 1 BackupLba 1465149167
    GPT Header FirstUsableLba 34  LastUsableLba 1465149134
    GPT Header Guid ac1ac815-eaa-4c26-a3f7-79ebf6d92eba
    GPT Header Contains 128 partition entries starting at LBA 2
    GPT Header Partition entry size = 128
    Backup GPT header Signature 4546492050415254
    Backup GPT header Revision 65536 Size 92 CRC 367095435
    Backup GPT header CurrentLba = 1465149167 BackupLba 1
    Backup GPT header FirstUsableLba 34  LastUsableLba 1465149134
    Backup GPT header Guid ac1ac815-eaa-4c26-a3f7-79ebf6d92eba
    Backup GPT header Contains 128 partition entries starting at LBA 1465149135
    Backup GPT header Partition entry size = 128
    Partition 0 Type c12a7328-f81f-11d2-ba4b-0a0c93ec93b
    Partition ID 4882e20a-af85-47dd-84ca-c56e43458a98
    FirstLBA 2048  Last LBA 534527
    Attributes 0
    Partition Name                 EFI system partition
    GPT Partition 0 is bootable
    Partition 1 Type e3c9e316-b5c-4db8-817d-f92df0215ae
    Partition ID ca6bb1c4-f55-4368-936a-61ed1a35a15
    FirstLBA 534528  Last LBA 796671
    Attributes 0
    Partition Name         Microsoft reserved partition
    Partition 2 Type ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
    Partition ID e0a2b011-a72e-4007-955b-cd91cdb298a9
    FirstLBA 796672  Last LBA 1422432942
    Attributes 0
    Partition Name                 Basic data partition
    Partition 3 Type de94bba4-6d1-4d40-a16a-bfd5179d6ac
    Partition ID f059e400-ec73-453a-8ddc-5154d3a9e55c
    FirstLBA 1422434304  Last LBA 1424209919
    Attributes 1
    Partition Name                                    
    Partition 4 Type de94bba4-6d1-4d40-a16a-bfd5179d6ac
    Partition ID 1858300f-de93-4580-9ee3-4e78506ac079
    FirstLBA 1424209920  Last LBA 1465141247
    Attributes 1
    Partition Name                 Basic data partition
Disk Size: 750156374016 bytes
Sector size: 512 bytes
Done!
File "C:\Users\yosef\AppData\Local\Comms\UnistoreDB\store.vol" is sparse (flags = 32768)
File "C:\Windows\System32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat" is sparse (flags = 32768)
Scan finished
=======================================

Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam…
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam…
Removal finished

 

# AdwCleaner 7.0.1.0 - Logfile created on Sun Aug 06 21:49:59 2017
# Updated on 2017/05/08 by Malwarebytes
# Running on Windows 10 Home (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support
***** [ Services ] *****
No malicious services deleted.
***** [ Folders ] *****
Deleted: C:\ProgramData\{C6FA530F-BB98-4D9F-BA00-45FD0698077C}

***** [ Files ] *****
No malicious files deleted.
***** [ DLL ] *****
No malicious DLLs cleaned.
***** [ WMI ] *****
No malicious WMI cleaned.
***** [ Shortcuts ] *****
No malicious shortcuts cleaned.
***** [ Tasks ] *****
No malicious tasks deleted.
***** [ Registry ] *****
Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{FA7B2795-C0C8-4A58-8672-3F8D80CC0270}
Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{47A1DF02-BCE4-40C3-AE47-E3EA09A65E4A}

***** [ Firefox (and derivatives) ] *****
No malicious Firefox entries deleted.
***** [ Chromium (and derivatives) ] *****
No malicious Chromium entries deleted.
*************************
::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0
 
*************************
C:/AdwCleaner/AdwCleaner[S0].txt - [1161 B] - [2017/8/6 21:45:15]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ##########
Post #5
Without seeing the logs and what was quarantined I can't say much. First guess was something found maybe in temp file directory.

You know, computers just do us any kind of way they want to. (trying to make a funny)

Could it be several windows were open at one time and script was active?
Your low on computer space or small processor? if that was/is the case I'd have to send you over to the tech form,

The file CompatTelRunner.exe is located in C:\Windows\System32 folder. It allows Microsoft to ensure compatibility if you want to update to the Windows latest version.
https://windowsfreeapps.com/compattelrunner-exe-how-to-disable-or-remove-microsoft-compatibility-telemetry/

you can disable CompatTelRunner.exe from Task Scheduler

Press Windows + R Key, and type taskschd.msc to open Task Scheduler.
Go to Task Scheduler Library -> Microsoft -> Windows -> Application Experience
Look for Microsoft Compatibility Appraiser. Right-click it and select Disable.
Restart your computer


SynTPEnh.exe
https://www.bleepingcomputer.com/startups/syntpenh.exe-5373.html

GOOGLEUPDATE.EXE
https://www.bleepingcomputer.com/startups/Google_Update-24397.html

Disabling these above items, can't say if thats an answer but I'll leave it to you if you want to disable to see if that can free up resources.

Sounds like when you rebooted it freed up spaces then?
Post #6

Hi Juliet, hmm… don't think I'm low on computer space or small processor. I've posted the logs in the response prior to the one about restarting the modem, did you see them? Did you notice anything out of the ordinary? What other scans can I run to make sure I don't have anymore malware? Thanks.

Post #7

Hi Juliet, hmm… don't think I'm low on computer space or small processor. I've posted the logs in the response prior to the one about restarting the modem, did you see them? Did you notice anything out of the ordinary? What other scans can I run to make sure I don't have anymore malware? Thanks.

No I didn't see anything that can be considered threatening.

I went back through the logs and even went through the system errors,
The Kingsoft_WPS_UpdateService service failed to start
This was the most noticeable. Have you disabled/removed the task for the updater for this?

~~~~~

OK
Let's try a fresh scan for Emsisoft Emergency Kit

Please download Emsisoft Emergency Kit and save it to your desktop. Double click on the EmsisoftEmergencyKit file you downloaded to extract its contents and create a shortcut on the desktop. Leave all settings as they are and click the Extract button at the bottom. A folder named EEK will be created in the root of the drive (usually c:\).
  • After extraction please double-click on the new Start Emsisoft Emergency Kit icon on your desktop.
  • The first time you launch it, Emsisoft Emergency Kit will recommend that you allow it to download updates. Please click Yes so that it downloads the latest database updates.
  • When update is complete, click Malware Scan. When asked if you want the scanner to scan for Potentially Unwanted Programs, click Yes. Emsisoft Emergency Kit will start scanning.
  • When the scan is completed click Quarantine selected objects. Note, this option is only available if malicious objects were detected during the scan.
  • When the threats have been quarantined, click the View report button in the lower-right corner, and the scan log will be opened in Notepad.
  • Please save the log in Notepad on your desktop and post the contents in your next reply.
  • When you close Emsisoft Emergency Kit, it will give you an option to sign up for a newsletter. This is optional, and is not necessary for the malware removal process.
~~~~~~~~~~~~~~~`

Zemana AntiMalware Free

download it from here:
  • Double-click on the file named Zemana.AntiMalware.Portable to perform a system scan with Zemana AntiMalware Free.

    You may be presented with a User Account Control dialog asking you if you want to run this program. If this happens, you should click Yes to allow Zemana AntiMalware to run.

    When Zemana AntiMalware starts, click on the Scan button to perform a system scan.
    without changing any options, press Scan
    When Zemana has finished finished scanning it will show a screen that displays any malware that has been detected. To remove all the malicious files, click on the Next button.

    Zemana AntiMalware will now start to remove all the malicious programs from your computer.
    Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please restart your computer manually.
    • open Zemana AntiMalware again and locate the latest report
    • please paste the contents into your reply
    When the process is complete, you can close Zemana AntiMalware

    ~~~

    Let's delete the version of Farbar Recovery Scan Tool you have now, I think it's been updated since this one and let's see if anything different shows.

    Right click on Farbar Recovery Scan Tool and select delete.
  • Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
  • Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
  • Right-Click FRST.exe / FRST64.exe and select [external image: AVOiBNU.jpg]Run as administrator to run the programme.
  • Click Yes to the disclaimer.
  • Ensure the Addition.txt box is checked.
  • Click the Scan button and let the programme run.
  • Upon completion, click OK, then OK on the Addition.txt pop up screen.
  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.

Post #8

Hi Juliet, thank you for your response. Not sure which program the Kingsoft_WPS_UpdateService is related to…

 

Ran the scans. Nothing has been found. Please find Emisoft, Zemana, FRST and Addition logs below:

 

msisoft Emergency Kit - Version 2017.6
Last update: 8/7/2017 9:50:52 PM
User account: DESKTOP-FMTT2PH\yosef
Computer name: DESKTOP-FMTT2PH
OS version: Windows 10x64
Scan settings:
Scan type: Malware Scan
Objects: Rootkits, Memory, Traces, Files
Detect PUPs: On
Scan archives: Off
Scan mail archives: Off
ADS Scan: On
File extension filter: Off
Direct disk access: Off
Scan start: 8/7/2017 9:51:40 PM
Scanned 86460
Found 0
Scan end: 8/7/2017 10:02:22 PM
Scan time: 0:10:42

 

Zemana AntiMalware 2.74.2.76 (Installed)
——————————————————-
Scan Result            : Completed
Scan Date              : 2017/8/7
Operating System       : Windows 10 64-bit
Processor              : 4X Intel(R) Core(TM) i3-5005U CPU @ 2.00GHz
BIOS Mode              : UEFI
CUID                   : 12492A44B1DFBEA025845D
Scan Type              : System Scan
Duration               : 14m 3s
Scanned Objects        : 74247
Detected Objects       : 0
Excluded Objects       : 0
Read Level             : SCSI
Auto Upload            : Enabled
Detect All Extensions  : Disabled
Scan Documents         : Disabled
Domain Info            : WORKGROUP,0,2
Detected Objects
——————————————————-
No threats detected

​

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 06-08-2017
Ran by [removed] (administrator) on DESKTOP-FMTT2PH (07-08-2017 22:36:34)
Running from C:\Users\[removed]\Desktop
[removed] Platform: Windows 10 Home Version 1607 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Intel Corporation) C:\Windows\SysWOW64\esif_uf.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\HP\HP System Event\HPWMISVC.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe
(Intel Security, Inc.) C:\Program Files\Common Files\Intel Security\PEF\CORE\PEFService.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Copyright 2017.) C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe
(Intel Corporation) C:\Windows\Temp\DPTF\esif_assist_64.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\VSCore_15_6\mcapexe.exe
(McAfee, Inc.) C:\Program Files\mcafee\MfeAV\MfeAVSvc.exe
(Intel Security) C:\Program Files\Common Files\McAfee\ClientAnalytics\Legacy\McClientAnalytics.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIIBE.EXE
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam6\YouCamService6.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\HP\HP System Event\HPMSGSVC.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\CSP\2.5.312.0\McCSPServiceHost.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\platform\McUICnt.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler64.exe
(WildTangent) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe
(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
(Microsoft Corporation) C:\Windows\System32\browser_broker.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgentUserBroker.exe
(Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\SrTasks.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8911872 2016-10-15] (RealtekSemiconductor)
HKLM\…\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-09-15] (AppleInc.)
HKLM\…\Run: [ZAM] => C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe [15546512 2017-06-19] (Copyright2017.)
HKLM-x32\…\Run: [PowerDVD14Agent] => C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14Agent.exe [795336 2015-06-21] (CyberLinkCorp.)
HKLM-x32\…\Run: [HPMessageService] => C:\Program Files (x86)\HP\HP System Event\HPMSGSVC.exe [653576 2015-06-29] (Hewlett-PackardDevelopmentCompany,L.P.)
HKU\S-1-5-21-182178435-2925743980-1085802887-1001\…\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATIIBE.EXE [283232 2015-09-15] (SEIKOEPSONCORPORATION)
HKU\S-1-5-21-182178435-2925743980-1085802887-1001\…\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [23819304 2017-03-21] (Google)
HKU\S-1-5-21-182178435-2925743980-1085802887-1001\…\Run: [Google Update] => C:\Users\yosef\AppData\Local\Google\Update\1.3.33.5\GoogleUpdateCore.exe [601168 2017-04-28] (GoogleInc.)
HKU\S-1-5-21-182178435-2925743980-1085802887-1001\…\Run: [EasyHideIPVPN] => C:\Program Files (x86)\Easy-Hide-IP VPN\easy.hide.ip.vpn.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 [removed] [removed]
Tcpip\..\Interfaces\{859a7fca-f00b-4090-a23b-664a3ab0e597}: [DhcpNameServer] 192.168.1.1 [removed] [removed]
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp15-comm.msn.com/?pc=HRTE
HKU\S-1-5-21-182178435-2925743980-1085802887-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-182178435-2925743980-1085802887-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp15-comm.msn.com/?pc=HRTE
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2017-07-11] (MicrosoftCorporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2017-07-11] (MicrosoftCorporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-04-30] (EvernoteCorp.,305WalnutStreet,RedwoodCity,CA94063)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2016-07-21] (HPInc.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2016-04-19] (MicrosoftCorporation)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll [2017-05-31] (McAfee,Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll [2017-05-31] (McAfee,Inc.)
FireFox:
========
FF DefaultProfile: 2eofar0g.default
FF ProfilePath: C:\Users\yosef\AppData\Roaming\Mozilla\Firefox\Profiles\2eofar0g.default [2017-08-07]
FF NewTab: Mozilla\Firefox\Profiles\2eofar0g.default -> about:newtab
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\2eofar0g.default -> Search Provided by Yahoo
FF DefaultSearchEngine.US: Mozilla\Firefox\Profiles\2eofar0g.default -> Search Provided by Yahoo
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\2eofar0g.default -> Search Provided by Yahoo
FF Homepage: Mozilla\Firefox\Profiles\2eofar0g.default -> about:home
FF Extension: (Dashlane) - C:\Users\yosef\AppData\Roaming\Mozilla\Firefox\Profiles\2eofar0g.default\Extensions\[removed] [2016-02-29]
FF HKLM-x32\…\Thunderbird\Extensions: [[removed]] - C:\Program Files\McAfee\MSK
FF Extension: (McAfee Anti-Spam Thunderbird Extension) - C:\Program Files\McAfee\MSK [2017-08-03] [not signed]
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2017-05-31] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1217157.dll [2015-02-05] (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.68 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2017-05-31] ()
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-09-15] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2015-06-25] ()
FF Plugin HKU\S-1-5-21-182178435-2925743980-1085802887-1001: @talk.google.com/GoogleTalkPlugin -> C:\Users\yosef\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
FF Plugin HKU\S-1-5-21-182178435-2925743980-1085802887-1001: @talk.google.com/O1DPlugin -> C:\Users\yosef\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-12-08] (Google)
FF Plugin HKU\S-1-5-21-182178435-2925743980-1085802887-1001: @tools.google.com/Google Update;version=3 -> C:\Users\yosef\AppData\Local\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin HKU\S-1-5-21-182178435-2925743980-1085802887-1001: @tools.google.com/Google Update;version=9 -> C:\Users\yosef\AppData\Local\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\yosef\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\yosef\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-12-08] (Google)
StartMenuInternet: FIREFOX.EXE - firefox.exe
Chrome:
=======
CHR Profile: C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default [2017-08-06]
CHR Extension: (Google Slides) - C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-07-31]
CHR Extension: (Google Docs) - C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-07-31]
CHR Extension: (Google Drive) - C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-07-31]
CHR Extension: (YouTube) - C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-07-31]
CHR Extension: (Google Sheets) - C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-07-31]
CHR Extension: (Google Docs Offline) - C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-07-31]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2017-07-31]
CHR Extension: (Chrome Web Store Payments) - C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-07-31]
CHR Extension: (Gmail) - C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-07-31]
CHR Extension: (Chrome Media Router) - C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-07-31]
CHR HKU\S-1-5-21-182178435-2925743980-1085802887-1001\SOFTWARE\Google\Chrome\Extensions\…\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-09-02] (AppleInc.)
R2 BcmBtRSupport; C:\WINDOWS\system32\BtwRSupportService.exe [2286848 2015-10-14] (BroadcomCorporation.)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [3042544 2017-03-14] (MicrosoftCorporation)
R3 ClientAnalyticsService; C:\Program Files\Common Files\McAfee\ClientAnalytics\Legacy\McClientAnalytics.exe [1752992 2017-03-29] (IntelSecurity)
R2 esifsvc; C:\WINDOWS\SysWoW64\esif_uf.exe [1385640 2015-07-13] (IntelCorporation)
R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [349728 2015-06-25] (WildTangent)
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [641520 2017-02-22] (McAfee,Inc.)
R2 HPSupportSolutionsFrameworkService; c:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [321896 2017-07-06] (HPInc.)
R2 HPWMISVC; C:\Program Files (x86)\HP\HP System Event\HPWMISVC.exe [602888 2015-06-29] (Hewlett-PackardDevelopmentCompany,L.P.)
R2 igfxCUIService2.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [373720 2017-01-13] (IntelCorporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [881152 2015-05-22] (Intel(R)Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [223008 2015-07-06] (IntelCorporation)
S2 Kingsoft_WPS_UpdateService; C:\Program Files (x86)\Kingsoft\WPS Office\9.1.0.5113\wtoolex\wpsupdatesvr.exe [133480 2015-07-21] (ZhuhaiKingsoftOfficeSoftwareCo.,Ltd)
R2 McAPExe; C:\Program Files\Common Files\McAfee\VSCore_15_6\McApExe.exe [984480 2017-06-03] (McAfee,Inc.)
S3 McAWFwk; C:\Program Files\Common Files\McAfee\ActWiz\McAWFwk.exe [338208 2015-03-19] (McAfee,Inc.)
R2 mcbootdelaystartsvc; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [641520 2017-02-22] (McAfee,Inc.)
R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\2.5.312.0\\McCSPServiceHost.exe [2139832 2017-05-30] (McAfee,Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [641520 2017-02-22] (McAfee,Inc.)
S4 McOobeSv2; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [641520 2017-02-22] (McAfee,Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [641520 2017-02-22] (McAfee,Inc.)
R2 McProxy; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [641520 2017-02-22] (McAfee,Inc.)
R3 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [241656 2017-04-30] (McAfee,Inc.)
R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\\mfemms.exe [390656 2017-04-30] (McAfee,Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [343544 2017-04-30] (McAfee,Inc.)
R2 ModuleCoreService; C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe [1543248 2017-05-31] (McAfee,Inc.)
S3 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [641520 2017-02-22] (McAfee,Inc.)
R2 PEFService; C:\Program Files\Common Files\Intel Security\PEF\CORE\PEFService.exe [1042288 2017-05-21] (IntelSecurity,Inc.)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [389896 2014-04-14] ()
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [326656 2016-10-15] (RealtekSemiconductor)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [266848 2016-12-27] (SynapticsIncorporated)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347320 2017-04-27] (MicrosoftCorporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103712 2017-04-27] (MicrosoftCorporation)
R2 ZAMSvc; C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe [15546512 2017-06-19] (Copyright2017.)
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 bcbtums; C:\WINDOWS\system32\drivers\bcbtums.sys [208176 2015-10-14] (BroadcomCorporation.)
R3 BCM43XX; C:\WINDOWS\system32\DRIVERS\bcmwl63a.sys [7551240 2015-07-21] (BroadcomCorporation)
R3 cfwids; C:\WINDOWS\System32\drivers\cfwids.sys [76824 2017-05-02] (McAfee,Inc.)
R3 clwvd6; C:\WINDOWS\system32\DRIVERS\clwvd6.sys [41704 2013-10-29] (CyberLinkCorporation)
R3 dptf_cpu; C:\WINDOWS\System32\drivers\dptf_cpu.sys [43512 2015-07-13] (IntelCorporation)
R3 dptf_pch; C:\WINDOWS\System32\drivers\dptf_pch.sys [41976 2015-07-13] (IntelCorporation)
R3 esif_lf; C:\WINDOWS\system32\DRIVERS\esif_lf.sys [251384 2015-07-13] (IntelCorporation)
S3 HipShieldK; C:\WINDOWS\System32\drivers\HipShieldK.sys [209608 2017-05-31] (McAfee,Inc.)
R3 mfeaack; C:\WINDOWS\System32\drivers\mfeaack.sys [476176 2017-05-02] (McAfee,Inc.)
R3 mfeavfk; C:\WINDOWS\System32\drivers\mfeavfk.sys [353808 2017-05-02] (McAfee,Inc.)
U3 mfeavfk01; no ImagePath
S0 mfeelamk; C:\WINDOWS\System32\drivers\mfeelamk.sys [84536 2017-05-02] (McAfee,Inc.)
R3 mfefirek; C:\WINDOWS\System32\drivers\mfefirek.sys [504336 2017-05-02] (McAfee,Inc.)
R0 mfehidk; C:\WINDOWS\System32\drivers\mfehidk.sys [918544 2017-05-02] (McAfee,Inc.)
R3 mfencbdc; C:\WINDOWS\System32\DRIVERS\mfencbdc.sys [495632 2017-04-07] (McAfee,Inc.)
S3 mfencrk; C:\WINDOWS\System32\DRIVERS\mfencrk.sys [107544 2017-04-07] (McAfee,Inc.)
R3 mfeplk; C:\WINDOWS\System32\drivers\mfeplk.sys [109072 2017-05-02] (McAfee,Inc.)
R0 mfewfpk; C:\WINDOWS\System32\drivers\mfewfpk.sys [252432 2017-05-02] (McAfee,Inc.)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
S3 Revoflt; C:\WINDOWS\System32\DRIVERS\revoflt.sys [40240 2016-12-21] (VSRevoGroup)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [895256 2015-06-18] (Realtek)
U5 RTSUER; C:\Windows\System32\Drivers\RTSUER.sys [411712 2015-05-20] (RealsilSemiconductorCorporation)
S3 SmbDrv; C:\WINDOWS\System32\drivers\Smb_driver_AMDASF.sys [33448 2015-07-13] (SynapticsIncorporated)
R3 SmbDrvI; C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys [72792 2016-12-27] (SynapticsIncorporated)
S0 vsmraid; C:\WINDOWS\System32\drivers\vsmraid.sys [166752 2016-07-16] (VIATechnologiesInc.,Ltd)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (MicrosoftCorporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (MicrosoftCorporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (MicrosoftCorporation)
R3 WirelessButtonDriver64; C:\WINDOWS\System32\drivers\WirelessButtonDriver64.sys [30384 2015-06-23] (HPInc.)
R1 ZAM; C:\WINDOWS\System32\drivers\zam64.sys [203680 2017-07-29] (ZemanaLtd.)
R1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard64.sys [203680 2017-07-29] (ZemanaLtd.)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-08-07 22:36 - 2017-08-07 22:37 - 000021921 _____ C:\Users\yosef\Desktop\FRST.txt
2017-08-07 22:36 - 2017-08-07 22:36 - 000000000 ____D C:\FRST
2017-08-07 22:34 - 2017-08-07 22:35 - 002381312 _____ (Farbar) C:\Users\yosef\Desktop\FRST64.exe
2017-08-07 22:27 - 2017-08-07 22:27 - 000000000 ____D C:\Users\yosef\Desktop\FRST-OlderVersion
2017-08-07 22:27 - 2017-08-07 22:27 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2017-08-07 22:06 - 2017-08-07 22:06 - 000001184 _____ C:\Users\Public\Desktop\Zemana AntiMalware.lnk
2017-08-07 22:06 - 2017-08-07 22:06 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zemana AntiMalware
2017-08-07 22:06 - 2017-08-07 22:06 - 000000000 ____D C:\Program Files (x86)\Zemana AntiMalware
2017-08-07 22:05 - 2017-08-07 22:06 - 006589840 _____ (Zemana Ltd. ) C:\Users\yosef\Desktop\Zemana.AntiMalware.Setup.exe
2017-08-07 22:04 - 2017-08-07 22:04 - 000001012 _____ C:\Users\yosef\Desktop\scan_170807-215140.txt
2017-08-07 21:50 - 2017-08-07 21:50 - 000000000 ____D C:\ProgramData\Emsisoft
2017-08-07 20:47 - 2017-08-07 21:48 - 323726728 _____ C:\Users\yosef\Desktop\EmsisoftEmergencyKit.exe
2017-08-07 00:19 - 2017-08-07 00:19 - 000054832 _____ C:\Users\yosef\Desktop\AMPTP Advisory Opinion Letter Guidelines.pdf
2017-08-06 23:54 - 2017-08-06 23:54 - 001036243 _____ C:\Users\yosef\Desktop\summary.pdf
2017-08-06 23:46 - 2017-08-06 23:48 - 000000000 ____D C:\Users\yosef\AppData\LocalLow\Mozilla
2017-08-06 14:42 - 2017-08-06 14:49 - 000000000 ____D C:\AdwCleaner
2017-08-06 14:39 - 2017-08-06 14:42 - 008185288 _____ (Malwarebytes) C:\Users\yosef\Desktop\adwcleaner_7.0.1.0.exe
2017-08-06 13:45 - 2017-08-06 14:30 - 000000000 ____D C:\Users\yosef\Desktop\mbar
2017-08-06 13:42 - 2017-08-06 13:45 - 016563352 _____ (Malwarebytes Corp.) C:\Users\yosef\Desktop\mbar-1.09.3.1001.exe
2017-08-06 00:34 - 2017-08-06 13:47 - 000192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-08-06 00:32 - 2017-08-06 13:45 - 000109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2017-08-05 19:23 - 2017-08-05 19:23 - 000000512 _____ C:\Users\yosef\Desktop\MBR.dat
2017-08-05 14:33 - 2017-08-05 14:37 - 005198336 _____ (AVAST Software) C:\Users\yosef\Desktop\aswMBR.exe
2017-08-05 14:27 - 2017-08-06 01:18 - 015579280 _____ (Copyright 2017.) C:\Users\yosef\Desktop\Zemana.AntiMalware.Portable-unsigned.exe
2017-08-04 12:03 - 2017-08-07 21:43 - 000004034 _____ C:\WINDOWS\System32\Tasks\Intel Security DAT Reputation (AMCore) periodic endpoint safety pulse
2017-08-01 17:49 - 2017-08-01 17:49 - 000000000 ____D C:\WINDOWS\LastGood
2017-08-01 17:39 - 2017-08-01 17:40 - 000000000 ____D C:\WINDOWS\LastGood.Tmp
2017-08-01 17:31 - 2017-08-01 17:33 - 065033984 _____ (Malwarebytes ) C:\Users\yosef\Desktop\mb3-setup-consumer-3.1.2.1733-1.0.160-1.0.2251.exe
2017-08-01 17:14 - 2017-08-01 17:15 - 000000359 _____ C:\DelFix.txt
2017-08-01 00:42 - 2017-08-01 00:21 - 007576049 ____N C:\Users\yosef\Desktop\VID-20170801-WA0001.mp4
2017-07-31 17:01 - 2017-08-03 02:34 - 000002239 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-07-31 17:01 - 2017-08-03 02:34 - 000002227 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-07-30 19:25 - 2017-08-05 00:18 - 000001178 _____ C:\Users\yosef\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware Guard.lnk
2017-07-30 18:01 - 2017-08-07 22:03 - 000000000 ____D C:\EEK
2017-07-29 17:34 - 2017-08-07 16:33 - 000004222 _____ C:\WINDOWS\System32\Tasks\Intel Security DAT Reputation (AMCore) Post DAT update endpoint safety pulse
2017-07-29 15:03 - 2017-08-07 22:36 - 000066785 _____ C:\WINDOWS\ZAM.krnl.trace
2017-07-29 15:03 - 2017-08-07 22:36 - 000037408 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2017-07-29 15:03 - 2017-07-29 15:03 - 000203680 _____ (Zemana Ltd.) C:\WINDOWS\system32\Drivers\zamguard64.sys
2017-07-29 15:03 - 2017-07-29 15:03 - 000203680 _____ (Zemana Ltd.) C:\WINDOWS\system32\Drivers\zam64.sys
2017-07-29 15:03 - 2017-07-29 15:03 - 000000000 ____D C:\Users\yosef\AppData\Local\Zemana
2017-07-29 14:07 - 2017-08-05 17:19 - 000000000 ____D C:\ProgramData\Malwarebytes
2017-07-29 14:06 - 2017-08-06 14:30 - 000000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2017-07-29 13:08 - 2017-07-29 13:08 - 000000000 ____D C:\Users\yosef\AppData\Local\VS Revo Group
2017-07-29 13:08 - 2017-07-29 13:08 - 000000000 ____D C:\ProgramData\VS Revo Group
2017-07-29 13:08 - 2017-07-29 13:08 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
2017-07-29 13:08 - 2016-12-21 14:52 - 000040240 _____ (VS Revo Group) C:\WINDOWS\system32\Drivers\revoflt.sys
2017-07-29 13:05 - 2017-07-29 13:08 - 000000000 ____D C:\Program Files\VS Revo Group
2017-07-29 13:05 - 2017-07-29 13:05 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
2017-07-28 17:20 - 2017-07-28 16:57 - 000565416 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2017-07-27 19:12 - 2017-07-31 12:34 - 000000000 ____D C:\WINDOWS\Minidump
2017-07-26 18:14 - 2017-07-26 18:14 - 000051625 _____ C:\WINDOWS\uninstaller.dat
2017-07-21 00:34 - 2017-07-21 00:34 - 000001156 _____ C:\Users\Public\Desktop\Movavi Video Editor 12.lnk
2017-07-21 00:34 - 2017-07-21 00:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movavi Video Editor 12
2017-07-21 00:34 - 2017-07-21 00:34 - 000000000 ____D C:\Program Files (x86)\Movavi Video Editor 12
2017-07-14 12:57 - 2017-07-07 00:46 - 000781152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe
2017-07-14 12:57 - 2017-07-07 00:45 - 002263832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2017-07-14 12:57 - 2017-07-07 00:29 - 005686272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2017-07-14 12:57 - 2017-07-06 23:54 - 002997248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-07-14 12:57 - 2017-07-06 23:53 - 002483200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2017-07-14 12:57 - 2017-07-06 23:52 - 001599488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2017-07-14 12:57 - 2017-06-21 00:28 - 001504056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2017-07-14 12:57 - 2017-06-21 00:27 - 001431232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll
2017-07-14 12:57 - 2017-06-21 00:27 - 000116576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudExperienceHostCommon.dll
2017-07-14 12:57 - 2017-06-21 00:21 - 001277856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2017-07-14 12:57 - 2017-06-21 00:04 - 001631232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll
2017-07-14 12:57 - 2017-06-21 00:01 - 000141824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Radios.dll
2017-07-14 12:57 - 2017-06-21 00:00 - 000156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDeviceRegistration.dll
2017-07-14 12:57 - 2017-06-20 23:59 - 000285184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll
2017-07-14 12:57 - 2017-06-20 23:59 - 000123904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.HostName.dll
2017-07-14 12:57 - 2017-06-20 23:59 - 000097792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.System.SystemManagement.dll
2017-07-14 12:57 - 2017-06-20 23:58 - 000136192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinRtTracing.dll
2017-07-14 12:57 - 2017-06-20 23:58 - 000129024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.SerialCommunication.dll
2017-07-14 12:57 - 2017-06-20 23:58 - 000094208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryClient.dll
2017-07-14 12:57 - 2017-06-20 23:58 - 000087040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.ServiceDiscovery.Dnssd.dll
2017-07-14 12:57 - 2017-06-20 23:58 - 000059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.System.UserDeviceAssociation.dll
2017-07-14 12:57 - 2017-06-20 23:57 - 000142336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.WiFi.dll
2017-07-14 12:57 - 2017-06-20 23:56 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Gaming.Input.dll
2017-07-14 12:57 - 2017-06-20 23:56 - 000374784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.LowLevel.dll
2017-07-14 12:57 - 2017-06-20 23:56 - 000315904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Gaming.XboxLive.Storage.dll
2017-07-14 12:57 - 2017-06-20 23:56 - 000237056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SyncSettings.dll
2017-07-14 12:57 - 2017-06-20 23:56 - 000231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2017-07-14 12:57 - 2017-06-20 23:56 - 000184320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserMgrProxy.dll
2017-07-14 12:57 - 2017-06-20 23:56 - 000180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2017-07-14 12:57 - 2017-06-20 23:56 - 000113152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Lights.dll
2017-07-14 12:57 - 2017-06-20 23:55 - 000557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2017-07-14 12:57 - 2017-06-20 23:55 - 000117760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AuthBroker.dll
2017-07-14 12:57 - 2017-06-20 23:55 - 000115712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Core.dll
2017-07-14 12:57 - 2017-06-20 23:54 - 000609280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Import.dll
2017-07-14 12:57 - 2017-06-20 23:54 - 000298496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Management.dll
2017-07-14 12:57 - 2017-06-20 23:54 - 000223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe
2017-07-14 12:57 - 2017-06-20 23:53 - 000431616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\efswrt.dll
2017-07-14 12:57 - 2017-06-20 23:53 - 000386048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.WiFiDirect.dll
2017-07-14 12:57 - 2017-06-20 23:53 - 000332288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Bluetooth.dll
2017-07-14 12:57 - 2017-06-20 23:53 - 000325120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleacc.dll
2017-07-14 12:57 - 2017-06-20 23:53 - 000284672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apprepsync.dll
2017-07-14 12:57 - 2017-06-20 23:53 - 000271360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\deviceaccess.dll
2017-07-14 12:57 - 2017-06-20 23:53 - 000218624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WwaApi.dll
2017-07-14 12:57 - 2017-06-20 23:53 - 000202752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.HumanInterfaceDevice.dll
2017-07-14 12:57 - 2017-06-20 23:53 - 000185856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Identity.Provider.dll
2017-07-14 12:57 - 2017-06-20 23:53 - 000175616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Scanners.dll
2017-07-14 12:57 - 2017-06-20 23:53 - 000125952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apprepapi.dll
2017-07-14 12:57 - 2017-06-20 23:52 - 000262144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Picker.dll
2017-07-14 12:57 - 2017-06-20 23:51 - 000314368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Usb.dll
2017-07-14 12:57 - 2017-06-20 23:51 - 000284672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.dll
2017-07-14 12:57 - 2017-06-20 23:50 - 000857600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EmailApis.dll
2017-07-14 12:57 - 2017-06-20 23:49 - 000288256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CryptoWinRT.dll
2017-07-14 12:57 - 2017-06-20 23:48 - 002333184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmSvc.dll
2017-07-14 12:57 - 2017-06-20 23:46 - 001077760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Editing.dll
2017-07-14 12:57 - 2017-06-20 23:46 - 000355328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RTMediaFrame.dll
2017-07-14 12:57 - 2017-06-20 23:45 - 000313856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2017-07-14 12:57 - 2017-06-20 23:44 - 000795648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MiracastReceiver.dll
2017-07-14 12:57 - 2017-06-20 23:44 - 000343040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToDevice.dll
2017-07-14 12:57 - 2017-06-20 23:43 - 000653312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.AccountsControl.dll
2017-07-14 12:57 - 2017-06-20 23:43 - 000468992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.InkControls.dll
2017-07-14 12:57 - 2017-06-20 23:42 - 003307008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2017-07-14 12:57 - 2017-06-20 23:40 - 002641920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2017-07-14 12:57 - 2017-06-20 23:40 - 000895488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Streaming.dll
2017-07-14 12:57 - 2017-06-20 23:40 - 000675840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.dll
2017-07-14 12:57 - 2017-06-20 23:40 - 000220672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToReceiver.dll
2017-07-14 12:57 - 2017-06-20 23:39 - 000134144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ErrorDetails.dll
2017-07-14 12:57 - 2017-06-20 23:38 - 003733504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll
2017-07-14 12:57 - 2017-06-20 23:38 - 001221120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Audio.dll
2017-07-14 12:57 - 2017-06-20 23:37 - 006109696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2017-07-14 12:57 - 2017-06-20 23:37 - 000400384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToManager.dll
2017-07-14 12:57 - 2017-06-20 23:37 - 000357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Geolocation.dll
2017-07-14 12:57 - 2017-06-20 23:37 - 000103936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Devices.dll
2017-07-14 12:57 - 2017-06-20 23:36 - 001988096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
2017-07-14 12:57 - 2017-06-20 23:36 - 001247232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2017-07-14 12:57 - 2017-06-20 23:35 - 001656320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Perception.dll
2017-07-14 12:57 - 2017-06-20 23:35 - 001232384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Maps.dll
2017-07-14 12:57 - 2017-06-20 23:35 - 000598528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.dll
2017-07-14 12:57 - 2017-06-20 23:35 - 000589312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Sensors.dll
2017-07-14 12:57 - 2017-06-20 23:34 - 001886720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2017-07-14 12:57 - 2017-06-20 23:34 - 000654336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MbaeApiPublic.dll
2017-07-14 12:57 - 2017-06-20 23:34 - 000621056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2017-07-14 12:57 - 2017-06-20 23:34 - 000542208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.Connectivity.dll
2017-07-14 12:57 - 2017-06-20 23:33 - 001170944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Phone.dll
2017-07-14 12:57 - 2017-06-20 23:33 - 001013248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.Http.dll
2017-07-14 12:57 - 2017-06-20 23:33 - 000751104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.dll
2017-07-14 12:57 - 2017-06-20 23:10 - 000483840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2017-07-14 12:57 - 2017-03-03 23:56 - 000263472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll
2017-07-14 12:57 - 2017-03-03 23:21 - 001243136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.FaceAnalysis.dll
2017-07-14 12:57 - 2017-03-03 23:20 - 000426496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Wallet.dll
2017-07-14 12:57 - 2017-03-03 23:19 - 000498688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mbsmsapi.dll
2017-07-14 12:57 - 2016-10-05 02:15 - 000141312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dialclient.dll
2017-07-14 12:57 - 2016-09-15 09:58 - 000092672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Background.SystemEventsBroker.dll
2017-07-14 12:57 - 2016-09-15 09:47 - 000134656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Energy.dll
2017-07-14 12:56 - 2017-07-07 00:49 - 000340824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2017-07-14 12:56 - 2017-07-07 00:40 - 020967840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2017-07-14 12:56 - 2017-07-07 00:37 - 000118112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tdx.sys
2017-07-14 12:56 - 2017-07-07 00:29 - 000857440 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
2017-07-14 12:56 - 2017-07-07 00:24 - 022220856 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2017-07-14 12:56 - 2017-07-07 00:20 - 000059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\l2gpstore.dll
2017-07-14 12:56 - 2017-07-07 00:19 - 000025088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapprovp.dll
2017-07-14 12:56 - 2017-07-07 00:18 - 002532192 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2017-07-14 12:56 - 2017-07-07 00:18 - 000450560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll
2017-07-14 12:56 - 2017-07-07 00:18 - 000210432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\onex.dll
2017-07-14 12:56 - 2017-07-07 00:17 - 000118784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\raschap.dll
2017-07-14 12:56 - 2017-07-07 00:13 - 000364544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupShim.dll
2017-07-14 12:56 - 2017-07-07 00:13 - 000310272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Wldap32.dll
2017-07-14 12:56 - 2017-07-07 00:10 - 000755200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2017-07-14 12:56 - 2017-07-07 00:09 - 000637952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SmartcardCredentialProvider.dll
2017-07-14 12:56 - 2017-07-07 00:09 - 000506368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2017-07-14 12:56 - 2017-07-07 00:06 - 007626752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2017-07-14 12:56 - 2017-07-07 00:03 - 000337408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msinfo32.exe
2017-07-14 12:56 - 2017-07-07 00:02 - 001313280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wdc.dll
2017-07-14 12:56 - 2017-07-07 00:00 - 000476160 _____ (Microsoft® Windows® Operating System) C:\WINDOWS\SysWOW64\wvc.dll
2017-07-14 12:56 - 2017-07-06 23:55 - 004423680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
2017-07-14 12:56 - 2017-07-06 23:55 - 001571840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2017-07-14 12:56 - 2017-07-06 23:52 - 004561408 _____ (Microsoft) C:\WINDOWS\SysWOW64\dbgeng.dll
2017-07-14 12:56 - 2017-07-06 23:52 - 001413632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OpcServices.dll
2017-07-14 12:56 - 2017-07-06 23:47 - 000128512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthpan.sys
2017-07-14 12:56 - 2017-07-05 21:29 - 000690008 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcp120_clr0400.dll
2017-07-14 12:56 - 2017-06-21 23:17 - 000987840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr120_clr0400.dll
2017-07-14 12:56 - 2017-06-21 23:17 - 000485576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp120_clr0400.dll
2017-07-14 12:56 - 2017-06-21 00:53 - 000794928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Shell.Broker.dll
2017-07-14 12:56 - 2017-06-21 00:52 - 002213760 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2017-07-14 12:56 - 2017-06-21 00:52 - 000774224 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2017-07-14 12:56 - 2017-06-21 00:52 - 000088416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\scmbus.sys
2017-07-14 12:56 - 2017-06-21 00:52 - 000081760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\stornvme.sys
2017-07-14 12:56 - 2017-06-21 00:42 - 001573280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2017-07-14 12:56 - 2017-06-21 00:42 - 000601712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2017-07-14 12:56 - 2017-06-21 00:41 - 001706488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2017-07-14 12:56 - 2017-06-21 00:39 - 002048496 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2017-07-14 12:56 - 2017-06-21 00:38 - 007220192 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2017-07-14 12:56 - 2017-06-21 00:38 - 000790752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2017-07-14 12:56 - 2017-06-21 00:36 - 000557408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2017-07-14 12:56 - 2017-06-21 00:36 - 000129888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBSTOR.SYS
2017-07-14 12:56 - 2017-06-21 00:33 - 000408600 _____ (Microsoft Corporation) C:\WINDOWS\system32\tsmf.dll
2017-07-14 12:56 - 2017-06-21 00:33 - 000092512 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2017-07-14 12:56 - 2017-06-21 00:32 - 008169024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2017-07-14 12:56 - 2017-06-21 00:32 - 004260576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2017-07-14 12:56 - 2017-06-21 00:32 - 001983408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2017-07-14 12:56 - 2017-06-21 00:32 - 001702392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2017-07-14 12:56 - 2017-06-21 00:32 - 001072248 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll
2017-07-14 12:56 - 2017-06-21 00:30 - 000869848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2017-07-14 12:56 - 2017-06-21 00:30 - 000196960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ifsutil.dll
2017-07-14 12:56 - 2017-06-21 00:29 - 005722320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2017-07-14 12:56 - 2017-06-21 00:28 - 002277288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2017-07-14 12:56 - 2017-06-21 00:28 - 000524776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
2017-07-14 12:56 - 2017-06-21 00:28 - 000170960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2017-07-14 12:56 - 2017-06-21 00:27 - 001122344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dcomp.dll
2017-07-14 12:56 - 2017-06-21 00:27 - 000975744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2017-07-14 12:56 - 2017-06-21 00:27 - 000861024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2017-07-14 12:56 - 2017-06-21 00:27 - 000549088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll
2017-07-14 12:56 - 2017-06-21 00:25 - 002168288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2017-07-14 12:56 - 2017-06-21 00:25 - 001980776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2017-07-14 12:56 - 2017-06-21 00:24 - 000846560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll
2017-07-14 12:56 - 2017-06-21 00:24 - 000154432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntmarta.dll
2017-07-14 12:56 - 2017-06-21 00:22 - 000361104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tsmf.dll
2017-07-14 12:56 - 2017-06-21 00:21 - 006665440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2017-07-14 12:56 - 2017-06-21 00:21 - 004023552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2017-07-14 12:56 - 2017-06-21 00:21 - 001845512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2017-07-14 12:56 - 2017-06-21 00:21 - 001557808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
2017-07-14 12:56 - 2017-06-21 00:21 - 000952416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2017-07-14 12:56 - 2017-06-21 00:21 - 000374448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFPlay.dll
2017-07-14 12:56 - 2017-06-21 00:20 - 001360464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll
2017-07-14 12:56 - 2017-06-21 00:20 - 000981888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetcore.dll
2017-07-14 12:56 - 2017-06-21 00:20 - 000962768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2017-07-14 12:56 - 2017-06-21 00:20 - 000312472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mftranscode.dll
2017-07-14 12:56 - 2017-06-21 00:19 - 004312248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2017-07-14 12:56 - 2017-06-21 00:04 - 000026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\odbcconf.dll
2017-07-14 12:56 - 2017-06-21 00:03 - 000013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rootmdm.sys
2017-07-14 12:56 - 2017-06-21 00:02 - 000237568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.Diagnostics.dll
2017-07-14 12:56 - 2017-06-21 00:02 - 000124928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\scmdisk0101.sys
2017-07-14 12:56 - 2017-06-21 00:02 - 000124416 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2017-07-14 12:56 - 2017-06-21 00:01 - 000138752 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEDataLayerHelpers.dll
2017-07-14 12:56 - 2017-06-21 00:00 - 000519168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ngccredprov.dll
2017-07-14 12:56 - 2017-06-21 00:00 - 000295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\unimdm.tsp
2017-07-14 12:56 - 2017-06-21 00:00 - 000193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinRtTracing.dll
2017-07-14 12:56 - 2017-06-21 00:00 - 000143360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uudf.dll
2017-07-14 12:56 - 2017-06-21 00:00 - 000138240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DisplayManager.dll
2017-07-14 12:56 - 2017-06-21 00:00 - 000114688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Background.SystemEventsBroker.dll
2017-07-14 12:56 - 2017-06-20 23:59 - 000467968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Gaming.XboxLive.Storage.dll
2017-07-14 12:56 - 2017-06-20 23:59 - 000255488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\unimdm.tsp
2017-07-14 12:56 - 2017-06-20 23:59 - 000177664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.Diagnostics.dll
2017-07-14 12:56 - 2017-06-20 23:59 - 000149504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Core.dll
2017-07-14 12:56 - 2017-06-20 23:59 - 000137216 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdlrecover.exe
2017-07-14 12:56 - 2017-06-20 23:57 - 000360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll
2017-07-14 12:56 - 2017-06-20 23:57 - 000122880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sendmail.dll
2017-07-14 12:56 - 2017-06-20 23:57 - 000088576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDeviceRegistration.Ngc.dll
2017-07-14 12:56 - 2017-06-20 23:56 - 001507840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.FaceAnalysis.dll
2017-07-14 12:56 - 2017-06-20 23:56 - 000299520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll
2017-07-14 12:56 - 2017-06-20 23:56 - 000203776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\credprovhost.dll
2017-07-14 12:56 - 2017-06-20 23:55 - 000561664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Wallet.dll
2017-07-14 12:56 - 2017-06-20 23:55 - 000533504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FXSCOMEX.dll
2017-07-14 12:56 - 2017-06-20 23:55 - 000456192 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
2017-07-14 12:56 - 2017-06-20 23:55 - 000404992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dsreg.dll
2017-07-14 12:56 - 2017-06-20 23:55 - 000358912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.dll
2017-07-14 12:56 - 2017-06-20 23:55 - 000349184 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
2017-07-14 12:56 - 2017-06-20 23:55 - 000265728 _____ C:\WINDOWS\SysWOW64\Windows.Perception.Stub.dll
2017-07-14 12:56 - 2017-06-20 23:55 - 000020480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\regsvr32.exe
2017-07-14 12:56 - 2017-06-20 23:54 - 001159680 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblGameSave.dll
2017-07-14 12:56 - 2017-06-20 23:54 - 000574976 _____ (Microsoft Corporation) C:\WINDOWS\system32\tileobjserver.dll
2017-07-14 12:56 - 2017-06-20 23:54 - 000483840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.AllJoyn.dll
2017-07-14 12:56 - 2017-06-20 23:54 - 000245760 _____ (Microsoft Corporation) C:\WINDOWS\system32\WwaApi.dll
2017-07-14 12:56 - 2017-06-20 23:54 - 000141824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\easwrt.dll
2017-07-14 12:56 - 2017-06-20 23:53 - 000642048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.InkControls.dll
2017-07-14 12:56 - 2017-06-20 23:53 - 000390656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredProvDataModel.dll
2017-07-14 12:56 - 2017-06-20 23:53 - 000284160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AboveLockAppHost.dll
2017-07-14 12:56 - 2017-06-20 23:53 - 000201728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExecModelClient.dll
2017-07-14 12:56 - 2017-06-20 23:52 - 006288384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2017-07-14 12:56 - 2017-06-20 23:52 - 000963584 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebcamUi.dll
2017-07-14 12:56 - 2017-06-20 23:52 - 000331264 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnrSvc.dll
2017-07-14 12:56 - 2017-06-20 23:52 - 000182784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BioCredProv.dll
2017-07-14 12:56 - 2017-06-20 23:51 - 000846336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebcamUi.dll
2017-07-14 12:56 - 2017-06-20 23:51 - 000747520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Ocr.dll
2017-07-14 12:56 - 2017-06-20 23:51 - 000258048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsDocumentTargetPrint.dll
2017-07-14 12:56 - 2017-06-20 23:50 - 001167360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certutil.exe
2017-07-14 12:56 - 2017-06-20 23:50 - 000529920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StructuredQuery.dll
2017-07-14 12:56 - 2017-06-20 23:50 - 000297472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe
2017-07-14 12:56 - 2017-06-20 23:50 - 000238080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AboveLockAppHost.dll
2017-07-14 12:56 - 2017-06-20 23:49 - 003778048 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2017-07-14 12:56 - 2017-06-20 23:49 - 000500224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Graphics.Printing.dll
2017-07-14 12:56 - 2017-06-20 23:49 - 000458752 _____ (Microsoft Corporation) C:\WINDOWS\system32\RTMediaFrame.dll
2017-07-14 12:56 - 2017-06-20 23:49 - 000295936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Graphics.dll
2017-07-14 12:56 - 2017-06-20 23:49 - 000175616 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.DeviceEncryptionHandlers.dll
2017-07-14 12:56 - 2017-06-20 23:48 - 000395264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmenrollengine.dll
2017-07-14 12:56 - 2017-06-20 23:48 - 000336384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\azroleui.dll
2017-07-14 12:56 - 2017-06-20 23:47 - 013873664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2017-07-14 12:56 - 2017-06-20 23:47 - 007655424 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2017-07-14 12:56 - 2017-06-20 23:46 - 004615168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2017-07-14 12:56 - 2017-06-20 23:46 - 001908224 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll
2017-07-14 12:56 - 2017-06-20 23:46 - 001323008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_fs.dll
2017-07-14 12:56 - 2017-06-20 23:46 - 001137152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll
2017-07-14 12:56 - 2017-06-20 23:46 - 000627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\SpaceControl.dll
2017-07-14 12:56 - 2017-06-20 23:45 - 000891904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\autochk.exe
2017-07-14 12:56 - 2017-06-20 23:45 - 000471552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.BackgroundMediaPlayback.dll
2017-07-14 12:56 - 2017-06-20 23:45 - 000102400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uexfat.dll
2017-07-14 12:56 - 2017-06-20 23:44 - 000535040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\untfs.dll
2017-07-14 12:56 - 2017-06-20 23:44 - 000136704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ufat.dll
2017-07-14 12:56 - 2017-06-20 23:44 - 000027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fdProxy.dll
2017-07-14 12:56 - 2017-06-20 23:43 - 001534464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Graphics.Printing.3D.dll
2017-07-14 12:56 - 2017-06-20 23:43 - 001217024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Audio.dll
2017-07-14 12:56 - 2017-06-20 23:43 - 000713216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpnapps.dll
2017-07-14 12:56 - 2017-06-20 23:43 - 000035328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cnvfat.dll
2017-07-14 12:56 - 2017-06-20 23:42 - 002749440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mispace.dll
2017-07-14 12:56 - 2017-06-20 23:42 - 000853504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\autofmt.exe
2017-07-14 12:56 - 2017-06-20 23:42 - 000525312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll
2017-07-14 12:56 - 2017-06-20 23:42 - 000470016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.BackgroundMediaPlayer.dll
2017-07-14 12:56 - 2017-06-20 23:42 - 000380416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uReFSv1.dll
2017-07-14 12:56 - 2017-06-20 23:41 - 003400704 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2017-07-14 12:56 - 2017-06-20 23:41 - 001255936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll
2017-07-14 12:56 - 2017-06-20 23:41 - 001080320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Ocr.dll
2017-07-14 12:56 - 2017-06-20 23:41 - 000983040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcsvc.dll
2017-07-14 12:56 - 2017-06-20 23:41 - 000459776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.MediaPlayer.dll
2017-07-14 12:56 - 2017-06-20 23:40 - 002154496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\storagewmi.dll
2017-07-14 12:56 - 2017-06-20 23:40 - 000901120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Bluetooth.dll
2017-07-14 12:56 - 2017-06-20 23:40 - 000611328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Graphics.Printing.dll
2017-07-14 12:56 - 2017-06-20 23:40 - 000090624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2017-07-14 12:56 - 2017-06-20 23:39 - 008076288 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2017-07-14 12:56 - 2017-06-20 23:39 - 002538496 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
2017-07-14 12:56 - 2017-06-20 23:39 - 000816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2017-07-14 12:56 - 2017-06-20 23:39 - 000546304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uReFS.dll
2017-07-14 12:56 - 2017-06-20 23:38 - 003520512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsrchvw.exe
2017-07-14 12:56 - 2017-06-20 23:38 - 002424320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Perception.dll
2017-07-14 12:56 - 2017-06-20 23:38 - 001984000 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2017-07-14 12:56 - 2017-06-20 23:38 - 000886272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll
2017-07-14 12:56 - 2017-06-20 23:38 - 000877056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\autoconv.exe
2017-07-14 12:56 - 2017-06-20 23:38 - 000846336 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApiPublic.dll
2017-07-14 12:56 - 2017-06-20 23:38 - 000765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Sensors.dll
2017-07-14 12:56 - 2017-06-20 23:38 - 000753152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imapi2fs.dll
2017-07-14 12:56 - 2017-06-20 23:38 - 000709120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CPFilters.dll
2017-07-14 12:56 - 2017-06-20 23:37 - 007468544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2017-07-14 12:56 - 2017-06-20 23:36 - 002648576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnroll.dll
2017-07-14 12:56 - 2017-06-20 23:36 - 001424896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Maps.dll
2017-07-14 12:56 - 2017-06-20 23:36 - 000903680 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
2017-07-14 12:56 - 2017-06-20 23:35 - 004149248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2017-07-14 12:56 - 2017-06-20 23:35 - 002740224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2017-07-14 12:56 - 2017-06-20 23:35 - 002682880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netshell.dll
2017-07-14 12:56 - 2017-06-20 23:35 - 001369088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Phone.dll
2017-07-14 12:56 - 2017-06-20 23:35 - 001170944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll
2017-07-14 12:56 - 2017-06-20 23:35 - 000827904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll
2017-07-14 12:56 - 2017-06-20 23:35 - 000732160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll
2017-07-14 12:56 - 2017-06-20 23:35 - 000348160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Midi.dll
2017-07-14 12:56 - 2017-06-20 23:34 - 003299840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstsc.exe
2017-07-14 12:56 - 2017-06-20 23:34 - 000773120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
2017-07-14 12:56 - 2017-06-20 23:34 - 000711168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2017-07-14 12:56 - 2017-06-20 23:34 - 000566784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ShareHost.dll
2017-07-14 12:56 - 2017-06-20 23:33 - 000691200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2017-07-14 12:56 - 2017-06-20 23:33 - 000439296 _____ (Microsoft Corporation) C:\WINDOWS\system32\wksprt.exe
2017-07-14 12:56 - 2017-06-20 23:32 - 001556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
2017-07-14 12:56 - 2017-06-20 23:32 - 000353280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TextInputFramework.dll
2017-07-14 12:56 - 2017-06-20 23:31 - 003106304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe
2017-07-14 12:56 - 2017-06-20 23:30 - 000038912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tlscsp.dll
2017-07-14 12:56 - 2017-06-19 19:42 - 000993632 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcr120_clr0400.dll
2017-07-14 12:56 - 2017-05-22 21:58 - 000448576 _____ C:\WINDOWS\system32\ApnDatabase.xml
2017-07-14 12:56 - 2017-03-04 00:10 - 000360040 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2017-07-14 12:56 - 2017-03-03 23:26 - 000307200 _____ (Microsoft Corporation) C:\WINDOWS\system32\PrintDialogs3D.dll
2017-07-14 12:56 - 2017-03-03 23:23 - 000583680 _____ (Microsoft Corporation) C:\WINDOWS\system32\PrintDialogs.dll
2017-07-14 12:56 - 2017-03-03 23:21 - 000670208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.PointOfService.dll
2017-07-14 12:56 - 2017-03-03 23:20 - 000562176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.SmartCards.dll
2017-07-14 12:56 - 2017-03-03 23:20 - 000206336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vaultcli.dll
2017-07-14 12:56 - 2017-03-03 23:18 - 000525824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintDialogs.dll
2017-07-14 12:56 - 2017-03-03 23:17 - 000864256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnapps.dll
2017-07-14 12:56 - 2017-03-03 23:16 - 000584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2017-07-14 12:56 - 2017-03-03 23:15 - 001078784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Streaming.dll
2017-07-14 12:56 - 2017-03-03 23:12 - 004596224 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsrchvw.exe
2017-07-14 12:56 - 2017-03-03 23:02 - 002138112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
2017-07-14 12:55 - 2017-07-07 00:44 - 000108896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2017-07-14 12:55 - 2017-07-07 00:42 - 007781720 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-07-14 12:55 - 2017-07-07 00:40 - 000376672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2017-07-14 12:55 - 2017-07-07 00:37 - 000468320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys
2017-07-14 12:55 - 2017-07-07 00:32 - 000404824 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2017-07-14 12:55 - 2017-07-07 00:29 - 002759712 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2017-07-14 12:55 - 2017-07-07 00:28 - 000223584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2017-07-14 12:55 - 2017-07-07 00:23 - 000241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHost.dll
2017-07-14 12:55 - 2017-07-07 00:19 - 000081408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2017-07-14 12:55 - 2017-07-07 00:18 - 001100120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys
2017-07-14 12:55 - 2017-07-07 00:18 - 000057400 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsass.exe
2017-07-14 12:55 - 2017-07-07 00:14 - 000270336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2017-07-14 12:55 - 2017-07-07 00:14 - 000126464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2017-07-14 12:55 - 2017-07-07 00:11 - 000340480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2017-07-14 12:55 - 2017-07-07 00:06 - 018364928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-07-14 12:55 - 2017-07-07 00:05 - 019414528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-07-14 12:55 - 2017-07-07 00:00 - 012187136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2017-07-14 12:55 - 2017-07-06 23:57 - 000691712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2017-07-14 12:55 - 2017-07-06 23:56 - 006035456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-07-14 12:55 - 2017-07-06 23:55 - 003664896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2017-07-14 12:55 - 2017-07-06 23:54 - 002027008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2017-07-14 12:55 - 2017-07-06 23:51 - 022569984 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-07-14 12:55 - 2017-07-06 23:49 - 000115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bridge.sys
2017-07-14 12:55 - 2017-07-06 23:48 - 000071680 _____ (Microsoft Corporation) C:\WINDOWS\system32\l2gpstore.dll
2017-07-14 12:55 - 2017-07-06 23:48 - 000030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapprovp.dll
2017-07-14 12:55 - 2017-07-06 23:46 - 000231424 _____ (Microsoft Corporation) C:\WINDOWS\system32\shutdownux.dll
2017-07-14 12:55 - 2017-07-06 23:46 - 000052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpipreg.sys
2017-07-14 12:55 - 2017-07-06 23:45 - 000276992 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2017-07-14 12:55 - 2017-07-06 23:45 - 000223744 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2017-07-14 12:55 - 2017-07-06 23:44 - 000502784 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll
2017-07-14 12:55 - 2017-07-06 23:44 - 000238592 _____ (Microsoft Corporation) C:\WINDOWS\system32\onex.dll
2017-07-14 12:55 - 2017-07-06 23:44 - 000139264 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2017-07-14 12:55 - 2017-07-06 23:44 - 000137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\raschap.dll
2017-07-14 12:55 - 2017-07-06 23:43 - 001081856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2017-07-14 12:55 - 2017-07-06 23:43 - 000431616 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpAXHolder.dll
2017-07-14 12:55 - 2017-07-06 23:43 - 000387584 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2017-07-14 12:55 - 2017-07-06 23:43 - 000088576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2017-07-14 12:55 - 2017-07-06 23:42 - 000805888 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2017-07-14 12:55 - 2017-07-06 23:39 - 000282624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2017-07-14 12:55 - 2017-07-06 23:36 - 000369664 _____ (Microsoft Corporation) C:\WINDOWS\system32\msinfo32.exe
2017-07-14 12:55 - 2017-07-06 23:35 - 001397760 _____ (Microsoft Corporation) C:\WINDOWS\system32\wdc.dll
2017-07-14 12:55 - 2017-07-06 23:33 - 000576000 _____ (Microsoft® Windows® Operating System) C:\WINDOWS\system32\wvc.dll
2017-07-14 12:55 - 2017-07-06 23:31 - 023676416 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-07-14 12:55 - 2017-07-06 23:30 - 013090816 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2017-07-14 12:55 - 2017-07-06 23:29 - 000932864 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2017-07-14 12:55 - 2017-07-06 23:28 - 002096640 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2017-07-14 12:55 - 2017-07-06 23:28 - 000759296 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2017-07-14 12:55 - 2017-07-06 23:28 - 000589312 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2017-07-14 12:55 - 2017-07-06 23:27 - 008120832 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-07-14 12:55 - 2017-07-06 23:24 - 004744704 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2017-07-14 12:55 - 2017-07-06 23:24 - 002895872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2017-07-14 12:55 - 2017-07-06 23:24 - 001783296 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2017-07-14 12:55 - 2017-07-06 23:24 - 001513472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2017-07-14 12:55 - 2017-07-06 23:22 - 001826816 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2017-07-14 12:55 - 2017-06-21 00:54 - 000603488 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContentDeliveryManager.Utilities.dll
2017-07-14 12:55 - 2017-06-21 00:52 - 001886344 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2017-07-14 12:55 - 2017-06-21 00:51 - 002255712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2017-07-14 12:55 - 2017-06-21 00:51 - 000434528 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2017-07-14 12:55 - 2017-06-21 00:50 - 000126304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mup.sys
2017-07-14 12:55 - 2017-06-21 00:48 - 002681200 _____ C:\WINDOWS\system32\CoreUIComponents.dll
2017-07-14 12:55 - 2017-06-21 00:40 - 001069720 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2017-07-14 12:55 - 2017-06-21 00:40 - 000328008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2017-07-14 12:55 - 2017-06-21 00:38 - 001860288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2017-07-14 12:55 - 2017-06-21 00:38 - 001738560 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2017-07-14 12:55 - 2017-06-21 00:37 - 001369240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcomp.dll
2017-07-14 12:55 - 2017-06-21 00:37 - 001157008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2017-07-14 12:55 - 2017-06-21 00:31 - 001277824 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2017-07-14 12:55 - 2017-06-21 00:31 - 000160096 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHostBroker.dll
2017-07-14 12:55 - 2017-06-21 00:26 - 000387864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpps.dll
2017-07-14 12:55 - 2017-06-21 00:06 - 000372736 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXTaskFactory.dll
2017-07-14 12:55 - 2017-06-21 00:04 - 001631232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll
2017-07-14 12:55 - 2017-06-21 00:02 - 000030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\odbcconf.dll
2017-07-14 12:55 - 2017-06-21 00:01 - 000185344 _____ (Microsoft Corporation) C:\WINDOWS\system32\DisplayManager.dll
2017-07-14 12:55 - 2017-06-21 00:01 - 000015872 _____ (Microsoft Corporation) C:\WINDOWS\system32\snmptrap.exe
2017-07-14 12:55 - 2017-06-21 00:00 - 000233984 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvisioningHandlers.dll
2017-07-14 12:55 - 2017-06-21 00:00 - 000113664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.ServiceDiscovery.Dnssd.dll
2017-07-14 12:55 - 2017-06-20 23:59 - 000182272 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceDirectoryClient.dll
2017-07-14 12:55 - 2017-06-20 23:58 - 000418304 _____ C:\WINDOWS\system32\Windows.Perception.Stub.dll
2017-07-14 12:55 - 2017-06-20 23:58 - 000211968 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2017-07-14 12:55 - 2017-06-20 23:58 - 000144896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dfsc.sys
2017-07-14 12:55 - 2017-06-20 23:57 - 000505856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.WiFiDirect.dll
2017-07-14 12:55 - 2017-06-20 23:57 - 000418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll
2017-07-14 12:55 - 2017-06-20 23:57 - 000243712 _____ (Microsoft Corporation) C:\WINDOWS\system32\credprovhost.dll
2017-07-14 12:55 - 2017-06-20 23:57 - 000171520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.SerialCommunication.dll
2017-07-14 12:55 - 2017-06-20 23:57 - 000144896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Lights.dll
2017-07-14 12:55 - 2017-06-20 23:56 - 000912384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.SmartCards.dll
2017-07-14 12:55 - 2017-06-20 23:56 - 000748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2017-07-14 12:55 - 2017-06-20 23:56 - 000719872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdiWiFi.sys
2017-07-14 12:55 - 2017-06-20 23:56 - 000590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\efswrt.dll
2017-07-14 12:55 - 2017-06-20 23:56 - 000568320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.LowLevel.dll
2017-07-14 12:55 - 2017-06-20 23:56 - 000260608 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe
2017-07-14 12:55 - 2017-06-20 23:56 - 000216576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Scanners.dll
2017-07-14 12:55 - 2017-06-20 23:55 - 000310784 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncSettings.dll
2017-07-14 12:55 - 2017-06-20 23:55 - 000252416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Identity.Provider.dll
2017-07-14 12:55 - 2017-06-20 23:54 - 000949248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.PointOfService.dll
2017-07-14 12:55 - 2017-06-20 23:54 - 000671744 _____ (Microsoft Corporation) C:\WINDOWS\system32\mbsmsapi.dll
2017-07-14 12:55 - 2017-06-20 23:54 - 000472064 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Bluetooth.dll
2017-07-14 12:55 - 2017-06-20 23:54 - 000337408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Picker.dll
2017-07-14 12:55 - 2017-06-20 23:53 - 000437248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Usb.dll
2017-07-14 12:55 - 2017-06-20 23:53 - 000425984 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll
2017-07-14 12:55 - 2017-06-20 23:53 - 000339968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Graphics.dll
2017-07-14 12:55 - 2017-06-20 23:52 - 017198592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2017-07-14 12:55 - 2017-06-20 23:52 - 000410112 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevicesFlowBroker.dll
2017-07-14 12:55 - 2017-06-20 23:52 - 000352256 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsDocumentTargetPrint.dll
2017-07-14 12:55 - 2017-06-20 23:51 - 000634368 _____ (Microsoft Corporation) C:\WINDOWS\system32\StructuredQuery.dll
2017-07-14 12:55 - 2017-06-20 23:50 - 000661504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
2017-07-14 12:55 - 2017-06-20 23:49 - 002104320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
2017-07-14 12:55 - 2017-06-20 23:49 - 001403392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Editing.dll
2017-07-14 12:55 - 2017-06-20 23:49 - 000169984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Energy.dll
2017-07-14 12:55 - 2017-06-20 23:47 - 001105408 _____ (Microsoft Corporation) C:\WINDOWS\system32\MiracastReceiver.dll
2017-07-14 12:55 - 2017-06-20 23:47 - 000442368 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToDevice.dll
2017-07-14 12:55 - 2017-06-20 23:46 - 000187904 _____ (Microsoft Corporation) C:\WINDOWS\system32\dialclient.dll
2017-07-14 12:55 - 2017-06-20 23:44 - 000588288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidprov.dll
2017-07-14 12:55 - 2017-06-20 23:43 - 000130560 _____ (Microsoft Corporation) C:\WINDOWS\system32\SpaceAgent.exe
2017-07-14 12:55 - 2017-06-20 23:42 - 000981504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll
2017-07-14 12:55 - 2017-06-20 23:42 - 000539136 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToManager.dll
2017-07-14 12:55 - 2017-06-20 23:42 - 000467968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Geolocation.dll
2017-07-14 12:55 - 2017-06-20 23:42 - 000079360 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationFrameworkInternalPS.dll
2017-07-14 12:55 - 2017-06-20 23:41 - 000945664 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
2017-07-14 12:55 - 2017-06-20 23:41 - 000913920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.dll
2017-07-14 12:55 - 2017-06-20 23:40 - 004474368 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll
2017-07-14 12:55 - 2017-06-20 23:40 - 001891328 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnidui.dll
2017-07-14 12:55 - 2017-06-20 23:39 - 002208768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Graphics.Printing.3D.dll
2017-07-14 12:55 - 2017-06-20 23:39 - 000971264 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll
2017-07-14 12:55 - 2017-06-20 23:38 - 005611008 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll
2017-07-14 12:55 - 2017-06-20 23:38 - 002695680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2017-07-14 12:55 - 2017-06-20 23:38 - 001275392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Bluetooth.dll
2017-07-14 12:55 - 2017-06-20 23:38 - 000908800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2017-07-14 12:55 - 2017-06-20 23:37 - 000875520 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2017-07-14 12:55 - 2017-06-20 23:37 - 000774656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.dll
2017-07-14 12:55 - 2017-06-20 23:37 - 000735744 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2017-07-14 12:55 - 2017-06-20 23:36 - 000701952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.Connectivity.dll
2017-07-14 12:55 - 2017-06-20 23:35 - 001328640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.Http.dll
2017-07-14 12:55 - 2017-06-20 23:35 - 000924672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.dll
2017-07-14 12:55 - 2017-06-20 23:34 - 001121280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll
2017-07-14 12:55 - 2017-06-20 23:34 - 000035328 _____ (Microsoft Corporation) C:\WINDOWS\system32\spaceman.exe
2017-07-14 12:55 - 2017-06-20 23:33 - 000048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\tlscsp.dll
2017-07-14 12:55 - 2017-03-03 23:28 - 000279552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.HumanInterfaceDevice.dll
2017-07-14 12:55 - 2017-03-03 23:23 - 001145856 _____ (Microsoft Corporation) C:\WINDOWS\system32\EmailApis.dll
2017-07-14 12:55 - 2017-03-03 23:20 - 000800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2017-07-14 12:55 - 2017-03-03 23:19 - 001589760 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtctm.dll
2017-07-14 12:55 - 2017-03-03 23:14 - 000279552 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToReceiver.dll
2017-07-14 12:55 - 2016-10-14 20:45 - 001790464 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationFramework.dll
2017-07-14 12:55 - 2016-08-26 22:12 - 000244816 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2017-07-14 12:54 - 2017-07-07 00:23 - 001600624 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2017-07-14 12:54 - 2017-07-06 23:58 - 007217152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2017-07-14 12:54 - 2017-07-06 23:47 - 000201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\ScDeviceEnum.dll
2017-07-14 12:54 - 2017-07-06 23:45 - 000488960 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupShim.dll
2017-07-14 12:54 - 2017-07-06 23:45 - 000289792 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeveloperOptionsSettingsHandlers.dll
2017-07-14 12:54 - 2017-07-06 23:44 - 000193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\certprop.dll
2017-07-14 12:54 - 2017-07-06 23:44 - 000147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll
2017-07-14 12:54 - 2017-07-06 23:42 - 000352256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wldap32.dll
2017-07-14 12:54 - 2017-07-06 23:34 - 009131008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2017-07-14 12:54 - 2017-07-06 23:29 - 004749824 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2017-07-14 12:54 - 2017-07-06 23:28 - 000927744 _____ (Microsoft Corporation) C:\WINDOWS\system32\SmartcardCredentialProvider.dll
2017-07-14 12:54 - 2017-07-06 23:25 - 004708864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
2017-07-14 12:54 - 2017-07-06 23:24 - 005388800 _____ (Microsoft) C:\WINDOWS\system32\dbgeng.dll
2017-07-14 12:54 - 2017-07-06 23:24 - 003615744 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-07-14 12:54 - 2017-07-06 23:24 - 002217472 _____ (Microsoft Corporation) C:\WINDOWS\system32\OpcServices.dll
2017-07-14 12:54 - 2017-06-21 00:47 - 000764392 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2017-07-14 12:54 - 2017-06-21 00:40 - 000224096 _____ (Microsoft Corporation) C:\WINDOWS\system32\ifsutil.dll
2017-07-14 12:54 - 2017-06-21 00:37 - 002446704 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2017-07-14 12:54 - 2017-06-21 00:37 - 000146784 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHostCommon.dll
2017-07-14 12:54 - 2017-06-21 00:36 - 000624048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2017-07-14 12:54 - 2017-06-21 00:35 - 002915704 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2017-07-14 12:54 - 2017-06-21 00:35 - 001267512 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll
2017-07-14 12:54 - 2017-06-21 00:31 - 004674360 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2017-07-14 12:54 - 2017-06-21 00:03 - 000167936 _____ (Microsoft Corporation) C:\WINDOWS\system32\uudf.dll
2017-07-14 12:54 - 2017-06-21 00:02 - 000124416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.System.SystemManagement.dll
2017-07-14 12:54 - 2017-06-21 00:01 - 000156160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Family.Client.dll
2017-07-14 12:54 - 2017-06-21 00:01 - 000108032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Family.Authentication.dll
2017-07-14 12:54 - 2017-06-21 00:00 - 000259072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Family.SyncEngine.dll
2017-07-14 12:54 - 2017-06-21 00:00 - 000224256 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_SignInOptions.dll
2017-07-14 12:54 - 2017-06-21 00:00 - 000193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.WiFi.dll
2017-07-14 12:54 - 2017-06-21 00:00 - 000148480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.System.Profile.RetailInfo.dll
2017-07-14 12:54 - 2017-06-21 00:00 - 000082432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.System.UserDeviceAssociation.dll
2017-07-14 12:54 - 2017-06-21 00:00 - 000073216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryBroker.dll
2017-07-14 12:54 - 2017-06-20 23:59 - 000196096 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDeviceRegistration.dll
2017-07-14 12:54 - 2017-06-20 23:59 - 000136192 _____ (Microsoft Corporation) C:\WINDOWS\system32\sendmail.dll
2017-07-14 12:54 - 2017-06-20 23:59 - 000122880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryClient.dll
2017-07-14 12:54 - 2017-06-20 23:59 - 000101888 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDeviceRegistration.Ngc.dll
2017-07-14 12:54 - 2017-06-20 23:59 - 000082944 _____ (Microsoft Corporation) C:\WINDOWS\system32\KdsCli.dll
2017-07-14 12:54 - 2017-06-20 23:58 - 000547840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Gaming.Input.dll
2017-07-14 12:54 - 2017-06-20 23:58 - 000257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudDomainJoinDataModelServer.dll
2017-07-14 12:54 - 2017-06-20 23:58 - 000224768 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpd_ci.dll
2017-07-14 12:54 - 2017-06-20 23:58 - 000186368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Radios.dll
2017-07-14 12:54 - 2017-06-20 23:57 - 000651264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.AllJoyn.dll
2017-07-14 12:54 - 2017-06-20 23:57 - 000157696 _____ (Microsoft Corporation) C:\WINDOWS\system32\XamlTileRender.dll
2017-07-14 12:54 - 2017-06-20 23:57 - 000087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdbusenum.dll
2017-07-14 12:54 - 2017-06-20 23:56 - 000852480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Import.dll
2017-07-14 12:54 - 2017-06-20 23:56 - 000379904 _____ (Microsoft Corporation) C:\WINDOWS\system32\apprepsync.dll
2017-07-14 12:54 - 2017-06-20 23:56 - 000324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2017-07-14 12:54 - 2017-06-20 23:56 - 000268800 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserMgrProxy.dll
2017-07-14 12:54 - 2017-06-20 23:56 - 000267264 _____ (Microsoft Corporation) C:\WINDOWS\system32\vaultcli.dll
2017-07-14 12:54 - 2017-06-20 23:55 - 000407552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Management.dll
2017-07-14 12:54 - 2017-06-20 23:55 - 000176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\apprepapi.dll
2017-07-14 12:54 - 2017-06-20 23:54 - 000247808 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExecModelClient.dll
2017-07-14 12:54 - 2017-06-20 23:54 - 000168960 _____ (Microsoft Corporation) C:\WINDOWS\system32\easwrt.dll
2017-07-14 12:54 - 2017-06-20 23:53 - 001010176 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2017-07-14 12:54 - 2017-06-20 23:53 - 000329728 _____ (Microsoft Corporation) C:\WINDOWS\system32\deviceaccess.dll
2017-07-14 12:54 - 2017-06-20 23:52 - 000956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2017-07-14 12:54 - 2017-06-20 23:52 - 000896512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.AccountsControl.dll
2017-07-14 12:54 - 2017-06-20 23:52 - 000775168 _____ (Microsoft Corporation) C:\WINDOWS\system32\GamePanel.exe
2017-07-14 12:54 - 2017-06-20 23:52 - 000560128 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppReadiness.dll
2017-07-14 12:54 - 2017-06-20 23:51 - 000410112 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2017-07-14 12:54 - 2017-06-20 23:50 - 001054208 _____ (Microsoft Corporation) C:\WINDOWS\system32\qmgr.dll
2017-07-14 12:54 - 2017-06-20 23:49 - 001913856 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_fs.dll
2017-07-14 12:54 - 2017-06-20 23:49 - 001584128 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_health.dll
2017-07-14 12:54 - 2017-06-20 23:48 - 000968192 _____ (Microsoft Corporation) C:\WINDOWS\system32\autochk.exe
2017-07-14 12:54 - 2017-06-20 23:48 - 000112640 _____ (Microsoft Corporation) C:\WINDOWS\system32\uexfat.dll
2017-07-14 12:54 - 2017-06-20 23:47 - 000574976 _____ (Microsoft Corporation) C:\WINDOWS\system32\untfs.dll
2017-07-14 12:54 - 2017-06-20 23:47 - 000152064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ufat.dll
2017-07-14 12:54 - 2017-06-20 23:47 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\fdProxy.dll
2017-07-14 12:54 - 2017-06-20 23:46 - 003290112 _____ (Microsoft Corporation) C:\WINDOWS\system32\mispace.dll
2017-07-14 12:54 - 2017-06-20 23:46 - 000925184 _____ (Microsoft Corporation) C:\WINDOWS\system32\autofmt.exe
2017-07-14 12:54 - 2017-06-20 23:46 - 000516608 _____ (Microsoft Corporation) C:\WINDOWS\system32\uReFSv1.dll
2017-07-14 12:54 - 2017-06-20 23:46 - 000039424 _____ (Microsoft Corporation) C:\WINDOWS\system32\cnvfat.dll
2017-07-14 12:54 - 2017-06-20 23:45 - 002861056 _____ (Microsoft Corporation) C:\WINDOWS\system32\storagewmi.dll
2017-07-14 12:54 - 2017-06-20 23:44 - 000167936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ErrorDetails.dll
2017-07-14 12:54 - 2017-06-20 23:43 - 000961536 _____ (Microsoft Corporation) C:\WINDOWS\system32\imapi2fs.dll
2017-07-14 12:54 - 2017-06-20 23:43 - 000953344 _____ (Microsoft Corporation) C:\WINDOWS\system32\autoconv.exe
2017-07-14 12:54 - 2017-06-20 23:43 - 000628736 _____ (Microsoft Corporation) C:\WINDOWS\system32\uReFS.dll
2017-07-14 12:54 - 2017-06-20 23:42 - 000139776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Devices.dll
2017-07-14 12:54 - 2017-06-20 23:41 - 002279424 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2017-07-14 12:54 - 2017-06-20 23:41 - 001692160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2017-07-14 12:54 - 2017-06-20 23:41 - 001359872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModel.dll
2017-07-14 12:54 - 2017-06-20 23:41 - 001021440 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll
2017-07-14 12:54 - 2017-06-20 23:41 - 000460800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Midi.dll
2017-07-14 12:54 - 2017-06-20 23:40 - 001586176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2017-07-14 12:54 - 2017-06-20 23:40 - 001421824 _____ (Microsoft Corporation) C:\WINDOWS\system32\certutil.exe
2017-07-14 12:54 - 2017-06-20 23:40 - 000886784 _____ (Microsoft Corporation) C:\WINDOWS\system32\CPFilters.dll
2017-07-14 12:54 - 2017-06-20 23:40 - 000376832 _____ (Microsoft Corporation) C:\WINDOWS\system32\CryptoWinRT.dll
2017-07-14 12:54 - 2017-06-20 23:39 - 002916864 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertEnroll.dll
2017-07-14 12:54 - 2017-06-20 23:39 - 001643008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll
2017-07-14 12:54 - 2017-06-20 23:39 - 001490432 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2017-07-14 12:54 - 2017-06-20 23:39 - 000673792 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2017-07-14 12:54 - 2017-06-20 23:37 - 000716800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ShareHost.dll
2017-07-14 12:54 - 2017-06-20 23:36 - 002318848 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2017-07-14 12:54 - 2017-06-20 23:36 - 000881152 _____ (Microsoft Corporation) C:\WINDOWS\system32\MsSpellCheckingFacility.dll
2017-07-14 12:54 - 2017-06-20 23:36 - 000180224 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
2017-07-14 12:54 - 2017-06-20 23:35 - 001726976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
2017-07-14 12:54 - 2017-03-03 23:27 - 000391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleacc.dll
2017-07-14 12:54 - 2016-10-05 02:32 - 000146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\AuthBroker.dll
2017-07-13 22:57 - 2017-08-06 15:53 - 000000000 ____D C:\Users\yosef\Desktop\Renewal of O1
2017-07-12 22:41 - 2017-07-12 22:41 - 000000000 ____D C:\Program Files\WinRAR
2017-07-12 22:40 - 2017-07-12 22:40 - 000000000 ____D C:\Program Files\Mozilla Firefox
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-08-07 22:28 - 2015-09-14 17:29 - 000000000 ____D C:\Users\yosef\Documents\YouCam
2017-08-07 22:25 - 2016-09-20 12:33 - 000000000 ___RD C:\Users\yosef\Google Drive
2017-08-07 22:23 - 2016-09-26 03:07 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-08-07 22:23 - 2016-09-26 02:37 - 000000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2017-08-07 22:23 - 2015-09-14 17:28 - 000000000 __SHD C:\Users\yosef\IntelGraphicsProfiles
2017-08-07 22:22 - 2016-07-15 23:04 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2017-08-07 22:07 - 2016-09-26 02:42 - 000000000 ____D C:\Users\yosef
2017-08-07 21:42 - 2016-09-26 02:34 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2017-08-07 16:30 - 2016-07-16 04:47 - 000000000 ____D C:\WINDOWS\AppReadiness
2017-08-07 16:29 - 2016-07-16 04:47 - 000000000 ____D C:\WINDOWS\system32\FxsTmp
2017-08-06 13:17 - 2016-07-16 04:47 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2017-08-04 20:53 - 2017-03-13 19:26 - 000000364 _____ C:\WINDOWS\Tasks\HPCeeScheduleForyosef.job
2017-08-04 19:50 - 2015-09-20 12:08 - 000000000 ____D C:\Users\yosef\Desktop\Quotes
2017-08-04 19:28 - 2017-03-13 19:26 - 000003256 _____ C:\WINDOWS\System32\Tasks\HPCeeScheduleForyosef
2017-08-04 12:06 - 2016-07-16 04:47 - 000000000 ___HD C:\Program Files\WindowsApps
2017-08-03 15:42 - 2015-07-21 17:31 - 000000000 ____D C:\Program Files\mcafee
2017-08-03 13:17 - 2016-07-16 04:47 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-08-03 13:15 - 2015-09-15 10:43 - 000000000 ____D C:\Program Files\Microsoft Office 15
2017-08-03 13:13 - 2015-07-21 17:31 - 000000000 ____D C:\ProgramData\mcafee
2017-08-03 13:13 - 2015-07-21 17:31 - 000000000 ____D C:\Program Files\Common Files\McAfee
2017-08-03 13:11 - 2016-07-16 04:47 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2017-08-03 13:09 - 2016-09-26 03:07 - 000003126 _____ C:\WINDOWS\System32\Tasks\McAfeeLogon
2017-08-03 13:07 - 2016-09-26 03:07 - 000000000 ____D C:\WINDOWS\System32\Tasks\McAfee
2017-08-01 17:48 - 2016-07-16 04:45 - 000000000 ____D C:\WINDOWS\INF
2017-07-31 23:55 - 2016-07-15 23:04 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2017-07-31 18:48 - 2017-06-23 01:12 - 000000000 ____D C:\Users\yosef\Desktop\Health Rsc
2017-07-31 17:01 - 2016-09-20 12:31 - 000000000 ____D C:\Users\yosef\AppData\Local\Google
2017-07-31 17:01 - 2016-09-20 12:31 - 000000000 ____D C:\Program Files (x86)\Google
2017-07-31 17:00 - 2016-09-26 03:07 - 000003416 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2017-07-31 17:00 - 2016-09-26 03:07 - 000003292 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2017-07-30 15:20 - 2015-10-30 00:24 - 000000000 ____D C:\WINDOWS\system32\Tasks_Migrated
2017-07-30 00:55 - 2015-09-14 17:33 - 000000000 ___RD C:\Users\yosef\OneDrive
2017-07-29 13:56 - 2016-05-12 15:24 - 000000008 __RSH C:\ProgramData\ntuser.pol
2017-07-29 13:19 - 2015-07-21 17:36 - 000002170 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Priceline.com.lnk
2017-07-29 13:15 - 2016-07-16 04:47 - 000000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy
2017-07-29 13:15 - 2015-07-10 04:04 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy
2017-07-29 12:48 - 2015-11-30 14:06 - 000000000 ____D C:\Users\yosef\AppData\Roaming\Dashlane
2017-07-29 12:47 - 2015-09-14 17:28 - 000000000 ____D C:\Users\yosef\AppData\Local\Packages
2017-07-22 00:16 - 2016-11-19 21:39 - 000000000 ____D C:\Users\yosef\Desktop\Agents & Managers
2017-07-19 10:15 - 2016-12-15 23:48 - 000000000 ____D C:\Users\yosef\Desktop\Headshots
2017-07-17 14:11 - 2016-07-16 04:47 - 000000000 ____D C:\WINDOWS\rescache
2017-07-15 11:57 - 2016-09-26 02:41 - 001557236 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-07-15 11:56 - 2015-07-15 23:05 - 000000000 __RHD C:\Users\Public\AccountPictures
2017-07-15 11:49 - 2016-09-26 02:34 - 000356848 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-07-14 22:52 - 2016-07-16 04:47 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-07-14 22:52 - 2016-07-16 04:47 - 000000000 ____D C:\WINDOWS\system32\oobe
2017-07-14 22:52 - 2016-07-16 04:47 - 000000000 ____D C:\WINDOWS\system32\appraiser
2017-07-14 22:52 - 2016-07-16 04:47 - 000000000 ____D C:\WINDOWS\ShellExperiences
2017-07-14 22:52 - 2016-07-16 04:47 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2017-07-14 22:52 - 2016-07-16 04:47 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2017-07-14 13:10 - 2016-07-16 04:36 - 000000000 ____D C:\WINDOWS\CbsTemp
2017-07-14 13:02 - 2015-09-14 20:52 - 000000000 ____D C:\WINDOWS\system32\MRT
2017-07-14 12:59 - 2015-09-14 20:52 - 135225752 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-07-14 12:21 - 2016-07-16 04:43 - 000157696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\enrollmentapi.dll
2017-07-14 12:00 - 2016-03-18 18:03 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-07-13 20:31 - 2015-09-19 15:00 - 000000000 ____D C:\Users\yosef\Desktop\O1 -Supporting Documents
2017-07-12 22:41 - 2016-05-12 15:26 - 000000000 ____D C:\Users\yosef\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-07-12 22:41 - 2016-05-12 15:26 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-07-12 22:41 - 2016-03-18 18:03 - 000001012 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-07-12 22:41 - 2016-03-18 18:03 - 000001000 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2017-07-12 22:39 - 2017-04-17 22:33 - 000001106 _____ C:\Users\Public\Desktop\VLC media player.lnk
2017-07-12 13:11 - 2015-09-15 18:36 - 000000000 ____D C:\Users\yosef\AppData\Roaming\Skype
2017-07-11 14:49 - 2017-04-18 12:51 - 000170298 _____ C:\Users\yosef\Desktop\Yosef Podolski - Resume.pdf
2017-07-08 11:09 - 2017-05-20 18:47 - 000000000 ____D C:\Users\yosef\Desktop\Acting Reel - May 2017
2017-07-08 10:04 - 2015-11-06 16:04 - 000000000 ____D C:\Users\yosef\AppData\Roaming\CyberLink
2017-07-08 10:03 - 2015-07-21 17:38 - 000000000 ____D C:\ProgramData\CyberLink
==================== Files in the root of some directories =======
2016-05-12 16:25 - 2016-09-14 00:30 - 000000180 _____ () C:\Users\yosef\AppData\Roaming\WB.CFG
2017-05-17 11:32 - 2017-05-17 11:32 - 000125952 _____ () C:\Users\yosef\AppData\Local\report
2015-09-19 11:44 - 2015-09-19 11:44 - 000004105 _____ () C:\ProgramData\wmzddnmb.cix
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2017-08-07 16:52
==================== End of FRST.txt ============================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-08-2017
Ran by [removed] (07-08-2017 22:38:24)
Running from C:\Users\[removed]\Desktop
Windows 10 Home Version 1607 (X64) (2016-09-26 10:27:16)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================
Administrator (S-1-5-21-182178435-2925743980-1085802887-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-182178435-2925743980-1085802887-503 - Limited - Disabled)
Guest (S-1-5-21-182178435-2925743980-1085802887-501 - Limited - Disabled)
yosef (S-1-5-21-182178435-2925743980-1085802887-1001 - Administrator - Enabled) => C:\Users\yosef
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: McAfee VirusScan (Enabled - Up to date) {8BCDACFA-D264-3528-5EF8-E94FD0BC1FBC}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: McAfee VirusScan (Enabled - Up to date) {30AC4D1E-F45E-3AA6-6448-D23DAB3B5501}
FW: McAfee Firewall (Enabled) {B3F62DDF-980B-3470-75A7-407A2E6F58C7}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
12 Labours of Hercules III: Girl Power (HKLM-x32\…\WTA-76751182-3748-4898-9b2c-2e90377d4935) (Version: 3.0.2.118 - WildTangent) Hidden
Adobe Shockwave Player 12.1 (HKLM-x32\…\Adobe Shockwave Player) (Version: 12.1.7.157 - Adobe Systems, Inc.)
Apple Application Support (32-bit) (HKLM-x32\…\{3540ADD5-822B-47FB-B1C2-CD7B2C8E9FEC}) (Version: 4.0.2 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\…\{C9C0FE2C-602E-49D7-8C42-5B9E8FF04798}) (Version: 4.0.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\…\{FD244E19-6EFE-4A2D-948A-0D45D4C168BE}) (Version: 9.0.0.26 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
Azkend 2: The World Beneath (HKLM-x32\…\WTA-9f75a07d-20f1-433e-b85e-073e239218c3) (Version: 2.2.0.98 - WildTangent) Hidden
Barn Yarn Collector's Edition (HKLM-x32\…\WTA-57ed38a0-dbd9-49c8-9ec7-f7061d1d8b6a) (Version: 3.0.2.48 - WildTangent) Hidden
Bonjour (HKLM\…\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Broadcom 802.11 Network Adapter (HKLM\…\Broadcom 802.11 Network Adapter) (Version:  - Broadcom Corporation)
Broadcom Bluetooth Drivers (HKLM\…\{0A1B4690-E176-4533-8058-939480AEE1D0}) (Version: 12.0.1.660 - Broadcom Corporation)
Coyote The Outlander (HKLM-x32\…\WTA-cf511337-9247-43e2-af11-399a371345fe) (Version: 3.0.2.59 - WildTangent) Hidden
CyberLink PhotoDirector (HKLM\…\{5A454EC5-217A-42a5-8CE1-2DDEC4E70E01}) (Version: 5.0.5.6713 - CyberLink Corp.) Hidden
CyberLink PhotoDirector (HKLM-x32\…\InstallShield_{5A454EC5-217A-42a5-8CE1-2DDEC4E70E01}) (Version: 5.0.5.6713 - CyberLink Corp.)
CyberLink Power Media Player 14 (HKLM-x32\…\{32C8E300-BDB4-4398-92C2-E9B7D8A233DB}) (Version: 14.0.1.5418 - CyberLink Corp.)
CyberLink PowerDirector 12 (HKLM\…\{E1646825-D391-42A0-93AA-27FA810DA093}) (Version: 12.0.4.4301 - CyberLink Corp.) Hidden
CyberLink PowerDirector 12 (HKLM-x32\…\InstallShield_{E1646825-D391-42A0-93AA-27FA810DA093}) (Version: 12.0.4.4301 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\…\{A9CEDD6E-4792-493e-BB35-D86D2E188A5A}) (Version: 6.0.1.4301 - CyberLink Corp.)
Delicious: Emily's Wonder Wedding Premium Edition (HKLM-x32\…\WTA-793d5787-4a3c-4f98-b5fb-673d9b3abf12) (Version: 3.0.2.59 - WildTangent) Hidden
DisableMSDefender (HKLM\…\{74FE39A0-FB76-47CD-84BA-91E2BBB17EF2}) (Version: 1.0.0 - Hewlett-Packard Company) Hidden
Dropbox 25 GB (HKLM-x32\…\{597A58EC-42D6-4940-8739-FB94491B013C}) (Version: 1.0.8.2 - Dropbox, Inc.)
Energy Star (HKLM\…\{465CA2B6-98AF-4E77-BE22-A908C34BB9EC}) (Version: 1.0.9 - Hewlett-Packard Company)
Entwined: The Perfect Murder (HKLM-x32\…\WTA-0e9bc4f8-6d2a-4190-ada3-b1251028a3b0) (Version: 3.0.2.59 - WildTangent) Hidden
EPSON XP-400 Series Printer Uninstall (HKLM\…\EPSON XP-400 Series) (Version:  - SEIKO EPSON Corporation)
Evernote v. 5.8.6 (HKLM-x32\…\{FEDC7C10-EF67-11E4-9B07-00505695D7B0}) (Version: 5.8.6.7519 - Evernote Corp.)
Family Vacation 2: Road Trip (HKLM-x32\…\WTA-1e934273-d7f5-4b7a-a48d-7d6b88282e1b) (Version: 3.0.2.59 - WildTangent) Hidden
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 60.0.3112.90 - Google Inc.)
Google Drive (HKLM-x32\…\{A1238426-ECDF-4639-BE2F-8D12A97AE23C}) (Version: 2.34.5075.1619 - Google, Inc.)
Google Talk Plugin (HKLM-x32\…\{F9B579C2-D854-300A-BE62-A09EB9D722E4}) (Version: 5.41.3.0 - Google)
Google Update Helper (HKLM-x32\…\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
Home Makeover (HKLM-x32\…\WTA-e752cb9b-7a63-420a-8731-f734d5eb96bc) (Version: 3.0.2.59 - WildTangent) Hidden
HP Documentation (HKLM\…\HP_Documentation) (Version:  - HP)
HP Registration Service (HKLM\…\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.8293.5264 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\…\{61EB474B-67A6-47F4-B1B7-386851BAB3D0}) (Version: 8.4.19.3 - Hewlett-Packard Company)
HP Support Solutions Framework (HKLM-x32\…\{D7D5F438-26EF-45AB-AB89-C476FBCF8584}) (Version: 12.7.27.15 - Hewlett-Packard Company)
HP System Event Utility (HKLM-x32\…\{8B4EE87E-6D40-4C91-B5E8-0DC77DC412F1}) (Version: 1.4.1 - Hewlett-Packard Company)
HP Welcome (HKLM\…\HPWelcome) (Version: 1.0 - Hewlett-Packard Company)
HP Wireless Button Driver (HKLM-x32\…\{EFA01423-3857-468C-B7B6-F30AA08E50BC}) (Version: 1.1.5.1 - Hewlett-Packard)
IGT Slots: Paradise Garden (HKLM-x32\…\WTA-2c63d50e-94ea-451b-934e-eb8deb930f60) (Version: 3.0.2.59 - WildTangent) Hidden
Imperial Island: Birth of an Empire (HKLM-x32\…\WTA-cff803f1-2ce3-4772-bcf3-5f12ef24633d) (Version: 3.0.2.59 - WildTangent) Hidden
Intel(R) Chipset Device Software (HKLM-x32\…\{a47edec4-fa11-4d02-b329-4424d0197af8}) (Version: 10.1.1.7 - Intel(R) Corporation) Hidden
Intel(R) Dynamic Platform and Thermal Framework (HKLM-x32\…\{654EE65D-FAA4-4EA6-8C07-DC94E6A304D4}) (Version: 8.1.10600.150 - Intel Corporation)
Intel(R) Management Engine Components (HKLM\…\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.0.0.1156 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4549 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\…\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 14.5.0.1081 - Intel Corporation)
iTunes (HKLM\…\{88509E20-3936-4D88-A1C0-B274C7BB5151}) (Version: 12.3.0.44 - Apple Inc.)
Jewel Match Snowscapes (HKLM-x32\…\WTA-7a8e062b-3597-40c2-8579-84ca06953def) (Version: 3.0.2.118 - WildTangent) Hidden
Living Legends: Frozen Beauty Collector's Edition (HKLM-x32\…\WTA-fc0d8f3c-b6ff-4736-ba7a-91da30926247) (Version: 3.0.2.59 - WildTangent) Hidden
Lost Lands: Dark Overlord Collector's Edition (HKLM-x32\…\WTA-7288a8d7-d139-41e8-98b6-a9339f31b5ed) (Version: 3.0.2.59 - WildTangent) Hidden
Lost Souls: Timeless Fables Collector's Edition (HKLM-x32\…\WTA-6d5ca6d9-18c2-4dbc-adeb-a3a864014469) (Version: 3.0.2.59 - WildTangent) Hidden
Magic Heroes: Save Our Park (HKLM-x32\…\WTA-b228589f-9c01-448b-8783-b4a680393483) (Version: 3.0.2.59 - WildTangent) Hidden
Manor Memoirs Collector's Edition (HKLM-x32\…\WTA-fc29eb53-639f-4dba-8a10-091ebf6b71e9) (Version: 3.0.2.59 - WildTangent) Hidden
McAfee LiveSafe (HKLM-x32\…\MSC) (Version: 16.0.1 - McAfee, Inc.)
Microsoft Office 365 - en-us (HKLM\…\O365HomePremRetail - en-us) (Version: 15.0.4953.1001 - Microsoft Corporation)
Microsoft Office Word 2007 (HKLM-x32\…\WORD) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\…\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\…\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Preview Redistributable (x64) - 12.0.20617 (HKLM-x32\…\{448652c1-f5f3-4230-98c6-68c10c88b1fb}) (Version: 12.0.20617.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\…\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Movavi Video Editor 10 (HKLM-x32\…\Movavi Video Editor 10) (Version: 10.3.0 - Movavi)
Movavi Video Editor 12 (HKLM-x32\…\Movavi Video Editor 12) (Version: 12.5.1 - Movavi)
Mozilla Firefox 45.0 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 45.0 (x86 en-US)) (Version: 45.0 - Mozilla)
Mozilla Firefox 54.0 (x64 en-US) (HKLM\…\Mozilla Firefox 54.0 (x64 en-US)) (Version: 54.0 - Mozilla)
Mozilla Maintenance Service (HKLM\…\MozillaMaintenanceService) (Version: 54.0 - Mozilla)
Mystery Expedition: Prisoners of Ice (HKLM-x32\…\WTA-3fe90593-1a24-44c2-9f8b-86c44393f858) (Version: 3.0.2.59 - WildTangent) Hidden
Office 15 Click-to-Run Extensibility Component (HKLM-x32\…\{90150000-008C-0000-0000-0000000FF1CE}) (Version: 15.0.4953.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (HKLM\…\{90150000-008F-0000-1000-0000000FF1CE}) (Version: 15.0.4953.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (HKLM-x32\…\{90150000-008C-0409-0000-0000000FF1CE}) (Version: 15.0.4953.1001 - Microsoft Corporation) Hidden
Plagiarii (HKLM-x32\…\WTA-60a65df8-48a2-4111-9fe0-551199cf889e) (Version: 3.0.2.59 - WildTangent) Hidden
Polar Bowler 1st Frame (HKLM-x32\…\WTA-cac33129-b6f6-4681-9ec3-15be5fb54d4d) (Version: 3.0.2.59 - WildTangent) Hidden
Realtek Card Reader (HKLM-x32\…\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.31213 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.1.505.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7944 - Realtek Semiconductor Corp.)
Revo Uninstaller 2.0.3 (HKLM\…\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.3 - VS Revo Group, Ltd.)
Revo Uninstaller Pro 3.1.9 (HKLM\…\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.1.9 - VS Revo Group, Ltd.)
Runefall (HKLM-x32\…\WTA-29505306-8974-4f8d-adda-167c316ca56d) (Version: 3.0.2.126 - WildTangent) Hidden
Rush Hour! Gas Station (HKLM-x32\…\WTA-57bb1ec7-8c64-4249-bc66-243dd49246c3) (Version: 3.0.2.59 - WildTangent) Hidden
Sky High Farm (HKLM-x32\…\WTA-f25c1209-e55c-470d-91fe-69545a39bc29) (Version: 3.0.2.59 - WildTangent) Hidden
Skype™ 7.37 (HKLM-x32\…\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.37.103 - Skype Technologies S.A.)
swMSM (HKLM-x32\…\{612C34C7-5E90-47D8-9B5C-0F717DD82726}) (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\…\SynTPDeinstKey) (Version: 19.3.11.45 - Synaptics Incorporated)
Update Installer for WildTangent Games App (HKLM-x32\…\{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App) (Version:  - WildTangent) Hidden
VLC media player (HKLM-x32\…\VLC media player) (Version: 2.2.6 - VideoLAN)
WildTangent Games (HKLM-x32\…\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App for HP (HKLM-x32\…\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-hp) (Version: 4.0.11.16 - WildTangent) Hidden
Windows 10 Update and Privacy Settings (HKLM\…\{4DFCD818-036A-4229-A67D-CF17DC461D92}) (Version: 1.0.14.0 - Microsoft Corporation)
WinRAR 5.30 beta 6 (32-bit) (HKLM-x32\…\WinRAR archiver) (Version: 5.30.6 - win.rar GmbH)
WinRAR 5.40 (64-bit) (HKLM\…\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
WPS Office (9.1.0.5113) (HKLM-x32\…\Kingsoft Office) (Version: 9.1.0.5113 - Kingsoft Corp.)
Zemana AntiMalware (HKLM-x32\…\{8F0CD7D1-42F3-4195-95CD-833578D45057}_is1) (Version: 2.74.0.76 - Zemana Ltd.)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-182178435-2925743980-1085802887-1001_Classes\CLSID\{144DF3B2-2402-47AE-9583-5A045929A8D4}\InprocServer32 -> C:\Users\yosef\AppData\Local\Google\Update\1.3.33.5\psuser_64.dll (GoogleInc.)
CustomCLSID: HKU\S-1-5-21-182178435-2925743980-1085802887-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\yosef\AppData\Local\Google\Update\1.3.33.5\psuser_64.dll (GoogleInc.)
ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2017-07-11] (MicrosoftCorporation)
ShellIconOverlayIdentifiers: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2017-07-11] (MicrosoftCorporation)
ShellIconOverlayIdentifiers: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2017-07-11] (MicrosoftCorporation)
ShellIconOverlayIdentifiers: [EnhancedStorageShell] -> {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} => C:\Windows\System32\EhStorShell.dll [2016-07-16] (MicrosoftCorporation)
ContextMenuHandlers1: [2.0 Zemana AntiMalware] -> {6ABB1C11-E261-4CEA-BBB5-3836225689DD} => C:\Program Files (x86)\Zemana AntiMalware\ZAMShellExt64.dll [2017-08-07] ()
ContextMenuHandlers1: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => C:\WINDOWS\system32\syncui.dll [2016-07-16] (MicrosoftCorporation)
ContextMenuHandlers1: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files (x86)\Google\Drive\contextmenu64.dll [2017-03-21] (Google)
ContextMenuHandlers1: [McCtxMenuFrmWrk] -> {CCA9EFD3-29ED-430A-BA6D-E6BBFF0A60C2} => c:\Program Files\mcafee\msc\McCtxMenuFrmWrk.dll [2017-05-31] (McAfee,Inc.)
ContextMenuHandlers1: [Open With] -> {09799AFB-AD67-11d1-ABCD-00C04FC30936} => C:\WINDOWS\system32\shell32.dll [2017-07-07] (MicrosoftCorporation)
ContextMenuHandlers1: [Open With EncryptionMenu] -> {A470F8CF-A1E8-4f65-8335-227475AA5C46} => C:\WINDOWS\system32\shell32.dll [2017-07-07] (MicrosoftCorporation)
ContextMenuHandlers1: [Sharing] -> {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} => C:\WINDOWS\system32\ntshrui.dll [2017-03-03] (MicrosoftCorporation)
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-15] (AlexanderRoshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2016-08-15] (AlexanderRoshal)
ContextMenuHandlers1-x32: [WorkFolders] -> {E61BF828-5E63-4287-BEF1-60B1A4FDE0E3} => C:\Windows\System32\WorkfoldersShell.dll [2017-03-03] (MicrosoftCorporation)
ContextMenuHandlers2: [EnhancedStorageShell] -> {2854F705-3548-414C-A113-93E27C808C85} => C:\Windows\System32\EhStorShell.dll [2016-07-16] (MicrosoftCorporation)
ContextMenuHandlers2: [Sharing] -> {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} => C:\WINDOWS\system32\ntshrui.dll [2017-03-03] (MicrosoftCorporation)
ContextMenuHandlers3: [CopyAsPathMenu] -> {f3d06e7c-1e45-4a26-847e-f9fcdee59be0} => C:\WINDOWS\system32\shell32.dll [2017-07-07] (MicrosoftCorporation)
ContextMenuHandlers3: [SendTo] -> {7BA4C740-9E81-11CF-99D3-00AA004AE837} => C:\WINDOWS\system32\shell32.dll [2017-07-07] (MicrosoftCorporation)
ContextMenuHandlers4: [EncryptionMenu] -> {A470F8CF-A1E8-4f65-8335-227475AA5C46} => C:\WINDOWS\system32\shell32.dll [2017-07-07] (MicrosoftCorporation)
ContextMenuHandlers4: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files (x86)\Google\Drive\contextmenu64.dll [2017-03-21] (Google)
ContextMenuHandlers4: [Sharing] -> {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} => C:\WINDOWS\system32\ntshrui.dll [2017-03-03] (MicrosoftCorporation)
ContextMenuHandlers4: [WorkFolders] -> {E61BF828-5E63-4287-BEF1-60B1A4FDE0E3} => C:\Windows\System32\WorkfoldersShell.dll [2017-03-03] (MicrosoftCorporation)
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2017-01-13] (IntelCorporation)
ContextMenuHandlers5: [New] -> {D969A300-E7FF-11d0-A93B-00A0C90F2719} => C:\WINDOWS\system32\shell32.dll [2017-07-07] (MicrosoftCorporation)
ContextMenuHandlers5: [Sharing] -> {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} => C:\WINDOWS\system32\ntshrui.dll [2017-03-03] (MicrosoftCorporation)
ContextMenuHandlers5: [WorkFolders] -> {E61BF828-5E63-4287-BEF1-60B1A4FDE0E3} => C:\Windows\System32\WorkfoldersShell.dll [2017-03-03] (MicrosoftCorporation)
ContextMenuHandlers6: [2.0 Zemana AntiMalware] -> {6ABB1C11-E261-4CEA-BBB5-3836225689DD} => C:\Program Files (x86)\Zemana AntiMalware\ZAMShellExt64.dll [2017-08-07] ()
ContextMenuHandlers6: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => C:\WINDOWS\system32\syncui.dll [2016-07-16] (MicrosoftCorporation)
ContextMenuHandlers6: [Library Location] -> {3dad6c5d-2167-4cae-9914-f99e41c12cfa} => C:\WINDOWS\system32\shell32.dll [2017-07-07] (MicrosoftCorporation)
ContextMenuHandlers6: [McCtxMenuFrmWrk] -> {CCA9EFD3-29ED-430A-BA6D-E6BBFF0A60C2} => c:\Program Files\mcafee\msc\McCtxMenuFrmWrk.dll [2017-05-31] (McAfee,Inc.)
ContextMenuHandlers6: [PintoStartScreen] -> {470C0EBD-5D73-4d58-9CED-E91E22E23282} => C:\WINDOWS\system32\shell32.dll [2017-07-07] (MicrosoftCorporation)
ContextMenuHandlers6: [RUShellExt] -> {2C5515DC-2A7E-4BFD-B813-CACC2B685EB7} => C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll [2016-12-15] (VSRevoGroup)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-15] (AlexanderRoshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2016-08-15] (AlexanderRoshal)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {002E612E-385D-4E40-8F13-204610C5F922} - System32\Tasks\Microsoft\Windows\Feedback\Siuf\DmClient => C:\WINDOWS\system32\dmclient.exe [2016-07-16] (MicrosoftCorporation)
Task: {014833AD-91B1-4001-B63A-A4F945E2BDFB} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics => C:\WINDOWS\system32\disksnapshot.exe [2016-07-16] (MicrosoftCorporation)
Task: {020E62A9-C5CD-4604-885F-640447A6DE84} - System32\Tasks\User_Feed_Synchronization-{45396127-5C98-4120-AB82-5B26C997B303} => C:\Windows\system32\msfeedssync.exe [2016-07-16] (MicrosoftCorporation)
Task: {03896D04-23AB-4F74-A27D-B1B71EE41E2C} - System32\Tasks\Microsoft\Windows\EnterpriseMgmt\MDMMaintenenceTask => C:\WINDOWS\system32\MDMAgent.exe [2016-07-16] (MicrosoftCorporation)
Task: {0550484F-2C2D-4AAC-9644-AC8ABD0D33BD} - System32\Tasks\Microsoft\Windows\Windows Media Sharing\UpdateLibrary => C:\Program Files\Windows Media Player\wmpnscfg.exe [2016-07-16] (MicrosoftCorporation)
Task: {0858DFA0-D044-429F-B65C-DAF1567D71D4} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyMonitor => C:\WINDOWS\System32\wpcmon.exe [2017-03-04] (MicrosoftCorporation)
Task: {0BF5C6AB-FDD2-4A09-A5BA-A41C53B888EC} - System32\Tasks\Microsoft\Windows\SpacePort\SpaceManagerTask => C:\WINDOWS\system32\spaceman.exe [2017-06-20] (MicrosoftCorporation)
Task: {11EF8237-224D-4CF9-9039-61D08754EA5D} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => C:\WINDOWS\system32\compattelrunner.exe [2017-06-03] (MicrosoftCorporation)
Task: {13848A87-6E5A-44F4-85DB-061203CA7869} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2017-04-07] (HPInc.)
Task: {14383DBE-04CD-485C-98E2-9D909989819D} - System32\Tasks\Microsoft\Windows\SystemRestore\SR => C:\WINDOWS\system32\srtasks.exe [2016-07-16] (MicrosoftCorporation)
Task: {18959483-CD8B-4F24-9272-6899B6844F87} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-182178435-2925743980-1085802887-1001UA => C:\Users\yosef\AppData\Local\Google\Update\GoogleUpdate.exe [2017-02-16] (GoogleInc.)
Task: {193EB9DC-B30D-428C-AFBB-E56B96CC72C6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-12-07] (HPInc.)
Task: {1B61F209-091F-4072-8079-4F2C74A33927} - System32\Tasks\WpsUpdateTask_Administrator => C:\Program Files (x86)\Kingsoft\WPS Office\9.1.0.5113\wtoolex\wpsupdate.exe [2015-07-21] (ZhuhaiKingsoftOfficeSoftwareCo.,Ltd)
Task: {1DDCB080-DCF4-422D-904C-07D5B7C10AB8} - System32\Tasks\Microsoft\Windows\MUI\LPRemove => C:\WINDOWS\system32\lpremove.exe [2016-11-11] (MicrosoftCorporation)
Task: {22526601-1FC2-4EE8-97B0-A53E2A8BE110} - System32\Tasks\Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck => C:\WINDOWS\system32\appidcertstorecheck.exe [2017-04-27] (MicrosoftCorporation)
Task: {2410276A-AC66-4BC8-81DE-59EEA5BA7D65} - System32\Tasks\Microsoft\Windows\WCM\WiFiTask => C:\WINDOWS\System32\WiFiTask.exe [2016-11-02] (MicrosoftCorporation)
Task: {2B158669-4D40-4614-8691-3A0E746A075F} - System32\Tasks\{427419DB-1E0C-4CEA-A0DF-37EFAB4545E7} => "c:\windows\system32\launchwinapp.exe" hxxp://www.skype.com/go/downloading?source=lightinstaller&ver;=7.10.0.101&LastError;=12002
Task: {2F337F47-0821-48F4-9DDD-4EA7C09C827A} - System32\Tasks\Intel Security DAT Reputation (AMCore) periodic endpoint safety pulse => C:\Program Files\Common Files\McAfee\AMContent\scanners\x86_64\datrep\1.50.1291.1\mcdatrep.exe [2017-02-10] (McAfee,Inc.)
Task: {2FCD28F4-9215-409D-A3F5-55CFCB7C0D2C} - System32\Tasks\Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask => C:\WINDOWS\system32\RAServer.exe [2016-07-16] (MicrosoftCorporation)
Task: {33967F1F-606F-440E-8503-630278A85455} - System32\Tasks\Microsoft\Windows\Location\Notifications => C:\WINDOWS\System32\LocationNotificationWindows.exe [2016-07-16] (MicrosoftCorporation)
Task: {34826D50-0B05-4366-8E1D-5FEBDE510615} - System32\Tasks\Microsoft\Windows\NlaSvc\WiFiTask => C:\WINDOWS\System32\WiFiTask.exe [2016-11-02] (MicrosoftCorporation)
Task: {3630116B-EB93-4A1A-9CB6-BFC21343BE0C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2017-04-06] (HPInc.)
Task: {3C83DBB2-159D-48FC-9489-CF3AE6178DDF} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2016-11-07] (HPInc.)
Task: {3E7D7899-3D27-4D88-B784-7AF0F041229D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-09-20] (GoogleInc.)
Task: {40808E68-62A9-447B-BA4D-C7D2902F2AD5} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-182178435-2925743980-1085802887-1001Core => C:\Users\yosef\AppData\Local\Google\Update\GoogleUpdate.exe [2017-02-16] (GoogleInc.)
Task: {43DF67E8-D733-48FA-98F2-4E6D341E4A79} - System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser => C:\WINDOWS\system32\compattelrunner.exe [2017-06-03] (MicrosoftCorporation)
Task: {47F7BDF2-ADED-45DF-B3E4-C04A597A4846} - System32\Tasks\OneDrive Standalone Update Task => C:\Users\yosef\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\OneDriveStandaloneUpdater.exe
Task: {4A734EB2-05E2-4A9E-9645-E2C7D40112CC} - System32\Tasks\YCMServiceAgent => C:\Program Files (x86)\CyberLink\YouCam6\YouCamService6.exe [2015-07-01] (CyberLinkCorp.)
Task: {4CCCC3FF-5B75-4BD6-A660-564308728570} - System32\Tasks\DropboxOEM => C:\Program Files (x86)\Dropbox\DropboxOEM\DropboxOEM.exe [2015-06-19] ()
Task: {5366A388-ACD5-4FEB-887E-6C5F9653EBAE} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2017-04-11] (MicrosoftCorporation)
Task: {5654DFBB-E797-4758-B9A0-8BAE94A91F1D} - System32\Tasks\Microsoft\Windows\DUSM\dusmtask => C:\WINDOWS\System32\dusmtask.exe [2016-07-16] (MicrosoftCorporation)
Task: {59676E11-6B8A-4CD7-9DC0-60977A2029CF} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2017-07-11] (MicrosoftCorporation)
Task: {5A0986BC-560A-4D24-81E3-FAFD260EE3E5} - System32\Tasks\Microsoft\Windows\Clip\License Validation => C:\WINDOWS\system32\ClipUp.exe [2016-12-13] (MicrosoftCorporation)
Task: {5F87496D-8277-4734-91F0-1CBE7CCAA0DF} - System32\Tasks\McAfee\McAfee Idle Detection Task
Task: {5FE2102D-E4A2-4A85-BEF3-8D9F66CFB43A} - System32\Tasks\WpsNotifyTask_Administrator => C:\Program Files (x86)\Kingsoft\WPS Office\9.1.0.5113\wtoolex\wpsnotify.exe [2015-07-21] (ZhuhaiKingsoftOfficeSoftwareCo.,Ltd)
Task: {611C823C-437B-46E7-9683-5312DFFCFD7B} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Policy Install => C:\WINDOWS\system32\usoclient.exe [2016-07-16] (MicrosoftCorporation)
Task: {635A185A-88AD-4B41-9344-B07C284A75E9} - System32\Tasks\Microsoft\Windows\WindowsUpdate\sih => C:\WINDOWS\System32\sihclient.exe [2016-07-16] (MicrosoftCorporation)
Task: {63687C65-E23F-4154-A555-02CD95F065BF} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\MusUx_UpdateInterval => C:\WINDOWS\system32\MusNotification.exe [2017-06-03] (MicrosoftCorporation)
Task: {66AC8D60-CF78-4FD6-908F-94C8D7B67EE3} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2017-04-11] (MicrosoftCorporation)
Task: {6A2230EB-F3B7-488F-BF5C-8E0176A084ED} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2017-04-07] (HPInc.)
Task: {6E07D3C4-DF11-4E24-B0B0-BC0844DA0226} - System32\Tasks\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload => C:\WINDOWS\system32\dmclient.exe [2016-07-16] (MicrosoftCorporation)
Task: {73A6708D-0117-4101-B544-2FAD25496D47} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Refresh Settings => C:\WINDOWS\system32\usoclient.exe [2016-07-16] (MicrosoftCorporation)
Task: {744C9FEA-08B7-43E1-A729-0F94647D655C} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Resume On Boot => C:\WINDOWS\system32\usoclient.exe [2016-07-16] (MicrosoftCorporation)
Task: {7ADBD0EE-0CDE-4CD8-820B-E188292104EA} - System32\Tasks\Microsoft\Windows\Bluetooth\UninstallDeviceTask => C:\WINDOWS\system32\BthUdTask.exe [2016-07-16] (MicrosoftCorporation)
Task: {7CC1ED86-971A-444A-9C3F-1C1F7EC92F5B} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Product Configurator => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\ProductConfig.exe [2017-03-02] (HPInc.)
Task: {7E7280E4-311A-4CE7-A53D-6F8B9219821E} - System32\Tasks\Microsoft\Windows\WindowsUpdate\sihboot => C:\WINDOWS\System32\sihclient.exe [2016-07-16] (MicrosoftCorporation)
Task: {84344425-14CD-4F70-8680-884ACE59FA57} - System32\Tasks\Microsoft\Windows\Management\Provisioning\Logon => C:\WINDOWS\system32\ProvTool.exe [2016-09-26] (MicrosoftCorporation)
Task: {848DCC36-520C-4946-BF68-C7EFFEFA2F84} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_ReadyToReboot => C:\windows\system32\MusNotification.exe [2017-06-03] (MicrosoftCorporation)
Task: {89B8B4C4-16B3-4591-9316-F39DEC7B30CF} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan => C:\WINDOWS\system32\usoclient.exe [2016-07-16] (MicrosoftCorporation)
Task: {8F89FF4B-20F0-4E1A-8738-2EA7B809D499} - System32\Tasks\McAfee Remediation (Prepare) => C:\Program Files\Common Files\AV\McAfee VirusScan\upgrade.exe [2017-04-12] (McAfee,Inc.)
Task: {901E1AEB-ECAA-4402-B2D2-EA785F1EF5EC} - System32\Tasks\Microsoft\Windows\AppID\PolicyConverter => C:\WINDOWS\system32\appidpolicyconverter.exe [2016-07-16] (MicrosoftCorporation)
Task: {92E54674-503B-4E5E-A713-C30E4D8D4999} - System32\Tasks\Microsoft\Windows\SpacePort\SpaceAgentTask => C:\WINDOWS\system32\SpaceAgent.exe [2017-06-20] (MicrosoftCorporation)
Task: {94DDDA13-A380-4296-87D2-284E2A27738B} - System32\Tasks\Microsoft\Windows\Device Information\Device => C:\WINDOWS\system32\devicecensus.exe [2017-06-03] (MicrosoftCorporation)
Task: {9C90F517-06F8-4130-8F83-BFA12E28F2DB} - System32\Tasks\Microsoft\XblGameSave\XblGameSaveTaskLogon => C:\WINDOWS\System32\XblGameSaveTask.exe [2016-07-16] (MicrosoftCorporation)
Task: {A23E2DB7-EAB7-4377-80C6-657910C0099C} - System32\Tasks\McAfee\McAfee Auto Maintenance Task Agent
Task: {A29C9BD0-478C-4A36-9CB4-1EB0F885E997} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => C:\WINDOWS\System32\MbaeParserTask.exe [2016-07-16] (MicrosoftCorporation)
Task: {A364E297-00AD-490D-900E-22AC34598C71} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Maintenance Install => C:\WINDOWS\system32\usoclient.exe [2016-07-16] (MicrosoftCorporation)
Task: {A408E10C-3A88-4D2F-A1B8-18AE368917A5} - System32\Tasks\Microsoft\XblGameSave\XblGameSaveTask => C:\WINDOWS\System32\XblGameSaveTask.exe [2016-07-16] (MicrosoftCorporation)
Task: {A4A39533-2A95-4669-80D2-435B704FF8D9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-09-20] (GoogleInc.)
Task: {A5669DC1-A01E-49E4-B803-1B94E7A7CF4D} - System32\Tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver => C:\WINDOWS\system32\DFDWiz.exe [2016-07-16] (MicrosoftCorporation)
Task: {A77CEEA6-BBDA-4C74-94AD-47678C6CC54B} - System32\Tasks\{7A7E1064-99F9-4EA8-BD03-2A432A7E0968} => "c:\windows\system32\launchwinapp.exe" hxxp://www.skype.com/go/downloading?source=lightinstaller&ver;=7.10.0.101&LastError;=12002
Task: {AA9415D4-2A2D-43AA-99FA-0952FEE4AD70} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Device-Join => C:\WINDOWS\System32\dsregcmd.exe [2016-09-15] (MicrosoftCorporation)
Task: {AD660034-68FC-471D-B982-91443C09AAA7} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2017-07-14] (MicrosoftCorporation)
Task: {B0CA8AA3-67B9-4F50-840B-D2FE0FD59E13} - System32\Tasks\Microsoft\Windows\Storage Tiers Management\Storage Tiers Optimization => C:\WINDOWS\system32\defrag.exe [2016-07-16] (MicrosoftCorp.)
Task: {B6EE76B2-4F82-4E15-9345-C867A29CBAD0} - System32\Tasks\Microsoft\Windows\Speech\SpeechModelDownloadTask => C:\WINDOWS\system32\speech_onecore\common\SpeechModelDownload.exe [2016-09-26] (MicrosoftCorporation)
Task: {BE135F98-9AC4-413C-B131-86EB26C02804} - System32\Tasks\Microsoft\Windows\UNP\RunCampaignManager => C:\WINDOWS\System32\UNP\UNPCampaignManager.exe [2017-05-20] (MicrosoftCorporation)
Task: {C248172E-976F-4677-AF85-6457CBF039BB} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Consolidator => C:\WINDOWS\System32\wsqmcons.exe [2016-07-16] (MicrosoftCorporation)
Task: {C3F000B3-A1B8-42A6-9256-4956B5603F58} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2017-04-06] (HPInc.)
Task: {C54BA01F-4A55-4F25-84C4-F441FF067C02} - System32\Tasks\Microsoft\Windows\Location\WindowsActionDialog => C:\WINDOWS\System32\WindowsActionDialog.exe [2016-07-16] (MicrosoftCorporation)
Task: {CA53C656-61A2-4D4B-B8A9-8E9767A86AE7} - System32\Tasks\Intel Security DAT Reputation (AMCore) Post DAT update endpoint safety pulse => C:\Program Files\Common Files\McAfee\AMContent\scanners\x86_64\datrep\1.50.1291.1\mcdatrep.exe [2017-02-10] (McAfee,Inc.)
Task: {CB8E9ABD-9FF5-4EFA-AA08-AA3792167412} - System32\Tasks\Microsoft\Windows\Defrag\ScheduledDefrag => C:\WINDOWS\system32\defrag.exe [2016-07-16] (MicrosoftCorp.)
Task: {D011B3FC-52AA-424B-B76D-5D15AD90DCEA} - System32\Tasks\Microsoft\Windows\Windows Error Reporting\QueueReporting => C:\WINDOWS\system32\wermgr.exe [2016-07-16] (MicrosoftCorporation)
Task: {D03D871B-D1F2-4901-92C8-FD836B1B18E1} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\WINDOWS\system32\tzsync.exe [2016-07-16] (MicrosoftCorporation)
Task: {D3C4106A-D511-42C6-9716-465644534C87} - System32\Tasks\microsoft\windows\applicationdata\appuriverifierinstall => C:\WINDOWS\system32\AppHostRegistrationVerifier.exe [2016-07-16] (MicrosoftCorporation)
Task: {D83B1FDA-DB2E-451C-91B5-AC30C6A5210B} - System32\Tasks\HPCeeScheduleForyosef => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-16] (Hewlett-Packard)
Task: {DBC49B44-659C-4396-A983-648CECC0A813} - System32\Tasks\Microsoft\Windows\ApplicationData\DsSvcCleanup => C:\WINDOWS\system32\dstokenclean.exe [2016-07-16] (MicrosoftCorporation)
Task: {E127B81B-813C-4A05-8EB6-CE1DA21F7C5B} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\WINDOWS\system32\cleanmgr.exe [2016-07-16] (MicrosoftCorporation)
Task: {EA3F661E-B31C-44A9-B40C-E3D5D56149D4} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_Display => C:\windows\system32\MusNotification.exe [2017-06-03] (MicrosoftCorporation)
Task: {ECEDC57D-8965-4EB1-BD6F-84791D928E23} - System32\Tasks\microsoft\windows\applicationdata\appuriverifierdaily => C:\WINDOWS\system32\AppHostRegistrationVerifier.exe [2016-07-16] (MicrosoftCorporation)
Task: {EFC51866-5754-4F96-86E4-8B9C40C7624A} - System32\Tasks\McAfeeLogon => C:\Program Files\Common Files\McAfee\platform\McUICnt.exe [2017-05-31] (McAfee,Inc.)
Task: {F200B6AE-7AD3-4DF7-B3EB-F1356CA5D011} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot => C:\WINDOWS\system32\MusNotification.exe [2017-06-03] (MicrosoftCorporation)
Task: {F570CC82-535F-4606-8616-CFD7E79FB91E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2017-06-22] (HPInc.)
Task: {FA30E48A-B8B9-4B5C-811C-DE4DF31F6CF6} - System32\Tasks\Microsoft\Windows\Plug and Play\Sysprep Generalize Drivers => C:\WINDOWS\System32\drvinst.exe [2016-07-16] (MicrosoftCorporation)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\HPCeeScheduleForyosef.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\WINDOWS\Tasks\WpsNotifyTask_Administrator.job => C:\Program Files (x86)\Kingsoft\WPS Office\9.1.0.5113\wtoolex\wpsnotify.exe
Task: C:\WINDOWS\Tasks\WpsUpdateTask_Administrator.job => C:\Program Files (x86)\Kingsoft\WPS Office\9.1.0.5113\wtoolex\wpsupdate.exe
==================== Shortcuts & WMI ========================
(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============
2016-07-16 04:42 - 2016-07-16 04:42 - 000231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2017-07-14 12:55 - 2017-06-21 00:48 - 002681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2015-09-15 14:25 - 2015-09-15 14:25 - 000085800 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-09-15 14:25 - 2015-09-15 14:25 - 001328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-09-15 10:43 - 2017-01-17 04:25 - 000117440 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-07-21 17:52 - 2014-04-14 18:59 - 000389896 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2017-03-21 18:56 - 2017-01-31 05:34 - 008909512 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2017-08-07 22:06 - 2017-08-07 22:06 - 000155504 _____ () C:\Program Files (x86)\Zemana AntiMalware\ZAMShellExt64.dll
2016-09-26 03:25 - 2016-09-26 03:25 - 000134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-03-14 17:22 - 2017-03-03 23:31 - 000474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-03-14 17:22 - 2017-03-03 23:12 - 009760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-03-14 17:22 - 2017-03-03 23:05 - 001401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-03-14 17:22 - 2017-03-03 23:05 - 000757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-07-14 12:55 - 2017-06-20 23:35 - 002424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-07-14 12:55 - 2017-06-20 23:37 - 004853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2017-08-03 13:13 - 2017-06-11 13:00 - 000583160 _____ () C:\Program Files\McAfee\MfeAV\RealProtectAMScanIf.dll
2017-08-03 13:13 - 2017-06-11 12:59 - 000574352 _____ () C:\Program Files\McAfee\MfeAV\AMEngineScan.dll
2017-08-03 13:13 - 2017-06-11 13:00 - 000571240 _____ () C:\Program Files\McAfee\MfeAV\RepairModule.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Users\yosef\Desktop\Stella Adler Diploma.jpg:3or4kl4x13tuuug3Byamue2s4b [91]
AlternateDataStreams: C:\Users\yosef\Desktop\Zara branches info.bmp:3or4kl4x13tuuug3Byamue2s4b [91]
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ModuleCoreService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcapexe => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfemms => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeplk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeplk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ModuleCoreService => ""="Service"
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2015-07-10 04:04 - 2017-07-29 13:19 - 000000027 _____ C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1       localhost
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-182178435-2925743980-1085802887-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Hewlett-Packard Backgrounds\backgroundDefault.jpg
DNS Servers: 192.168.1.1 - [removed]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==

==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{94A1FC2B-CAAE-45C8-BEF4-C1F1324F6054}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPSOCKSVC.exe
FirewallRules: [{A48DC7D6-4F7C-4D83-8AFE-1A98B26A1F69}] => (Allow) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
FirewallRules: [{B42334A0-2767-4022-BE9E-569E99A087AE}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD.exe
FirewallRules: [{FE962337-939B-4177-BF12-DB6ABFB1C815}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\Kernel\DMS\CLMSServerPDVD14.exe
FirewallRules: [{42DA7682-94C7-49F3-801B-084876B05B84}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14Agent.exe
FirewallRules: [{A4993C1B-0FA0-4B8E-970E-25A2DA416548}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\Movie\PowerDVDMovie.exe
FirewallRules: [{24E5ED63-2589-46AE-9165-7ABC924480B4}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\Movie\PowerDVD Cinema\PowerDVDCinema.exe
FirewallRules: [{657BC0F0-7F71-4363-AF5D-0A673FFCB418}] => (Allow) c:\Program Files\CyberLink\PowerDirector12\PDR10.EXE
FirewallRules: [{14E516DA-83A0-4458-85F8-429E6E29361C}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{05EE5315-BB21-4A58-AB6C-7B1A3702FCED}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{E0505C3F-C60C-4E09-B3C6-E3AF41247087}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{2860C6D6-F1BC-4A65-B1E6-0CB17EAB2B22}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{D1146C6D-897E-4868-8A8F-9B91FE0E952A}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{5B9D4B53-A35A-404B-8869-0840D6C7A721}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{1FCE313E-378F-4CDE-9A77-140B9C0F35E6}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{25923F13-0C3A-4633-8AC1-8C04D1C80874}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{E7371350-D21C-4AAE-8388-5FBFF45EE3E7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{8B0FD386-6EBB-4065-ADFA-9B0779E64E53}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{61D06E48-A321-43A4-830F-EDC4FD9EFB85}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{A0DF1237-BA95-4845-AC64-F16F6FF023B2}] => (Allow) C:\WINDOWS\system32\rundll32.exe
FirewallRules: [{39480C80-71DB-4FFA-95DF-1EF1A66139E2}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Restore Points =========================
07-08-2017 20:56:45 Scheduled Checkpoint
==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================
Application errors:
==================
Error: (08/07/2017 10:35:10 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "c:\Program Files\CyberLink\PhotoDirector\Kernel\CES\CES_AudioCacheAgent.exe.Manifest".
Dependent Assembly PDR.X,type="win32",version="1.0.0.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.
Error: (08/07/2017 10:35:07 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "c:\Program Files\CyberLink\PhotoDirector\Kernel\CES\CES_CacheAgent.exe.Manifest".
Dependent Assembly PDR.X,type="win32",version="1.0.0.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.
Error: (08/07/2017 10:32:33 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine QueryFullProcessImageNameW.  hr = 0x80070006, The handle is invalid.
.

Operation:
   Executing Asynchronous Operation
Context:
   Current State: DoSnapshotSet
Error: (08/07/2017 10:31:52 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
System Error:
Access is denied.
.
Error: (08/07/2017 10:31:27 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
   Gathering Writer Data
Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {91328886-4bb2-4555-91dd-000228a6491b}
Error: (08/07/2017 10:24:42 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: PowerDVD14Agent.exe, version: 14.0.1.5418, time stamp: 0x55823d4f
Faulting module name: EvoParser.dll_unloaded, version: 1.2.0.7602, time stamp: 0x551d0eff
Exception code: 0xc0000005
Fault offset: 0x00022a91
Faulting process id: 0x1c68
Faulting application start time: 0x01d310069ada8c70
Faulting application path: C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14Agent.exe
Faulting module path: EvoParser.dll
Report Id: bde092f5-e6b1-4f0d-87a4-d17a7a2f1ea3
Faulting package full name:
Faulting package-relative application ID:
Error: (08/07/2017 09:42:11 PM) (Source: DPTF) (EventID: 256) (User: )
Description: Intel(R) Dynamic Platform and Thermal Framework : ESIF(8.1.10600.150) TYPE: ERROR
DPTF Build Version:  8.1.10600.150
DPTF Build Date:  Jun 26 2015 11:46:12
Source File:  ..\..\..\Sources\Manager\EsifApplicationInterface.cpp @ line 737
Executing Function:  DptfEvent
Message:  Received unexpected event
Framework Event:  DptfResume [3]
Error: (08/07/2017 08:57:09 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
System Error:
Access is denied.
.
Error: (08/07/2017 08:53:15 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "c:\Program Files\CyberLink\PhotoDirector\Kernel\CES\CES_AudioCacheAgent.exe.Manifest".
Dependent Assembly PDR.X,type="win32",version="1.0.0.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.
Error: (08/07/2017 08:53:08 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "c:\Program Files\CyberLink\PhotoDirector\Kernel\CES\CES_CacheAgent.exe.Manifest".
Dependent Assembly PDR.X,type="win32",version="1.0.0.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

System errors:
=============
Error: (08/07/2017 10:38:47 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (08/07/2017 10:23:31 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Kingsoft_WPS_UpdateService service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.
Error: (08/07/2017 10:23:31 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Kingsoft_WPS_UpdateService service to connect.
Error: (08/07/2017 10:22:21 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (08/07/2017 09:25:19 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (08/07/2017 08:45:05 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (08/07/2017 08:44:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Kingsoft_WPS_UpdateService service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.
Error: (08/07/2017 08:44:07 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Kingsoft_WPS_UpdateService service to connect.
Error: (08/07/2017 08:43:18 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (08/07/2017 07:58:32 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

CodeIntegrity:
===================================
  Date: 2017-08-05 17:27:46.337
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
  Date: 2017-08-05 17:19:49.248
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
  Date: 2017-08-05 17:09:51.739
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
  Date: 2017-08-05 17:04:05.128
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
  Date: 2017-08-05 16:49:54.192
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
  Date: 2017-08-05 16:32:23.997
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
  Date: 2017-08-05 16:24:06.462
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
  Date: 2017-08-05 15:57:56.850
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
  Date: 2017-08-05 15:55:58.719
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
  Date: 2017-08-05 15:41:32.046
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.

==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3-5005U CPU @ 2.00GHz
Percentage of memory in use: 38%
Total physical RAM: 6059.39 MB
Available physical RAM: 3739.88 MB
Total Virtual: 6443.39 MB
Available Virtual: 4083.98 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:677.89 GB) (Free:561.73 GB) NTFS
Drive d: (RECOVERY) (Fixed) (Total:19.52 GB) (Free:2.28 GB) NTFS ==>[system with boot components (obtained from drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: 54E8AF3C)
Partition: GPT.
==================== End of Addition.txt ============================
Post #9
This is looking to be a pretty clean machine.
 

Not sure which program the Kingsoft_WPS_UpdateService is related to

 
Kingsoft WPS Office is a program that is supposed to be a substitute for Microsoft Office

Located in your add/remove programs list here

WPS Office is an office suite for Microsoft Windows, Linux, iOS and Android OS, developed by Zhuhai-based Chinese software developer Kingsoft. WPS
WPS Office (9.1.0.5113) (HKLM-x32\…\Kingsoft Office) (Version: 9.1.0.5113 - Kingsoft Corp.)


~~~~~~~~~~~~~~~~~~~~`
 
Start FRST (Please double-click on FRST/FRST64) with Administrator privileges

 or   Right click on the FRST icon and select Run as administrator
    Highlight the below information then hit the Ctrl + C keys at the same time


    Right click/highlight on the  text below and select Copy.[beginning with Start:: and finishing with End::]


Start::
EndProcesses:
CreateRestorePoint:
CHR Extension: (Chrome Media Router) - C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-07-31]
CMD: ipconfig /flushdns
Emptytemp:
End::


Press the Fix button.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`
 Reset Chrome…
Open Google Chrome, click on menu icon [external image: google-chrome-setting-icon.png] which is located right side top of the google chrome.

Click "Settings" then "Show advanced settings" at the bottom of the screen.
Click "Reset browser settings" button.
Restart Chrome.
—-

Let me know how the computer is now.
Post #10

Hi Juliet,

 

I apologize for the delayed reply. It seems that my modem or router were causing problems in the internet connection and that's why everything was so slow. Restarted it a few times and everything looks fine, at leasr from what I can tell.

 

Did as you said with chrome, please see fixlog below, thank you:

 

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 09-08-2017
Ran by [removed] (10-08-2017 00:46:00) Run:1
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal
==============================================
fixlist content:
*****************
EndProcesses:
CreateRestorePoint:
CHR Extension: (Chrome Media Router) - C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-07-31]
CMD: ipconfig /flushdns
Emptytemp:
*****************
EndProcesses: => Error: No automatic fix found for this entry.
Restore point was successfully created.
CHR Extension: (Chrome Media Router) - C:\Users\yosef\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-07-31] => Error: No automatic fix found for this entry.
========= ipconfig /flushdns =========

Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
========= End of CMD: =========
Post #13 last edited
If everything is good, let's remove the tools used.

DelFix
  • Please download DelFix or from Here and save the file to your Desktop.
  • Double-click DelFix.exe to run the programme.
  • Place a checkmark next to the following items:
  • Activate UAC
  • Remove disinfection tools
  • Click the Run button.
  • – This will remove the specialized tools we used to disinfect your system.
    Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete    ).
*******************

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI